Abstract: A method, comprising: retrieving a VDG definition; processing the VDG definition to identify a primary storage system and one or more secondary storage systems; detecting a consistency formation event; transmitting a first instruction to initialize one or more data structures for a first snapshot of a volume that is stored in the primary storage system; transmitting, to each of the secondary storage systems, a respective second instruction to initialize one or more data structures for a respective snapshot of a copy of the volume that is stored in that secondary storage system; suspending servicing of input-output (I/O) by the primary storage system; transmitting to the primary storage system a third instruction to complete the first snapshot of the volume; transmitting to each of the secondary storage systems a respective fourth instruction to complete a respective snapshot of the copy of the volume; and resuming servicing of I/O.

Abstract: Real Time Intrusion Detection (RTID) is implemented on a host computer by defining an Atypical Access Rate Detection (AARD) policy specifying storage volume access parameters configured to protect particular storage volumes maintained by a storage system for the host computer. An AARD application on the storage system monitors storage volume accesses based on the AARD policy. If a storage volume access is detected that is in violation of the AARD policy, the RTID application on the host computer is notified of the storage volume access. The RTID application on the host determines if the storage volume access was authorized or malicious. If the storage volume access was authorized, the RTID application re-issues the storage volume access and instructs the AARD application that the storage volume access is authorized. If the storage volume access was not authorized, the RTID application prevents the storage volume access to protect the storage volume.

Abstract: One or more aspects of the present disclosure relate to protecting the integrity of datasets stored by a storage array. In embodiments, one or more IO write requests from an input/output (IO) workload are intercepted. Additionally, a likely cyber-attack event is identified based on a bit density of write data corresponding to the one or more IO requests. Further, the cyber-attack event is mitigated.

Abstract: One or more aspects of the present disclosure relate to protecting the integrity of datasets stored by a storage array. In embodiments, an input/output (IO) workload is received at a storage array. A restricted access policy is also established for at least one target of one or more IO requests corresponding to the IO workload. Further, access to the at least one target is restricted based on the restricted access policy.

Abstract: A method, comprising: retrieving a VDG definition; processing the VDG definition to identify a primary storage system and one or more secondary storage systems; detecting a consistency formation event; transmitting a first instruction to initialize one or more data structures for a first snapshot of a volume that is stored in the primary storage system; transmitting, to each of the secondary storage systems, a respective second instruction to initialize one or more data structures for a respective snapshot of a copy of the volume that is stored in that secondary storage system; suspending servicing of input-output (I/O) by the primary storage system; transmitting to the primary storage system a third instruction to complete the first snapshot of the volume; transmitting to each of the secondary storage systems a respective fourth instruction to complete a respective snapshot of the copy of the volume; and resuming servicing of I/O.

Abstract: Recovery of a primary image is facilitated by using non-consistent snapshots on a primary storage array and consistent snapshots on a secondary storage array to avoid the need to transmit entire secondary replicas from the secondary storage array to the primary storage array. Non-consistent snaps of the primary replicas are generated by the primary storage array. Consistent snaps of the secondary replicas are generated by the secondary storage array. The primary replicas are recovered by linking non-consistent snaps to primary staging volumes, linking consistent snaps to secondary staging volumes, synchronizing the primary and secondary staging volumes, and using the synchronized primary staging volumes to recover the primary replicas.

Abstract: Recovery of a primary image is facilitated by using consistent snapshots on a primary storage array and consistent snapshots on a secondary storage array to avoid the need to transmit entire secondary replicas of storage objects from the secondary storage array to the primary storage array. Consistent snaps of the primary replicas are generated by the primary storage array. Consistent snaps of the secondary replicas are generated by the secondary storage array. The primary image is recovered by linking consistent snaps on the primary storage array to primary staging volumes, linking consistent snaps on the secondary storage array to secondary staging volumes, synchronizing the primary and secondary staging volumes, and migrating host IO traffic to the synchronized staging volumes.

Abstract: Embodiments of the present disclosure include receiving one or more input/output (IO) requests at a storage array from a host device. Furthermore, the IO requests can include at least one data replication and recovery operation. In addition, the host device's connectivity access to a recovery storage array can be determined. Data replication and recovery operations can be performed based on the host device's connectivity to the recovery storage array.

Abstract: Embodiments of the present disclosure include receiving one or more input/output (IO) requests at a storage array from a host device. Furthermore, the IO requests can include at least one data replication and recovery operation. In addition, the host device's connectivity access to a recovery storage array can be determined. Data replication and recovery operations can be performed based on the host device's connectivity to the recovery storage array.

Abstract: An Orchestrated Data Recovery (ODR) Cyber Protection Automation (CPA) operates to ensure one-to-one creation of snapsets of a production site and corresponding snapsets of a cyber vault. During an initiation phase, the ODR CPA monitors synchronization of a snapset of production volumes from the production site to the cyber vault. If additional snapsets of the production volumes are created prior to completion of synchronization of the first snapset, the additional snapsets are also synchronized to the cyber vault. Once the initial synchronization of the storage volumes has been completed, the ODR CPA causes a Storage Volume Creation and Management System (SVCMS) to create a snapset of the storage volumes at the cyber vault. Subsequently, each time a snapset is created of the production site, the ODR CPA orchestrates synchronization of the snapset to the cyber vault and creation of a corresponding snapset at the cyber vault.

Abstract: Handling failure of a primary group at a first data center that is part of plurality of data centers providing triangular asynchronous replication includes creating a data mirroring relationship between at least one storage volume at a second data center having a synchronous backup group that is part of the plurality of data centers and at least one storage volume at a third data center having an asynchronous backup group that is part of the plurality of data centers and resuming work at the third data center. Handling failure of a primary group at a first data center may also include synchronizing the at least one storage volume at the second data center with the at least one storage volume at the third data center prior to resuming work at the third data center.

Abstract: Handling failure of a primary group at a first data center that is part of plurality of data centers providing triangular asynchronous replication, includes creating a data mirroring relationship between at least one storage volume at a second data center having a synchronous backup group that is part of the plurality of data centers and at least one storage volume at a third data center having an asynchronous backup group that is part of the plurality of data centers and resuming work at the second data center. Handling failure of a primary group at a first data center may also include synchronizing the at least one storage volume at the second data center with the at least one storage volume at the third data center prior to resuming work at the second data center.

Abstract: A primary group may be swapped with a synchronous backup group where triangular asynchronous replication is being provided between the primary group, the synchronous backup group and an asynchronous backup group. Swapping may include halting work at the primary group, transferring pending mirrored data from the primary group to an asynchronous backup group, creating a data mirroring relationship between a storage volume at the synchronous backup group and a storage volume at the asynchronous backup group, reversing a data mirroring relationship between the storage volume at the primary group and the storage volume at the synchronous backup group, and resuming work at the asynchronous backup group.

Abstract: Handling failure of a primary group at a first data center that is part of plurality of data centers providing triangular asynchronous replication includes creating a data mirroring relationship between at least one storage volume at a second data center having a synchronous backup group that is part of the plurality of data centers and at least one storage volume at a third data center having an asynchronous backup group that is part of the plurality of data centers and resuming work at the third data center. Handling failure of a primary group at a first data center may also include synchronizing the at least one storage volume at the second data center with the at least one storage volume at the third data center prior to resuming work at the third data center.

Abstract: Storing recovery data includes a host processor writing data to a local storage device, the host processor causing the local storage device to accumulate chunks of data corresponding to writes by the host processor, where each chunk of data represents data written before a first time and after a second time and where the second time for one of the particular chunks of data corresponds to a first time for a subsequent one of the particular chunks of data, transmitting the chunks of data from the local storage device to a remote destination, providing synchronous data from the local storage device to a local destination; and, the host processor causing an indicator to be provided to the local destination in connection with creation of a new chunk of data for storage at the remote destination. The local destination may maintain a plurality of maps, where each of the maps associates synchronous data being provided thereto with a specific chunk of data.

Abstract: Storing recovery data includes providing chunks of data to a remote destination, where each chunk of data represents data written before a first time and after a second time and where the second time for one of the particular chunks corresponds to a first time for a subsequent one of the particular chunks, providing synchronous data to a local destination, and providing an indicator to the local destination in connection with creation of a new chunk of data for storage at the remote destination. The local destination may maintain a plurality of maps, where each of the maps associates synchronous data being provided thereto with a specific chunk of data. In response to receiving an indicator in connection with creation of a new chunk of data, the local destination may point to a new map. There may be two maps or more than two maps.