Dell Products Inc.

David Goncalves

Evan Jones

Melissa Flynn

Brett A Quinn

Kevin Heasley

A storage node maintains storage objects that contain decoy datasets that are used to detect cyber-attacks. The decoy datasets may be deployed at logical block addresses (LBAs) including the first and last LBAs of the LBA range of the storage object. Real active data may be stored on the storage object with the decoy datasets. A cyber-attack is detected based on receipt of a suspicious IO command that accesses decoy data. Access to the decoy data may be detected by maintaining an IO access bitmap, calculating digital signatures of decoy datasets, or monitoring for decoy data that is marked for remote replication.

Using decoy datasets for cyber threat detection

A secure physical vault is used in connection with cyber protection automation to ensure that initial configuration and all configuration changes to the cyber protection environment are only implemented by a host that is locally physically connected to the cyber vault. By requiring the host to be locally physically connected to the cyber vault, it is possible to prevent remote modifications to the cyber protection environment configuration, thus preventing a remote attack on the cyber protection afforded by the cyber protection environment. The Operating System of a storage system implementing the cyber vault may be flagged to prevent any syscall from being processed that is not received from a host that is locally physically connected to the cyber vault. Host controller software can also be used to ensure that the initial configuration and all configuration changes to the cyber protection environment configuration are only processed if locally received.

Cyber protection automation with secure physical vault

Recovery of a primary image is facilitated by using non-consistent snapshots on a primary storage array and consistent snapshots on a secondary storage array to avoid the need to transmit entire secondary replicas from the secondary storage array to the primary storage array. Non-consistent snaps of the primary replicas are generated by the primary storage array. Consistent snaps of the secondary replicas are generated by the secondary storage array. The primary replicas are recovered by linking non-consistent snaps to primary staging volumes, linking consistent snaps to secondary staging volumes, synchronizing the primary and secondary staging volumes, and using the synchronized primary staging volumes to recover the primary replicas.

Optimizing data resynchronization in cyber recovery solutions

Recovery of a primary image is facilitated by using consistent snapshots on a primary storage array and consistent snapshots on a secondary storage array to avoid the need to transmit entire secondary replicas of storage objects from the secondary storage array to the primary storage array. Consistent snaps of the primary replicas are generated by the primary storage array. Consistent snaps of the secondary replicas are generated by the secondary storage array. The primary image is recovered by linking consistent snaps on the primary storage array to primary staging volumes, linking consistent snaps on the secondary storage array to secondary staging volumes, synchronizing the primary and secondary staging volumes, and migrating host IO traffic to the synchronized staging volumes.

Growing community of inventors

Acushnet, MA, United States of America

David Goncalves