Abstract: Real Time Intrusion Detection (RTID) is implemented on a host computer by defining an Atypical Access Rate Detection (AARD) policy specifying storage volume access parameters configured to protect particular storage volumes maintained by a storage system for the host computer. An AARD application on the storage system monitors storage volume accesses based on the AARD policy. If a storage volume access is detected that is in violation of the AARD policy, the RTID application on the host computer is notified of the storage volume access. The RTID application on the host determines if the storage volume access was authorized or malicious. If the storage volume access was authorized, the RTID application re-issues the storage volume access and instructs the AARD application that the storage volume access is authorized. If the storage volume access was not authorized, the RTID application prevents the storage volume access to protect the storage volume.

Abstract: Real Time Intrusion Detection (RTID) is implemented on a host computer by defining an Atypical Access Rate Detection (AARD) policy specifying storage volume access parameters configured to protect particular storage volumes maintained by a storage system for the host computer. An AARD application on the storage system monitors storage volume accesses based on the AARD policy. If a storage volume access is detected that is in violation of the AARD policy, the RTID application on the host computer is notified of the storage volume access. The RTID application on the host determines if the storage volume access was authorized or malicious. If the storage volume access was authorized, the RTID application re-issues the storage volume access and instructs the AARD application that the storage volume access is authorized. If the storage volume access was not authorized, the RTID application prevents the storage volume access to protect the storage volume.

Abstract: Handling failure of a primary group at a first data center that is part of plurality of data centers providing triangular asynchronous replication, includes creating a data mirroring relationship between at least one storage volume at a second data center having a synchronous backup group that is part of the plurality of data centers and at least one storage volume at a third data center having an asynchronous backup group that is part of the plurality of data centers and resuming work at the second data center. Handling failure of a primary group at a first data center may also include synchronizing the at least one storage volume at the second data center with the at least one storage volume at the third data center prior to resuming work at the second data center.

Abstract: Handling failure of a primary group at a first data center that is part of plurality of data centers providing triangular asynchronous replication includes creating a data mirroring relationship between at least one storage volume at a second data center having a synchronous backup group that is part of the plurality of data centers and at least one storage volume at a third data center having an asynchronous backup group that is part of the plurality of data centers and resuming work at the third data center. Handling failure of a primary group at a first data center may also include synchronizing the at least one storage volume at the second data center with the at least one storage volume at the third data center prior to resuming work at the third data center.

Abstract: A primary group may be swapped with a synchronous backup group where triangular asynchronous replication is being provided between the primary group, the synchronous backup group and an asynchronous backup group. Swapping may include halting work at the primary group, transferring pending mirrored data from the primary group to an asynchronous backup group, creating a data mirroring relationship between a storage volume at the synchronous backup group and a storage volume at the asynchronous backup group, reversing a data mirroring relationship between the storage volume at the primary group and the storage volume at the synchronous backup group, and resuming work at the asynchronous backup group.

Abstract: Handling failure of a primary group at a first data center that is part of plurality of data centers providing triangular asynchronous replication includes creating a data mirroring relationship between at least one storage volume at a second data center having a synchronous backup group that is part of the plurality of data centers and at least one storage volume at a third data center having an asynchronous backup group that is part of the plurality of data centers and resuming work at the third data center. Handling failure of a primary group at a first data center may also include synchronizing the at least one storage volume at the second data center with the at least one storage volume at the third data center prior to resuming work at the third data center.

Abstract: A mass storage business continuance time maker function host system that allows one or more MVS mainframe hosts to have the time to: establish business continuation volumes to mirror the standard mass storage volumes; synchronize business continuation volumes with the standard volumes so that their contents are identical; split off a business continuation volume from its standard volume counterpart to make the business continuation volume available for other purposes; and enable a business continuation volume to be used to restore the contents of a standard volume—all without halting or disrupting the business applications using standard volumes. These and related services are provided in a transparent manner to a host mainframe by manipulating MVS format volume labels, volume tables of contents and indexes, catalog entries, data set names and similar mechanisms on mass storage devices connected to host mainframes using the MVS operating system.

Abstract: Managing data on a storage device includes intercepting unencrypted data to be stored on the storage device, where intercepting unencrypted data is transparent to an application storing the data on the storage device and encrypting the data prior to storage on the storage device. The storage device may include a tape drive and/or a disk drive. Managing data on a storage device may also include migrating data from a first storage location to a second storage location. The first storage location may be the same as the second storage location or the first storage location may be different from the second storage location. The unencrypted data may be intercepted during migration. Managing data on a storage device may also include decrypting data read from the storage device.

Abstract: Ordering data writes includes at least some of a group of primary storage devices receiving a first plurality of data writes, causing a cycle switch for the group of primary storage devices where the first plurality of data writes are associated with a particular cycle on each primary storage device in the group, and at least some of the group of primary storage devices receiving a second plurality of writes after initiating the cycle switch where all of the second plurality of writes are associated with a cycle different from the particular cycle on each primary storage device. Writes to the group begun after initiating the cycle switch may not complete until after the cycle switch has completed. Ordering data writes may also include, after completion of the cycle switch, each of the primary storage devices of the group initiating transfer of the first plurality of writes to a corresponding secondary storage device.

Abstract: Storing recovery data includes a host processor writing data to a local storage device, the host processor causing the local storage device to accumulate chunks of data corresponding to writes by the host processor, where each chunk of data represents data written before a first time and after a second time and where the second time for one of the particular chunks of data corresponds to a first time for a subsequent one of the particular chunks of data, transmitting the chunks of data from the local storage device to a remote destination, providing synchronous data from the local storage device to a local destination; and, the host processor causing an indicator to be provided to the local destination in connection with creation of a new chunk of data for storage at the remote destination. The local destination may maintain a plurality of maps, where each of the maps associates synchronous data being provided thereto with a specific chunk of data.

Abstract: Storing recovery data includes providing chunks of data to a remote destination, where each chunk of data represents data written before a first time and after a second time and where the second time for one of the particular chunks corresponds to a first time for a subsequent one of the particular chunks, providing synchronous data to a local destination, and providing an indicator to the local destination in connection with creation of a new chunk of data for storage at the remote destination. The local destination may maintain a plurality of maps, where each of the maps associates synchronous data being provided thereto with a specific chunk of data. In response to receiving an indicator in connection with creation of a new chunk of data, the local destination may point to a new map. There may be two maps or more than two maps.

Abstract: Storing recovery data includes providing chunks of data to a remote destination, where each chunk of data represents data written before a first time and after a second time and where the second time for one of the particular chunks corresponds to a first time for a subsequent one of the particular chunks, providing synchronous data to a local destination, and providing an indicator to the local destination in connection with creation of a new chunk of data for storage at the remote destination. The local destination may maintain a plurality of maps, where each of the maps associates synchronous data being provided thereto with a specific chunk of data. In response to receiving an indicator in connection with creation of a new chunk of data, the local destination may point to a new map. There may be two maps or more than two maps.

Abstract: A method and apparatus for migrating one or more data sets each having one or more extents from one or more source logical devices to one or more target logical devices concurrently with interaction between the application and the data being migrated. A background operation copies each extent from the source logical device to the target logical device in a copy state. When a certain level of data has been copied, the extent is locked to assure synchronization of the data in the target logical device to the corresponding data in the source logical device. The status is changed to a mirrored state. When the extents for a data set in a source logical device or in a group of data sets have been mirrored, all the extents are changed to a diverted state. I/O requests to the diverted extents thereafter are intercepted and processed according to whether they access an extent that is in the copy, mirrored, or diverted state.

Abstract: Recovering data provided in chunks to a plurality of secondary storage devices includes, for each of the secondary storage devices, discarding data corresponding chunks for which all data thereof has not been received, and, for each of the secondary storage devices, restoring a chunk of data thereto where all of the chunks of data restored to the plurality of secondary storage devices correspond to a particular transmission cycle of primary storage devices that provide data to the plurality of secondary storage devices. Recovering data may also include, following discarding and prior to restoring, for each of the plurality of secondary storage devices having two different chunks, waiting for external intervention to indicate whether to restore a particular one of the chunks. The external intervention may be provided by a host computer that is proximate to at least one of the secondary storage devices or may be provided by a host computer that is proximate to at least one of the primary storage computers.

Abstract: Ordering data writes includes at least some of a group of primary storage devices receiving a first plurality of data writes, causing a cycle switch for the group of primary storage devices where the first plurality of data writes are associated with a particular cycle on each primary storage device in the group, and at least some of the group of primary storage devices receiving a second plurality of writes after initiating the cycle switch where all of the second plurality of writes are associated with a cycle different from the particular cycle on each primary storage device. Writes to the group begun after initiating the cycle switch may not complete until after the cycle switch has completed. Ordering data writes may also include, after completion of the cycle switch, each of the primary storage devices of the group initiating transfer of the first plurality of writes to a corresponding secondary storage device.

Abstract: A mass storage business continuance time maker function host system that allows one or more MVS mainframe hosts to have the time to: establish business continuation volumes to mirror the standard mass storage volumes; synchronize business continuation volumes with the standard volumes so that their contents are identical; split off a business continuation volume from its standard volume counterpart to make the business continuation volume available for other purposes; and enable a business continuation volume to be used to restore the contents of a standard volume—all without halting or disrupting the business applications using standard volumes. These and related services are provided in a transparent manner to a host mainframe by manipulating MVS format volume labels, volume tables of contents and indexes, catalog entries, data set names and similar mechanisms on mass storage devices connected to host mainframes using the MVS operating system.

Abstract: A host system for remote control of mass storage volumes using cascading commands which collect information about linked remote volumes located in physically separate sites so other cascading commands can be issued to effect changes in linked remote volumes. A host computer program issues the cascading commands which ask the locally communicating mass storage system to return information which can be used to identify one or more levels of remote mass storage systems in a stream of remote mass storage systems. Once a mass storage system at a given level has been identified, commands can be sent by the host through the locally communicating mass storage system to cause actions to occur at the identified remote level, whether or not there are multiple intervening levels of remote mass storage systems.