International Business Machines Corporation

Dan Edward Poff

Bulent Abali

Mohammad Banikazemi

Charles Otto Schulz

Peter Anthony Franaszek

Lorraine M Herger

T Basil Smith, Iii

Robert A Saccone, Jr

Mary Joan McHugh

James Lee Hafner

Timothy Joseph Chainer

John Alan Bivens

Krishnakumar Rao Surugucchi

Michael R Hines

Vittorio R Castelli

Hubertus Franke

Philip Heidelberger

John Michael Borkenhagen

Robert Brett Tremaine

Sumeet Kochar

Linda Ann Riedle

Luis A Lastras

Gary Valentin

D Scott Guthridge

James W Arendt

Robert Saccone

Ziv Rafalovich

Krishankumar Rao Surugucchi

Nancy M Wei

Charles O Schultz

James Gerard Palte

An intrusion detection and recovery system includes a copying module that creates a point-in-time copy of a storage level logical unit, the point-in-time copy including a volume copy of the storage level logical unit and signatures of the storage level logical unit, a comparison module that compares at least a portion of the point-in-time copy with a previous copy of the storage level logical unit, a judging module that, based on results of the comparison module, judges if a modification has occurred. A signature of the point-in-time copy is compared with a signature of the previous copy to detect a sign of an intrusion. The signatures of the storage level logical unit include encoded data of files of the storage level logical unit that are monitored in the point-in-time copy.

Method and system for storage-based intrusion detection and recovery

An intrusion detection and recovery system includes a copying module that creates a point-in-time copy of a storage level logical unit, the point-in-time copy including a volume copy of the storage level logical unit and a signature of the storage level logical unit, a comparison module that compares at least a portion of the point-in-time copy with a previous copy of the storage level logical unit, a judging module that, based on results of the comparison module, judges if a modification has occurred. A signature of the point-in-time copy is compared with a signature of the previous copy to detect a sign of an intrusion.

An apparatus comprises a storage controller coupled to at least one multi-region storage device. The at least one multi-region storage device comprises two or more storage regions, the two or more storage regions comprising a first storage region associated with a first set of failure characteristics and at least a second storage region associated with a second set of failure characteristics different than the first set of failure characteristics. The storage controller is configured to replicate in the second storage region at least a portion of data that is stored in the first storage region.

Storing data in multi-region storage devices

A method for detecting a modification to stored data includes continuously creating a point-in-time copy of a storage level logical unit, the point-in-time copy comprising a volume copy of the storage level logical unit and a signature of the storage level logical unit, comparing at least a portion of the point-in-time copy with a previous copy of the storage level logical unit, and monitoring, based on the comparing, changes on certain logical blocks of the stored data, using the signature of the storage level logical unit.

A method (and system) for detecting intrusions to stored data includes creating a point-time-copy of a logical unit, and comparing at least a portion of the point-time-copy with a previous copy of the logical unit. The method (and system) monitors access to a data storage system and detects an intrusion or any other intentional or unintentional, unwanted modification to data stored in the data storage system. The method (and system) also recovers data once an intrusion or other unwanted modification is detected.

Method and system for storage-based instrusion detection and recovery

A computer implemented method creates a snapshot of a logical volume of a computer. The computer stores a system state of the computer in persistent memory. The computer flushes a cache of the computer. The computer identifies a preceding snapshot. In response to identifying the preceding snapshot, the computer hardens changes occurring after the preceding snapshot. The computer then switches from a first indirection table to a second indirection table.

Instantaneous save/restore of virtual machines with persistent memory

Systems and methods to manage memory are provided. A particular method may include initiating a memory compression operation. The method may further include initiating a first interrupt configured to affect a first process executing on a processor in response to a first detected memory level. A second initiated interrupt may be configured to affect the first process executing on the processor in response to a second detected memory level, and a third interrupt may be initiated to affect the first process executing on the processor in response to a third detected memory level. At least of the first, the second, and the third detected memory levels are affected by the memory compression operation.

Managing shared computer memory using multiple interrupts

A computer implemented method, apparatus, and computer usable program product for managing redundant array of independent drives. In response to a failure of a hard disk in a first RAID array, the process calculates an amount of free capacity available across a set of remaining hard disks in the first RAID array. The set of remaining hard disks comprises every hard disk associated with the first RAID array except the failed disk. In response to a determination that the amount of free capacity is sufficient to re-create the first RAID array at a same RAID level, the process reconstructs the first RAID array using an amount of space in the set of remaining drives utilized by the first RAID array and the free capacity to form a new RAID array without utilizing a spare hard disk.

Storage redundant array of independent drives

The present invention describes lossless data compression/decompression methods and systems. A random access memory (RAM) operates as a static dictionary and includes commonly used strings/symbols/phrases/words. An input buffer operates as a dynamic dictionary and includes input strings/phrases/symbols/words. A set-associative cache memory operates as a hash table, and includes pointers pointing to the commonly used strings/symbols/phrases/words in the static dictionary and/or pointing to one or more of the input strings/phrases/symbols/words in the dynamic dictionary. Alternatively, the set-associative cache memory combines the dynamic dictionary, the static dictionary and the hash table. When encountering a symbol/phrase/string/word in the static or dynamic dictionary in an input stream, a compressor logic or module places a pointer pointing to the symbol/phrase/string/word at a current location on the output stream. The hash table may include phrases/symbols/strings/words and/or pointers pointing to phrases/symbols/strings/words.

Data compression using a nested hierachy of fixed phrase length static and dynamic dictionaries

The present invention reduces the number of writes to a main memory to increase useful life of the main memory. To reduce the number of writes to the main memory, data to be written is written to a cache line in a lowest-level cache memory and in a higher-level cache memory(s). If the cache line in the lowest-level cache memory is full, the number of used cache lines in the lowest-level cache reaches a threshold, or there is a need for an empty entry in the lowest-level cache, a processor or a hardware unit compresses content of the cache line and stores the compressed content in the main memory. The present invention also provides LZB algorithm allowing decompression of data from an arbitrary location in compressed data stream with a bound on the number of characters which needs to be processed before a character or string of interest is processed.

Wear reduction methods by using compression/decompression techniques with fast random access

In a computer system having an operating system and a compressed main memory defining a physical memory and a real memory characterized as an amount of main memory as seen by a processor, and including a compressed memory hardware controller device for controlling processor access to the compressed main memory, there is provided a system and method for managing real memory usage comprising: a compressed memory device driver for receiving real memory usage information from the compressed memory hardware controller, the information including a characterization of the real memory usage state: and, a compression management subsystem for monitoring the memory usage and initiating memory allocation and memory recovery in accordance with the memory usage state, the subsystem including mechanism for adjusting memory usage thresholds for controlling memory state changes. Such a system and method is implemented in software operating such that control of the real memory usage in the computer system is transparent to the operating system.

System and method for managing memory compression transparent to an operating system

Two methods (native and clone) are used for installing software, such as an operating system, on client system(s) booting from shared storage. The native installation method configures an interconnection network to create an exclusive communication zone between the client system and the shared storage system and installs the operating system on the client system using the exclusive communication zone. After the software is installed, the method terminates the exclusive communication zone. The clone installation method utilizes a point-in-time copy feature of the shared storage system to clone an operating system drive instantaneously. After the drive is cloned, it is logically attached to a new client and the operating system is customized for that client.

Growing community of inventors

Mahopac, NY, United States of America

Dan Edward Poff