Securing deallocated blocks in a file system
AssigneeInternational Business Machines Corporation
InventorsNils Haustein, Sandeep Ramesh Patil, Sasikanth Eda, Dominic Mueller-Wicke
Life of this patent
Estimating the term…
Abstract
A computer-implemented method for operating a storage system comprising a file system for managing a data object in one or more storage blocks may be provided. The method comprising receiving from a file system manager a message indicating that the data objects is to be encrypted, determining, in response to the received message, a set of unallocated storage blocks that were previously allocated for storing at least a portion of the data object, and rendering content of the unallocated storage blocks of the set unreadable.
Claims18
A computer-implemented method for operating a storage system, the computer-implemented method comprising:
- receiving, by one or more computer processors, from a file system manager a message indicating that a data object is to be encrypted, wherein the data object is stored in a storage system;
- determining, by one or more computer processors, in response to the received message, a set of unallocated storage blocks that were previously allocated for storing at least a portion of the data object;
- rendering, by one or more computer processors, a content of the set of unallocated storage blocks unreadable;
- determining, by one or more computer processors, an unencrypted copy of the data object in a different storage tier than the first storage tier;
- generating, by one or more computer processors, a message indicating the unencrypted copy;
- encrypting, by one or more computer processors, the unencrypted copy of the data object;
- and
- rendering, by one or more computer processors, blocks in the first storage tier relating to content of the unencrypted copy of the data object unreadable.
A computer program product for operating a storage system, the computer program product comprising:
- one or more computer readable storage medium;
- and
- program instructions stored on the one or more computer readable storage media, the program instructions comprising:
- program instructions to receive from a file system manager a message indicating that a data object is to be encrypted, wherein the data object is stored in a storage system;
- program instructions to determine, in response to the received message, a set of unallocated storage blocks that were previously allocated for storing at least a portion of the data object;
- and
- program instructions to render a content of the set of unallocated storage blocks unreadable;
- program instructions to determine an unencrypted copy of the data object in a different storage tier than the first storage tier;
- program instructions to generate a message indicating the unencrypted copy;
- program instructions to encrypt the unencrypted copy of the data object;
- and
- program instructions to render blocks in the first storage tier relating to content of the unencrypted copy of the data object unreadable.
A computer system for operating a storage system, the computer system comprising:
- one or more computer processors;
- one or more computer readable storage medium;
- and
- program instructions stored on the one or more computer readable storage media for execution by at least one of the one or more computer processors, the program instructions comprising:
- program instructions to receive from a file system manager a message indicating that a data object is to be encrypted, wherein the data object is stored in a storage system;
- program instructions to determine, in response to the received message, a set of unallocated storage blocks that were previously allocated for storing at least a portion of the data object;
- and
- program instructions to render a content of the set of unallocated storage blocks unreadable;
- program instructions to determine an unencrypted copy of the data object in a different storage tier than the first storage tier;
- program instructions to generate a message indicating the unencrypted copy;
- program instructions to encrypt the unencrypted copy of the data object;
- and
- program instructions to render blocks in the first storage tier relating to content of the unencrypted copy of the data object unreadable.
Dependencies are inferred from the claim text.