Dividing data between storage equipment in different security zones

Patent metadata

Field	Value
Publication number	US-12511411-B2
Application number	US-202217867669-A
Country	US
Kind code	B2
Filing date	Jul 18, 2022
Priority date	Jul 18, 2022
Publication date	Dec 30, 2025
Grant date	Dec 30, 2025

Abstract

The technologies described herein are generally directed toward maintaining data coherence after an updating node fails during an update. According to an embodiment, a system can comprise a processor and a memory that can enable performance of operations including respectively mapping a logical storage resource to first and second storage resources in first and second security zones associated with first provider and second providers. The operations can further include receiving a request to store a data resource at the logical storage resource. Further, the operations can include, based on a distribution policy associated with the data resource, dividing, by the storage controller equipment, the data resource into a first storage segment stored on the first storage resource and a second storage segment stored on the second storage resource.

First claim

What is claimed is:

1 . A method, comprising,
mapping, by storage controller equipment comprising a processor, a logical storage resource to a first storage resource in a first security zone associated with a first provider entity and a second storage resource in a second security zone associated with a second provider entity; receiving a request to store a data resource at the logical storage resource; based on a distribution policy associated with the data resource, dividing, by the storage controller equipment, the data resource into a first storage segment stored on the first storage resource and a second storage segment stored on the second storage resource; based on a first security level applicable to a first portion of the data resource corresponding to the first storage segment, identifying a first authentication key applicable to storing the first storage segment on the first storage resource; and based on a second security level, different from the first security level and applicable to a second portion of the data resource corresponding to the second storage segment, identifying a second authentication key different from the first authentication key, applicable to storing the second storage segment on the second storage resource, wherein the first portion of the data resource was determined to require a higher level of security than the second portion of the data resource, and wherein, based on the higher level of security, the first authentication key provides a higher level of security than the second authentication key.

2 . The method of claim 1 , wherein the first storage resource comprises a storage array.

3 . The method of claim 1 , wherein the logical storage resource is identified by a logical unit number and mounted as a volume within an operating system.

4 . The method of claim 1 , wherein the second storage resource comprises a cloud-based storage resource, and wherein the second provider entity comprises a cloud-based storage provider entity.

5 . The method of claim 1 , wherein the first storage segment is stored on the first storage resource by employing the first authentication key and the second storage segment is stored on the second storage resource by employing the second authentication key.

6 . The method of claim 1 , wherein the distribution policy defines a division of the data resource into storage segments respectively stored across storage resources comprising the first storage resource, the second storage resource, and additional storage resources in accordance with a parity recovery data structure, and wherein the parity recovery data structure employs parity information stored at ones of the storage resources to facilitate recovery of a data segment stored at a failed storage resource of the storage resources.

7 . The method of claim 6 , wherein the parity information comprises distributed parity information stored across ones of the storage resources.

8 . The method of claim 1 , wherein the distribution policy defines a first size of the first storage segment.

9 . The method of claim 8 , wherein the distribution policy further defines a second size of the second storage segment different from the first size.

10 . The method of claim 1 , wherein the distribution policy specifies distribution of the second storage segment in accordance with an availability threshold of availability associated with data of the second storage segment and an availability characteristic of the second storage resource.

11 . The method of claim 1 , further comprising:
analyzing the first portion of the data resource, resulting in a sensitivity level of the first portion of the data resource, wherein the first security level applicable to the first portion of the data resource was selected based on the sensitivity level.

12 . A device, comprising:
a memory that stores computer executable components; and a processor that executes the computer executable components stored in the memory, wherein the computer executable components comprise:
a request component that communicates a retrieval request to a storage controller device to retrieve data from a virtually addressed storage resource, and
an indicator component that receives, from the storage controller device, an indication that the data was retrieved from the virtually addressed storage resource, wherein the data was stored by dividing the data into parts stored at storage devices mapped to the virtually addressed storage resource in accordance with a storage specification, and wherein the storage devices comprise a first storage device managed by a provider entity associated with operation of the storage controller device and a second storage device managed by a different provider entity, wherein the data was retrieved from the virtually addressed storage resource based on a first authentication key used to store a first part of the data at the first storage device and a second authentication key used to store a second part of the data at the second storage device, wherein the first storage device is managed by the provider entity in accordance with a first zone of security, wherein the different provider entity comprises a cloud-based storage entity managing the second storage device in a second zone of security lower than the first zone of security, and wherein the first part of the data was stored at a higher zone of security than the second part based on the first part of the data being characterized as more sensitive data than the second part of the data.

13 . The device of claim 12 , wherein the data comprises a third part of the data with a first latency requirement and fourth part of the data with a second latency requirement, wherein the first storage device comprises a first latency characteristic and the second storage device comprises a second latency characteristic specifying higher latency than the first latency characteristic as a result of a determination that the second storage device comprises a cloud-based storage device external to the device and the first storage device comprises a storage device local to the device, and wherein the first part of the data was specified to be stored on the first storage device based on the first latency requirement and the first latency characteristic.

14 . The device of claim 12 , wherein the storage specification defined a division of the data into parity blocks and the generation of parity data stored across the storage devices of the virtually addressed storage resource, wherein the retrieval request comprises a retrieval request for data stored on a failed storage device of the storage devices, and wherein the data was retrieved from the storage devices based on the parity data stored on other storage devices different from the failed storage device.

15 . The device of claim 12 , wherein the first part of the data was characterized as more sensitive data than the second part of the data based on an analysis of the first part of the data and the second part of the data.

16 . The device of claim 15 , wherein the first part of the data was stored at the first storage device based on the analysis of the first part of the data.

17 . A non-transitory machine-readable medium comprising executable instructions that, when executed by a processor of a controller device, facilitate performance of operations, the operations comprising:
mapping a logical storage unit identifier to storage resources comprising a local storage resource in a local security zone associated with a first provider entity and a cloud-based storage resource in a

Assignees

• Dell Products Lp

Inventors

• Shachar Tomer
• Don Arieh
• Gehtman Yevgeni
• Balin Maxim

Classifications

• G06F21/6236

  between heterogeneous systems · CPC title

• G06F21/6218

  to a system of files or objects, e.g. local or distributed file system or database · CPC title

• H04W12/086

  using security domains · CPC title

• G06F21/62 Primary

  Protecting access to data via a platform, e.g. using keys or access control rules · CPC title