(19)
(11)EP 2 201 460 B1

(12)EUROPEAN PATENT SPECIFICATION

(45)Mention of the grant of the patent:
04.07.2018 Bulletin 2018/27

(21)Application number: 08837248.7

(22)Date of filing:  22.09.2008
(51)International Patent Classification (IPC): 
G06F 12/00(2006.01)
G06F 11/10(2006.01)
(86)International application number:
PCT/US2008/077162
(87)International publication number:
WO 2009/048726 (16.04.2009 Gazette  2009/16)

(54)

ENSURING DATA INTEGRITY ON A DISPERSED STORAGE GRID

SICHERUNG DER DATENINTEGRITÄT IN EINEM VERTEILTEN SPEICHERGITTER

INTÉGRITÉ DES DONNÉES ASSURÉE SUR UNE GRILLE DE STOCKAGE DISPERSÉE


(84)Designated Contracting States:
AT BE BG CH CY CZ DE DK EE ES FI FR GB GR HR HU IE IS IT LI LT LU LV MC MT NL NO PL PT RO SE SI SK TR

(30)Priority: 09.10.2007 US 973542

(43)Date of publication of application:
30.06.2010 Bulletin 2010/26

(73)Proprietor: International Business Machines Corporation
Armonk, New York 10504 (US)

(72)Inventors:
  • DHUSE, Greg
    Chicago, IL 60647 (US)
  • THORNTON, Vance
    Chicago, IL 60616 (US)
  • RESCH, Jason
    Chicago, IL 60616 (US)
  • VOLVOVSKI, Ilya
    Chicago, IL 60614 (US)
  • HENDRICKSON, Dusty
    Chicago, IL 60640 (US)
  • QUIGLEY, John
    Chicago, IL 60605 (US)

(74)Representative: Graham, Timothy Abbey et al
IBM United Kingdom Limited Intellectual Property Law Hursley Park
Winchester, Hampshire SO21 2JN
Winchester, Hampshire SO21 2JN (GB)


(56)References cited: : 
WO-A1-2007/103533
US-A1- 2005 144 514
US-B1- 7 080 101
US-B1- 7 222 133
US-A- 5 454 101
US-A1- 2007 143 359
US-B1- 7 146 461
  
      
    Note: Within nine months from the publication of the mention of the grant of the European patent, any person may give notice to the European Patent Office of opposition to the European patent granted. Notice of opposition shall be filed in a written reasoned statement. It shall not be deemed to have been filed until the opposition fee has been paid. (Art. 99(1) European Patent Convention).


    Description

    Field of the Invention



    [0001] The present invention relates generally to systems, apparatus, and methods for distributed data storage, and more particularly to systems, apparatus, and methods for distributed data storage using an information dispersal algorithm so that no one location will store an entire copy of stored data, and more particularly still to systems, apparatus, and methods for ensuring data integrity on a dispersed data storage network.

    Description of the Prior Art



    [0002] Storing data in digital form is a well-known problem associated with all computer systems, and numerous solutions to this problem are known in the art. The simplest solution involves merely storing digital data in a single location, such as a punch film, hard drive, or FLASH memory device. However, storage of data in a single location is inherently unreliable. The device storing the data can malfunction or be destroyed through natural disasters, such as a flood, or through a malicious act, such as arson. In addition, digital data is generally stored in a usable file, such as a document that can be opened with the appropriate word processing software, or a financial ledger that can be opened with the appropriate spreadsheet software. Storing an entire usable file in a single location is also inherently insecure as a malicious hacker only need compromise that one location to obtain access to the usable file.

    [0003] To address reliability concerns, digital data is often "backed-up," i.e., an additional copy of the digital data is made and maintained in a separate physical location. For example, a backup tape of all network drives may be made by a small office and maintained at the home of a trusted employee. When a backup of digital data exists, the destruction of either the original device holding the digital data or the backup will not compromise the digital data. However, the existence of the backup exacerbates the security problem, as a malicious hacker can choose between two locations from which to obtain the digital data. Further, the site where the backup is stored may be far less secure than the original location of the digital data, such as in the case when an employee stores the tape in her home.

    [0004] Another method used to address reliability and performance concerns is the use of a Redundant Array of Independent Drives ("RAID"). RAID refers to a collection of data storage schemes that divide and replicate data among multiple storage units. Different configurations of RAID provide increased performance, improved reliability, or both increased performance and improved reliability. In certain configurations of RAID, when digital data is stored, it is split into multiple units, referred to as "stripes," each of which is stored on a separate drive. Data striping is performed in an algorithmically certain way so that the data can be reconstructed. While certain RAID configurations can improve reliability, RAID does nothing to address security concerns associated with digital data storage.

    [0005] One method that prior art solutions have addressed security concerns is through the use of encryption. Encrypted data is mathematically coded so that only users with access to a certain key can decrypt and use the data. Common forms of encryption include DES, AES, RSA, and others. While modern encryption methods are difficult to break, numerous instances of successful attacks are known, some of which have resulted in valuable data being compromised.

    [0006] Digitally stored data is subject to degradation over time, although such degradation tends to be extremely minor and the time periods involved tend to be much longer than for analog data storage. Nonetheless, if a single bit within a file comprised of millions of bits changes from a zero to a one or vice verse, the integrity of the file has been compromised, and its usability becomes suspect. Further, errors occur more frequently when digital data is transmitted due to noise in the transmission medium. Various prior art techniques have been devised to detect when a digital data segment has been compromised. One early form of error detection is known as parity, wherein a single bit is appended to each transmitted byte or word of data. The parity bit is set so that the total number of one bits in the transmitted byte or word is either even or odd. The receiving processor then checks the received byte or word for the appropriate parity, and, if it is incorrect, asks that the byte or word be resent.

    [0007] Another form of error detection is the use of a checksum. There are many different types of checksums including classic checksums, cryptographic hash functions, digital signatures, cyclic redundancy checks, and the use of human readable "check digits" by the postal service and libraries. All of these techniques involve performing a mathematical calculation over an entire data segment to arrive at a checksum, which is appended to the data segment. For stored data, the checksum for the data segment can be recalculated periodically, and checked against the previously calculated checksum appended to the data segment. For transmitted data, the checksum is calculated by the transmitter and appended to the data segment. The receiver then recalculates the checksum for the received data segment, and if it does not match the checksum appended to the data segment, requests that it be retransmitted.

    [0008] In 1979, two researchers independently developed a method for splitting data among multiple recipients called "secret sharing." One of the characteristics of secret sharing is that a piece of data may be split among n recipients, but cannot be known unless at least t recipients share their data, where nt. For example, a trivial form of secret sharing can be implemented by assigning a single random byte to every recipient but one, who would receive the actual data byte after it had been bitwise exclusive orred with the random bytes. In other words, for a group of four recipients, three of the recipients would be given random bytes, and the fourth would be given a byte calculated by the following formula:

    where s is the original source data, ra, rb, and rc are random bytes given to three of the four recipients, and s' is the encoded byte given to the fourth recipient. The original byte s can be recovered by bitwise exclusive-orring all four bytes together.

    [0009] The problem of reconstructing data stored on a digital medium that is subject to damage has also been addressed in the prior art. In particular, Reed-Solomon and Cauchy Reed-Solomon coding are two well-known methods of dividing encoded information into multiple slices so that the original information can be reassembled even if all of the slices are not available. Reed-Solomon coding, Cauchy Reed-Solomon coding, and other data coding techniques are described in "Erasure Codes for Storage Applications," by Dr. James S. Plank, which is hereby incorporated by reference.

    [0010] Schemes for implementing dispersed data storage networks ("DDSN"), which are also known as dispersed data storage grids, are also known in the art. In particular, United States Patent Number 5,485,474, issued to Michael O. Rabin, describes a system for splitting a segment of digital information into n data slices, which are stored in separate devices. When the data segment must be retrieved, only m of the original data slices are required to reconstruct the data segment, where n>m.

    [0011] While DDSN's can theoretically be implemented to provide any desired level of reliability, practical considerations tend to make this impossible in prior art solutions. For example, DDSNs rely on storage media to store data slices. This storage media, like all storage media, will degrade over time. Furthermore, DDSN's rely on numerous transmissions to physically disparate slice servers, and data slices may become corrupted during transmissions. While TCP utilizes a CRC in every transmitted packet, the reliability provided by this CRC is not sufficient for critical data storage. US 2007/0143359 A1 describes a system and method for recovery from failure of a storage server in a distributed column chunk data store. Column chunks from failed storage servers may be recreated from parity column chunks and redistributed among the remaining storage servers.

    Objects of the Invention



    [0012] Accordingly, it is an object of this invention to provide a method and a system for ensuring data integrity on a dispersed data storage network.

    Summary of the Invention



    [0013] In accordance with the invention, there are provided: a method of ensuring data integrity on a dispersed data storage network, as recited in claim 1; and a distributed computer system implementing a dispersed data storage network, as recited in claim 4. The disclosed invention achieves its objectives by providing an improved method for insuring the integrity of data stored on a dispersed data storage network. A checksum is calculated for a data segment to be written to a DDSN. The checksum is appended to the data segment, which is sliced into a plurality of data slices. A second set of checksums is calculated for and appended to the different data slices, which are then transmitted to different slice servers. For each receiving slice server, a checksum is calculated for the received data slice, and compared to the checksum appended to the received data slice. If the checksums vary, the receiving slice server marks the data slice as corrupted, and requests that the corrupted data slice be resent.

    [0014] In another aspect of the disclosed invention, a distributed computer system implements a dispersed data storage network. In this system, a rebuilder application periodically recalculates checksums for data slices stored on a plurality of slice servers. Where the calculated checksum does not match the checksum appended to a stored data slice, the data slice is marked as corrupted. The rebuilder application then identifies the stored data segment associated with the corrupted data slice, and issues read requests to other slice servers holding data slices corresponding to the identified data segment. The data segment is rebuilt and re-sliced, and any slice servers containing corrupted data are sent new data slices to replace the corrupted data slices.

    Brief Description of the Drawings



    [0015] Although the characteristic features of this invention will be particularly pointed out in the claims, the invention itself, and the manner in which it may be made and used, may be better understood by referring to the following description taken in connection with the accompanying drawings forming a part hereof, wherein like reference numerals refer to like parts throughout the several views and in which:

    Figure 1 is a network diagram of a dispersed data storage network constructed in accordance with an embodiment of the disclosed invention;

    Figure 2 illustrates the use of checksums on a data segment as well as on an arbitrary number of data slices created from the data segment;

    Figure 3A is a flowchart illustrating the process by which a corrupted data segment can be rebuilt by a dispersed data storage network constructed in accordance with an embodiment of the disclosed invention;

    Figures 4A-4C collectively illustrates a read operation from a dispersed data storage network constructed in accordance with an embodiment of the disclosed invention;

    Figures 5A-5B collectively illustrates a write operation from a dispersed data storage network constructed in accordance with an embodiment of the disclosed invention;

    Figures 6A-6B collectively illustrates an alternative process by which corrupted data slices may be recreated.


    Detailed Description of the Illustrated Embodiment



    [0016] Turning to the Figures, and to Figure 1 in particular, a distributed computer system implementing a dispersed data storage grid 100 is shown. An arbitrary number of slice servers 150-162 store data slices sent to them by networked source computers 102,104,106. As illustrated, some number of grid access computers 120,122 allows access to the slice servers 150-162 by the source computers 102,104,106.

    [0017] As explained herein, the disclosed invention works to ensure integrity of data stored in a DDSN not only by using checksums on each stored data segment as well as the constituent data slices, but also by reconstructing corrupted data slices as well. In accordance with the disclosed invention, grid access computers 120,122 will calculate a checksum for each data segment to be stored, and append the checksum to the data segment prior to slicing. The data segment is then sliced in accordance with an information dispersal algorithm, and checksums are calculated and appended to each of the data slices. The data slices are then forwarded to slice servers 150-162, where the data slices are stored.

    [0018] In addition, grid access computers 120,122 also recreate data slices that have become corrupted, or were destroyed. If during operation of the DDSN 100, it is detected that a particular data slice has been corrupted or destroyed, a different data slice will be requested from a different slice server 150-162. Assuming that sufficient non-corrupted data slices exist to successfully reconstruct the original data segment, the reconstructed data segment will be re-sliced, and the corrupted data slice will be replaced with a non-corrupted version. Further, a rebuilder application operating within the DDSN periodically walks through all data slices stored on the DDSN. When a corrupted data slice is found, the rebuilder application identifies the data segment corresponding to the corrupted data slice, rebuilds the identified data segment, and rewrites the corrupted slice.

    [0019] Figure 2 depicts the use of a checksum 220 on a data segment 230, as well as on the data slices 250-257 that the data segment 230 was divided into. Assuming that a data segment 230 is being written to a DDSN, a checksum 220 will be calculated for and appended to the data segment 230, thereby forming a "certified data segment." The certified data segment 230 will then be sliced as one piece of data resulting in data slices 250-257, i.e., when the data slices 250-257 are recombined, both the data segment 230 and data segment checksum 220 will be recovered. A checksum 240-247 is then calculated for, and appended to each data slice 250-257, forming "certified data slices" 260-267. The certified data slices 260-267 will then be sent to different slice servers.

    [0020] Figure 3 depicts one possible process by which corrupted slices may be recreated. During a read operation of the DDSN, a client requests a slice from a slice server in step 302. In step 303, the slice server transmits the requested slice to the client, which calculates a checksum for the requested data slice. In step 304, the calculated checksum is compared to the checksum appended to the stored data slice, and if the two checksums match, the read proceeds as normal in step 306. However, if the two checksums do not match, the slice server will transmit a message to a rebuilder application operating on the DDSN indicating that the requested data slice is corrupted in step 308, and return "Failure" to the querying server. The corrupted slice may be rewritten asynchronously as discussed in the text addressing Figure 6. In step 310, the querying server determines if an alternative slice can be read from a different slice server. If an alternative slice does not exist, the querying server will report an error in step 312. In step 314, the querying computer reads the alternative slice.

    [0021] Figures 4A-4C show the process by which a DDSN, constructed in accordance with the disclosed invention and used in conjunction with the with the process depicted in Figures 3A-3B, could fulfill a read request. In step 402, a read request is received. Contained within the read request will be information sufficient to determine which slice servers contain applicable data, as well as the minimum number of data slices that must be retrieved before the requested data can be reconstructed. Further information on one method that can be used to associate data requests with particular slice servers is contained in United States Patent Application 11/973,621, titled "VIRTUALIZED DATA STORAGE VAULTS ON A DISPERSED DATA STORAGE NETWORK," filed on October 9, 2007 and assigned to Cleversafe, Inc. In step 404, the variable m is initialized to the minimum number of slices required to construct the requested data segment. As described herein, for each successfully received and validated slice, m is decremented.

    [0022] In step 406, a list of slice servers each holding a required data slice that has yet to be received is assembled, and in step 408, the list is ordered by any applicable criteria. Further information on criteria by which the list may be ordered is contained in United States Patent Application 11/973,622 , titled "SMART ACCESS TO A DISPERSED DATA STORAGE NETWORK," filed on October 9, 2007 and assigned to Cleversafe, Inc. In step 410, read requests are issued to the first k slice servers on the assembled list, where k is at least equal to m, the minimum number of data slices needed to reconstruct the requested data segment, but could be as large as n, the number of data slices that have data relevant to the requested data segment. In step 412; r data slices are received, and in step 414 the number of received data slices r is subtracted from the variable m. In step 416, m is compared to zero, and if m is greater than or equal to zero, execution returns to step 406 and proceeds as normal from there. However, if m is equal to zero, a collection of data transformations may optionally be applied to the received slices in step 418. The applied data transformations can include decryption, decompression, and integrity checking. In accordance with the disclosed invention, each data slice includes a cyclical redundancy check ("CRC"), or other form of checksum appended to the data contained in the slice. This checksum will be compared against a checksum calculated by the receiving slice server against the received data to ensure that the data was not corrupted during the transmission process.

    [0023] In step 420, it is determined if the applied data transformations were successful for all of the received data slices. If the applied data transformations were not successful for some of the received slices, m is incremented by this number in step 422, and execution is resumed at step 406. The data transformations could fail, for example, if an integrity check revealed that a received data slice was corrupted. However, if the applied data transformations were successful for all received data slices, the received slices are assembled into the requested block of data in step 424. The same or different data transformations may optionally be applied to the assembled data block in step 426, which completes the read process. In accordance with the disclosed invention, a checksum for the data segment will be calculated and compared to a checksum appended to the assembled data segment.

    [0024] In Figures 5A-5B the process by which a DDSN, constructed in accordance with the disclosed invention, could write data to a network of slice servers is illustrated. In step 502 a data segment write request is received. Included in this write request is information sufficient to determine which slice servers the data segment should be written to, as well as information required by the information dispersal algorithm to divide the data segment, i.e., the number of slices to be written, referred to as n, as well as the minimum number of slices that are required to recover the data, referred to as m. Further information on one method that can be used to associate data writes with particular slice servers is contained in United States Patent Application 11/973,621, titled "VIRTUALIZED DATA STORAGE VAULTS ON A DISPERSED DATA STORAGE NETWORK," filed on October 9, 2007 and assigned to Cleversafe, Inc.

    [0025] A number of data transformations may optionally be applied to each block in step 506, and an information dispersal algorithm is applied in step 508. In particular, the Cauchy Reed-Solomon dispersal algorithm could be applied to the data segment, resulting in a predetermined number of data slices. In step 510, a number of data transformations are optionally applied to each data slice.

    [0026] In the disclosed system, writes are performed transactionally, meaning that a minimum number of data slices t must be successfully written before a write is deemed complete. Normally, the number of data slices that must be successfully written will be set to n, i.e., the number of slices that the data segment was originally divided into. However, this number can be configured by the user to a lesser number, down to the minimum number of slices required to reconstruct the data. This would allow the user to continue using the DDSN during a minor network outage where one or more slice servers were unavailable. Slices that could not be immediately transmitted and stored could be queued and transmitted when the network outage cleared. In step 512, a write transaction is initiated to the data storage grid. As discussed herein, all slice servers are simultaneously contacted, and in step 514, a confirmation that at least t receiving slice servers are prepared to begin the write transaction, i.e., to store each slice, must be received, or the transaction is rolled back in step 516.

    [0027] In step 520 data slices are transmitted to the slice servers that indicated their ability to receive and store slices. The number of slice servers that successfully received and stored their assigned data slices is checked in step 522, and if less than t slices are successfully stored, the transaction is rolled back in step 516. In step 524, a commit transaction is begun on all servers with successful writes. If the commit transaction fails, an error is logged in step 528. Otherwise, the write transaction was successful.

    [0028] Figures 6A-6B are a flow chart illustrating an alternative process by which corrupted data slices may be recreated. In step 602, a scan of data slices is initiated by a rebuilder application operating somewhere on the DDSN. If no corrupted data slice is found, the corrupted slice recreation process is exited in step 605. However, if a corrupted slice is detected because of a failed integrity check, execution proceeds to step 606, where a grid access computer determines what data segment corresponds to the corrupted data slice, and reads that data segment from the DDSN. The grid access computer then reconstructs the data segment in step 608. In step 610, the data segment is re-sliced, and the grid access computer rewrites a non-corrupted version of the corrupted data slice to the appropriate slice server in step 612.

    [0029] The foregoing description of the invention has been presented for purposes of illustration and description, and is not intended to be exhaustive or to limit the invention to the precise form disclosed. The description was selected to best explain the principles of the invention and practical application of these principles to enable others skilled in the art to best utilize the invention in various embodiments and various modifications as are suited to the particular use contemplated. It is intended that the scope of the invention not be limited by the specification, but be defined by the claims set forth below.


    Claims

    1. A method of ensuring data integrity on a dispersed data storage network (Fig. 1) comprising the steps of:

    i) calculating a first checksum (220) for a data segment (230) to be written to said dispersed data storage network (Fig. 1);

    ii) appending said first checksum (220) to said data segment (230), thereby forming a certified data segment (235);

    iii) slicing said certified data segment (235) in accordance with an information dispersal algorithm, thereby forming a plurality (250-257) of data slices;

    iv) calculating a plurality of second checksums (240-247) for said plurality of data slices (250-257);

    v) appending said plurality of second checksums (240-247) to said plurality of data slices (250-257), so that the appropriate second checksum (240-247) is appended to the appropriate data slice (250-257), thereby forming a plurality of certified data slices (260-267) ;

    vi) transmitting said certified data slices (260-267) to a plurality of slice servers (150-162); and

    vii) storing said certified data slices (260-267) on said slice servers (150-162).


     
    2. The method of claim 1, further comprising the steps of:

    i) on each slice server, periodically calculating a third checksum for a stored data slice;

    ii) comparing said third checksum to said second checksum appended to said data slice; and

    iii) marking said data slice as corrupted if said third checksum does not match said second checksum.


     
    3. The method of claim 1, further comprising the steps of:

    i) initiating a read request for a data segment stored on said dispersed data storage network;

    ii) assembling a list of slice servers holding a data slice corresponding to said data segment;

    iii) issuing data slice read requests to at least some of the slice servers on said list;

    iv) on reception of said data slice read requests, calculating a third checksum on said slice servers;

    v) comparing said third checksum to said second checksum appended to said data slice; and

    vi) marking said data slice as corrupted if said third checksum does not match said second checksum.


     
    4. A distributed computer system implementing a dispersed data storage network (Fig. 1) comprising:

    i) a slice server (150-162) including a network port coupled to a network (140) and storing a plurality of data slices (250-257) and including an integrity checking application for calculating a first checksum for each of said plurality of data slices and comparing said first checksum to a plurality of second checksums (240-247) appended to said data slices (250-257), so that a first checksum calculated for a data slice is compared to a second checksum (240-247) appended to a data slice; and

    ii) a rebuilder application running on a computer (120; 122) including a network port coupled to a network (110; 140), said rebuilder application receiving a corrupted data slice indication identifying a corrupted data slice from said slice server (150-162) when said slice server (150-162) determines that said first checksum does not match said second checksum (240-247), characterised in that

    said rebuilder application will a) read sufficient data slices (250-257) from other slice servers to reconstruct a data segment (235) corresponding to said corrupted data slice, b) reconstruct said data segment (235), c) slice said data segment (235) according to an information dispersal algorithm, and d) re-write a data slice corresponding to said corrupted data slice to said slice server (150-162).
     


    Ansprüche

    1. Verfahren zur Sicherung der Datenintegrität auf einem verteilten Datenspeicher-Netzwerk (Abb. 1), wobei das Verfahren die Schritte umfasst:

    i) Berechnen einer ersten Prüfsumme (220) für ein Datensegment (230), das in das verteilte Datenspeicher-Netzwerk (Abb. 1) geschrieben werden muss;

    ii) Anfügen einer ersten Prüfsumme (220) an das Datensegment (230), damit ein zertifiziertes Datensegment (235) gebildet wird;

    iii) Erstellen des zertifizierten Datensegments (235) gemäß einem Daten-Verteilungsalgorithmus, damit eine Vielzahl (250 bis 257) von Datensektoren gebildet wird;

    iv) Berechnen einer Vielzahl von zweiten Prüfsummen (240 bis 247) für die Vielzahl von Datensektoren (250 bis 257) ;

    v) Anfügen der Vielzahl von zweiten Prüfsummen (240 bis 247) an die Vielzahl von Datensektoren (250 bis 257), sodass die jeweilige zweite Prüfsumme (240 bis 247) an den passenden Datensektor (250 bis 257) angefügt wird, damit eine Vielzahl von zertifizierten Datensektoren (260 bis 267) gebildet wird;

    vi) Übertragen der zertifizierten Datensektoren (260 bis 267) an die Vielzahl von Sektor-Servern (150 bis 162); und

    vii) Speichern der zertifizierten Datensektoren (260 bis 267) auf den Sektor-Servern (150 bis 162).


     
    2. Verfahren nach Anspruch 1, das ferner die Schritte umfasst:

    i) auf jedem Sektor-Server periodisches Berechnen einer dritten Prüfsumme für einen gespeicherten Datensektor;

    ii) Vergleichen der dritten Prüfsumme mit der zweiten Prüfsumme, die an den Datensektor angefügt ist; und

    iii) Markieren des Datensektors als beschädigt, wenn die dritte Prüfsumme nicht mit der zweiten Prüfsumme übereinstimmt.


     
    3. Verfahren nach Anspruch 1, das ferner die Schritte umfasst:

    i) Auslösen einer Leseanforderung für ein Datensegment, das auf dem verteilten Datenspeicher-Netzwerk gespeichert ist;

    ii) Zusammenstellen einer Liste von Sektor-Servern, die einen Datensektor beinhaltet, der zu dem Datensegment gehört;

    iii) Ausgeben von Datensektor-Leseanforderungen an mindestens einige der Sektor-Server auf der Liste;

    iv) beim Empfang der Datensektor-Leseanforderungen Berechnen einer dritten Prüfsumme auf den Sektor-Servern;

    v) Vergleichen der dritten Prüfsumme mit der zweiten Prüfsumme, die an den Datensektor angefügt wird; und

    vi) Markieren des Datensektors als beschädigt, wenn die dritte Prüfsumme nicht mit der zweiten Prüfsumme übereinstimmt.


     
    4. Verteiltes Computer-System, das ein verteiltes Datenspeicher-Netzwerk (Abb. 1) realisiert und umfasst:

    i) einen Sektor-Server (150 bis 162), der einen mit einem Netzwerk (140) verbundenen Netzwerkanschluss beinhaltet und eine Vielzahl von Datensektoren (250 bis 257) speichert und eine Integritäts-Prüfanwendung zum Berechnen einer ersten Prüfsumme für jeden Datensektor aus der Vielzahl von Datensektoren und zum Vergleichen der ersten Prüfsumme mit einer Vielzahl von zweiten Prüfsummen (240 bis 247) beinhaltet, die an die Datensektoren (250 bis 257) angefügt werden, sodass eine erste Prüfsumme, die für einen Datensektor berechnet wird, mit einer zweiten Prüfsumme (240 bis 247) verglichen wird, die an einen Datensektor angefügt ist; und

    ii) eine Neubildungs-Anwendung, die auf einem Computer (120; 122) ausgeführt wird und einen mit einem Netzwerk (110; 140) verbundenen Netzwerkanschluss beinhaltet, wobei die Neubildungs-Anwendung eine "Datensektor beschädigt"-Anzeige empfängt, die einen beschädigten Datensektor von dem Sektor-Server (150 bis 162) kennzeichnet, wenn der Sektor-Server (150 bis 162) feststellt, dass die erste Prüfsumme nicht mit der zweiten Prüfsumme (240 bis 247) übereinstimmt, dadurch gekennzeichnet, dass

    die Neubildungs-Anwendung a) zum Wiederherstellen eines Datensegments (235) ausreichend viele Datensektoren (250 bis 257) von anderen Sektor-Servern lesen wird, die mit dem beschädigten Datensektor übereinstimmen, b) das Datensegment (235) wiederherstellen wird, c) das Datensegment (235) gemäß einem Daten-Verteilungsalgorithmus erstellen wird, und d) einen Datensektor, der mit dem beschädigten Datensektor übereinstimmt, neu auf den Sektor-Server (150 bis 162) schreiben wird.
     


    Revendications

    1. Procédé pour garantir l'intégrité des données sur un réseau de mémorisation de données dispersé (Fig.1), le procédé comprenant les étapes consistant à :

    i) calculer une première somme de vérification (220) pour un segment de données (230) à écrire dans ledit réseau de mémorisation de données dispersé (Fig.1) ;

    ii) annexer ladite première somme de vérification (220) audit segment de données (230) en formant ainsi un segment de données certifié (235) ;

    iii) découper ledit segment de données certifié (235) conformément à un algorithme de dispersion d'information, en formant ainsi une pluralité de découpages de données (250 à 257) ;

    iv) calculer une pluralité de secondes sommes de vérification (240 à 247) pour ladite pluralité de découpages de données (250 à 257) ;

    v) annexer ladite pluralité de secondes sommes de vérification (240 à 247) à ladite pluralité de découpages de données (250 à 257), de sorte que la seconde somme de vérification appropriée (240 à 247) soit annexée au découpage de données approprié (250 à 257) en formant ainsi une pluralité de découpages de données certifiés (260 à 267) ;

    vi) transmettre lesdits découpages de données certifiés (260 à 267) à une pluralité de serveurs de découpage (150 à 162) ; et

    vii) mémoriser lesdits découpages de données certifiés (260 à 267) sur lesdits serveurs de découpage (150 à 162) .


     
    2. Procédé selon la revendication 1, comprenant en outre les étapes consistant à :

    i) sur chaque serveur de découpages, calculer périodiquement une troisième somme de vérification pour un découpage de données mémorisée ;

    ii) comparer ladite troisième somme de vérification avec ladite seconde somme de vérification annexée audit découpage de données ;

    ii) marquer ledit découpage de données comme corrompu si ladite troisième somme de vérification ne concorde pas avec ladite seconde somme de vérification.


     
    3. Procédé selon la revendication 1, comprenant en outre les étapes consistant à :

    i) amorcer une demande de lecture pour un segment de données mémorisées sur ledit réseau de mémorisation de données dispersé ;

    ii) assembler une liste de serveurs de découpage détenant un découpage de données correspondant audit segment de données ;

    iii) émettre des demandes de lecture de découpage de données vers au moins certains des serveurs de découpage sur ladite liste ;

    iv) à la réception desdites demandes de lecture de découpage de données, calculer une troisième somme de vérification sur ledit serveur de découpage ;

    v) comparer ladite troisième somme de vérification avec ladite seconde somme de vérification annexée audit découpage de données ; et

    vi) marquer ledit découpage de données comme corrompu si ladite troisième somme de vérification ne concorde pas avec ladite seconde somme de vérification.


     
    4. Système informatique distribué implémentant un réseau de mémorisation de données dispersé (Fig.1) comprenant :

    i) un serveur de découpage (150 à 162) incluant un port de réseau connecté à un réseau (140) et mémorisant une pluralité de découpages de données (250 à 257) et incluant une application de vérification d'intégrité pour calculer une première somme de vérification pour chacun de ladite pluralité de découpages de données et comparer ladite première somme de vérification avec une pluralité de secondes sommes de vérification (240 à 247) annexées auxdits découpages de données (250 à 257), de sorte qu'une première somme de vérification calculée pour un découpage de données soit comparée avec une seconde somme de vérification (240 à 247) annexée à un découpage de données ; et

    ii) une application de reconstruction s'exécutant sur un ordinateur (120; 122) incluant un port de réseau couplé à un réseau (110; 140), ladite application de reconstruction recevant une indication de découpage de données corrompu identifiant un découpage de données corrompu depuis ledit serveur de découpage (150 à 162) lorsque ledit serveur de découpage (150 à 162) détermine que ladite première somme de vérification ne concorde pas avec ladite seconde somme de vérification (240 à 247), caractérisé en ce que

    ladite application de reconstruction a) lira des découpages de données suffisants (250, 257) provenant d'autres serveurs de découpage pour reconstruire un segment de données (235) correspondant audit découpage de données corrompu, b) reconstruira ledit segment de données (235), c) découpera ledit segment de données (235) selon un algorithme de dispersion d'information et d) réécrira un découpage de données correspondant audit découpage de données corrompu sur ledit serveur de découpage (150 à 162) .
     




    Drawing



































    Cited references

    REFERENCES CITED IN THE DESCRIPTION



    This list of references cited by the applicant is for the reader's convenience only. It does not form part of the European patent document. Even though great care has been taken in compiling the references, errors or omissions cannot be excluded and the EPO disclaims all liability in this regard.

    Patent documents cited in the description