Dell Products Inc.

Emc IP Holding Company LLC

Nitin Madan

Bhimsen Bhanjois

Salil Dangi

Kedar Godbole

Donna Barry Lewis

Kalyan Chakravarthy Gunda

Srikant Viswanathan

Srisailendra Yallapragada

Mahadev Karadigudda

Naveen Rastogi

Madhu Agrahara Gopalakrishna

Sanjay Vedanthan

Alok Katiyar

Kiran Kumar Malle Gowda

Jagannathdas Rath

Senthil Ponnuswamy

Sandeep Nirmale

Srikanth Srinivasan

Neerajkumar Nareshkumar Chourasia

Kedar Sadanand Godbole

Jayasekhar Konduru

Niharika Avasarala

Fani Jenkins

Deepa Ramesh

Gobikrishnan Sundharraj

Neeraj Bhutani

Fei Wang

Rajendra Kumar Bhairy Raj

Aditi Tejas Gosavi

A count of multi-stream restore (MSR) streams associated with restore jobs pinned for the MSR streams and a count of MSR streams associated with restore jobs not pinned for the MSR streams are tracked. Each MSR stream includes multiple internal threads that prefetch data for the restore jobs into read-ahead caches. A REST request is received for a restore job, the REST request requesting that the restore job be pinned for an MSR stream. When the count of MSR streams associated with restore jobs pinned for the MSR streams plus the count of MSR streams associated with restore jobs not pinned for MSR streams has reached a threshold, an MSR stream associated with a restore job not pinned for the MSR stream is torn down.

Indicating preferred restore throughput in a deduplication filesystem via a rest interface

Corruption detection in backups is disclosed. Backups that are received into a backup environment are stored in corresponding lineages. A detection engine is configured to perform corruption detection operations on the most recent backups in each of the lineages based on a sample frequency. Corruption detection operations may also be performed randomly and based on unexpected or unusual changes in backup metadata.

Method for lineage sampling to efficiently detect corruptions

Improving read performance using pre-fetches by encoding an extent map identifying valid data of the file as extents that may be interspersed with holes constituting invalid data, and storing the extent map in the client. The extent map generates pre-fetches of data that land on only extents of the file and avoids the holes, by one of: transferring, upon the read request, the extent map to a filesystem storing the file, and bringing the extents from the extent map into memory ahead of the read request; or using, in the network client, the extent map to generate prefetch requests and execute read-ahead operations on the filesystem. The method may also apply where the application only wants to read what has changed since the last backup. In this case, the application has a map of what has changed, and can choose to read just the right extents.

Extent restore performance using smart prefetching

System audits messages, communicated internally in copy management system, about copy management jobs, and learns about relationships between message requests for user actions on copy management jobs and subsequent failures of copy management jobs. System creates snapshot of copy management content displayed by user interface and selected by user as context for user's message, and creates message's link to snapshot. System stores user entries that identify message's intended recipient(s), time of availability, and text. If message requests user action on copy management job, and relationship between unanswered requests for user to perform action on copy management job and subsequent failures of copy management job satisfies relationship threshold, then machine learning system sends message via copy management system's internal communication channel to system-selected administrator, who selects message's hyperlink to snapshot. System responds by outputting context for message to system-selected administrator's user interface, which enables system-selected administrator to respond to message.

Auditing contextual messages between users in copy management systems

System determines first context of messages between copy management system users and creates snapshot of copy management content part, which is displayed by user interface, and selected by system user as context for subsequent message. System creates hyperlink in message to snapshot that depicts copy management content part and stores user entries for tag that identifies at least one intended recipient of message, time when message is available for intended recipient(s), and text for message. System sends message at time to intended recipient(s) via internal communication channel of system. In response to recipient of message selecting message's hyperlink to snapshot, system outputs context for message to recipient's user interface, which enables recipient to respond to message. If second context of messages between copy management system users matches first context of messages, then information requested in message after first context of messages is conveyed to at least one user interface.

Communicating and taking action based on contexts for messages between users in copy management systems

Embodiments of a cryptographic key management system for cached data that abstracts key management details from the cache tier to the active tier and encryption process by encrypting data from the active tier using an encryption process employing an encryption key to generate an encrypted data block, and associating an encryption header with the encrypted data block, the encryption header including a key identifier as an index to the encryption key, where the encryption key is accessed through a key table maintained in the active tier. The system stores the encrypted data block in a cache tier, and decrypts the encrypted data block in the cache tier by providing the key identifier in the encryption header to the encryption process.

Dynamic cryptographic key management for cached data

Improving data recovery and restoration times by clamping down security after malware detection, and protect a data center from a cyber recovery vault. Embodiments provide a cyber recovery vault configured to store data backed up for a production site for long-term retention and disaster recovery. The vault is coupled to the data center comprising a production site through an automated air gap controlled by the vault. Control signals transmitted by the vault trigger the air gap to close the coupling between the vault and data center upon detection of a malware attack, and the data center is configured to listen for the control signals and implement heightened security measures to protect its data in response to the control signal.

Protecting data against malware attacks using cyber vault and automated airgap control

One example method includes generating in a shared protection namespace a first point-in-time copy of a first working frozen copy of an active namespace that includes first files associated with the active namespace that are stacked in a first horizontal file. A retention lock is applied to the first horizontal file. A second point-in-time copy of a second working frozen copy of the active namespace that includes second files associated with the active namespace that are stacked in a second horizontal is generated. A retention lock is applied to the second horizontal file. The second horizontal file is generated by copying files from the first horizontal file into the second horizontal file and copying files from the second working frozen copy of the active namespace into the second horizontal file.

Efficient retention locking of a copy of a large namespace on a deduplication filesystem

Improving the performance of read operations in a restore path of a backup system by adaptively applying compression. The method defines an extent covering data segments for which compression ratio statistics are calculated, and calculates a respective compression ratio for each data segment in the defined extent. It then associates each unique compression ratio with a corresponding index value and stores each compression ratio and associated corresponding index value in an array. The array is appended as extended file attribute to the data segments, the indexed compression ratio is used by a backup server to determine whether or not to apply compression to the data segments in a restore path sending the data segments from the backup server.

Pre-filter check for compressibility using stored compression factors to improve reads in a deduplication file system

One example method includes generating first and second snapshots of a shared protection namespace of a backup storage device. The first snapshot includes a first working frozen copy of an active namespace and the second snapshot includes a second work working frozen copy of the active namespace. First and second point-in-time copies of the first and second working frozen copies are generated in the shared protection namespace. The first point-in-time copy includes first files extracted from the first working frozen copy and that are stacked in at least one first horizontal file. The second point-in-time copy includes the second files included in the second working frozen copy that are stacked in at least one second horizontal file. A retention lock is applied to the at least one first and second horizontal files.

A method of blocking access to files encrypted with a compromised key by mapping keys and ranges of containers encrypted by the keys. Upon notification that a key is compromised, fencing a container range corresponding to data segments encrypted by the compromised key to prevent deduplication operations on the segments. The method makes a point-in-time copy of the filesystem managing the segments, wherein each file of the file system is represented as tree structure having a root level and other levels. The method iteratively inspects in a level-wise manner, each container in each level of the file trees of the files to identify containers having segments encrypted by the compromised key, and marks files corresponding to the identified containers as not readable to block the access to the files encrypted with the compromised key.

Disallowing reads on files associated with compromised data encryption keys

Disclosed is a storage system comprising: receiving a first data segment and first metadata associated with the first data segment to be stored in the storage system; storing the first data segment and the first metadata in a persistent storage device of the storage system; compressing the first data segment using a predetermined compression algorithm to generate a first compressed data segment; and storing the first metadata and the first compressed data segment in a solid state drive (SSD) cache device of the storage system, including aligning the first metadata and the first compressed data segment to a page boundary of the SSD device to reduce a number of input and output (IO) operations required for accessing the first metadata and the first compressed data segment from the SSD cache device.

Method to opportunistically reduce the number of SSD IOs, and reduce the encryption payload, in an SSD based cache in a deduplication file system

One example method includes generating first and second snapshots of a shared protection namespace of a backup storage device. The first snapshot includes a first working frozen copy of an active namespace and the second snapshot includes a second work working frozen copy of the active namespace. The first snapshot is converted into a first data-less snapshot. A snapshot difference operation is preformed between the first data-less snapshot and the second snapshot. First and second point-in-time copies of the first and second working frozen copies are generated in the shared protection namespace. The first point-in-time copy includes the first files extracted from the first working frozen copy and stacked in at least one first horizontal file. The second point-in-time copy includes the second files stacked in at least one second horizontal file. A retention lock is applied to the at least one first and second horizontal files.

One example method includes accessing a point-in-time copy including retention locked backups that were stored on a backup storage server at a time the point-in-time copy was generated. The method further includes accessing a current namespace including retention locked backups that are currently stored on the backup storage server. Each retention locked backup includes data backup files. The method also includes determining a first set of retention locked backups that are included in the point-in-time copy, but are not included in the current namespace. The method finally includes copying the first set of retention locked backups from the point-in-time copy into the current namespace without removing any of the retention locked backups already in the current namespace.

Rollback from a retention locked namespace

During a current backup of a file system of a client, a determination is that a file in the current backup includes first data regions found in a file from a previous backup, and second data regions that are new. A virtual synthetic file is generated by writing the second data regions, and synthesizing the first data regions by referencing the file from the previous backup. A request received to restore the particular file includes identifications of other files still present at client. A determination is that the particular file corresponds to the virtual synthetic file and that the other files still present at client include the file from the previous backup. The second data regions are read to send to client. A complete version of the particular file is assembled at client using the file from the previous backup, still present at client, and the second data regions.

Growing community of inventors

Cupertino, CA, United States of America

Nitin Madan