Securing data storage by slicing swapped data portions into data fragments and shuffling physical storage location of data fragments

Patent metadata

Field	Value
Publication number	US-12093401-B2
Application number	US-202117511872-A
Country	US
Kind code	B2
Filing date	Oct 27, 2021
Priority date	Oct 27, 2021
Publication date	Sep 17, 2024
Grant date	Sep 17, 2024

Abstract

Techniques are provided for securing data storage by slicing swapped data portions into data fragments and shuffling a physical storage location of the data fragments. One method comprises obtaining at least one data item; dividing the at least one data item into a plurality of data portions; swapping respective positions of at least two of the data portions of the at least one data item; slicing the plurality of data portions, following the swapping, into a plurality of data fragments; and shuffling a distribution of the data fragments across a plurality of storage nodes in a storage system by moving at least one data fragment from a current physical storage location on a current storage node to a different physical storage location on a different storage node. A predefined number of the plurality of data fragments may be needed to reconstruct the data item.

First claim

What is claimed is:

1. A method, comprising:
obtaining at least one data item;
dividing the at least one data item into a plurality of data portions;
swapping respective positions of at least two of the plurality of data portions of the at least one data item;
slicing the plurality of data portions, following the swapping, into a plurality of data fragments; and
shuffling, following the slicing, a distribution of at least some of the data fragments across a plurality of storage nodes in a storage system, wherein the shuffling the distribution of at least some of the data fragments across the plurality of storage nodes comprises moving at least one data fragment of the plurality of data fragments from a current physical storage location on a current storage node of the plurality of storage nodes to a different physical storage location on a different storage node of the plurality of storage nodes;
wherein the method is performed by at least one processing device, wherein the at least one processing device comprises a processor coupled to a memory.

2. The method of claim 1 , wherein the at least one data item comprises one or more of a cryptographic key, a hash value of a file stored in the storage system, a file digest of a file stored in the storage system, and a block of data.

3. The method of claim 2 , further comprising maintaining a given file associated with one or more of a given hash value and a given file digest in a current physical storage location of the given file in the storage system.

4. The method of claim 1 , wherein the plurality of storage nodes comprises at least three storage nodes.

5. The method of claim 1 , wherein each of the data fragments are uniformly-sized and comprise data from a plurality of the data portions.

6. The method of claim 1 , wherein the shuffling the distribution of at least some of the data fragments across the plurality of storage nodes is performed in response to an occurrence of one or more of a time-based trigger and an event-based trigger.

7. The method of claim 1 , wherein the dividing the at least one data item into the plurality of data portions and the swapping the respective positions of the at least two data portions are each performed at least two times for the at least one data item.

8. The method of claim 1 , wherein the dividing the at least one data item into the plurality of data portions, the swapping the respective positions of the at least two data portions and the slicing the plurality of data portions into the plurality of data fragments comprise an all-or-nothing transform.

9. The method of claim 1 , wherein the shuffling the distribution of at least some of the data fragments across the plurality of storage nodes further comprises utilizing a set of swap operations that moves at least a subset of the data fragments between two or more of a plurality of nodes in at least one of two or more levels of a tree structure comprising the plurality of nodes.

10. The method of claim 9 , wherein each data fragment is stored in a corresponding leaf of the tree structure.

11. The method of claim 1 , wherein a predefined number of the plurality of data fragments is needed to reconstruct the data item.

12. An apparatus comprising:
at least one processing device comprising a processor coupled to a memory;
the at least one processing device being configured to implement the following steps:
obtaining at least one data item;
dividing the at least one data item into a plurality of data portions;
swapping respective positions of at least two of the plurality of data portions of the at least one data item;
slicing the plurality of data portions, following the swapping, into a plurality of data fragments; and
shuffling, following the slicing, a distribution of at least some of the data fragments across a plurality of storage nodes in a storage system, wherein the shuffling the distribution of at least some of the data fragments across the plurality of storage nodes comprises moving at least one data fragment of the plurality of data fragments from a current physical storage location on a current storage node of the plurality of storage nodes to a different physical storage location on a different storage node of the plurality of storage nodes.

13. The apparatus of claim 12 , wherein the at least one data item comprises one or more of a cryptographic key, a hash value of a file stored in the storage system, a file digest of a file stored in the storage system, and a block of data.

14. The apparatus of claim 12 , wherein each of the data fragments are uniformly-sized and comprise data from a plurality of the data portions.

15. The apparatus of claim 12 , wherein the shuffling the distribution of at least some of the data fragments across the plurality of storage nodes is performed in response to an occurrence of one or more of a time-based trigger and an event-based trigger.

16. The apparatus of claim 12 , wherein a predefined number of the plurality of data fragments is needed to reconstruct the data item.

17. A non-transitory processor-readable storage medium having stored therein program code of one or more software programs, wherein the program code when executed by at least one processing device causes the at least one processing device to perform the following steps:
obtaining at least one data item;
dividing the at least one data item into a plurality of data portions;
swapping respective positions of at least two of the plurality of data portions of the at least one data item;
slicing the plurality of data portions, following the swapping, into a plurality of data fragments; and
shuffling, following the slicing, a distribution of at least some of the data fragments across a plurality of storage nodes in a storage system, wherein the shuffling the distribution of at least some of the data fragments across the plurality of storage nodes comprises moving at least one data fragment of the plurality of data fragments from a current physical storage location on a current storage node of the plurality of storage nodes to a different physical storage location on a different storage node of the plurality of storage nodes.

18. The non-transitory processor-readable storage medium of claim 17 , wherein the at least one data item comprises one or more of a cryptographic key, a hash value of a file stored in the storage system, a file digest of a file stored in the storage system, and a block of data.

19. The non-transitory processor-readable storage medium of claim 17 , wherein each of the data fragments are uniformly-sized and comprise data from a plurality of the data portions.

20. The non-transitory processor-readable storage medium of claim 17 , wherein a predefined number of the plurality of data fragments is needed to reconstruct the data item.

Assignees

• Dell Products Lp

Inventors

• Mahony Aidan O
• Bowden David
• Barnett Alan

Classifications

• G06F16/2365

  Ensuring data consistency and integrity · CPC title

• H04L67/1097 Primary

  for distributed storage of data in networks, e.g. transport arrangements for network file system [NFS], storage area networks [SAN] or network attached storage [NAS] · CPC title

• G06F21/64

  Protecting data integrity, e.g. using checksums, certificates or signatures · CPC title

• G06F21/60 Primary

  Protecting data · CPC title