Methods and systems for session-based and secure access control to a data storage system

A data processing system for session-based and secure access control to a data storage system, the data processing system comprising:

• a processor;
• and a memory coupled with and readable by the processor and storing therein a set of instructions which, when executed by the processor, causes the processor to:
• detect an activation signal to initiate access to the data storage system;
• and
• opening a plurality of write sessions to write write session-related data to the data storage system, wherein each of the plurality of write sessions comprises:
• in response to detecting the activation signal, determine a free physical storage subarea of the data storage system to be used during the write session to write the data in the context of a direct or indirect address mapping from an address space with logical storage addresses to an address space with physical storage addresses of the physical storage area to be assigned to the respective write session and selectively assigning the storage subarea to the write session,
• wherein for at least two of the write sessions, the respective logical address spaces for the address mapping match at least with regard to their logical start address;
• receive or generate the data to be written in the context of the write session;
• protect the data using an access protection which protects the data from later access from unauthorized other access sessions to the data storage system;
• output the access-protected data in order to write the access-protected data to the storage subarea of the data storage system that is selectively assigned to the write session;
• and
• conduct at least one read session for read accessing data previously written to the data storage system during at least one write session, the read session comprising:
• checking the permissibility of a respective pending read access by authenticating an object to be granted read access,
• when the check reveals that the respective pending read access is permissible, determining at least one storage subarea assigned to the authenticated object from a set of storage subareas assigned to one or more of the previous write sessions in each case, reading access-protected data from the determined at least one storage subarea, making the read data accessible by canceling the access protection in the context of a current respective pending reading session, and outputting the data that has been made accessible, and wherein at the beginning of each write session for the storage subarea assigned to the respective write session, a file management structure which is individually adapted and assigned to the storage subarea is defined and used for a later writing of data in the context of the write session, and wherein reading the access-protected data from a respective specific storage subarea comprises:
• checking whether the respective read access relates to a storage address in the specific storage subarea, in which storage address data has already been written in the context of a previous write session relating to the storage subarea,
• when the respective read access relates to a storage address in the specific storage subarea for the respective read access, reading the access-protected data using a mapping of logical storage addresses to physical addresses of the storage subarea, and otherwise, reading the access-protected data using the file management structure individually assigned to the storage subarea.

A storage system, comprising:

• a data processing system;
• and a data storage system having at least one data storage;
• wherein the data processing system and the data storage system are integrated in a storage medium as a common structural unit;
• and
• the data processing system comprises:
• a processor;
• and a memory coupled with and readable by the processor and storing therein a set of instructions which, when executed by the processor, causes the processor to:
• detect an activation signal to initiate access to the data storage system;
• and
• opening a plurality of write sessions to write write session-related data to the data storage system, wherein each of the plurality of write sessions comprises:
• in response to detecting the activation signal, determine a free physical storage subarea of the data storage system to be used during the write session to write the data in the context of a direct or indirect address mapping from an address space with logical storage addresses to an address space with physical storage addresses of the physical storage area to be assigned to the respective write session and selectively assigning the free physical storage subarea to the write session,
• wherein for at least two of the write sessions, the respective logical address spaces for the address mapping match at least with regard to their logical start address;
• receive or generate the data to be written in the context of the write session;
• protect the data using an access protection which protects the data from later access from unauthorized other access sessions to the data storage system;
• output the access-protected data in order to write the access-protected data to the storage subarea of the data storage system that is selectively assigned to the write session;
• and
• conduct at least one read session for read accessing data previously written to the data storage system during at least one write session, the read session comprising:
• checking the permissibility of a respective pending read access by authenticating an object to be granted read access,
• when the check reveals that the respective pending read access is permissible, determining at least one storage subarea assigned to the authenticated object from a set of storage subareas assigned to one or more of the previous write sessions in each case, reading access-protected data from the determined at least one storage subarea, making the read data accessible by canceling the access protection in the context of a current respective pending reading session, and outputting the data that has been made accessible, and wherein at the beginning of each write session for the storage subarea assigned to the respective write session, a file management structure which is individually adapted and assigned to the storage subarea is defined and used for a later writing of data in the context of the write session, and wherein reading the access-protected data from a respective specific storage subarea comprises:
• checking whether the respective read access relates to a storage address in the specific storage subarea, in which storage address data has already been written in the context of a previous write session relating to the storage subarea,
• when the respective read access relates to a storage address in the specific storage subarea for the respective read access, reading the access-protected data using a mapping of logical storage addresses to physical addresses of the storage subarea, and otherwise, reading the access-protected data using the file management structure individually assigned to the storage subarea.

A recording system for continuous or repeated sensory detecting of real events or states of objects over a period of time and for providing recording data representing these detected events or states;

• wherein the recording system is a physical recording system configured to cooperate with a data processing system to use a storage medium for storing the recording data by:
• detecting an activation signal to initiate access to the data storage system;
• and
• opening a plurality of write sessions to write write session-related data to the data storage system, wherein each of the plurality of write sessions comprises:
• in response to detecting the activation signal, determining a free physical storage subarea of the data storage system to be used during the write session to write the data in the context of a direct or indirect address mapping from an address space with logical storage addresses to an address space with physical storage addresses of the physical storage area to be assigned to the respective write session and selectively assigning the free physical storage subarea to the write session,
• wherein for at least two of the write sessions, the respective logical address spaces for the address mapping match at least with regard to their logical start address;
• receiving or generating the data to be written in the context of the write session;
• protecting the data using an access protection which protects the data from later access from unauthorized other access sessions to the data storage system;
• outputting the access-protected data in order to write the access-protected data to the storage subarea of the data storage system that is selectively assigned to the write session;
• and
• conducting at least one read session for read accessing data previously written to the data storage system during at least one write session, the read session comprising:
• checking the permissibility of a respective pending read access by authenticating an object to be granted read access,
• when the check reveals that the respective pending read access is permissible, determining at least one storage subarea assigned to the authenticated object from a set of storage subareas assigned to one or more of the previous write sessions in each case, reading access-protected data from the determined at least one storage subarea, making the read data accessible by canceling the access protection in the context of a current respective pending reading session, and outputting the data that has been made accessible, and wherein at the beginning of each write session for the storage subarea assigned to the respective write session, a file management structure which is individually adapted and assigned to the storage subarea is defined and used for a later writing of data in the context of the write session, and wherein reading the access-protected data from a respective specific storage subarea comprises:
• checking whether the respective read access relates to a storage address in the specific storage subarea, in which storage address data has already been written in the context of a previous write session relating to the storage subarea,
• when the respective read access relates to a storage address in the specific storage subarea for the respective read access, reading the access-protected data using a mapping of logical storage addresses to physical addresses of the storage subarea, and otherwise, reading the access-protected data using the file management structure individually assigned to the storage subarea.

A non-transitory, computer-readable medium comprising instructions stored therein which, when executed on one or more cause the one or more processors to provide session-based and secure access control to a data storage system by:

• detecting an activation signal to initiate access to the data storage system;
• and
• opening a plurality of write sessions to write write session-related data to the data storage system, wherein each of the plurality of write sessions comprises:
• in response to detecting the activation signal, determining a free physical storage subarea of the data storage system to be used during the write session to write the data in the context of a direct or indirect address mapping from an address space with logical storage addresses to an address space with physical storage addresses of the physical storage area to be assigned to the respective write session and selectively assigning the free physical storage subarea to the write session,
• wherein for at least two of the write sessions, the respective logical address spaces for the address mapping match at least with regard to their logical start address;
• receiving or generating the data to be written in the context of the write session;
• protecting the data using an access protection which protects the data from later access from unauthorized other access sessions to the data storage system;
• outputting the access-protected data in order to write the access-protected data to the storage subarea of the data storage system that is selectively assigned to the write session;
• and
• conducting at least one read session for read accessing data previously written to the data storage system during at least one write session, the read session comprising:
• checking the permissibility of a respective pending read access by authenticating an object to be granted read access,
• when the check reveals that the respective pending read access is permissible, determining at least one storage subarea assigned to the authenticated object from a set of storage subareas assigned to one or more of the previous write sessions in each case, reading access-protected data from the determined at least one storage subarea, making the read data accessible by canceling the access protection in the context of a current respective pending reading session, and outputting the data that has been made accessible, and wherein at the beginning of each write session for the storage subarea assigned to the respective write session, a file management structure which is individually adapted and assigned to the storage subarea is defined and used for a later writing of data in the context of the write session, and wherein reading the access-protected data from a respective specific storage subarea comprises:
• checking whether the respective read access relates to a storage address in the specific storage subarea, in which storage address data has already been written in the context of a previous write session relating to the storage subarea,
• when the respective read access relates to a storage address in the specific storage subarea for the respective read access, reading the access-protected data using a mapping of logical storage addresses to physical addresses of the storage subarea, and otherwise, reading the access-protected data using the file management structure individually assigned to the storage subarea.