International Business Machines Corporation

Dominic Mueller-Wicke

Nils Haustein

Christian Mueller

Thomas Schreiber

Stefan Bender

Wayne A Sawdon

James Patrick Smith

Kai Boerner

Fabian Kuhl

Khanh V Ngo

Takeshi Ishimoto

Slavisa Sarafijanovic

Simon Lorenz

Harald Seipp

Sabine U Steinhauer

Daniel James Winarski

Erik Rueger

Tim Uwe Scheideler

Joerg H Walter

Steven M Berman

Mauro Cruciani

Eirini Petraki

Frank Mueller

Andre Gaschler

Sandeep R Patil

Sasikanth Eda

Christian Bolik

Thomas Prause

Andreas Uhl

Frank Lautenbach

Alexander Saupp

Achim Christ

A method and system for detecting ransomware and repairing data following an attack. The method includes, collecting file statistics for files in a file system, identifying an affected file based on collected file statistics, locking down of access to the file system in response to identifying the affected file, undoing of reconcile processing, repairing the affected files, and unlocking access to the file system. The system includes a computer node, a file system, a plurality of disc storage components, a backup client, a backup client, and a hierarchical storage client. The hierarchical storage client is configured to collect file statistics for files in file system, identify affected files based on collected file statistics for the file, lock down of access to the file system in response to an identified affected file, undo reconcile processing, repair the affected file; and unlock access to the file system.

Automatic ransomware detection with an on-demand file system lock down and automatic repair function

A method, computer program product, and system for detecting and mitigating ransomware using snapshot-based backups applied to a block-oriented storage device, by performing the following operations: (i) performing, in predetermined time-intervals, snapshot backups of data in a block-oriented storage device; (ii) determining at least one interval malware index value between a last snapshot backup and a next planned snapshot backup, wherein the interval malware index value is indicative of a changed block rate in stored data of storage blocks of the block-oriented storage device; and (iii) in response to determining that the interval malware index value is larger than a predefined interval malware index threshold value, triggering an emergency snapshot.

Automatic ransomware detection and mitigation

A method includes receiving a plurality of files where each file represents an object. The method further combines selected files of the plurality of files into an aggregation file and stores the aggregation file on low-latency storage media, such as disk storage media. The method represents the aggregation file with a single inode that is stored on the low-latency storage media. The method migrates the aggregate file to high-latency storage media, such as tape storage media, while leaving the single inode representing the aggregation file on the low-latency storage media. By collecting files into larger aggregation files, the number of files archived is significantly reduced and the files archived are of larger size. The reduced number of files and increased size of the files improves archival and retrieval performance due to reduced metadata operation overhead. A corresponding system and computer program product are also disclosed.

Performance- and cost-efficient archiving of small objects

A computer-implemented method for operating a storage system comprising a file system for managing a data object in one or more storage blocks may be provided. The method comprising receiving from a file system manager a message indicating that the data objects is to be encrypted, determining, in response to the received message, a set of unallocated storage blocks that were previously allocated for storing at least a portion of the data object, and rendering content of the unallocated storage blocks of the set unreadable.

Securing deallocated blocks in a file system

A method includes receiving a plurality of files where each file represents an object. The method further combines selected files of the plurality of files into an aggregation file and stores the aggregation file on low-latency storage media, such as disk storage media. The method represents the aggregation file with a single inode that is stored on the low-latency storage media. The method migrates the aggregate file to high-latency storage media, such as tape storage media. By collecting files into larger aggregation files, the number of files archived is significantly reduced and the files archived are of larger size. The reduced number of files and increased size of the files improves archival and retrieval performance due to reduced metadata operation overhead. A corresponding system and computer program product are also disclosed.

The disclosure relates to a method for archiving files of a local file system of a client system in a remote storage system. The local file system and the remote storage system are communicatively coupled via a network. The method comprises executing an archive process on an archive computer system communicatively coupled to the network. The archiving is solely controlled by the archive process. The execution causes the archive computer system to receive a configuration comprising share metadata, descriptive of a file share in the local file system, and a network address of the client system; remotely access the local file system using the configuration; scan the files of the file share to identify candidate files for archiving; and archive the candidate files by copying the candidate files to the remote storage system.

Clientless active remote archive

Operating a data processing and storage apparatus to perform continuous backup monitoring for a collection of stored file system objects. In response to changes respective to a number of the file system objects, a set of Data Management Application Program Interface (DMAPI) events is created. For each of the events, accessory file system object information relative to a file system object subject to the change is determined. The events are grouped into an event group and a unique group identifier and an overall group size count are assigned to each of the events included in the event group. The events are sent together with the respective accessory file system object information, the respective group identifier and the respective group size to a number of backup clients registered as applications. The backup clients are to process the events together with the respective accessory file system object information, the respective group identifier and the respective group size into a number of backup requests.

Data processing apparatus and method

A computer-implemented method according to one embodiment includes receiving a request to perform a high-latency media (HLM) action on an object or a group of objects, identifying metadata associated with the object or group of objects, and conditionally allowing the HLM action to be performed on the object or group of objects, based on the HLM action and the metadata associated with the object.

Regulating migration and recall actions for high latency media (HLM) on objects or group of objects through metadata locking attributes

A computer-implemented method according to one embodiment includes identifying abnormal data modification characteristics at a first system, determining time data associated with the abnormal data modification characteristics, and adjusting an instance of backup log data stored at a second system, utilizing an identification of the abnormal data modification characteristics and the time data associated with the abnormal data modification characteristics.

Adjusting backup data in response to an abnormality detection

In an approach to maintain data integrity in a computer data storage system, a clone management table is generated for a clone file tree that includes a relationship between at least one parent file and a clone file. The parent file is restored by: (i) determining that the parent-child relationship exists between the parent file and the clone file based on an entry in the clone management table, (ii) restoring data blocks in the parent file to the file system based on an analysis of an entry in the clone management table for the parent file and an identification of data blocks included in the clone file, and (iii) generating a new instance of the parent file based on the data blocks included in the file system and the entry in the clone management table for the clone file tree.

Clone file backup and restore

Embodiments of systems and methods are provided for data storage in a tiered storage system comprising at least two storage tiers. A method comprises: providing storage information for each storage tier of the storage tiers to a user. The storage information comprising values of storage parameters, wherein the storage parameters comprise at least one of a storage quota limit of the user, usable storage capacity in the tier for the user based on the storage quota limit, and consumed storage capacity of the tier by the user. The storage information is used to move data between the storage tiers.

Quota controlled movement of data in a tiered storage system

A method for handling snapshots together with migrated files in a hierarchical storage management may be provided. The method comprises managing files using a first-tier storage and a second-tier storage. The files are organized in a managed file system&#x2014;e.g., a hierarchically managed file system&#x2014;in the first-tier storage. The method comprises further creating a snapshot of a portion of the files of the first-tier storage, thereby creating a hidden directory in the file system, deleting a migrated file, and moving the stub file relating to the file to be deleted in the first-tier storage to the hidden directory.

Effective handling of HSM migrated files and snapshots

Automatically configuring backup client systems and backup server systems in a backup environment includes the following steps: determining if a new backup client system is available in the backup environment; in case of an available new backup client system a backup configuration module performs the sub-steps of: determining data types the new backup client system has to backup; determining corresponding backup policies for the determined data types based on a backup policy table mapping data types with backup policies; selecting a backup server system for the determined data types based on a backup server table including connection details of available backup server systems; configuring the determined backup policies for the data types of the new backup client system on the selected backup server systems; and updating the backup server table with an identifier of the new backup client system and an identifier of the backup policy.

Growing community of inventors

Weilburg, Germany

Dominic Mueller-Wicke