Venti

Venti is a network storage system that permanently stores data blocks. A 160-bit SHA-1 hash of the data (called "score" by Venti) acts as the address of the data. This enforces a write-once policy since no other data block can be found with the same address. The addresses of multiple writes of the same data are identical, so duplicate data is easily identified and the data block is stored only once. Data blocks cannot be removed, making it ideal for permanent or backup storage. Venti is typically used with Fossil to provide a file system with permanent snapshots.

History

Venti was designed and implemented by Sean Quinlan and Sean Dorward at Bell Labs. It appeared in the Plan 9 distribution in 2002. Development has been continued by Russ Cox who has reimplemented most of the server, written a library for creating datastructures (files, directories and meta-data) to store in Venti and implemented optimizations. Venti is available both in the Plan 9 distribution and for Linux and FreeBSD as part of Plan 9 from User Space.

Details

Venti is a user space daemon. Clients connect to Venti over TCP and communicate using a simple RPC-protocol. The most important messages of the protocol are listed below. Note that there is no message to delete an address or modify data at a given address.
* "read(score, type)", returns the data identified by "score" and "type"
* "write(data, type)", stores "data" at the address calculated by SHA-1 hashing "data", combined with "type".

The data block stored by Venti must be greater than 512 bytes in length and smaller than 56 kilobytes. So, if a Venti user/client wants to store larger data blocks, it has to make a datastructure (which can be stored in Venti). For example, Fossil uses hash trees to store large files. Venti itself is not concerned with the contents of a data block; it does however store the "type" of a data block.

The design of Venti has some interesting consequences:
* Since writes are permanent, the file system is append-only (which allows for a simple implementation with lower chance of data-destroying bugs); no file system fragmentation occurs.
* Clients can verify the correctness of the server: the score of the returned data should be the same as the address requested. Since SHA-1 is a cryptographically secure hash, it is computationally infeasible to fabricate data.
* Data cannot be overwritten. If an "address" is already present, the "data" is already present.
* There is little need for user authentication: Data cannot be deleted, and can be read only if the score is known. The only potential problem is a user filling up the disks.
* Data can be compressed without making the disk structure complicated.

The data blocks are stored on hard drives. The disks making up the available storage, typically a RAID 5 configuration, is called the "data log". This data log is split up in smaller pieces called "arenas", which are sized so they can be written to other media such as CD/DVD or magnetic tape. Another set of hard drives is used for the index, which maps scores to addresses in the data log. The data structure used for the index is a hash table with fixed-sized buckets. Venti relies on the scores to be randomly distributed so buckets do not fill up. Since each lookup costs one disk seek time, an index usually consists of multiple small SCSI hard drives with low access time.

Hash collisions

A basic principle of information theory is the pigeonhole principle, which states that if set A contains more values than set B, then for any function that maps A to B there will be members of B that are associated with more than one member of set A. In the case of Venti, the set of possible SHA-1 hashes is obviously smaller than the set of all possible blocks that could be stored in the filesystem, and thus a hash collision is, in principle, possible. Venti does not address the issue of hash collisions, however, it is argued that the design is sound, because the hashes is of sufficient length that the risk of an accidental hash collision is infinitesimal, even for exabytes of data, and malicious hash collisions are computationally infeasible to produce. [http://plan9.bell-labs.com/sys/doc/venti/venti.html]

See also

* Fossil - snapshot file system that uses Venti for permanent storage
* Plan 9 from User Space

External links

* [http://plan9.bell-labs.com/sys/doc/venti.html Venti: a new approach to archival storage] , paper describing Venti
* [http://swtch.com/plan9port/man/man7/venti.html New Venti manual page (overview)] , section 1 and 8 venti manual pages also exist
* [http://www.cs.bell-labs.com/magic/man2html/8/venti Old Venti manual page] , currently in use on Plan 9.
* [http://www.cs.bell-labs.com/magic/man2html/8/ventiaux Old Venti utilities manual page] , currently in use on Plan 9.