Emc IP Holding Company LLC

Emc Corporation

Dell Products Inc.

Brett A Quinn

Douglas Eric LeCrone

Gary H Cox

Paul A Linstead

Mark J Halstead

Benjamin W Yoder

Denis J Burt

Peter Callewaert

Marik Marshak

Eugene D Pflueger

Ronald G Haupert

Mike Specht

David Meiri

Melissa Flynn

Evan Jones

David Goncalves

Dennis Trulli, Jr

Doug Lecrone

Evan G Jones

Dennis Trulli

Dan Aharoni

John P Darling

John Darling

Douglas LeCrone

Michael John Egan

Kevin Heasley

A secure physical vault is used in connection with cyber protection automation to ensure that initial configuration and all configuration changes to the cyber protection environment are only implemented by a host that is locally physically connected to the cyber vault. By requiring the host to be locally physically connected to the cyber vault, it is possible to prevent remote modifications to the cyber protection environment configuration, thus preventing a remote attack on the cyber protection afforded by the cyber protection environment. The Operating System of a storage system implementing the cyber vault may be flagged to prevent any syscall from being processed that is not received from a host that is locally physically connected to the cyber vault. Host controller software can also be used to ensure that the initial configuration and all configuration changes to the cyber protection environment configuration are only processed if locally received.

Cyber protection automation with secure physical vault

One or more aspects of the present disclosure relate to protecting the integrity of datasets stored by a storage array. In embodiments, one or more IO write requests from an input/output (IO) workload are intercepted. Additionally, a likely cyber-attack event is identified based on a bit density of write data corresponding to the one or more IO requests. Further, the cyber-attack event is mitigated.

Encryption detection

Recovery of a primary image is facilitated by using non-consistent snapshots on a primary storage array and consistent snapshots on a secondary storage array to avoid the need to transmit entire secondary replicas from the secondary storage array to the primary storage array. Non-consistent snaps of the primary replicas are generated by the primary storage array. Consistent snaps of the secondary replicas are generated by the secondary storage array. The primary replicas are recovered by linking non-consistent snaps to primary staging volumes, linking consistent snaps to secondary staging volumes, synchronizing the primary and secondary staging volumes, and using the synchronized primary staging volumes to recover the primary replicas.

Optimizing data resynchronization in cyber recovery solutions

Recovery of a primary image is facilitated by using consistent snapshots on a primary storage array and consistent snapshots on a secondary storage array to avoid the need to transmit entire secondary replicas of storage objects from the secondary storage array to the primary storage array. Consistent snaps of the primary replicas are generated by the primary storage array. Consistent snaps of the secondary replicas are generated by the secondary storage array. The primary image is recovered by linking consistent snaps on the primary storage array to primary staging volumes, linking consistent snaps on the secondary storage array to secondary staging volumes, synchronizing the primary and secondary staging volumes, and migrating host IO traffic to the synchronized staging volumes.

Eliminating data resynchronization in cyber recovery solutions

Storage volumes of a remote data forwarding group are mirrored on a leg of a data replication facility from a production site in a primary region of the data replication facility to a cyber vault using asynchronous remote data forwarding. A multi-site consistency application is used to bring and maintain the data of the storage volumes on the cyber vault into a consistent state. Once the storage volumes in the cyber vault have achieved a consistent state, a snapset including a snapshot of each of the storage volumes is created from the storage volumes contained in the cyber vault on a determined rhythm. The snapset is optionally linked to a set of target devices at the cyber vault. If the production site is not in the primary region, the absence of consistency of the data at the cyber vault halts creation of snapsets at the cyber vault.

Space-saving cyber protection automation

Real Time Intrusion Detection (RTID) is implemented on a host computer by defining an Atypical Access Rate Detection (AARD) policy specifying storage volume access parameters configured to protect particular storage volumes maintained by a storage system for the host computer. An AARD application on the storage system monitors storage volume accesses based on the AARD policy. If a storage volume access is detected that is in violation of the AARD policy, the RTID application on the host computer is notified of the storage volume access. The RTID application on the host determines if the storage volume access was authorized or malicious. If the storage volume access was authorized, the RTID application re-issues the storage volume access and instructs the AARD application that the storage volume access is authorized. If the storage volume access was not authorized, the RTID application prevents the storage volume access to protect the storage volume.

Real time intrusion detection

RDF/QAR bandwidth reduction is a GDDR feature that allows for separate synchronous-only RDF groups from sites DC1→DC2 to be included in the QAR consistency group definition without RDF/A protection. The devices in these sync-only RDF groups form perfect quadruplets like regular QAR devices, but the RDF groups from sites DC1→DC3 and DC2→DC4 are not included in QAR-A and QAR-B Multi Session Consistency group definitions. Instead, these sync-only pairing RDF groups are replicated to the secondary region using ADCOPY-DISK mode or not replicating at all (suspended). The sync-only devices have no QAR recovery capability from sites DC3→DC4, but device pairing from DC3→DC4 is present via sync-only RDF groups.

GDDR RDF/QAR bandwidth reduction

A method, comprising: retrieving a VDG definition; processing the VDG definition to identify a primary storage system and one or more secondary storage systems; detecting a consistency formation event; transmitting a first instruction to initialize one or more data structures for a first snapshot of a volume that is stored in the primary storage system; transmitting, to each of the secondary storage systems, a respective second instruction to initialize one or more data structures for a respective snapshot of a copy of the volume that is stored in that secondary storage system; suspending servicing of input-output (I/O) by the primary storage system; transmitting to the primary storage system a third instruction to complete the first snapshot of the volume; transmitting to each of the secondary storage systems a respective fourth instruction to complete a respective snapshot of the copy of the volume; and resuming servicing of I/O.

Method and apparatus for snapshot creation

Backing up logical data from a storage system to a backup system includes accessing data on the storage system corresponding to logical file structures of data stored on the storage system, using machine learning to ascertain file access patterns and frequency of file backups, determining backup data based on the logical file structure of data stored on the storage system and the file access patterns and frequency of file backups, and directly transferring data corresponding the backup data from the storage system to the backup system. The logical file structures may be provided by file metadata. The file metadata may include at least one of: a VTOC (volume table of contents), an IXVTOC (indexed VTOC), VSAM (virtual storage access method) information, a VVDS (VSAM volume data set), file attributes, and/or catalog data. The file attributes may include management class information for each of the files.

Logical backup using a storage system

Transforming data that is provided by a first instance of an application that uses application-instance specific data includes determining if a component of the data is an application-instance specific component and, if the component is an application-instance specific component, transforming the component either at a storage system containing the data or as the component is being accessed by a second instance of the application, different from the first instance. Transforming the component at a storage system containing the data may be performed independently of any accesses of the data. Transforming the component at a storage system containing the data may be performed by the storage system. The first instance of the application may run on a first host and the second instance of the application may run on a second host different from the first host. The first and second instances of the application may run on a same host.

Transforming application-instance specific data

Copying data from a source storage system to a target storage system includes resetting a write tracker on the source storage system to track writes to the source storage system by one or more host computing systems, copying data from the source storage system to the target storage system after resetting the write tracker, suspending writes to the source storage system after copying the data, and copying data portions of the source storage system to the target storage system that are indicated as being written by the write tracker after suspending writes to the source storage system. Applications that write data to the source storage system may be quiesced in connection with suspending writes to the source storage system. Data portions may be repeatedly copied from the source storage system to the target storage system until an end condition is reached.

Copying data between storage systems

Creating point-in-time versions of files for applications at a storage system includes maintaining at the storage system a data structure correlating each of a plurality of applications with files for each of the applications and correlating each of the files with portions of the data storage system, using the data structure to determine specific files for a particular one of the applications for which a point-in-time version is being created, using the data structure to determine specific portions of the storage system corresponding to the specific files, suspending writes to the specific portions, completing previous writes to the specific portions following suspending writes, and performing a snapshot of the specific files following completing previous writes. The portions of the data storage may be extents. A host may provide information to the storage system to correlate applications with files and to correlate files with portions of the data storage system.

File level incremental continuous data protection

Obtaining a consistent set of snapshots of a group of storage volumes includes obtaining a plurality of snapshots, each of the snapshots being for one of the volumes, determining if there are any specific write operations to at least one volume that occurred after obtaining a first one of the snapshots and before obtaining a last of the snapshots, if there are any specific write operations, discarding the plurality of snapshots, and, if there are no specific write operations, designating the plurality of snapshots as the consistent set of snapshots. Obtaining a consistent set of snapshots may include repeatedly obtaining a plurality of snapshots and determining if there are specific write operations until either a particular condition is met or there are no specific write operations determined. The particular condition may be exceeding a predetermined number of iterations or a predetermined time limit.

Snapshots with selective suspending of writes

Embodiments of the present disclosure include receiving one or more input/output (IO) requests at a storage array from a host device. Furthermore, the IO requests can include at least one data replication and recovery operation. In addition, the host device's connectivity access to a recovery storage array can be determined. Data replication and recovery operations can be performed based on the host device's connectivity to the recovery storage array.

Cyber-related data recovery

Providing TCP/IP control commands to a storage system includes intercepting TCP/IP data provided on a TCP/IP network, determining if the TCP/IP data corresponds to a control command directed to the storage system, and converting the TCP/IP data to a Fibre Channel control command that is forwarded to the storage system if the TCP/IP data is a control command directed to the storage system. A host may intercept the TCP/IP data. The host may be coupled to the storage system. The storage system may have only Fibre Channel connectivity. A PC having only TCP/IP connectivity may provide the control commands via the TCP/IP network. At least two hosts may be coupled to the TCP/IP network. Software on one of the hosts may provide the control commands for the storage system. The storage system may be coupled to an other one of the hosts.

Growing community of inventors

Lincoln, RI, United States of America

Brett A Quinn