International Business Machines Corporation

Schott Ag

Christian Mueller

Dominic Mueller-Wicke

Nils Haustein

Stefan Bender

Fabian Kuhl

Mauro Cruciani

Sabine U Steinhauer

Thomas Schreiber

Eirini Petraki

Michael Loehr

Erik Rueger

Frank Krick

Bernd Freitag

Aravind Hippargi

Wayne A Sawdon

Friedrich Siebers

Frank-Thomas Lentes

Evelin Weiss

Wayne Curtis Hineman

Jens-Peter Akelbein

Karin Naumann

Ulrich Schiffner

Douglas Stephen Noddings

Klaus Schoenberger

Kai Boerner

Frank Mueller

Dietmar Fischer

Jens Fauth

Carsten Brixius

Markus Zellner

A method, computer program product, and system for detecting and mitigating ransomware using snapshot-based backups applied to a block-oriented storage device, by performing the following operations: (i) performing, in predetermined time-intervals, snapshot backups of data in a block-oriented storage device; (ii) determining at least one interval malware index value between a last snapshot backup and a next planned snapshot backup, wherein the interval malware index value is indicative of a changed block rate in stored data of storage blocks of the block-oriented storage device; and (iii) in response to determining that the interval malware index value is larger than a predefined interval malware index threshold value, triggering an emergency snapshot.

Automatic ransomware detection and mitigation

Operating a data processing and storage apparatus to perform continuous backup monitoring for a collection of stored file system objects. In response to changes respective to a number of the file system objects, a set of Data Management Application Program Interface (DMAPI) events is created. For each of the events, accessory file system object information relative to a file system object subject to the change is determined. The events are grouped into an event group and a unique group identifier and an overall group size count are assigned to each of the events included in the event group. The events are sent together with the respective accessory file system object information, the respective group identifier and the respective group size to a number of backup clients registered as applications. The backup clients are to process the events together with the respective accessory file system object information, the respective group identifier and the respective group size into a number of backup requests.

Data processing apparatus and method

A method for handling snapshots together with migrated files in a hierarchical storage management may be provided. The method comprises managing files using a first-tier storage and a second-tier storage. The files are organized in a managed file system&#x2014;e.g., a hierarchically managed file system&#x2014;in the first-tier storage. The method comprises further creating a snapshot of a portion of the files of the first-tier storage, thereby creating a hidden directory in the file system, deleting a migrated file, and moving the stub file relating to the file to be deleted in the first-tier storage to the hidden directory.

Effective handling of HSM migrated files and snapshots

A data storage cartridge according to one embodiment comprises a housing configured to house a data storage medium, a sensor coupled to the housing, and a microcontroller coupled to the sensor. The microcontroller is configured to wirelessly communicate information about the sensor. Other embodiments relate to a data storage cartridge comprising a housing configured to house a data storage medium, a cartridge memory coupled to the housing, the cartridge memory having a wireless communications interface, and a microcontroller in physical communication with the cartridge memory. The microcontroller is configured to wirelessly communicate information retrieved from the cartridge memory. Additional embodiments relate to a data storage cartridge comprising a mechanical write protect mechanism coupled to the housing of the data storage cartridge, an actuator coupled to the mechanical write protect mechanism for selectively changing a state of the mechanical write protect mechanism, and a microcontroller configured to control the actuator.

Remotely controlling a magnetic tape cartridge

A method for accessing filesystem objects on a backup server storing block level backups, includes: receiving a request to access a filesystem object stored in the block level backups, the request including a pattern of characters identifying the filesystem object in a global history table mapping a history of filesystem objects to the block level backups; identifying, based on the pattern of characters, an object identifier in the global history table corresponding to the filesystem object; identifying, based on the object identifier, a set of one or more block level backups of the computing system having a copy of the filesystem object; selecting a block level backup from the set of one or more block level backups; mounting the selected block level backup to access a backed-up file system of the computing system; and retrieving, from the backed-up filesystem, the filesystem object.

File name level based file search and restoration from block level backups of virtual machines

Techniques for managing data stored in a hierarchical storage management (HSM) system are provided. A first controller receives a request to migrate a data item to a first storage tier managed by the first controller, wherein the data item is not associated with an object ID and a HSM status value indicates that the data item is resident on a second storage tier. The first controller generates an initial object ID, creates a new record for the data item in a data structure, sets an object ID field and a parent ID field of the record to the initial object ID. The first controller stores the data item on the first storage tier and sends an acknowledgement identifying the initial object ID as an object ID of the data item to a second controller that manages the second storage tier. The second controller updates the HSM status value.

Restoring data in a hierarchical storage management system

A backup system retains a certain number of file versions in backups of a virtual machine running on a host computing system. Files are identified that have changed on the virtual machine since storing a backup of the virtual machine on a backup server. Host blocks on that are associated with each of the changed files are determined. Backup blocks associated with each of the host blocks are determined. The changed files and associated backup blocks are merged with previous file version information. It is determined that a version of a file has become expired, the version of the file associated with a backup block. The backup block is deleted in response to determining that the backup block is not associated with any unexpired file versions and the backup block is not associated with any unexpired virtual machine backups.

Expiration handling for block level backup of virtual machines

Backing up virtual machine operating system data on sequential-access data storage systems is provided. A virtual machine boots into an operating system using operating system data that is provided to the virtual machine from a random access storage unit. The random access storage unit stores the operating system data as a first plurality of blocks. The operating system data is recorded in a sequential order as it is provided to the virtual machine. The operative system data is recorded in a record file. Sequential boot data is recorded on a sequential backup system based, at least in part, on the record file. The sequential boot data is a copy of the operating system data that represent the operating system as a second plurality of blocks based, at least in part, on the sequential order of the operating system data provided to the virtual machine.

Backing up virtual machine operating system data on sequential-access data storage systems

A method for backing a computing system includes generating a local history table of filesystem objects that have changed since storing a first backup of the computing system where the local history table includes attributes of the filesystem objects and a set of operations associated with changes to the filesystem objects. The method further includes transferring, from the computing system to a backup server, a second backup of the computing system, where the second backup includes a block level representation of a portion of a data storage medium associated with the computing system. The method additionally includes merging the local history table with a global history table stored on the backup server, the global history table mapping a history of filesystem objects to a set of block level backups of the computing system including the first backup of the computing system and the second backup of the computing system.

Block level backup of virtual machines for file name level based file search and restoration

The present disclosure provides a hierarchical storage management system for storing data. A first controller receives a request to migrate a data item to a first storage tier. The data item is associated with at least an initial object ID. The first controller, in response to the request, generates a new object ID and identifies a first record in a data structure, wherein the initial object ID is identical to an object ID of the first record and to a parent object ID of the first record. The first controller replaces the object ID of the first record with the new object ID, creates in the data structure a new record that is associated with the data item, sets an object ID of the new record and a parent object ID of the new record to the initial object ID, and stores the data item to the first storage tier.

A computer receives a set of objects from a client, whereby at least one of the objects of the set are respectively associated and encrypted with a unique file encryption key (FEK). The computer encrypts each of the FEKs with a common master encryption key, MEK, resulting in respective locked keys. In an initial backup, the encrypted objects together with their associated locked keys are transmitted to a backup server where a first module determines if locked key has changed via referencing an encryption state associated with the encrypted objects. If an MEK has changed, the existing FEKs are re-encrypted with the changed MEK to generate new locked keys, and, in a subsequent backup operation, sending the new locked keys to the backup server to replace the existing locked keys, while avoiding transmitting to the backup server the objects whose associated FEKs are affected by the changed MEK.

Growing community of inventors

Dichtelbach, Germany

Christian Mueller