Securing integrity and consistency of a cloud storage service with efficient client operations

Patent metadata

Field	Value
Publication number	US-9589153-B2
Application number	US-201514790329-A
Country	US
Kind code	B2
Filing date	Jul 2, 2015
Priority date	Aug 15, 2014
Publication date	Mar 7, 2017
Grant date	Mar 7, 2017

Abstract

A method for providing integrity and consistency of a cloud storage service to a group of mutually trusted clients may be provided. The cloud storage service may offer a set of operations, such as read, write, update, delete in respect to stored data to the clients, whereby each client only executes its own client operations when consuming one of the set of operations of the cloud storage service, and wherein each client detects data correctness of the cloud storage service based on a protocol providing fork-linearizablity.

First claim

The invention claimed is:

1. A method for securing integrity and consistency of a cloud storage service to a group of mutually trusted clients comprising a first client and a second client, the method comprising:
offering, by the cloud storage service, a set of operations with respect to stored data to the group of mutually trusted clients;
receiving, by the cloud storage service from the first client, a request to consume a particular operation of the set of operations;
receiving, by the cloud storage service from the first client, a first set of one or more commands in connection with the requested particular operation;
executing, by the cloud storage service, the particular operation at least in part by executing the first set of one or more commands;
sending, by the cloud storage service, proof of execution of the particular operation to the first client;
receiving, by the cloud storage service from the second client, a second set of one or more commands; and
executing, by the cloud storage service, at least one operation of the set of operations at least in part by executing the second set of one or more commands,
wherein the first client verifies execution of the first set of one or more commands and does not verify execution of the second set of one or more commands when consuming the particular operation,
wherein the first client verifies execution of the first set of one or more commands based at least in part on the proof of execution, and
wherein each client detects data correctness of the cloud storage service based on a protocol providing fork-linearizablity.

2. The method of claim 1 , wherein the data correctness comprises one or more of integrity violations and consistency violations.

3. The method of claim 1 , wherein the operation is selected from the group of: a read operation, a write operation, an update operation, and a delete operation.

4. The method of claim 1 , further comprising establishing an order in a pending operations list indicating the order in which operations from different clients will be applied to the stored data by receiving a commit-message for a committed operation.

5. The method of claim 4 , further comprising sending an update-authentication-message comprising the proof of the execution (s0) of the operation, and an authentication value for the last applied operation.

6. The method of claim 5 , further comprising receiving a second authentication value and a commitment digital signature, wherein the second authentication value is generated based on the first authentication value and the commitment digital signature is generated by cryptographically signing the operation and the second authentication value.

7. The method of claim 6 , further comprising:
storing the second authentication value; and
executing, by the cloud storage service, the operation on the data resulting in an applied operation.

8. A client system associated with a first client out of a group of mutually trusted clients for demanding services from a cloud storage service, the client system comprising:
at least one memory storing computer-executable instructions; and
at lease one hardware processor configured to access the at lease one memory and execute the computer-executable instructions to:
send an invocation message comprising a cryptographically signed operation for data in an invocation digital signature;
receive a reply-message comprising a list of pending operations, an authentication value, and proof, wherein the list of pending operations includes a pending-other operation associated with a second client of the group of mutually trusted clients that is different from the first client;
determine that the operation is not in conflict with the pending operations list by determining that the operation commutes with the pending-other operation;
send a commit message comprising a test result indication that the operation is not in conflict with the pending operations list, the operation and a commitment digital signature; and
send an authentication value based on the operation and a received proof.

9. A server system configured to perform a cloud storage service for data, wherein the cloud storage service comprises a set of operations, the server system comprising:
at least one memory storing computer-executable instructions; and
at lease one hardware processor configured to access the at lease one memory and execute the computer-executable instructions to:
receive, from a first client, an invocation message comprising an indication of an operation to be executed;
send, to the first client, a list of pending operations, an authentication value for a last applied operation, and a proof, wherein the list of pending operations includes a pending-other operation associated with a second client different from the first client;
receive a commit message comprising a test result indication that the operation is not in conflict with the pending operations list, the operation, and a commitment digital signature, wherein the operation is determined not to be in conflict with the pending operations list based on a determination that the operation commutes with the pending-other operation;
store a received authentication value; and
execute the operation to be executed resulting in an applied operation.

10. A non-transitory computer readable storage medium having computer readable instructions stored thereon that, when executed by a computer, implement a method for securing integrity and consistency of a cloud storage service to a group of mutually trusted clients comprising a first client and a second client, the method comprising:
offering, by the cloud storage service, a set of operations with respect to stored data to the group of mutually trusted clients;
receiving, by the cloud storage service from the first client, a request to consume a particular operation of the set of operations;
receiving, by the cloud storage service from the first client, a first set of one or more commands in connection with the requested particular operation;
executing, by the cloud storage service, the particular operation at least in part by executing the first set of one or more commands;
sending, by the cloud storage service, proof of execution of the particular operation to the first client;
receiving, by the cloud storage service from the second client, a second set of one or more commands; and
executing, by the cloud storage service, at least one operation of the set of operations at least in part by executing the second set of one or more commands,
wherein the first client verifies execution of the first set of one or more commands and does not verify execution of the second set of one or more commands when consuming the particular operation,
wherein the first client verifies execution of the first set of one or more commands based at least in part on the proof of execution, and
wherein each client detects data correctness of the cloud storage service based on a protocol providing fork-linearizablity.

11. The storage medium of claim 10 , wherein the data correctness comprises one or more of integrity violations and consistency violations.

12. The storage medium of claim 10 , wherein the operation is selected from the group of: a read operation, a write operation, an update operation, and a delete operation.

13. The storage medium of claim 10 , wherein the method further comprises establishing an order in a pending operations list indicating the order in which operations from different clients will be applied to the stored data by receiving a commit-message for a committed operation.

14. The storage medi

Assignees

• Int Businesss Machines Corp
• IBM

Inventors

• Brandenburger Marcus
• Cachin Christian
• Knezevic Nikola

Classifications

• H04L67/10

  in which an application is distributed across nodes in the network (software deployment G06F8/60; multiprogramming arrangements G06F9/46) · CPC title

• G06F21/6218

  to a system of files or objects, e.g. local or distributed file system or database · CPC title

• H04L9/3247

  involving digital signatures · CPC title

• G06F21/64 Primary

  Protecting data integrity, e.g. using checksums, certificates or signatures · CPC title

• H04L63/123

  received data contents, e.g. message integrity · CPC title