Dell Products Inc.

Mohammed Asher Vt

Ramesh Doddaiah

Sandeep Chandrashekhara

Peng Wu

Rong Yu

Malak Alshawabkeh

Lixin Pang

Shao Hu

Host IO write operations on a given storage group are grouped into cycles of a write destage pipeline for the storage group. Host writes are collected during a capture cycle, while host writes from a previous capture cycle are analyzed and destaged during an apply cycle. After the previous apply cycle has completed, a cycle switch occurs and the current capture cycle becomes the new apply cycle. Anomaly detection is implemented before any IO write operations are destaged during the apply cycle, and if an anomaly is detected the write destage is stopped. The entire apply cycle is either destaged to disk, or is discarded, depending on whether the anomaly is confirmed. By maintaining the order of writes across different cycles, which act as consistency points, it is possible to implement ransomware protection in real time on host write operations, while using ordered write destage to maintain data consistency.

Data protection by delayed ordered write destage operations

Ransomware activity detection and data protection is implemented by a remote R2 storage array on an asynchronous remote data replication facility, on which data from a primary R1 storage array is replicated to the remote storage array. Write operations on storage volumes in a remote data replication group are collected in a capture cycle on the primary storage array, along with IO pattern metadata describing both read and write operations on the storage volumes. At the end of the capture cycle, the update and metadata is transmitted to the remote storage array. The remote storage array receives the update and metadata and temporarily stores the update prior to applying it to its copy of the storage volumes. Ransomware anomaly detection is implemented using the update and metadata, and if ransomware activity is detected, the data on the remote R2 storage array is protected, and the update is not applied.

Ransomware activity detection and data protection

A synchronous destage process is used to move data from shared global memory to back-end storage resources. The synchronous destage process is implemented using a client-server model between a data service layer (client) and back-end disk array of a storage system (server). The data service layer initiates a synchronous destage operation by requesting that the back-end disk array move data from one or more slots of global memory to back-end storage resources. The back-end disk array services the request and notifies the data service layer of the status of the destage operation, e.g. a destage success or destage failure. If the destage operation is a success, the data service layer updates metadata to identify the location of the data on back-end storage resources. If the destage operation is not successful, the data service layer re-initiates the destage process by issuing a subsequent destage request to the back-end disk array.

Synchronous destage of write data from shared global memory to back-end storage resources

Growing community of inventors

Bengaluru, India

Mohammed Asher Vt