Dell Products Inc.

Emc IP Holding Company LLC

Peter Callewaert

Dennis Trulli, Jr

Brett A Quinn

Kenneth J Schopp

Dennis Trulli

Melissa Flynn

Evan Jones

David Goncalves

John P Darling

John Darling

Kevin Heasley

A secure physical vault is used in connection with cyber protection automation to ensure that initial configuration and all configuration changes to the cyber protection environment are only implemented by a host that is locally physically connected to the cyber vault. By requiring the host to be locally physically connected to the cyber vault, it is possible to prevent remote modifications to the cyber protection environment configuration, thus preventing a remote attack on the cyber protection afforded by the cyber protection environment. The Operating System of a storage system implementing the cyber vault may be flagged to prevent any syscall from being processed that is not received from a host that is locally physically connected to the cyber vault. Host controller software can also be used to ensure that the initial configuration and all configuration changes to the cyber protection environment configuration are only processed if locally received.

Cyber protection automation with secure physical vault

Storage volumes of a remote data forwarding group are mirrored on a leg of a data replication facility from a production site in a primary region of the data replication facility to a cyber vault using asynchronous remote data forwarding. A multi-site consistency application is used to bring and maintain the data of the storage volumes on the cyber vault into a consistent state. Once the storage volumes in the cyber vault have achieved a consistent state, a snapset including a snapshot of each of the storage volumes is created from the storage volumes contained in the cyber vault on a determined rhythm. The snapset is optionally linked to a set of target devices at the cyber vault. If the production site is not in the primary region, the absence of consistency of the data at the cyber vault halts creation of snapsets at the cyber vault.

Space-saving cyber protection automation

RDF/QAR bandwidth reduction is a GDDR feature that allows for separate synchronous-only RDF groups from sites DC1→DC2 to be included in the QAR consistency group definition without RDF/A protection. The devices in these sync-only RDF groups form perfect quadruplets like regular QAR devices, but the RDF groups from sites DC1→DC3 and DC2→DC4 are not included in QAR-A and QAR-B Multi Session Consistency group definitions. Instead, these sync-only pairing RDF groups are replicated to the secondary region using ADCOPY-DISK mode or not replicating at all (suspended). The sync-only devices have no QAR recovery capability from sites DC3→DC4, but device pairing from DC3→DC4 is present via sync-only RDF groups.

GDDR RDF/QAR bandwidth reduction

A method, comprising: retrieving a VDG definition; processing the VDG definition to identify a primary storage system and one or more secondary storage systems; detecting a consistency formation event; transmitting a first instruction to initialize one or more data structures for a first snapshot of a volume that is stored in the primary storage system; transmitting, to each of the secondary storage systems, a respective second instruction to initialize one or more data structures for a respective snapshot of a copy of the volume that is stored in that secondary storage system; suspending servicing of input-output (I/O) by the primary storage system; transmitting to the primary storage system a third instruction to complete the first snapshot of the volume; transmitting to each of the secondary storage systems a respective fourth instruction to complete a respective snapshot of the copy of the volume; and resuming servicing of I/O.

Method and apparatus for snapshot creation

An Orchestrated Data Recovery (ODR) Cyber Protection Automation (CPA) operates to ensure one-to-one creation of snapsets of a production site and corresponding snapsets of a cyber vault. During an initiation phase, the ODR CPA monitors synchronization of a snapset of production volumes from the production site to the cyber vault. If additional snapsets of the production volumes are created prior to completion of synchronization of the first snapset, the additional snapsets are also synchronized to the cyber vault. Once the initial synchronization of the storage volumes has been completed, the ODR CPA causes a Storage Volume Creation and Management System (SVCMS) to create a snapset of the storage volumes at the cyber vault. Subsequently, each time a snapset is created of the production site, the ODR CPA orchestrates synchronization of the snapset to the cyber vault and creation of a corresponding snapset at the cyber vault.

Automated orchestration of cyber protection of a set of storage volumes

A consistency group is defined to include a set of required devices on a set of storage systems. Write patterns on each of the required devices are monitored and write patterns on each of the other devices on the set of storage systems is monitored. Pairs of devices are formed, in which each pair includes one required device and one other device. Write patterns of the pairs of devices are compared to determine respective percentage coordinated write probabilities for pairs of devices. Write patterns of the pairs of devices are also compared to determine ratios of write operations for pairs of devices. A coordinate write probability above a threshold, or a determined ratio of write operations that occurs sufficiently frequently, is interpreted as an indication that one of the other devices should be included in the consistency group. A learning process is trained and used to analyze the write patterns.

Method and apparatus for identifying a device missing from a consistency group

A consistency group is defined to include a set of required devices on a set of storage systems. High activity devices are determined, and write dependencies between each high activity device and each low activity devices are monitored. A set of high importance devices is determined to include the high activity devices and low activity devices with a high write dependency on at least one of the high activity devices. Comparative write patterns between the high importance devices and low importance devices are used to determine a set of candidate devices for removal from the consistency group. The high importance devices, rather than all devices of the consistency group, are also used to determine a set of devices that have inadvertently not been included in the consistency group.

Method and apparatus for identifying high importance devices of a consistency group

The system and methods disclosed herein relate to an improved hardware configuration for geographically dispersed data restart ('GDDR') systems. Specifically, the teachings herein allow users to reduce the number of operating systems required to run multiple GDDR systems simultaneously by employing multitenancy principles in the system design. The embodiments cover a system for operating multiple GDDR complexes wherein the individual control systems typically required to run each GDDR complex are combined into a single logical partition. We also disclose methods and computer executable products for operating multiple GDDR complexes wherein the individual control systems typically required to run each GDDR complex are combined into a single logical partition.

Geographically dispersed disaster restart multitenancy systems

The system, products, and methods disclosed herein relate to an improved configuration for geographically dispersed data restart ('GDDR') systems. Specifically, the teachings herein ensure a particular GDDR instance does not react to messages issued from address spaces outside of its affinity group. We use the term message 'affinity group' to mean the combination of a particular GDDR instance and its set of Mainframe Enablers started tasks. By ensuring that the particular GDDR instance does not react to messages intended for recipients outside of its affinity group, we improve computer functionality and efficiency by facilitating further partitioning of the logical partition. Once the logical partition is further partitioned into additional address spaces, it is possible to run Mainframe Enablers and/or additional GDDR instances independent of the particular GDDR instance of concern.

Growing community of inventors

Puurs-Sint-Amands, Belgium

Peter Callewaert