Hewlett Packard Enterprise Development LP

Alex Veprinsky

Matthew S Gates

Susan Agten

Sriram Narasimhan

Joel E Lilienkamp

Joseph E Algieri

Douglas L Voigt

Gil Barash

Ayman Abouelwafa

Doug Voigt

Xiali He

William Michael McCormack

Robert Michael Lester

Oded Kedem

Systems and methods are provided for lock-free thread scheduling. Threads may be placed in a ring buffer shared by all computer processing units (CPUs), e.g., in a node. A thread assigned to a CPU may be placed in the CPU's local run queue. However, when a CPU's local run queue is cleared, that CPU checks the shared ring buffer to determine if any threads are waiting to run on that CPU, and if so, the CPU pulls a batch of threads related to that ready-to-run thread to execute. If not, an idle CPU randomly selects another CPU to steak threads from, and the idle CPU attempts to dequeue a thread batch associated with the CPU from the shared ring buffer. Polling may be handled through the use of a shared poller array to dynamically distribute polling across multiple CPUs.

Lock-free work-stealing thread scheduler

In some examples, a storage system intercepts a write request communicated over a network from a requester in a host system, the write request to write data of a data volume. The storage system determines whether the data of the write request matches a specified pattern. In response to determining that the data of the write request does not match the specified pattern, the storage system indicates that the write request from the requester in the host system has been corrupted by malware that has performed an unauthorized encryption on the data.

Unauthorized data encryption detection based on pattern matching at a storage system

Example implementations relate to storing data in a storage system. An example includes accessing a first portion of a data stream to be stored in a storage system; selecting sample data blocks included in the first portion; determining entropy values based on the sample data blocks; selecting, based on the sample data blocks, a entropy threshold from multiple precalculated entropy thresholds; determining whether the generated set of entropy values matches the selected entropy threshold within a probability level; and in response to a determination that the generated set of entropy values matches the selected entropy threshold within the probability level, identifying the first portion of the data stream as potentially including encrypted data affected by a ransomware attack.

Detection of ransomware attack using entropy values

In some examples, a computer system computes a rate of operations that involves a first system, and classifies, using a classifier, a request for an operation. The computer system determines a relationship between the computed rate of operations and a dynamic threshold rate determined during a training phase, and based on the determined relationship and a classification of the request by the classifier, selectively activates or disables an operational feature of the first system.

Operational feature activation/disabling

Example implementations relate to storing data in a storage system. An example includes receiving, by a storage controller of a storage system, a data unit to be stored in persistent storage of the storage system. The storage controller determines maximum and minimum entropy values for the received data unit. The storage controller determines, based on at least the minimum entropy value and the maximum entropy value, whether the received data unit is viable for data reduction. In response to a determination that the received data unit is viable for data reduction, The storage controller performs at least one reduction operation on the received data unit.

Data reduction in a storage system

In some examples, a storage system creates a first copy of a data volume, and receives write requests having a specified characteristic from a host system, the write requests to write data of the data volume, where the storage system is to reject the write requests having the specified characteristic and to accept write requests without the specified characteristic. The storage system maintains metadata for the first copy of the data volume, the metadata indicating blocks of the data volume that have changed since the first copy of the data volume was created. The storage system determines, using the metadata, whether an unauthorized data encryption of the data of the data volume has occurred.

Unauthorized data encryption detection

In some examples, a system dynamically adjusts a prefetching load with respect to a prefetch cache based on a measure of past utilizations of the prefetch cache, wherein the prefetching load is to prefetch data from storage into the prefetch cache.

Dynamic prefetching of data from storage

Systems and methods are provided for lock-free thread scheduling. Threads may be placed in a ring buffer shared by all computer processing units (CPUs), e.g., in a node. A thread assigned to a CPU may be placed in the CPU's local run queue. However, when a CPU's local run queue is cleared, that CPU checks the shared ring buffer to determine if any threads are waiting to run on that CPU, and if so, the CPU pulls a batch of threads related to that ready-to-run thread to execute. If not, an idle CPU randomly selects another CPU to steal threads from, and the idle CPU attempts to dequeue a thread batch associated with the CPU from the shared ring buffer. Polling may be handled through the use of a shared poller array to dynamically distribute polling across multiple CPUs.

In some examples, a system includes a Fibre Channel (FC) interface to communicate over an FC network, and a network stack including a network layer and a transport layer. Machine-readable instructions are executable to produce a command packet including a payload including data for transmission to another system, the payload further including headers for the network layer and the transport layer, where the command packet is according to a storage interface protocol. The FC interface is to communicate the command packet over the FC network.

Storage interface command packets over fibre channel with transport and network headers as payloads

An example data storage system includes a first storage array having a first LUN and a second storage array having a second LUN. The first and second storage arrays may implement replication from the first LUN as a primary LUN to the second LUN as a secondary LUN. The first and second LUNs may both be an active target for host write I/O. The second storage array may, in response to receiving from a host a write that is directed to the second LUN, send write data of the write to the first storage for replication array while maintaining a copy of the write data in a fenced portion of a cache of the second storage array. The second storage array may wait to release the copy of the write data to the second LUN until a write acknowledgment is received from the first storage array.

Growing community of inventors

Fremont, CA, United States of America

Alex Veprinsky