System and method for user data isolation

1. A computer-implemented method for isolating data written by different users on a cloud drive, the method comprising:

receiving a write request from a first user comprising to-be-written data;

binding the to-be-written data with a writer's identifier of the first user by performing error-control encoding on a combination of the to-be-written data and the writer's identifier of the first user; and

writing the to-be-written data bound with the writer's identifier into physical media associated with the cloud drive, thereby facilitating user data isolation by preventing a second user having a reader's identifier that is different from the writer's identifier of the first user from gaining access to the written data.

2. The computer-implemented method of claim 1 , further comprising:

updating a mapping between a logical address and a physical address of the to-be-written data subsequent to writing the to-be-written data; and

storing the updated mapping in a location-mapping table located on the cloud drive.

3. The computer-implemented method of claim 2 , wherein the location-mapping table comprises a first-level table indexed using most significant bits (MSB) of the logical address and a second-level table indexed using least significant bits (LSB) of the logical address.

4. The computer-implemented method of claim 2 , further comprising preparing the cloud drive for resale by removing the location-mapping table from the cloud drive.

5. The computer-implemented method of claim 1 , wherein performing the error-control encoding comprises:

appending the writer's identifier to the to-be-written data; and

performing a channel-encoding operation on the to-be-written data and the appended writer's identifier.

6. The computer-implemented method of claim 1 , wherein the writer's identifier is generated by calculating a hash function based on identification information associated with the first user.

7. The computer-implemented method of claim 1 , further comprising erasing, in a background, data of a previous user subsequent to selling the cloud drive to a new user.

8. A computer-implemented method for isolating data written by different users on a cloud drive, the method comprising:

receiving a read request from a first user for data stored on the cloud drive, the first user having a reader's identifier;

retrieving, based on the read request, data from physical media associated with the cloud drive, the retrieved data being bound with a writer's identifier of a second user;

extracting the writer's identifier from the retrieved data by performing error-control decoding on the retrieved data; and

in response to determining that the extracted writer's identifier does not match the generated reader's identifier, denying the read request.

9. The computer-implemented method of claim 8 , further comprising:

obtaining a logical-address-to-physical-address mapping based on the read request;

performing a lookup in a location-mapping table currently stored on the cloud drive based on the obtained logical-address-to-physical address mapping; and

in response to failing to find a matching entry, denying the read request.

10. The computer-implemented method of claim 8 , wherein denying the read request comprises responding to the read request using a dummy data pattern.

11. A cloud storage system for isolating data written by different users, the system comprising:

a processor;

a memory coupled to the processor and storing instructions, which when executed by the processor cause the processor to perform a method, the method comprising:

receiving a write request from a first user comprising to-be-written data;

binding the to-be-written data with a writer's identifier of the first user by performing error-control encoding on a combination of the to-be-written data and the writer's identifier of the first user;

writing the to-be-written data bound with the writer's identifier into physical media associated with the cloud storage system;

receiving a read request from a second user;

retrieving, based on the read request, data from the physical media;

extracting a writer's identifier from the retrieved data by performing error-control decoding on the retrieved data;

determining whether the extracted writer's identifier matches a reader's identifier associated with the second user; and

denying the read request in response to the determination module determining that the extracted writer's identifier does not match the reader's identifier.

12. The storage system of claim 11 , wherein the method further comprises:

updating a mapping between a logical address and a physical address of the to-be-written data subsequent to writing the to-be-written data; and

storing the updated mapping in a location-mapping table maintained by the storage system.

13. The storage system of claim 12 , wherein the location-mapping table comprises a first-level table indexed using most significant bits (MSB) of the logical address and a second-level table indexed using least significant bits (LSB) of the logical address.

14. The storage system of claim 12 , wherein the method further comprises resetting the location-mapping table in response to preparing the storage system for resale.

15. The storage system of claim 14 , wherein the method further comprises:

obtaining a logical-address-to-physical-address mapping based on the read request; and

performing a lookup in a location-mapping table currently maintained by the storage system based on the obtained logical-address-to-physical address mapping; and

denying the read request in response to the table-lookup module failing to find a matching entry.

16. The storage system of claim 15 , wherein the method further comprises responding to the read request using the retrieved data in response to finding a matching entry and in response to determining that the extracted writer's identifier matches the reader's identifier.

17. The storage system of claim 11 , wherein performing the error-control encoding comprises:

appending the writer's identifier to the to-be-written data; and

performing a channel-encoding operation on the to-be-written data and the appended writer's identifier.

18. The storage system of claim 11 , wherein the method further comprises generating a dummy data pattern, and wherein denying the read request comprises responding to the read request using the dummy data pattern.

19. The storage system of claim 11 , wherein the writer's or the reader's identifier is generated by calculating a hash function based on identification information associated with the first or the second user, respectively.

20. The storage system of claim 11 , wherein the method further comprises erasing, in a background, data of a previous user subsequent to selling the storage system to a new user.