Abstract:
Method and apparatus applicable to a variety of data storage, data communication, and parallel computing applications, efficiently improving information availability and load balancing. Information to be transmitted in a data signal or stored is represented as N elements of a field or computational structure, and dispersed among a set of n pieces that are to be transmitted or stored in a manner yielding no fewer than m pieces used in subsequent reconstruction. 
     For dispersal, n vectors a i  each having m elements are used and the n pieces are assembled from elements obtained as products of these vectors with m element groups taken from the N elements representing the information. For reconstruction from m available pieces, m m-element vectors α i  are derived from the vectors a i , and the N elements representing the information are obtained as products of these vectors with m-element groups taken from the pieces. 
     The vector products may be implemented using an appropriate processor, including a vector processor, systolic array, or parallel processor. 
     For fault-tolerant storage in a partitioned or distributed system, information is dispersed into n pieces so that any m suffice for reconstruction, and the pieces are stored in different parts of the medium. 
     For fault-tolerant and congestion-free transmission of packets in a network or a parallel computer, each packet is dispersed into n pieces so that any m pieces suffice for reconstruction and the pieces are routed to the packet&#39;s destination along independent paths or at different times.

Description:
This is a continuation of application(s) Ser. No. 07/160,356 filed on Feb. 25, 1988, now abandoned. 
    
    
     BACKGROUND OF THE INVENTION 
     This invention relates to dispersal and reconstruction of information during communication or storage and retrieval, in order to achieve fault tolerance and load balancing. 
     When information is communicated or stored, it may be lost if the communication link or storage medium fails. One straightforward, but inefficient, way to reduce the chance of loss is simply to transmit duplicate copies of the information over different communication links or to store duplicate copies in different storage locations. By providing enough duplicate copies, the likelihood that all copies will be lost can be made as small as desired. But this fault tolerance is achieved only at great cost in transmission or storage resources. 
     Asmuth, et al., &#34;Pooling, splitting, and restituting information to overcome total failure of some channels of communication,&#34; Proc. of the 1982 Symp. on Security and Privacy, IEEE Soc. (1982), pp. 156-169, propose an algorithm for splitting and restituting information that applies to specific small cases of the problem, and is based on number theoretic computations, namely the Chinese remaindering method. 
     Conventional error correction codes add extra bits to a binary message to create a block such that any k errors (bit reversals or lost bits) that occur in the block during transmission or storage can be corrected. 
     SUMMARY OF THE INVENTION 
     In one aspect, the invention features an efficient and fault tolerant method for dispersing N characters of information, intended to be transmitted in a data signal or stored as a data file, among a set of n pieces that are to be transmitted or stored in a manner that is expected to yield no fewer than m pieces for use in subsequent reconstruction of the information; in the invention, the N characters are grouped into N/m groups, each containing m characters, the characters being elements of an appropriate field or computational structure; a set of vectors a i  is selected, each having m coordinates, there being as high as desired a probability (up to complete certainty) that any given subset of m of the vectors are linearly independent; a set of elements c i ,r is generated for assembly into the n pieces, each element being calculated as the product of the vector a i  times the characters of the r-th group of characters; and the n pieces are generated such that the i-th piece is an assemblage of the elements c i ,r, r=1, . . . , N/m. 
     If expressed in bits, the size of each element comprising the pieces is nearly the same as (and can in fact be made exactly the same as) the size of each of the original characters. Thus the total size in bits of each of the pieces is nearly (or if desired exactly) equal to 1/m of the size in bits of the original information, and the original information may be reconstructed from a set of bits that numbers no greater than the number of original information bits. 
     In another aspect, the invention features a method for reconstructing information from an available set of m pieces that were generated by dispersing the information in accordance with the method described above; an m×m matrix is formed whose rows are the m vectors a i  that were used to form the elements c i ,r of the available m pieces; the m×m matrix is inverted; the N characters of the information are generated by multiplying the inverted matrix times groups of the elements c i ,r ; and the N characters are reassembled to form the original information. 
     In another aspect, the invention features a method for storing and retrieving information in a storage medium of the kind having portions prone to faults and in which a fault of any portion does not necessarily also entail a fault in any other portion; the method includes dispersing the information into n pieces in accordance with the method described above; storing the n pieces in the portions of the storage medium, at least some pieces being stored in different portions; retrieving at least m pieces from the storage medium; and reconstructing the information from the m pieces in accordance with the method described above. 
     In another aspect, the invention features a method for communicating information over communication links prone to faults and in which a fault of any link does not necessarily also entail a fault in any other link; the method uses the dispersal and reconstruction techiques described above; the n pieces are transmitted over the links, at least some pieces being transmitted on different links, and at least m pieces are received at a destination from the links, for use in the reconstruction. 
     In another aspect, the invention features a method for distributing information in a distributed processing system of the kind having nodes with associated storage devices, the nodes being interconnected in a network, and in which the storage devices are prone to faults and in which a fault of any storage device does not necessarily also entail a fault in any other storage device; the information is dispersed into n pieces in accordance with the method described above, the pieces are distributed to the storage devices at different nodes via the network, at least m peices are retrieved from the storage devices via the network, and the information is reconstructed from the m pieces in accordance with the method described above. 
     Another aspect of the invention features a method for communicating information packets among the nodes of a parallel processing computer, each node having an associated processor, memory, information dispersal/reconstruction unit, and a buffer, the nodes being linked by an interconnecting network, whereby each node can communicate with any other node via paths at least some of which pass through intermediate nodes, the paths being subject to failure, each node&#39;s buffer having a finite capacity, each information packet to be sent from a source node to a destination node; in this aspect of the invention, the information packet is dispersed into n pieces in accordance with the method described above, the pieces are sent via different paths of the network toward the destination node, at least m pieces are received from the network at the destination node, and the information packet is reconstructed from the m pieces in accordance with the method described above. 
     Preferred embodiments of the invention include the following features. The information is a file comprising a string of N characters, all characters bieng equal-sized bytes and the groups comprise segments of the string, each segment consisting of a sequence of successive characters. Each byte is considered as an element of a finite field whose size is at least as large as (preferably no larger than) the size of the alphabet of possible characters (for example, the field Z p  of residues (mod p) where p is a prime number greater than the highest-valued possible byte, or, for q-bit long bytes, the field GF(2 q ) or any other finite field E). Fingerprints are generated based on the pieces in a manner to be detailed later on, the fingerprints are communicated or stored and later tested for authenticity as the basis for deciding whether to accept any of the pieces for the process of recontructing the field. 
     The invention also features apparatus for performing the methods described above. In the apparatus, the vector products may be performed by a calculator having a cache memory connected to an associated processor in the form of either an arithmetic unit, a vector processor, a systolic array processor, or a set of any of them in parallel. Because n/m can be chosen to be close to 1, the total number of elements (n/m).N in the dispersed pieces need not be much larger than the number of bytes in the original file F, and the number of elements in the m pieces required for reconstruction need not be any greater than the number of bytes in the original file; thus, the scheme is space efficient. Fingerprinting is useful in thwarting a saboteur from substituting a bogus piece for a good one. The dispersal and reconstruction procedures are computationally efficient, realizable on a variety of devices including general purpose or customized processors, pipelined and systolic arrays, and parallel or vectorized devices, and applicable in many contexts, including secure and reliable storage on disks and in distributed systems, fault-tolerant and efficient transmission of information in networks, and communications between processors in parallel computers. 
    
    
     Other advantages and features will become apparent from the following description of the preferred embodiment and from the claims. 
     DESCRIPTION OF THE PREFERRED EMBODIMENT 
     We first briefly describe the drawings. 
     FIG. 1 is a diagram of the composition of an information file F to be communicated or stored. 
     FIG. 2 is a flow chart of a dispersal procedure. 
     FIG. 3 is a diagram of n vectors a 1 , . . . , a n . 
     FIG. 4 is a diagram of the segmentation of file F. 
     FIG. 5 is a flow chart of a reconstruction procedure. 
     FIG. 6 is a diagram of a matrix A, where the pieces available for reconstruction are the first m pieces, T 1 , . . . , T m . 
     FIG. 7 is a diagram of the computation of the first elements for each of the n pieces to be communicated or stored. 
     FIG. 8 is a diagram of the inverse matrix A -1 . 
     FIG. 9 is a diagram of the computation of the first m characters of F during reconstruction. 
     FIG. 10 is an illustration of dispersal and reconstruction. 
     FIG. 11 is an expression related to generating vectors a i  used for dispersal. 
     FIG. 12 is a block diagram of dispersal and reconstruction apparatus. 
     FIGS. 13, 14 are flow charts of procedures for generating a fingerprint during dispersal and testing the authenticity of the fingerprint during reconstruction. 
     FIGS. 15, 16, 17, 18 are block diagrams of applications of the invention. 
     FIGS. 19, 20, 21 are block diagrams of hardware implementations. 
    
    
     STRUCTURE AND OPERATION 
     Referring to FIG. 1, a string 10 of N bytes 12 makes up a file F to be transmitted or stored. Each byte 12, denoted b j , j=1, . . . , N, is, for example, an eight-bit byte representing an integer in the range from 0 to 255. Byte b 1  is shown as representing 108 base  10. Thus, for some prime number p larger than B (where B is the upper end of the range of integers represented by the eight-bit bytes, i.e., 255), the file F is a string of characters b j  each of which is a residue, mod p, i.e., an element in the finite field Z p  =residues mod p. For example, if p=257, then a byte b=11001011=203 base  10 is represented as a residue of b (mod p), namely 203 (mod 257). It is possible to use any finite field that contains at least as many elements as the number of possible characters in the alphabet of characters from which F is assembled. The field Z p , referred to above, has 257 elements and thus requires 9 bits to represent all possible elements, i.e., one more bit than the 8-bit length of b j . Alternatively, for q-bit bytes, one could use a field E=GF (2 q ), e.g., for 8-bit bytes we could use the field E=GF (2 8 ) of characteristic 2 having 256 elements. We only need an irreducible polynomial p(X), an element of Z 2  [X] of degree 8, to effectively compute in the field E, as explained in Rabin, &#34;Probabilistic algorithms in finite fields&#34;, SIAM J. on Computing, 1980, pp. 273-280, incorporated herein by reference. 
     We are going to derive from the information comprising F a number of pieces to be stored or communicated. We expect no more than some number (denoted by k) of the pieces to be lost in storage or communication. Our goal is to be able to reconstruct F from the pieces that remain (numbering at least m). Then n=m+k will be the number of original pieces. Given k, we choose m such that n/m is no greater than 1+  for some acceptable value of  . That is, n is greater than m by an amount that makes n/m greater than 1 by at most  . For example, n, m, and k could be 6, 4, and 2, respectively. In this case, any two pieces may be lost while still allowing the file to be reconstructed from the four remaining pieces; then   would be 1/2, i.e., the information overhead for this degree of fault tolerance is just 50%. If n, m, and k were instead 6, 5, and 1, then e would be 1/5, an information overhead of just 20%. Thus   is a measure of how many lost pieces can be tolerated as a proportion of the number of surviving pieces, without jeopardizing the ability to reconstruct F. 
     Referring to FIG. 2, to generate the n pieces to be communicated or stored, given the original file F, first choose (20) n vectors a i  (see FIG. 3), each consisting of m coordinates a i ,1, . . . , a i ,m that are all elements of the finite field being used. The m coordinates for each vector a i  are chosen (in a manner described below) so that any subset of m of the vectors a i  are linearly independent (or, at least, so that with high probability a randomly chosen subset of m of the vectors a i  are linearly independent). 
     Next, split (22) the characters of F into N/m equal length segments s q , each m characters long (see FIG. 4). For example if N=10,000, and (as above) m=4, then there are 2500 segments s q  each 4 characters long. 
     Then the n pieces to be communicated or stored, called T i , are assembled as strings of newly constructed elements, c i ,r, i=1, . . . , n, r=1, . . . , N/m, i.e., 
     T i  =c i ,1, . . . , c i ,N/m, i=1, . . . , n. Each element c i ,r is calculated (24) as the vector product, in the finite field, of vector a i  and segment s r  : 
     
         c.sub.i,r =a.sub.i.s.sub.r =a.sub.i,1.b.sub.(r-1)m+1 +. . . +a.sub.i,m b.sub.rm. 
    
     The elements are then assembled (26) into the n pieces T i . The pieces may then be fingerprinted for later authentication, as discussed below. Finally the n pieces T i  (and the fingerprints, if any) are communicated or stored (28) on separate communication links or storage locations (separate in the sense that a loss of one or more of the pieces will not necessarily imply a loss of any other piece). 
     Suppose that, following communication or storage, only m of the n pieces T i  are available for reconstruction of F. (We assume that the elements c were subjected to conventional error correction coding and decoding so that there are no bit errors in the m pieces available for reconstruction.) Our goal is to derive all of the original characters (bytes) of F, i.e., the b j , j=1, . . . , N, from the elements c i ,r. 
     Referring to FIG. 5, we first form (50) a square m×m matrix A (see FIG. 6) having as its rows m of the originally chosen vectors a i , such that the vectors a v , v=1, . . . , m, in matrix A are those m of the original n vectors a i  that were used to generate the elements c of the m pieces T i  now available for reconstruction of F. For simplicity, we assume (without loss of generality) that matrix A contains the first m vectors a i . FIG. 7 shows that it was the matrix A multiplied by the first segment s 1  of F that generated the original first elements c 1 ,1, . . . , c m ,1, of the available m pieces T i . Thus A times s r , r=1, . . . , m generated all of the original elements of all m available pieces T i . 
     Next, invert (52) matrix A once and for all to form the inverted matrix A -1  (see FIG. 8) where the v-th row of A -1  is d v ,1, . . . , d v ,m. Now, from FIG. 7, it is clear that the original segments s r , r=1, . . . , n, of F can each be calculated (54) by multiplying A -1  times the vector assembled from the r-th elements of all of the m available pieces (see FIG. 9). If we express j as j=mr+v, where r and v are integers, v=1, . . . , m, r=0, . . . , N/m, then each b j , j=1, . . . , N, is calculated as row v of the inverse matrix A -1  times the vector (column) consisting of the r-th elements of all of the m available pieces T i . 
     Finally, we reassemble (56) the characters b j  into F. 
     Referring to FIG. 10, in a simple example, if F is N=8 bytes long, if there are four pieces T i  to be transmitted or stored (n=4), and if two of them will be available for reconstruction (m=2, and k=2), then F is split into N/m=4 segments (s 1 , . . . , s 4 ). There are four vectors a i  each two coordinates long, and four pieces T i  each with four elements c. All operations for calculating the T i  s are performed in the finite field. Now suppose that T 2  and T 4  are lost and T 1  and T 3  are available for reconstruction. Then the matrix A is a 2×2 matrix, the inverse matrix A -  is a 2×2 matrix, with elements d, and the bs are reconstructed from the ds and cs as described above. 
     In order to satisfy the requirement that the vectors a i  be linearly independent, we may choose the a i , i=1, . . . , n, as in FIG. 11, where x 1 , . . . , x n  and Y 1 , . . . , y m  are all elements of the finite field, which satisfy the condition that x i  +y j  ≠0 for all i and j, and for i≠j, x i  ≠x j  and y i  ≠y j , that is, all of the xs are different, all of the ys are different, and no sum of an x and a y is 0. 
     If A is a matrix with rows consisting of any m of the vectors a 1 , . . . , a n , then it can be shown that its rows a i  are linearly independent. 
     The inverse matrix A -1  need be calculated only once and can be calculated in a number of operations that is proportional to m 2 . 
     The dispersal and reconstruction techniques could be implemented, for example, by appropriately programmed general purpose processors or, referring to FIG. 12, by dedicated hardware elements. 
     In FIG. 12, a segmenter 100 receives the sequence of character b j  that comprise the file F 102, and organizes them in segments s r  which are written temporarily into a segment store 104. A multiplier 106 multiplies the characters of the various segments by the appropriate vectors a i  that were temporarily written into a vector store 108 by a vector generator 110 (or were otherwise made available in the vector store 108). The resulting elements c i ,r are stored temporarily in an element store 110. A piece assembler 112 assembles the c i ,r for each piece T i  (including for each piece a header comprising either the vector a i  used to generate the piece, or merely the index i of the vector in case the vectors are known to the device that is to perform the reconstruction). Each piece T i  may also be fingerprinted in a fingerprinter 119 which delivers an encrypted fingerprint E(R i ) to coder and transmitter 116 for transmission or storage with T i . The pieces T i  (and fingerprints, if any) then are sent in n independent ways to a channel or storage medium 114 by error correction coder and transmitter 116. 
     For reconstruction, at least m of the n error correction coded pieces T i  (including headers and fingerprints, if any) enter a receiver and error correction decoder 117 which delivers each decoded T i  (including its header) to a piece disassembler 118 and delivers each piece and fingerprint to an authenticator 121. 
     Authenticator 121 tests the fingerprints for authenticity (in a manner described below). If the i-th test is passed, the piece disassembler 118 splits that piece into the vector a i  (which is sent to a temporary vector store 120) and the individual elements c i ,r (which are sent to a temporary element store 122). A multiplier 124 multiplies the vectors each consisting of the elements c i ,r of the available pieces by the inverted matrix A -1 , which is generated from the stored a i  vectors by a matrix inverter 126. The resulting characters b j  are assembled in an assembler 128 to regenerate file F 102. 
     Referring to FIG. 13, to minimize the security risk that a bogus string of characters deliberately substituted for one of the pieces T i  will not be discovered, a fingerprint may be calculated for each piece T i  during dispersal as follows. Choose (130) any irreducible polynomial f(x), an element of the field of polynomials whose coefficients are in the finite field. Then expressing a piece T i  (including its header) as a polynomial, T i  (x), compute (132) R i , the residue of T i  (x) (mod f(x)). Next encrypt (134) R i  using an encryption function E and store or transmit (136) the n pairs (E(R i ), T i ), as well as the encryption function E. E(R i ) is the fingerprint. 
     Referring to FIG. 14 in the reconstruction process, for each received (138) pair H i  (the fingerprint) and G i  (the corresponding piece), decrypt (140) H i , and test (142) it against the residue of G i  (mod f(x)). Only if they are equal is G i  accepted as one of the pieces T i . The technique is discussed in Rabin, &#34;Fingerprinting by Random Polynomials&#34; TR-15-81, Center for Research in Computing Technology, Harvard University, (1981), incorporated herein by reference. It is also proven there that an adversary, if ignorant of f(x), has an exponentially small probability of generating a proper pair H i , G i , which will pass the authentication test. 
     The dispersal and reconstruction technique has a variety of applications. 
     For example, referring to FIG. 15, file F may be generated by a data source 150. A disperser 152 (e.g., as shown in the upper half of FIG. 12) would generate n pieces from F and deliver them for storage on n different portions of a storage disk 154. Assume that, despite faults on the disk (or head crashes), at least m of the pieces may be successfully retrieved. Then a reconstructer 156 (e.g., as shown in the lower half of FIG. 12) can reconstruct F from the m pieces for delivery to a data user 158. 
     Referring to FIG. 16, in another application, a distributed processing system 170 includes a network of nodes 172 each serving a data terminal equipment (DTE) 174 via a disperser/reconstructor (D/R) 176, and each IDTE has an associated disk storage 178. If a user of DTE 174 wishes to store a file efficiently while assuring that it may later be reconstructed, he could cause the file to be dispersed into n pieces. The n pieces would be delivered to n different nodes for storage in their associated disk storage units. Then despite failure of any k of those disk storage units, m of the pieces will survive and be sufficient to reconstruct F. This advantage is achieved with a relatively small information overhead, e.g., 25%. Furthermore, the use of this fault tolerant storage approach by all of the node users will conveniently and automatically balance the information load at the various disk units, because the stored pieces are distributed relatively evenly among the nodes. 
     Referring to FIG. 17, in another application, the data source 150 and disperser 152 may be associated with a node 160 of a multiple-node communication network 162. Reconstructer 156 and data user 158 are associated with a distant node 164. The n pieces generated by disperser 152 are sent via n different paths (five paths a, b, c, d, e are labeled). If at least m pieces reach node 164, then, despite failures of some communication links, the file F may be fully recovered. This application entails the additional benefit of distributing and balancing the transmission load over all links of the network. Network 162 could be a satellite network. 
     Referring to FIG. 18, in another application, a parallel processing computer 180 has K nodes 182 each having an associated processor 184, a memory 186, an information dispersal/reconstruction unit 188, and a buffer 190. Each node is connected to n or more other nodes by direct links, the totality of all these links constituting the intra-computer communications network. In a transmission round, every node holds in its memory certain information comprising a packet and needs to send this packet to some destination node (determined by the source node). All packets are to be transmitted concurrently from sources to destinations along paths, each path comprised of a sequence of direct links 192 and typically passing through intermediate nodes. The buffer provided at each node serves to temporarily store all pieces of information passing through that node in transit from sources to destinations. The size of that buffer, measured in bytes, is typically a fixed multiple of the packet size. FIG. 18 illustrates a particular embodiment of such a parallel computer having K=2 n  (for n=3) nodes which is organized as the n-dimensional binary cube, where every node is directly linked to its n neighbors in the n-cube. 
     In general, to send a packet, a disperser/reconstructer 185 disperses the packet into n pieces and appends to each piece a ticket that specifies the succession of nodes through which that piece must pass on its way to the destination. The computer operates in cycles such that in each cycle each piece of packets that are in transit traverses one more link on its route to its destination, and is stored in the buffer of the node that it reaches at the end of that cycle. Thus a piece may be lost if either a link along its route fails or a buffer of a node along its route is full when the piece arrives. It can be shown that, by using the dispersal and reconstruction procedures described above, the computer system will exhibit fast transmission time, with small fixed buffer size, high probability that packets will reach their destinations, high fault tolerance in the face of link failures, excellent load balancing among the nodes, and relatively low information overhead. 
     Referring to FIG. 19 the vector multiplication portions of the dispersal and reconstruction procedures could be performed rapidly by a high-speed arithmetic unit 202 attached to a high-speed cache memory 200. In disperal, the vectors a i , i=1, . . . , n would be brought into cache. Groups of characters s 1 , s 2 , . . . would also be brought into cache in blocks as large as permitted by the cache size. Then, in computing the products a 1  . s 1 , a 1  . s 2 , . . . all required data is directly available to arithmetic unit 202 for fast processing. Similarly, for reconstruction, the rows of the inverse matrix A -1  would be placed in cache together with as many columns of elements c i ,r as cache size permits, for fast reconstruction of the characters b j . Alternatively, arithmetic unit 202 may be a vector processor capable of performing the vector products directly on vectors drawn from the cache. In another arrangement, referring to FIG. 20, a number of processing units 208, 210,212 may be connected in parallel to cache 200 with each processing unit assigned to perform one of the products, e.g., a 1  . s 1 . In that case, cache 200 can be a multi-component unit with each unit dedicated to serving one of the processing units. Referring to FIG. 21, cache 200 alternatively could be connected to a systolic array 220 for performing the multiplications. Each processing unit of FIG. 20 could be a vector processor or a systolic array. 
     Other embodiments are within the following claims. 
     For example, another technique for assuring that any m of the vectors a i  are linearly independent is to choose n elements e 1 , . . . , e n  of the finite field and define a 1  =(1, e i , . . . , e i   m-1 ) for i=1, . . . , n. Or if we want every a i  to depend on more than one element e i , we simply choose a i  =(a i ,1, . . . , a i ,m) randomly by randomly and independently selecting a i ,j from the field. It can be shown that, if the field has q elements, than A is non-singular with a probability nearly 1-1/q. By choosing q large enough, the probability can be made to be as close to 1 as possible. 
     Other authentication approaches could be used as well. 
     Other hardware implementations are also possible.