Abstract: Real Time Intrusion Detection (RTID) is implemented on a host computer by defining an Atypical Access Rate Detection (AARD) policy specifying storage volume access parameters configured to protect particular storage volumes maintained by a storage system for the host computer. An AARD application on the storage system monitors storage volume accesses based on the AARD policy. If a storage volume access is detected that is in violation of the AARD policy, the RTID application on the host computer is notified of the storage volume access. The RTID application on the host determines if the storage volume access was authorized or malicious. If the storage volume access was authorized, the RTID application re-issues the storage volume access and instructs the AARD application that the storage volume access is authorized. If the storage volume access was not authorized, the RTID application prevents the storage volume access to protect the storage volume.

Abstract: A storage node maintains storage objects that contain decoy datasets that are used to detect cyber-attacks. The decoy datasets may be deployed at logical block addresses (LBAs) including the first and last LBAs of the LBA range of the storage object. Real active data may be stored on the storage object with the decoy datasets. A cyber-attack is detected based on receipt of a suspicious IO command that accesses decoy data. Access to the decoy data may be detected by maintaining an IO access bitmap, calculating digital signatures of decoy datasets, or monitoring for decoy data that is marked for remote replication.

Abstract: One or more aspects of the present disclosure relate to protecting the integrity of datasets stored by a storage array. In embodiments, one or more IO write requests from an input/output (IO) workload are intercepted. Additionally, a likely cyber-attack event is identified based on a bit density of write data corresponding to the one or more IO requests. Further, the cyber-attack event is mitigated.

Abstract: One or more aspects of the present disclosure relate to protecting the integrity of datasets stored by a storage array. In embodiments, an input/output (IO) workload is received at a storage array. A restricted access policy is also established for at least one target of one or more IO requests corresponding to the IO workload. Further, access to the at least one target is restricted based on the restricted access policy.

Abstract: Techniques are provided for assigning alias devices in a parallel access volume storage environment. An exemplary method for assigning alias devices by a host in a parallel access volume storage environment comprises: obtaining a next I/O (input/output) operation from a queue; obtaining a utilization factor for a plurality of available I/O processing thread in the storage controller; and assigning the next I/O operation to an alias device associated with a given one of the plurality of available I/O processing threads based on the utilization factors.

Abstract: Providing I/O operations to a storage device includes selecting a portion of original I/O operations based on a first set of criteria, determining whether to subdivide each of the portion of original I/O operations that are selected according to a second set of criteria different than the first set of criteria, and converting each of the original I/O operations selected for subdivision into a plurality of subdivided I/O operations for different portions of data for a corresponding one of the original I/O operations. The first set of criteria may include whether the I/O operations are for multiple tracks of data. The second set of criteria may include determining a measured amount of performance improvement for previous subdivision operations. Performance of subdivided I/O operations may be monitored. A number of subdivided I/O operations may be limited by a number of available parallel I/O routes.

Abstract: Releasing a data set at a source device in connection with migrating data from the source device to a target device includes mapping application address space to address space containing metadata for the target device and providing additional local metadata therefor, replacing within the application the address of metadata for the source device with the address of metadata for the target device, setting a diversion flag that is part of the additional local metadata, where the diversion flag indicates a remapping of extent, and closing and unallocating the data set at the source device. Releasing a data set at a source device in connection with migrating data from the source device to a target device may also include determining if an application uses standard I/O operations. The metadata may include UCB data.

Abstract: Releasing a data set at a source device in connection with migrating data from the source device to a target device includes mapping application address space to address space containing metadata for the target device and providing additional local metadata therefor, replacing within the application the address of metadata for the source device with the address of metadata for the target device, setting a diversion flag that is part of the additional local metadata, where the diversion flag indicates a remapping of extent, and closing and unallocating the data set at the source device. Releasing a data set at a source device in connection with migrating data from the source device to a target device may also include determining if an application uses standard I/O operations. The metadata may include UCB data.

Abstract: Non-disruptive modification of data in-place includes generating a copy of source data to a holding area. Data modification, such as encryption and/or other transformation process, may be performed on the source data in the source area while I/O operations of applications needing access to the source data is diverted to the data copy in the holding area. Updates to the data copy in the holding area from the continued I/O operations are tracked and the data updates are modified and transferred to the source area. Following successful modification of the source data, the I/O operations of the applications are re-directed back to the source area having the newly modified source data. The holding area may then be freed for subsequent use.

Abstract: A host computer system (host) includes an application that generates I/O commands for a first type of point-in-time (PIT) copy operation, and an I/O subsystem coupled to a data storage system capable of performing a second type of PIT copy operation. The host processes the I/O commands as part of an emulation of the first type of PIT copy operation, including determining whether the I/O commands require modification for the emulation, and if so whether they are of a back-end type or an out-of-band type. The I/O commands that do not require modification are processed without modification via the I/O subsystem. For the back-end I/O commands, (i) an intercept condition is set, (ii) the I/O commands are processed via the I/O subsystem, and (iii) upon completion with the intercept condition set, the results are modified so as to indicate to the application that the first type of PIT copy operation can be performed on the storage volumes.

Abstract: Providing a mechanism for performing special processing in connection with application I/O operations for a device includes mapping application address space to address space containing metadata for the device and providing additional local metadata therefor and providing an eyecatcher in the additional local metadata. Providing a mechanism for performing special processing in connection with application I/O operations for a device may also include determining if the application uses standard I/O operations. The metadata may include UCB data. The additional local metadata may be provided immediately following the application address space mapped to the address space containing metadata.

Abstract: Managing data on a storage device includes intercepting unencrypted data to be stored on the storage device, where intercepting unencrypted data is transparent to an application storing the data on the storage device and encrypting the data prior to storage on the storage device. The storage device may include a tape drive and/or a disk drive. Managing data on a storage device may also include migrating data from a first storage location to a second storage location. The first storage location may be the same as the second storage location or the first storage location may be different from the second storage location. The unencrypted data may be intercepted during migration. Managing data on a storage device may also include decrypting data read from the storage device.

Abstract: A method and apparatus for migrating one or more data sets each having one or more extents from one or more source logical devices to one or more target logical devices concurrently with interaction between the application and the data being migrated. A background operation copies each extent from the source logical device to the target logical device in a copy state. When a certain level of data has been copied, the extent is locked to assure synchronization of the data in the target logical device to the corresponding data in the source logical device. The status is changed to a mirrored state. When the extents for a data set in a source logical device or in a group of data sets have been mirrored, all the extents are changed to a diverted state. I/O requests to the diverted extents thereafter are intercepted and processed according to whether they access an extent that is in the copy, mirrored, or diverted state.