Accelerator system for use with secure data storage

• US 9,411,524 B2
• Filed: 10/18/2013
• Issued: 08/09/2016
• Est. Priority Date: 05/28/2010
• Status: Active Grant

• Current Assignee: Security First Innovations, LLC
• Original Assignee: Security First Corp
• Inventors: O'Hare, Mark S., Orsini, Rick L., Laurich, Lawrence A., Sample, Stephen Paul, Wang, Michael H., Kandimalla, Babu Rao, Martin, Don, Casselman, Steven Mark
• Primary Examiner(s): Ho, Andy
• Assistant Examiner(s): SEYE, ABDOU K
• Application Number:
  US14/057,902
• Publication Number:
  US 20140108726A1
• Time in Patent Office: 1,026 Days
• Field of Search: None
• US Class Current: 1/1
• CPC Class Codes: G06F 13/102 where the programme performs an interfacing function, e.g. device driver G06F13/105 takes precedence; scheduling within device drivers G06F9/52; contention policies within device drivers G06F9/4881
• CPC Class Codes: G06F 21/602 Providing cryptographic facilities or services
• CPC Class Codes: G06F 21/72 in cryptographic circuits
• CPC Class Codes: G06F 21/76 in application-specific integrated circuits [ASIC] or field-programmable devices, e.g. field-programmable gate arrays [FPGA] or programmable logic devices [PLD]
• CPC Class Codes: G06F 21/78 to assure secure storage of data address-based protection against unauthorised use of memory G06F12/14; record carriers for use with machines and with at least a part designed to carry digital markings G06K19/00
• CPC Class Codes: G06F 21/85 interconnection devices, e.g. bus-connected or in-line devices
• CPC Class Codes: G06F 3/061 Improving I/O performance
• CPC Class Codes: G06F 3/0619 in relation to data integrity, e.g. data losses, bit errors
• CPC Class Codes: G06F 3/0646 Horizontal data movement in storage systems, i.e. moving data in between storage devices or systems
• CPC Class Codes: G06F 3/0659 Command handling arrangements, e.g. command buffers, queues, command scheduling
• CPC Class Codes: G06F 3/067 Distributed or networked storage systems, e.g. storage area networks [SAN], network attached storage [NAS]
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04L 67/06 specially adapted for file transfer, e.g. file transfer protocol [FTP]
• CPC Class Codes: H04L 67/1097 for distributed storage of data in networks, e.g. transport arrangements for network file system [NFS], storage area networks [SAN] or network attached storage [NAS]
• CPC Class Codes: H04L 69/12 Protocol engines
• CPC Class Codes: H04L 69/14 Multichannel or multilink protocols

Abstract

Data processing and an accelerator system therefore are described. An embodiment relates generally to a data processing system. In such an embodiment, a bus and an accelerator are coupled to one another. The accelerator has an application function block. The application function block is to process data to provide processed data to storage. A network interface is coupled to obtain the processed data from the storage for transmission.

Claims

1. A secure data storage system, comprising:

an accelerator comprising a Programmable Logic Device (“

PLD”

) and a local memory, wherein the PLD includes an application function block instantiated in whole or in part in programmable logic resources of the PLD; and

a network interface communicatively coupled to the application function block, wherein the application function block is operable to;

store portions of data from a data set to a storage location in the local memory of the accelerator, wherein the data set is associated with a system payload pointer that is convertible to at least one local payload pointer, wherein the local payload pointer points to the storage location in the local memory of the accelerator system; and

communicate for storage in a storage network the portions of data over the network interface by accessing the portions of data from the local memory of the accelerator using a direct memory access operation and the at least one local payload pointer, wherein the data set is restorable from a threshold number of the portions of data by recombining data from the threshold number of portions of data.

2. The system of claim 1, wherein the application function block is operable to communicate the portions of data for storage in the storage network by communicating the portions of data for storage in a cloud computing storage network that includes at least two respectively remote storage devices.

3. The system of claim 2, wherein the application function block is further operable to generate a virtual machine image, wherein the virtual machine image is operable to access the data set within the cloud computing storage network.

4. The system of claim 3, wherein the application function block is further operable to transmit the virtual machine image to a second system, wherein the second system is operable to access the data set within the cloud computing storage network.

5. The system of claim 2, wherein the cloud computing storage network further comprises at least one resilient networked storage device.

6. The system of claim 5, wherein the application function block is further operable to regenerate a data portion stored on the at least one resilient networked storage device from other networked storage devices.

7. The system of claim 1, further comprising:

a bus;

a switch coupled between the bus and the accelerator and between the accelerator and the network interface, and operable to communicate the data set between the bus and the accelerator and to communicate the portions of data between the local memory and the network interface.

8. The system of claim 7, wherein:

the switch is configured to control peer-to-peer routing between the accelerator and the network interface for retrieval of the portions of data from the local memory by the network interface; and

the switch is further configured to control peer-to-peer routing between the network interface and the accelerator for storage of the portions of data in the local memory by the network interface.

9. The system of claim 7, further comprising at least one transmitter or transceiver coupled to the network interface for transmitting the portions of data.

10. The system of claim 9, further comprising:

a host system, coupled to the bus, for providing commands and data to the switch via the bus.

11. The system of claim 10, wherein the portions of data do not pass to the network interface via the bus.

12. The system of claim 10, wherein the network interface includes a direct memory access controller to read and write the portions of data from and to the local memory.

13. The system of claim 1, wherein the threshold number of the portions of data is less than all of the portions of data from the data set.

14. A method for securely storing data, the method comprising:

storing portions of data from a data set to a storage location in a local memory of an accelerator, wherein the data set is associated with a system payload pointer that is convertible to at least one local payload pointer, wherein the local payload pointer points to a storage location in the local memory of the accelerator system, and wherein the accelerator comprises a Programmable Logic Device (“

PLD”

) that includes an application function block instantiated in whole or in part in programmable logic resources of the PLD;

accessing by the application function block the portions of data from the local memory of the accelerator using a direct memory access operation and the at least one local payload pointer; and

communicating by the application function block the portions of data over a network interface for storage in a storage network, and wherein the data set is restorable from a threshold number of the portions of data by recombining data from the threshold number of portions of data.

15. The method of claim 14, wherein communicating the portions of data for storage in the storage network comprises communicating the portions of data for storage in a cloud computing storage network that includes at least two respectively remote storage devices.

16. The method of claim 15, further comprising generating using the application function block a virtual machine image for accessing the data set within the cloud computing storage network.

17. The method of claim 16, further comprising transmitting using the application function block the virtual machine image to a computing system for accessing the data set within the cloud computing storage network.

18. The method of claim 15, wherein communicating the portions of data for storage in a cloud computing storage network comprises communicating the portions of data to a cloud computing storage network that includes at least one resilient networked storage device.

19. The method of claim 18, further comprising regenerating a data portion stored on the at least one resilient networked storage device from other networked storage devices.

20. The method of claim 14, further comprising:

communicating the data set between a bus and the accelerator and between the local memory and the network interface using a switch coupled between the bus and the accelerator and between the accelerator and the network interface.

21. The method of claim 20, further comprising:

configuring the switch to control peer-to-peer routing between the accelerator and the network interface for retrieval of the portions of data from the local memory by the network interface; and

configuring the switch to control peer-to-peer routing between the network interface and the accelerator for storage of the portions of data in the local memory by the network interface.

22. The method of claim 20, wherein communicating the portions of data comprises communicating the portions of data using at least one transmitter or transceiver coupled to the network interface.

23. The method of claim 22, further comprising coupling a host system to the bus, for providing commands and data to the switch via the bus.

24. The method of claim 23, wherein the portions of data do not pass to the network interface via the bus.

25. The method of claim 23, wherein the network interface includes a direct memory access controller to read and write the portions of data from and to the local memory.

26. The method of claim 14 wherein the threshold number of the portions of data is less than all of the portions of data from the data set.

27. A method for processing data, comprising:

receiving in an accelerator system a system payload pointer, wherein the system payload pointer points to a storage location of data in a host system;

generating from the data at least two portions of data in the accelerator system;

storing the at least two portions of data in memory of the accelerator system;

converting the system payload pointer into at least one local payload pointer for the storing, wherein the at least one local payload pointer points to a location in the memory of the accelerator system where the at least two portions of data are stored;

passing the at least one local payload pointer to an interface;

accessing the at least two portions of data from the memory by the interface using the at least one local payload pointer; and

transmitting the at least two portions of data accessed by the interface, wherein the data set is restorable from at least a threshold number less than all of the at least two portions of data by recombining data from the threshold number of the at least two portions of data.

28. The method according to claim 27, wherein:

the at least one local payload pointer is passed to a driver stack;

the driver stack passes the at least one local payload pointer to the interface; and

the interface generates packets for the transmitting of the at least two portions of data.

29. The method according to claim 28, wherein:

the driver stack is a Small Computer System Interface (“

SCSI”

) driver stack; and

the packets are SCSI packets.

30. The method according to claim 29, wherein:

the packets are Internet SCSI packets (“

iSCSI”

) for remote storage of the at least two portions of data in a cloud computing storage network; and

the interface is a network interface having access to the at least two portions of data locally stored in the memory of the accelerator system without having to provide the interface with the system payload pointer.

31. The method according to claim 30, wherein the cloud computing storage network further comprises at least one resilient networked storage device.

32. The method according to claim 31, wherein the cloud computing storage network further comprises at least two respectively remote storage devices.

33. The method according to claim 32, wherein the accelerator system comprises:

a local memory; and

a Programmable Logic Device (“

PLD”

), wherein the PLD includes an application function block instantiated in whole or in part in programmable logic resources of the PLD.

34. The method according to claim 33, wherein the application function block is further operable to generate a virtual machine image, wherein the virtual machine image is operable to access the data set within the cloud computing storage network.

35. The method according to claim 34, wherein the application function block is further operable to transmit the virtual machine image to a second system, wherein the second system is operable to access the data set within the cloud computing storage network.

36. The method according to claim 35, wherein the application function block is further operable to regenerate a data portion stored on the at least one resilient networked storage device from other networked storage devices.

37. The method according to claim 27, wherein generating at least two portions of data further comprises encrypting each of the at least two portions of data.