Emc IP Holding Company LLC

Emc Corporation

Dell Products Inc.

Paul A Linstead

Douglas Eric LeCrone

Brett A Quinn

Denis J Burt

Bruce Alan Pocock

Doug Lecrone

Michael E Specht

Eugene D Pflueger

Jeffrey L Jones

David Goncalves

Philip E Tamer

Ning Wu

Jeremy O'Hare

Daryl Francis Kinney

Peter Callewaert

Daniel A Murphy

Kevin C Heasley

Dennis Trulli, Jr

Evan Jones

Melissa Flynn

Bruce A Pocock

Denis Hall

Evan G Jones

Kevin Heasley

Douglas LeCrone

Larry W McLoskey

Stewart C Woodworth, Iii

Raymond Wong

Roger A Ouellette

Amir Holtzman

Roger A Ouellete

One or more aspects of the present disclosure relate to protecting the integrity of datasets stored by a storage array. In embodiments, an input/output (IO) workload is received at a storage array. A restricted access policy is also established for at least one target of one or more IO requests corresponding to the IO workload. Further, access to the at least one target is restricted based on the restricted access policy.

Dataset integrity protection

A storage node maintains storage objects that contain decoy datasets that are used to detect cyber-attacks. The decoy datasets may be deployed at logical block addresses (LBAs) including the first and last LBAs of the LBA range of the storage object. Real active data may be stored on the storage object with the decoy datasets. A cyber-attack is detected based on receipt of a suspicious IO command that accesses decoy data. Access to the decoy data may be detected by maintaining an IO access bitmap, calculating digital signatures of decoy datasets, or monitoring for decoy data that is marked for remote replication.

Using decoy datasets for cyber threat detection

A secure physical vault is used in connection with cyber protection automation to ensure that initial configuration and all configuration changes to the cyber protection environment are only implemented by a host that is locally physically connected to the cyber vault. By requiring the host to be locally physically connected to the cyber vault, it is possible to prevent remote modifications to the cyber protection environment configuration, thus preventing a remote attack on the cyber protection afforded by the cyber protection environment. The Operating System of a storage system implementing the cyber vault may be flagged to prevent any syscall from being processed that is not received from a host that is locally physically connected to the cyber vault. Host controller software can also be used to ensure that the initial configuration and all configuration changes to the cyber protection environment configuration are only processed if locally received.

Cyber protection automation with secure physical vault

One or more aspects of the present disclosure relate to protecting the integrity of datasets stored by a storage array. In embodiments, one or more IO write requests from an input/output (IO) workload are intercepted. Additionally, a likely cyber-attack event is identified based on a bit density of write data corresponding to the one or more IO requests. Further, the cyber-attack event is mitigated.

Encryption detection

Real Time Intrusion Detection (RTID) is implemented on a host computer by defining an Atypical Access Rate Detection (AARD) policy specifying storage volume access parameters configured to protect particular storage volumes maintained by a storage system for the host computer. An AARD application on the storage system monitors storage volume accesses based on the AARD policy. If a storage volume access is detected that is in violation of the AARD policy, the RTID application on the host computer is notified of the storage volume access. The RTID application on the host determines if the storage volume access was authorized or malicious. If the storage volume access was authorized, the RTID application re-issues the storage volume access and instructs the AARD application that the storage volume access is authorized. If the storage volume access was not authorized, the RTID application prevents the storage volume access to protect the storage volume.

Real time intrusion detection

One or more aspects of the present disclosure relate to establishing and using a hybrid synchronous/asynchronous communication layer for input/output (IO) messages to a storage array. In embodiments, an input/output (IO) message can be modified into first and second IO portions. In addition, a network communications layer can be established to include synchronous and asynchronous channels. Further, the first IO portion can be transmitted over the synchronous channel, and the second IO portion can be transmitted over the asynchronous channel.

Synchronous/asynchronous network communications layer

Copying data from a source storage system to a target storage system includes resetting a write tracker on the source storage system to track writes to the source storage system by one or more host computing systems, copying data from the source storage system to the target storage system after resetting the write tracker, suspending writes to the source storage system after copying the data, and copying data portions of the source storage system to the target storage system that are indicated as being written by the write tracker after suspending writes to the source storage system. Applications that write data to the source storage system may be quiesced in connection with suspending writes to the source storage system. Data portions may be repeatedly copied from the source storage system to the target storage system until an end condition is reached.

Copying data between storage systems

Handling I/O operations between a storage system and a host includes initiating a direct data transfer for each of the I/O operations that initially excludes other processes from using a CPU of the host, setting a first timer for each of the direct data transfers, converting at least some of the direct transfers to semi-synchronous I/O operations that release the CPU for use by other processes and transfer data directly between the storage system and the host in response to the first timer expiring prior to completion of a corresponding one of the direct data transfers, and setting a second timer that corresponds to an expected completion of the semi-synchronous I/O operation. The direct data transfers may exchange data between the host and cache memory of the storage system. The direct data transfers may be performed using a high speed connection between the storage system and the host.

Synchronous to semi-synchronous out-of-band i/o

Running an independent task in connection with a synchronous I/O operation between a storage system and a host includes starting the synchronous I/O operation, setting a timer for the synchronous I/O operation, starting the independent task that runs while waiting for completion of the synchronous I/O operation, and aborting the synchronous I/O operation in response to the timer expiring prior to completion of the synchronous I/O operation. The independent task may be ended in response to the timer expiring. The independent task may be ended in response to the I/O operation completing. The synchronous I/O operation may be performed using a high speed connection between the storage system and the host, which may be coupled to a smart network interface controller provided on a director board in the storage system. The smart network interface controller may include a system on a chip having a processor, memory, and non-volatile storage.

Running an independent task in connection with synchronous I/O operations

A host computing system includes an applications layer containing one or more user applications that perform I/O operations, an access methods layer that communicates with the applications layer, an I/O drivers layer that communicates with the access methods layer, and an SSCH simulation layer that communicates with the I/O drivers layer and that simulates a Fibre Channel connection that is accessed by applications in the applications layer. The host computing system may also include a TCP/IP stack layer that communicates with the SSCH simulation layer to provide TCP/IP communication for the host computing system. TCP/IP communication provided by the TCP/IP stack layer may be separate from any dedicated TCP/IP communication provided by the host. The host computing system may be coupled to a TCP/IP network. A cloud storage may be coupled to the network to communicate with the host computing system.

Simulation for alternative communication

Using high speed data transfer protocol to transfer data between a host and a storage system includes determining if a portion of data is a candidate for being transferred using the high speed data transfer protocol if the portion is not a candidate for high speed data transfer, transferring the data using a relatively low speed data transfer protocol if the portion is a candidate for high speed data transfer, attempting to transfer the data using the high speed data transfer protocol, and if transferring the data using the high speed data transfer protocol is unsuccessful, transferring the data using the relatively low speed data transfer protocol. The high speed data transfer protocol may use a first connection and the relatively low speed data transfer protocol may use a second connection. The first connection may be a PCIe or InfiniBand connection. The second connection may be a FICON connection.

Using high speed data transfer protocol

Accessing additional storage space of a storage system includes reading a physical data fragment that is an incremental subset of a physical storage unit of the storage system, accessing metadata corresponding to logical blocks stored on the physical data fragment to determine a sidebar storage portion of the physical data fragment that is unused by the logical blocks, and accessing data of the sidebar storage portion. Accessing data of the sidebar storage portion may include providing data from the sidebar storage portion to a calling process. Accessing data of the sidebar storage portion may include modifying a portion of data from the physical data fragment and writing the physical data fragment back to the physical storage device. The physical data fragment may be locked prior to reading the physical data fragment and the physical data fragment may be unlocked after writing the physical data fragment.

Accessing storage space of a physical data fragment in a storage system

Providing concurrent access to a tape volume of a tape emulation unit includes a first process generating a first attachment request to attach to the tape emulation unit, generating a first unique id corresponding to the first attachment request, a second process generating a second attachment request, different from the first attachment request, to attach to the tape emulation unit, generating a second unique id corresponding to the second attachment request, and allowing the first process to access a tape volume on the tape emulation unit using the first unique id while the second process concurrently accesses the tape volume on the tape emulation unit using the second unique id. The first process may access the tape volume for writing data to the tape volume. Only one of the processes may access the tape volume for writing data to the tape volume.

Concurrent tape access

Directly writing snapshot data for a volume on a storage system to an external storage includes receiving a write of new data to a portion of the storage system, forming encapsulated data by encapsulating either the new data or data at the portion of the storage system in a format that is native to the storage system, and directly writing the encapsulated data to the external storage. The external storage may be cloud storage or may be a tape emulation unit. The data at the portion of the storage system may be encapsulated prior to writing the new data to the storage system. The new data may be encapsulated. Prior to receiving a write of the new data, a full backup may be performed from the storage system to the external storage. The encapsulated data may provide an incremental backup for the full backup.

Direct snapshot to external storage

Cloning a running computing system includes quiescing processes running on a source computing system, saving state data of the source computing system, configuring a target computing system using the state data from the source computing system, and resuming program execution at the source computing system and the target computing system. Quiescing processes running on the source computing system may include marking all of the processes on the source computing system as non-dispatchable. All external resources may be identified for the source computing system prior to quiescing processes running on a source computing system. The external resources may include devices and files. The target computing system may access data that is also accessed by the source computing system. Data accessed by the source computing system may be cloned for access by the target computing system prior to resuming program execution. The data may be cloned using snapshot copies.

Growing community of inventors

Shrewsbury, MA, United States of America

Paul A Linstead