WORM data falsification detection

Patent metadata

Field	Value
Publication number	US-11226929-B2
Application number	US-201615264658-A
Country	US
Kind code	B2
Filing date	Sep 14, 2016
Priority date	Sep 14, 2016
Publication date	Jan 18, 2022
Grant date	Jan 18, 2022

Abstract

A computer determines the file system that contains a first partition, a second partition and a third partition. The first partition contains metadata comprising metadata associated with a WORM-specified file, and metadata associated with a rewritable file. The second partition contains a file body of a file and a copy of the metadata. The third partition contains metadata associated with the WORM-specified file. The computer receives a request to set a file setting of a target file to a WORM setting. The computer stores metadata associated with the target file in the first partition, the second partition, and the third partition.

First claim

What is claimed is:

1. A method of detecting a falsification in a file system of a tape having a WORM (Write Once Read Many) function, comprising:
determining that the tape includes a first physical partition on the tape, a second physical partition on the tape, and a third physical partition on the tape, wherein the first physical partition contains metadata of the file system comprising metadata associated with a WORM-specified file, and metadata associated with a rewritable file, the second physical partition contains a file body of a file and a copy of the metadata of the file system, and the third physical partition only contains the metadata associated with the WORM-specified file, wherein the metadata associated with the WORM-specified file is only appended on the tape at the end of the third partition when any file with a WORM attribute is added or when a previously recorded file attribute is changed to a WORM attribute, and wherein changing or deleting metadata associated with a WORM-specified file previously stored in the third partition is prohibited;
receiving a request to set a file setting of a target file to a WORM setting;
storing metadata associated with the target file in the first physical partition on the tape, the second physical partition on the tape, and the third physical partition on the tape, wherein the metadata associated with the target file in the third partition is appended at the end of the metadata associated with the WORM-specified file in response to receiving an unmounting command;
receiving a request to change the target file, wherein the request to change the target file comprises an action selected from the group consisting of: renaming the target file, changing the target file content, deleting the target file, changing an attribute of the target file;
determining the target file metadata;
determining that the target file metadata appears in the third physical partition;
based on determining that the target file metadata appears in the third physical partition, rejecting the request to change the target file;
determining a difference between the metadata in the first partition and the metadata associated with the WORM-specified file in the third partition based on reading the metadata in the first partition and reading the metadata associated with the WORM-specified file in the third partition.

2. The method of claim 1 , further comprising:
based on determining the difference, transmitting a notification of the difference.

3. The method according to claim 2 , wherein determining a difference between the metadata in the first partition and the metadata associated with the WORM-specified file in the third partition comprises determining a difference in a parameter of the metadata, wherein the parameter of the metadata is selected from the group consisting of: a full path name, a File UID, file attributes, a time stamp, and an extent list.

4. The method according to claim 2 , wherein determining the difference between the metadata in the first partition and the metadata associated with the WORM-specified file in the third partition further comprises:
determining appearance of multiple instances of the metadata associated with the WORM-specified file in the third partition.

5. The method of claim 1 , further comprising storing a target file body in the second partition.

6. The method of claim 1 , further comprising:
receiving a request to change the third partition, wherein the request to change the third partition comprises an action selected from the group consisting of: changing the metadata associated with the WORM-specified file in the third partition, deleting the metadata associated with the WORM-specified file in the third partition, rewriting the metadata associated with the WORM-specified file in the third partition; and
rejecting the request to change the third partition.

7. A computer program product for detecting a falsification in a file system of a tape having a WORM (Write Once Read Many) function, the computer program product comprising:
one or more computer-readable storage devices and program instructions stored on at least one of the one or more tangible storage devices, the program instructions comprising:
program instructions to determine that the tape includes a first physical partition on the tape, a second physical partition on the tape and a third physical partition on the tape, wherein the first physical partition contains metadata of the file system comprising metadata associated with a WORM-specified file, and metadata associated with a rewritable file, the second physical partition contains a file body of a file and a copy of the metadata of the file system, and the third physical partition only contains the metadata associated with the WORM-specified file, wherein the metadata associated with the WORM-specified file is only appended on the tape at the end of the third partition when any file with a WORM attribute is added or when a previously recorded file attribute is changed to a WORM attribute, and wherein changing or deleting metadata associated with a WORM-specified file previously stored in the third partition is prohibited;
program instructions to receive a request to set a file setting of a target file to a WORM setting;
program instructions to store metadata associated with the target file in the first physical partition on the tape, the second physical partition on the tape, and the third physical partition on the tape, wherein the metadata associated with the target file in the third partition is appended at the end of the metadata associated with the WORM-specified file in response to receiving an unmounting command;
program instructions to receive a request to change the target file, wherein the request to change the target file comprises an action selected from the group consisting of: program instructions to rename the target file, program instructions to change the target file content, program instructions to delete the target file, program instructions to change an attribute of the target file;
program instructions to determine the target file metadata;
program instructions to determine that the target file metadata appears in the third physical partition;
based on determining that the target file metadata appears in the third physical partition, program instructions to reject the request to change the target file;
program instructions to determine a difference between the metadata in the first partition and the metadata associated with the WORM-specified file in the third partition based on reading the metadata in the first partition and reading the metadata associated with the WORM-specified file in the third partition.

8. The computer program product of claim 7 , further comprising:
based on determining the difference, program instructions to transmit a notification of the difference.

9. The computer program product of claim 8 , wherein program instructions to determine a difference between the metadata in the first partition and the metadata associated with the WORM-specified file in the third partition comprises program instructions to determine a difference in a parameter of the metadata, wherein the parameter of the metadata is selected from the group consisting of: a full path name, a File UID, file attributes, a time stamp, and an extent list.

10. The computer program product of claim 8 , wherein program instructions to determine the difference between the metadata in the first partition and the metadata associated with the WORM-specified file in the third partition further comprises:
program instructions to determine appearance of multiple instances of the metadata associated with the WORM-specified file in

Assignees

• IBM

Inventors

• Abe Atsushi
• Hasegawa Tohru

Classifications

• G06F16/164 Primary

  File meta data generation · CPC title

• G06F11/30

  Monitoring · CPC title

• G06F2201/865

  Monitoring of software · CPC title

• G06F11/3034

  where the computing system component is a storage system, e.g. DASD based or network based (digital input from or digital output to record carriers G06F3/06; digital recording or reproducing G11B20/18; for distributed storage of data in networks, e.g. transport arrangements for network file system [NFS], storage area networks [SAN] or network attached storage [NAS], H04L67/1097) · CPC title

• G06F16/1734

  Details of monitoring file system events, e.g. by the use of hooks, filter drivers, logs · CPC title