Emc IP Holding Company LLC

Dell Products Inc.

Wipro Limited

Kundan Kumar

Sanjib Mallick

Kurumurthy Gokam

Md Haris Iqbal

Shubham Sharma

Prasad Vishnu Paple

Remesh Parakunnath

Arieh Don

Vinay G Rao

Matthew H Long

Gopinath Marappan

Prakash Venkatanarayanan

Amihay Azruel

Jean Marie Schiff

Govindaraja Nayaka B

Sreenivasa Honnur Sathyanarayana

Sumana Ramachandra

Gaurav Singh

Elik Levin

Shabbeer Gangavaram

Udhaya Kumar Dhayalan

Karthik Rangasamy

An apparatus comprises at least one processing device configured to implement a multi-path layer in a host device, wherein the multi-path layer controls delivery of input-output (IO) operations from the host device to a storage system over selected ones of a plurality of paths through a network. The multi-path layer is configured, for each of at least a subset of the IO operations, to store at least a process identifier, a user identifier and an access type for the IO operation. The multi-path layer is further configured to perform analytics on the stored process identifiers, user identifiers and access types to detect an access pattern, and responsive to the detected access pattern having one or more designated characteristics associated with malware, to generate an alert. The alert may be generated by inserting security alert indicators into respective ones of the IO operations, for extraction therefrom by the storage system.

Host multi-path layer with IO analytics for malware defense

An apparatus in one embodiment comprises a host device comprising a processor coupled to memory. The host device is configured to communicate over a network with at least one storage system. The host device is further configured to retrieve data corresponding to a plurality of processes for submitting a plurality of input-output operations to the at least one storage system, to identify one or more constraints on the plurality of processes based at least in part on the data; and to control submissions of the plurality of input-output operations to the at least one storage system based at least in part on the one or more constraints. The retrieval of the data, the identification of the one or more constraints and the control of the submissions are performed in a user space of the host device.

Management of input-output operations in user space

Techniques are provided for provisioning zoned storage devices to sequential workloads. One method comprises obtaining a sequentiality classification of at least one workload of an application associated with a storage system comprising a plurality of zoned storage devices; and provisioning at least one of the zoned storage devices for storing the data of the at least one workload in response to the at least one workload being classified as a sequential workload. A sequentiality classification of a workload (e.g., as a sequential workload or a random workload) can be determined by: (i) evaluating the application name and/or application type of an application, (ii) learning input-output workload patterns, such as sequential read/write operations or random read/write operations, and/or (iii) detecting the application access mode to persistent volumes, such as a sequential write access mode.

Provisioning zoned storage devices to sequential workloads

An apparatus comprises at least one processing device comprising a processor coupled to a memory, with the at least one processing device being configured to provide at least a portion of an input-output (IO) stack for processing of IO operations in a host device for delivery to a storage system over selected ones of a plurality of paths through a network. The IO stack comprises at least a multi-path device overlying one or more logical storage devices. The at least one processing device is further configured to perform a check at each of one or more points in the IO stack to confirm that a given IO operation directed to a given device of the IO stack is received from an expected overlying device of the IO stack. The IO stack illustratively comprises an encryption device overlying the multi-path device, supporting end-to-end encryption for one or more logical storage devices.

End-to-end encryption of logical storage devices in a Linux native multi-pathing environment

Methods, apparatus, and processor-readable storage media for block-level classification of unstructured data are provided herein. An example apparatus includes a host device comprising a processor coupled to memory, the host device being configured to communicate over a network with a storage system, and further being configured to: obtain a pointer to a page cache associated with an input-output operation for at least one page of unstructured data of a file; obtain an index node object of the file based at least in part on the pointer to the page cache; derive at least one characteristic of the file based at least in part on the obtained index node object; and provide an indication of the at least one characteristic to the storage system. The storage system determines whether to apply one or more functions to the unstructured data based on the indication.

Block-level classification of unstructured data

An apparatus comprises a processing device configured to control delivery of input-output operations from a host device to a storage system over selected ones of a plurality of paths through a network. The processing device is further configured to identify whether operational information of the host device corresponding to a given write input-output operation comprises one or more index nodes, and to analyze the one or more index nodes responsive to a positive identification. The processing device is also configured to determine whether one or more portions of data corresponding to the given write input-output operation comprise file data based on the analysis of the one or more index nodes, to encrypt at least part of the file data responsive to an affirmative determination, and to deliver the given write input-output operation comprising the encrypted file data to the storage system.

File based encryption for multi-pathing devices

Host computers running applications that store data on a block-based storage system such as a SAN provide hints that differentiate IO data based on which application generated the IO. The hints may include tags that are associated with IO commands sent to the block-based storage system. Each host application is associated with a unique identifier that is placed in the tag. Application name-to-identifier mappings may be sent from the hosts to the block-based storage system. Per-identifier/application deduplication statistics are maintained by the block-based storage system and shared with other block-based storage system. Deduplication is disabled or de-emphasized for IO data generated by applications with statistically low deduplication ratios.

Intelligent deduplication in storage system based on application IO tagging

A method, computer program product, and computing system for selecting target volumes within a storage system that are currently accessible to computing devices via first storage protocol paths via a first storage protocol for accessing via second storage protocol paths via a second storage protocol. For each of the selected target volumes, a first storage protocol identifier specific to each selected target volume may be associated with a second storage protocol identifier specific to each selected target volume. The first storage protocol paths and the second storage protocol paths may be grouped into a multipath group based upon the association between the first storage protocol identifier and the second storage protocol identifier. Access between the computing devices and the selected target volumes may be switched from the first storage protocol paths to the second storage protocol paths without application disruption and across multiple host platforms, including host-clusters.

System and method for non-disruptive storage protocol conversion

Techniques are provided for selective snapshot creation using source tagging of input-output (I/O) operations. One method comprises receiving an I/O operation; obtaining an I/O tag associated with the I/O operation indicating a source of the I/O operation (e.g., a source application or a source virtual machine); updating a cumulative I/O tag value associated with the I/O tag that indicates an amount of activity associated with the I/O tag; and initiating a snapshot of at least a portion of a storage system that stores data associated with the I/O operation in response to the cumulative I/O tag value satisfying a corresponding threshold value. A source device associated with the I/O operation may associate the I/O tag with the I/O operation and send the I/O operation with the I/O tag to the storage system.

Selective snapshot creation using source tagging of input-output operations

An apparatus in one embodiment comprises a host device comprising a processor coupled to memory. The host device is configured to communicate over a network with at least one storage system. The host device is further configured to generate a user space block device and to generate a kernel space block device corresponding to the user space block device. The host device is further configured to receive an input-output operation at the kernel space block device from an application executing on the host device and to transfer the input-output operation from the kernel space block device to the corresponding user space block device. The host device is further configured to submit the input-output operation to the at least one storage system based at least in part on the user space block device.

Host-based transfer of input-output operations from kernel space block device to user space block device

An apparatus in one embodiment comprises a host device configured to communicate with a storage system. Responsive to an instruction to migrate data from a source volume to a destination volume, the host device replaces an input-output entry function of a source pathing device associated with the source volume with a migration input-output entry function that is configured, in response to receiving an input-output operation, to call an input-output entry function of a destination pathing device associated with the destination volume and to call the input-output entry function of the source pathing device. Responsive to an indication that a migration of data has completed, the host device replaces the migration input-output entry function with a post-migration input-output entry function. The post-migration input-output function is configured to call the input-output entry function of the destination pathing device in response to receiving an input-output operation.

Data migration agnostic of pathing software or underlying protocol

A technique provides transitioning from an original device to a new device within a data storage array. The technique involves initiating a copying activity within the data storage array, the copying activity copying data from the original device to the new device. The technique further involves, while the data is being copied from the original device to the new device, routing write requests that target logical storage which is currently supported by the original device to both the original device and the new device. The technique further involves, after the data has been copied from the original device to the new device, performing a configuration change which routes I/O requests that target the logical storage to the new device rather than the original device.

Transitioning from an original device to a new device within a data storage array

An apparatus in one embodiment comprises a host device configured to communicate over a network with a storage system comprising a plurality of storage devices. The host device comprises an MPIO driver that is configured to deliver input-output operations from the host device to the storage system over the network. The MPIO driver is configured to obtain a command generated by the host device under a first protocol for communicating with one or more of the storage devices. The command is directed to a target storage device of the plurality of storage devices. The target storage device is configured to communicate using a second protocol that is different than the first protocol. The MPIO driver is further configured to convert the command for communication under the second protocol and to provide the converted command to the target storage device.

Command communication via MPIO driver agnostic of underlying communication protocols

A method, computer program product, and computer system for creating, by a computing device, a logical unit number (LUN) on a storage array node of a storage system. An identifier of the LUN of the storage array node may be provided to a computing system, wherein the computing system includes one of a host, a server, and the storage array node. An access control list (ACL) of the computing system may be created. The ACL of the computing system may be applied to the LUN based upon, at least in part, the identifier. The LUN may be discovered and mapped at the computing system. It may be determined that the computing system has failed. The ACL of the computing system that has failed may be removed from the LUN to prevent the computing system that has failed from accessing the LUN.

System and method for I/O fencing based on storage array access control list

An apparatus comprises a host device configured to communicate over a network with a storage system. The host device comprises a plurality of nodes each comprising a plurality of processing devices and at least one communication adapter. The host device comprises a multi-path input-output (MPIO) driver that is configured to obtain an input-output (IO) operation that targets a given logical volume. The MPIO driver identifies a source node and a plurality of paths between the source node and the given logical volume. The MPIO driver determines a load factor and a distance for each identified path. The MPIO driver determines a weight associated with each identified path based at least in part on the determined load factor and distance and selects a target path based at least in part on the determined weight. The MPIO driver delivers the obtained IO operation to the given logical volume via the selected target path.

Growing community of inventors

Bengaluru, India

Kundan Kumar