DATA ACCESS CONTROL
The presently disclosed subject matter includes a system and method for protecting data stored in a physical storage space of a storage system. According to the teachings disclosed herein, a block key is provided together with a read and a write request and is applied on data, which is related to a logical data block, for calculating a data block signature. A read request according to the presently disclosed subject matter includes, in addition to data indicative of a requested data block, a block key for the purpose of verifying the data block signature that was stored upon the last write of the requested data block. A write request according to the presently disclosed subject matter includes, in addition to data indicative of a data block to be written, a block key for generating a respective data block signature.
1 . A method of storing data in a physical storage space of a storage system, the physical storage space constituted by a plurality of physical data blocks, the method comprising:
receiving a protected write request related to a logical object, logically representing data stored in said physical storage space; the request comprises data to be written, related to a logical data block in said logical object, and a respective block key; the block key comprises data identifying the logical object and data identifying the logical data block;
calculating a respective data block signature based on the data to be written and on the block key;
storing the data to be written and the respective data block signature in a same physical data block.
2 . The method according to claim 1 wherein said block key further comprises a security code identifying an accessing entity.
3 . The method according to claim 1 wherein said data, identifying said logical data block, is a logical block number, identifying the logical data block within the logical object.
4 . The method according to claim 1 , wherein said protected write request is generated by a host operatively connected to the storage system.
5 . The method according to claim 1 , wherein said protected write request is generated by an object storage facility interfacing between a host, operatively connected to said storage system, and said storage system.
6 . The method according to claim 5 , wherein said object storage facility is a file-system, said logical object is a file and said data identifying said logical object, is an Mode of said file.
7 . The method according to claim 1 wherein said logical object is represented by a data-structure, said data-structure comprising at least one path comprising a sequence of one or more metadata blocks referring to a respective data block; each of said one or more metadata blocks comprising a reference to a descendent metadata block or to a respective data block; the method further comprising:
for one or more metadata blocks along said at least one path:
calculating a respective metadata block signature based on data related to a metadata block, the data identifying said logical object and a metadata block identifier associated with said metadata block;
storing said data related to the metadata block and the respective metadata block signature in a same data block.
8 . The method according to claim 7 further comprising: storing a metadata block identifier of a descendent metadata block, in association with said metadata block.
9 . The method according to claim 7 wherein said metadata block identifier is a number uniquely identifying said metadata block within said logical object.
10 . The method according to claim 8 wherein said data-structure is a B-tree.
11 . The method according to claim 1 wherein said data block signature is calculated by applying a predefined function on the data to be written and on the block key.
12 . A method of storing data in a physical storage space of a storage system, the physical storage space constituted by a plurality of physical data blocks, the method comprising:
receiving a protected read request related to a logical data block in a logical object, logically representing data stored in said physical storage space; wherein the protected read request comprises a respective block key; the block key comprises data identifying the logical object and data identifying the logical data block;
reading a physical data block including data related to said logical data block and an associated stored data block signature;
calculating a second data block signature based on the data related to said logical data block and on the block key; and
denying the read request, in case said stored data block signature and said second data block signature do not match.
13 . The method according to claim 12 , wherein said logical object is represented by a data-structure, said data-structure comprising at least one path comprising a sequence of one or more metadata blocks referring to a respective data block; the method further comprising, prior to the reading of said physical data block:
for one or more metadata blocks along one of said at least one path:
reading data related to a metadata block and an associated stored metadata block signature;
calculating a second metadata block signature based on data related to said metadata block, the data identifying said logical object and a metadata block identifier associated with said metadata block;
denying the protected read request in case said stored metadata block signature and said second metadata block signature do not match.
14 . The method according to claim 13 further comprising: storing a metadata block identifier of a descendent metadata block, in association with said metadata block.
15 . A storage system comprising:
a control layer operatively connected to a physical storage space of said storage system, the physical storage space constituted by a plurality of physical data blocks stored in one or more storage devices; the control layer is operable to:
receive a protected read request related to a logical data block in a logical object, logically representing data stored in said physical storage space; wherein the read request comprises a respective block key; the block key comprises data identifying the logical object and data identifying the logical data block;
read a physical data block including data related to said logical data block and an associated stored data block signature;
calculate a second data block signature based on the data related to said logical data block and on the block key; and
deny the read request, in case said stored data block signature and said second data block signature do not match.
16 . The storage system according to claim 15 , wherein said block key further comprises a security code identifying an accessing entity.
17 . The storage system according to claim 15 , wherein said data, identifying said logical data block, is a logical block number, identifying the logical data block within the logical object.
18 . The storage system according to claim 15 , wherein said protected write request is generated by a host operatively connected to the storage system.
19 . The storage system according to claim 15 , wherein said control layer is operatively connected to an object storage facility interfacing between a host and said storage system; the object storage facility being configured to generate the protected read request.
20 . The storage system according to claim 19 , wherein said object storage facility is a file-system, and said logical object is a file in the file-system and said data, identifying said logical object, is an Mode of said file.
21 . The storage system according to claim 15 , wherein said logical object is represented by a data-structure, said data-structure comprising at least one path comprising a sequence of one or more metadata blocks referring to a respective data block; the control layer is further operable, for one or more metadata blocks along one of said at least one path, prior to the reading of said physical data block, to:
read data related to a metadata block and an associated stored metadata block signature;
calculate a second metadata block signature based on data related to said metadata block, the data identifying said logical object and a metadata block identifier associated with said metadata block;
deny the protected read request in case said stored metadata block signature and said second metadata block signature do not match.
22 . The storage system according to claim 21 , wherein said control layer is further operable to store metadata block identifier of a descendent metadata block, in association with said metadata block.
23 . The storage system according to claim 21 , wherein said metadata block identifier is a number uniquely identifying said metadata block within said logical object.
24 . The storage system according to claim 15 , wherein said control layer is further operable to calculate said data block signature by applying a predefined function on the data to be written and on the block key.
25 . The storage system according to claim 15 , wherein said control layer is further operable to:
receive a protected write request related to said logical object; the request includes data to be written, related to said logical data block in said logical object, and said respective block key;
calculate said respective data block signature based on the data to be written and on the block key;
store the data to be written and the respective data block signature in a same physical data block.
26 . The storage system according to claim 25 , wherein said logical object is represented by a data-structure, said data-structure comprising at least one path comprising a sequence of one or more metadata blocks referring to a respective physical data block; each of said one or more metadata blocks comprising a reference to a descendent metadata block or to a respective physical data block; the control layer is further operable, for one or more metadata blocks along said at least one path, to:
calculate a respective metadata block signature based on data related to a metadata block, the data identifying said logical object and a metadata block identifier associated with said metadata block;
store said data related to the metadata block and the respective metadata block signature in a same physical metadata block.
27 . The storage system according to claim 15 , wherein said control layer comprises an I/O management module and at least one processor.
28 . A program storage device readable by machine, tangibly embodying a program of instructions executable by the machine to perform method steps of storing data in a physical storage space of a storage system, the physical storage space constituted by a plurality of physical data blocks, the method comprising:
receiving a protected read request related to a logical data block in a logical object, logically representing data stored in said physical storage space; wherein the read request includes a respective block key; the block key comprises data identifying the logical object and data identifying the logical data block;
reading a physical data block including data related to said logical data block and an associated stored data block signature;
calculating a second data block signature based on the data related to said logical data block and on the block key; and
denying the read request, in said physical data block, in case said stored data block signature and said second data block signature do not match.
29 . The program storage device according to claim 28 , wherein said method steps further include:
receiving a protected write request related to a logical object, logically representing data stored in said physical storage space; wherein the request includes data to be written, related to a logical data block in said logical object, and a respective block key; the block key comprises data identifying the logical object and data identifying the logical data block;
calculating a respective data block signature based on the data to be written and on the block key; and
storing the data to be written and the respective data block signature in a same physical data block.