Designated data-only attribute read

Abstract

A technique to obtain attributes associated with data includes providing an attribute-only read request for a specified data element, accessing a metadata structure that stores one or more attributes associated with the specified data element, and returning the attribute(s) instead of the data itself in response to the request.

Description

Technical Field

[0001] This invention relates to the field of data storage. Background of the Invention A data storage system is a hardware and software arrangement in which a storage processor is coupled to an array of non-volatile storage devices, such as disk drives, electronic flash drives, and / or optical drives. The storage processor is supplied by the host machine (“…”). host machine The system provides services for storage requests that specify blocks, files, and / or other data elements to be written, read, created, deleted, etc. Software running on the storage processor manages incoming storage requests and performs various data processing tasks to organize and protect data elements on the non-volatile storage device.

[0002] Applications running on the host machine typically issue read requests to data objects served by the data storage system. For example, a host application might issue a read request to obtain data contained within a specified range of a LUN (Logical Unit). A read request can identify the LUN by its logical unit number and specify the range as an offset to the LUN and its length. A host application can also issue read requests to obtain a specified range of data from a particular file, for example, by identifying the file system, filename, and range within the indicated file.

[0003] In addition to receiving read requests from the host, a data storage system can also issue its own internal read requests. For example, a storage system can read data as part of performing data deduplication, migration, replication, relocation, or defragmentation. Summary of the Invention

[0004] Unfortunately, read requests can involve significant latency. For example, processing a read request typically requires instructing the disk controller to retrieve the requested data from the backend storage device (e.g., one or more disk drives or flash drives), which can take considerable time. If the data is compressed, decompressing it can introduce additional latency. Sometimes, the operation to be performed is not related to the data itself, but rather to its attributes. However, issuing a conventional read request does not return the expected attributes. Therefore, a way to read the attributes of specified data without obtaining the data itself is needed.

[0005] The aforementioned requirements are addressed at least in part by an improved approach comprising: providing an attribute-only read request for a specified data element; accessing a metadata structure storing one or more attributes associated with the specified data element; and returning the attribute (or multiple attributes) instead of the data itself in response to the request. Advantageously, the improved technique obtains the desired attribute without suffering the latency or processing overhead typically associated with data reads. Because the accessed metadata structure is often cached, attribute-only read requests can typically be processed with minimal latency without requiring numerous (if any) reads from the backend storage.

[0006] Some implementations involve a method for obtaining attributes associated with data. The method includes forming a read request for a specified data element. The read request instructs an attribute-only read of a set of attributes associated with the specified data element. In response to the read request, the method further includes accessing a set of metadata structures storing the set of attributes. The method further includes returning the set of attributes instead of the specified data element itself in response to the read request.

[0007] Other embodiments relate to a computerized device configured and arranged to perform a method for obtaining attributes associated with data, such as the method described above. Further embodiments relate to a computer program product. The computer program product stores instructions that, when executed by control circuitry of the computerized device, cause the computerized device to perform a method for obtaining attributes associated with data, such as the method described above.

[0008] The above overview is presented for illustrative purposes to help readers easily grasp the exemplary features presented herein; however, this overview is not intended to illustrate required elements or limit its implementation in any way. It should be understood that the above features can be combined in any technically significant manner, and all such combinations are intended to be disclosed herein, regardless of whether such combinations are explicitly identified. Attached Figure Description

[0009] As shown in the accompanying drawings, the foregoing and other features and advantages will become apparent from the following description of a particular embodiment, in which the same reference numerals refer to the same or similar parts in different views.

[0010] Figure 1 This is a block diagram of an exemplary environment in which certain implementations of improved technologies can be practiced.

[0011] Figure 2 This is a block diagram illustrating an exemplary data path from which attributes of a specified data element can be obtained.

[0012] Figure 3This is a block diagram illustrating an exemplary format for an attribute-only read request.

[0013] Figure 4 This is a flowchart illustrating an exemplary method for obtaining one or more attributes and applying such attributes to determine whether a ransomware attack is suspected.

[0014] Figure 5 This is a flowchart illustrating an exemplary method for obtaining one or more attributes and applying such attributes to perform storage tiering.

[0015] Figure 6 This is a flowchart illustrating an exemplary method for obtaining one or more attributes and applying such attributes to perform fingerprint-based data matching.

[0016] Figure 7 This is a flowchart illustrating an exemplary method for obtaining one or more attributes and applying such attributes to identify sequence data.

[0017] Figure 8 This is a flowchart illustrating an exemplary method for obtaining attributes associated with data. Detailed Implementation

[0018] Implementation schemes for the improved techniques will now be described. It should be understood that such implementation schemes are provided by way of example to illustrate certain features and principles of this disclosure, but are not intended to be limiting.

[0019] An improved technique for obtaining attributes associated with data includes: providing an attribute-only read request for a specified data element; accessing a metadata structure that stores one or more attributes associated with the specified data element; and returning the attribute instead of the data itself in response to the request.

[0020] Figure 1 An exemplary environment 100 is shown in which an improved technology can be implemented. Here, multiple hosts 110 are configured to access a data storage system 116 via a network 114. The data storage system 116 includes one or more storage processors 120, referred to herein as "…". node(e.g., nodes 120a and 120b); and storage 190, such as disk drives, electronic flash drives, etc. Nodes 120 may be provided as circuit board assemblies or blades inserted into a chassis (not shown) that encloses and cools the nodes. The chassis has a backplane or middleboard for interconnecting nodes 120 and can be used to make additional connections between nodes 120 using cables. In some examples, nodes 120 are part of a storage cluster, such as a storage cluster containing any number of storage devices, where each device includes a pair of nodes 120 connected to a shared storage device. In some arrangements, the host application runs directly on nodes 120, making the presence of a separate host 110 unnecessary. However, no specific hardware configuration is required because any number of nodes 120 can be provided in any arrangement, including a single node, and one or more nodes 120 can be any one or more types of computing devices capable of running software and processing host I / O.

[0021] Network 114 can be any type of network or combination of networks, such as, for example, a Storage Area Network (SAN), a Local Area Network (LAN), a Wide Area Network (WAN), the Internet, and / or some other type of network or combination of networks. Where a host 110 is provided, such host 110 can connect to node 120 using various technologies, such as, for example, Fibre Channel, iSCSI (Internet Small Computer System Interface), NVMeOF (Non-Volatile Memory Fast (NVMe) over Fabrics), NFS (Network File System), and CIFS (General Internet File System). Fibre Channel, iSCSI, and NVMeOF are known to be block-based protocols, while NFS and CIFS are file-based protocols. Node 120 can each be configured to receive I / O requests 112 according to block-based and / or file-based protocols and respond to such I / O requests 112 by reading from or writing to storage 190.

[0022] The depiction of node 120a is intended to represent all nodes 120. As shown, node 120a includes one or more communication interfaces 122, a collection of processing units 124, and memory 130. Communication interfaces 122 include, for example, SCSI target adapters and / or network interface adapters for converting electronic and / or optical signals received via network 114 into electronic form for use by node 120a. The collection of processing units 124 includes one or more processing chips and / or assemblies, such as multiple multi-core CPUs (Central Processing Units). Memory 130 includes volatile memory, such as RAM (Random Access Memory), and non-volatile memory, such as one or more ROMs (Read Only Memory), disk drives, solid-state drives, etc. The collection of processing units 124 and memory 130 together form control circuitry configured and arranged to perform various methods and functions as described herein. Furthermore, memory 130 includes various software structures implemented in the form of executable instructions. When the executable instructions are executed by the collection of processing units 124, the collection of processing units 124 performs operations on the software structures. Although certain software structures are specifically shown and described, it should be understood that memory 130 typically includes many other software components not shown, such as operating systems, various applications, processes, and daemons.

[0023] like Figure 1 As further shown, the memory 130" include (That is, implemented by executing software instructions) Cache 140 and many facilities, such as deduplication facility 150, compression facility 152, storage tiering facility 154, and ransomware protection facility 156. These facilities may be useful in various implementations but should not be considered necessary. Memory 130 may further implement data path 160 and any number of data objects, such as data objects 180. Data objects 180 can be any type of object, such as LUN (Logical Unit), file system, virtual machine disk, etc.

[0024] Data object 180 can be composed of blocks, where " piece "" is a unit of allocatable storage space. The size of a block is typically uniform, for example, a typical block size is 4 kB (kilobytes), 8 kB, or 16 kB. However, a specific block size is not required, and implementations can support non-uniform block sizes. The data storage system 116 is configured to access data objects 180, for example, by specifying the blocks to be created, read, updated, or deleted.

[0025] Cache 140 is configured to receive data from incoming write requests 112w from host 110 and arrange the data into pages 142, which may have block sizes. Cache 140 may also store recently read data of data objects, such as blocks obtained from storage 190 in response to read requests for specified data. Cache 140 may further store various metadata structures 144, such as those that are part of data paths 160 that were recently accessed for reading or writing data.

[0026] Deduplication facility 150 is configured to perform deduplication, that is, the process of replacing redundant blocks with pointers to a smaller number of retained copies of those blocks. Deduplication can be performed inline or near-inline, where, for example, fingerprint-based matching is used to compare page 142 in cache 140 with the existing set of blocks in data storage system 116, avoiding duplicate copies before being written to the persistent data object structure. In some examples, deduplication can also be performed in the background, that is, out-of-band, along with the initial processing of incoming writes. Deduplication is sometimes abbreviated as "..." dedupe The ability to perform deduplication on data objects can be described as the "data object's" Deduplication capability In one example, metadata can be used, for instance, via deduplication tags to track whether a particular block is a duplicate or original.

[0027] Compression facility 152 is configured to perform data compression. Similar to deduplication, compression can be performed inline or near-inline, and pages 142 in cache 140 are compressed before being written to the persistent data object structure. In one example, the metadata tracking blocks of the data objects are compressed to their respective sizes. Some blocks are easier to compress than others. Typically, compression is performed block-by-block after an attempt at deduplication.

[0028] Storage tiering facility 154 is configured to perform storage tiering, that is, to place data into storage tiers within storage 190. Storage " layer "" refers to the corresponding storage category that provides the corresponding performance level. For example, data storage system 116 can support providing, for example, " Highest "", high "and" medium "Multiple storage tiers based on performance levels, each tier including storage drives (e.g., disk drives or solid-state drives) capable of meeting the performance requirements of the corresponding level. In some implementations, the data storage system 116 tracks data access patterns and moves data from one tier to another as access patterns change. For example, previously identified as " cold Data units marked "" (meaning they are infrequently accessed for reading and / or writing) can be promoted from middle to higher levels as their access frequency increases. Similarly, data previously marked "" hotData units can be moved from the highest level to a higher level when their access frequency decreases.

[0029] Ransomware facility 156 is configured to detect and prevent suspicious ransomware attacks, for example, based on patterns in blocks received by data storage system 116. Examples of ransomware detection and protection can be found in co-pending U.S. Patent Application No. 17 / 714,689, filed April 6, 2022, the contents and teachings of which are incorporated herein by reference in their entirety.

[0030] Data path 160 is configured to provide metadata for accessing data objects (such as data object 180). As described in more detail below, data path 160 may include various logical blocks, mapping pointers, and block virtualization structures, some of which can track various attributes 170 of the blocks. Such attributes 170 can be read using the attribute-only read request described herein.

[0031] In an exemplary operation, host 110 issues I / O request 112 to data storage system 116. Node 120a receives I / O request 112 at communication interface 122 and initiates further processing. This processing may involve reading and / or writing data objects, such as data object 180. During the writing of data objects and / or the performance of other activities, node 120a may generate and store attributes 170 associated with the data, such as attributes associated with individual data blocks.

[0032] For example, node 120a can receive a new data block in write request 112w and attempt to deduplicate the new block. To do this, deduplication facility 150 can calculate a fingerprint (such as a hash value) representing the new block and can attempt to match said fingerprint with fingerprints calculated for other previously processed blocks. If a match is found, redundant storage of the new block can be avoided. When this processing occurs, node 120a can store… fingerprint "Attributes, which provide a computed fingerprint in the metadata associated with the new block. Node 120a can also store..." Deduplication flag "Attributes (e.g., boolean values) are used to indicate whether the new block has been successfully deduplicated. If deduplication of the new block is not possible (e.g., no matching fingerprint was found), the new block can be compressed instead. For example, compression facility 152 compresses the new block. Node 120a then places the compressed block in storage 190. Node 120a can arrange mapping pointers in data path 160 to point to the new block and can store the deduplication information in metadata." Compressed size "Attributes. For example, the compression size attribute provides the size of the compressed block in bytes or sectors (512 bytes). When a new block is placed in storage 190, storage tiering facility 154 can assign the new block to a specific storage tier. Node 120a can also..." Hierarchical levels"Attributes are written to the metadata associated with the new block. Hierarchical levels can be expressed as values ​​that explicitly indicate the allocated storage tier (e.g., highest, high, or medium) and / or in some other form (such as by using data temperature (e.g., hot, warm, or cold))."

[0033] Some attributes 170 (such as fingerprint attributes) may remain constant over time, while others 170 may change. For example, the hierarchical attribute may change if the data temperature of the new block changes and / or if the new block is moved to a different storage tier. Similarly, the deduplication flag attribute may change if a deduplication process executed later (such as a background process) manages to deduplicate the new block.

[0034] According to its improvement, an attribute-only read request can obtain attribute 170 associated with specified data without retrieving or returning the specified data itself. For example, data path 160 can receive an attribute-only read request 112ao. Request 112ao is for a specified data element, such as a specific block or set of blocks. In response to receiving request 112ao, data path 160 can access one or more metadata structures associated with the specified data element, obtain one or more attributes 170 from the metadata structures, and return attribute 170 in response 112a. However, data path 160 does not retrieve the specified data element. Therefore, response 112a includes one or more attributes 170 of the specified data element, rather than the specified data element itself.

[0035] Attribute-only read request 112ao can provide a useful and efficient option in certain contexts. For example, ransomware detection facility 156 can issue attribute-only read request 112ao for recently written blocks to access attributes 170 relevant to detecting ransomware attacks. Such attributes may include, for example, compression size and deduplication flags. Importantly, attribute 170 can be read quickly without the latency typically associated with read requests, which involves retrieving data from backend storage and may include decompressing the data. Moreover, the metadata storing attribute 170 may often be found in cache 140, making attribute-only read request 112ao often possible by reading only from cache 140, which is much faster than reading from backend storage 190.

[0036] As another example, for block matching purposes, deduplication facility 150 can issue attribute-only read request 112ao to quickly and efficiently obtain the fingerprint of a block. As yet another example, storage tiering facility 154 can issue attribute-only read request 112ao to obtain the tiering level of a specified block. As yet another example, a file system (not shown) can issue attribute-only read requests to blocks of a specified file to determine, for example, how much storage space can be reclaimed by deleting the file, for example, by examining the compressed size attribute of the file blocks. Many other use cases are envisioned.

[0037] Figure 2 Showing more details Figure 1 An exemplary data path 160 is provided. As shown, data path 160 provides the arrangement of metadata in the form of a mapping structure such as pointers, which can be traversed to locate data in data storage system 116. As described herein, the mapping structure of data path 160 also performs the role of storage attribute 170, which can be accessed using attribute read-only request 112ao.

[0038] As shown in the figure, data path 160 includes namespace 210, mapping structure (“mapper”) 220, and physical block layer 230. Namespace 210 is configured to organize logical data, such as logical data for LUNs, file systems, virtual machine disks, snapshots, clones, etc. In one example, namespace 210 provides a large logical address space and is named logical block 212.

[0039] Mapper 220 is configured to map logical blocks 212 in namespace 210 to corresponding physical blocks 232 in physical block layer 230. Physical blocks 232 are typically compressed and may therefore have a non-uniform size. Mapper 320 may include a multi-level mapping structure arranged in a tree structure, such as pointers. These levels include a top level 222, a middle level 224, and a leaf pointer structure 226, which together are capable of mapping large amounts of data. Mapper 220 may also include a virtual layer 228, i.e., a block virtualization structure, for providing indirection between leaf pointer structure 226 and physical blocks 232, thus allowing physical blocks 232 to move without interfering with leaf pointer structure 226. The top level 222, middle level 224, leaf pointer structure 226, and virtual layer 228 depict various pointer structures. Such pointer structures may be grouped together in arrays (not shown), and they themselves may be stored in blocks.

[0040] Typically, logical blocks 212 in namespace 210 are pointed to corresponding physical blocks 232 in physical block layer 230 via mapping structures in mapper 220. For example, logical block 212a in namespace 210 can point to a specific top layer 222a via path 216, which points to a specific middle layer 224a, which in turn points to a specific leaf 226a. Leaf 226a then points to a specific virtual layer 228a, which points to a specific physical block 232a. With this arrangement, virtual layer 228 represents the corresponding logical block 212 in namespace 210; for example, each allocated leaf pointer structure 226 corresponds one-to-one with the corresponding logical block 212 at the corresponding logical address 214. However, due to block sharing, the relationship between leaf pointer structures 226 and virtual layers 228 is not necessarily one-to-one. For example, multiple leaf pointer structures 226 can point to the same virtual layer (see virtual layer 228a).

[0041] like Figure 2 As shown on the right, the leaf pointer structure 226 can store various attributes 170. For example, the leaf pointer structure 226 can store the attribute 170a of the hierarchy level. This hierarchy level 170a can be specific to the logical block corresponding to the leaf (e.g., logical block 212a) and therefore can be independent of the hierarchy levels of other logical blocks, including those logical blocks mapped to the same physical block 232a. The leaf pointer structure 226 also includes a pointer 250 to a virtual layer 228 (such as virtual layer 228a).

[0042] Virtual layer 228 may also store various attributes 170. For example, virtual layer 228 may store its own attribute 170b for layering. Unlike attribute 170a, which is specific to a particular logical block 212, attribute 170b may be common to all logical blocks sharing the same physical block 232. Virtual layer 228 may also store fingerprints 170c, such as a hash value calculated based on physical block 232a before compression. Virtual layer 228 may further store attribute 170d of compression size (e.g., the size of physical block 232a) and attribute 170e of deduplication flag, which indicates whether the associated physical block (e.g., physical block 232a) has been deduplicated. As shown, virtual layer 228 includes pointers 260 to physical blocks 232 (such as physical block 232a). Virtual layer 228 may also include virtual addresses 262, i.e., addresses of virtual layer 228 within the virtual address space (the space that organizes virtual layer 228).

[0043] Specific attributes 170a to 170e are useful examples, but they are not intended to be restrictive. For example, additional attribute 170 could be provided, and the indicated attribute could be replaced with a different attribute.

[0044] In some examples, attribute 170 is placed in the mapping structure when processing the data block to be written or at another appropriate time. Attribute 170 can then be obtained via an attribute-only read request. For example, an attribute-only read request 112ao may be directed to logical block 212a, which may be identified by logical address 214. Logical address 214 may simply be expressed as a number or range of numbers representing one or more logical blocks 212.

[0045] Once logical address 214 has been identified, attribute-only read request 112ao can follow the pointer through the associated mapping structure toward (but not into) physical data, such as physical block 232a. For example, read request 112ao travels from logical block 212a to top layer 222a, then to middle layer 224a, and then to leaf 226a. If one or more desired attributes are found in leaf 226a, read request 112ao can stop reading those attributes and return them to the requester. Otherwise, read request 112ao can continue to the pointed-to virtual layer 228a, where it can retrieve the desired attribute or additional desired attributes and return all obtained attributes to the requester, no longer continuing along data path 160.

[0046] Figure 3 An exemplary format for an attribute-only read request 112ao is shown. The exemplary format includes the following fields: • Logical address field 310. Specifies the logical address of the data element whose one or more attributes you want to read. The logical address can be provided as described above or in any other way that explicitly identifies the specified data element.

[0047] • Size 320. Specifies the length of the data element. For example, it can be expressed as multiple blocks.

[0048] • Operation code 330 A code, such as a numeric value, that identifies the type of read request (in this case, an attribute-only read request). Different opcodes can be provided for different types of read requests, such as normal read (e.g., host read of user data), copy read (for performing a copy), or attribute-only read.

[0049] • Attribute parameter 340This returns a list 170 of attributes for a specified data element or multiple data elements. A parameter 340 can be provided for each readable attribute 170. The parameter 340 can be expressed, for example, as a numeric word where different bit positions correspond to the respective attribute. For example, a "true" value in a bit position can indicate that the attribute assigned to that bit position should be returned, while a "false" value can indicate that the attribute should not be returned. The parameter 340 can be applied to attributes of individual blocks, as described for attributes 170a to 170e. The parameter 340 can also be applied to groups of blocks. For example, a "sequentiality" parameter can be applied to multiple blocks.

[0050] Figure 3 The format shown is intended to be illustrative rather than restrictive. For example, additional or different fields may be provided, and some fields may be omitted. Furthermore, the individual fields may be structured in any suitable manner.

[0051] In one example, an attribute-only read request 112ao is formed by specifying the indicated field in the computer instructions. The above format can be defined by an API (Application Programming Interface) (such as an API provided for data I / O). In one example, the format defines one or more return values. In one example, instructions formed using the above format can return one or more data structures that provide the requested attribute 170 retrieved for the specified data element. If multiple blocks are specified (e.g., size > 1), a single data structure or a separate portion of a single data structure can be returned to provide the attributes for the respective blocks.

[0052] Figures 4 to 8 Exemplary methods 400, 500, 600, 700, and 800 that can be performed in conjunction with environment 100 are shown. Methods 400, 500, 600, 700, and 800 are typically performed, for example, by combining... Figure 1 The described software structure is executed by residing in the memory 130 of node 120a and run by a set of processing units 124. The various actions of the depicted method can be ordered in any suitable manner. Therefore, embodiments can be constructed that execute actions in a different order than that shown, which may include executing several actions simultaneously.

[0053] Figure 4An exemplary method 400 is shown for obtaining one or more attributes 170 and applying such attributes to determine whether a ransomware attack is suspected. For example, at 410, ransomware protection facility 152 issues an attribute-only read request 112ao to a specified data element (such as a block at a specific logical address). For example, request 112ao may specify parameters 340 for compression size (170d) and deduplication flag (170e). Read request 112ao then traces the path from the logical block 212 specified by the request to the associated top-level 222, middle-level 224, leaf pointer structure 226, and virtual layer 228 via data path 160. At 420, read request 112ao obtains attributes 170d and 170e from virtual layer 228 and returns them to the requester, i.e., ransomware protection facility 152, which receives attributes 170d and 170e and applies them as part of the process for determining whether a ransomware attack is suspected.

[0054] Figure 5 An exemplary method 500 is illustrated for obtaining one or more attributes 170 and applying such attributes to perform storage tiering. For example, at 510, storage tiering facility 154 issues an attribute-only read request 112ao to a specified data element, identifying any desired parameters, such as by logical tiering level 170a or by virtual tiering level 170b. The read request 112ao then traces path 216 through data path 160 from the logical block 212 specified by the request to the associated leaf pointer structure 226 or virtual tier 228, obtains attribute 170a or 170b, and returns the attribute to storage tiering facility 154. At 520, storage tiering facility 154 applies the attribute to perform storage tiering. For example, storage tiering facility 154 may aggregate tiering levels obtained from multiple blocks and determine whether the blocks should be moved together to different storage tiers.

[0055] Figure 6An exemplary method 600 is shown for obtaining one or more attributes 170 and applying such attributes to perform fingerprint-based data matching. For example, at 610, deduplication facility 150 issues an attribute-only read request 112ao to a specified data element, identifying any desired parameters 340, such as fingerprint 170c. Read request 112ao then traces the path from the logical block 212 specified by the request to the associated virtual layer 228 via data path 160, obtains attribute 170c, and returns attribute 170c to deduplication facility 150. At 620, deduplication facility 150 applies attribute 170c to perform block matching. For example, deduplication facility 150 may compare fingerprint 170c with a fingerprint calculated based on another data block. A match between these two fingerprints indicates a match between data blocks, and deduplication facility 150 may use this match to remove duplicate blocks. It should be understood that fingerprint-based block matching can be performed by components other than deduplication facility 150, and implementations involving fingerprints are not limited to deduplication.

[0056] Figure 7 An exemplary method 700 is shown for obtaining one or more attributes and applying such attributes to identify sequence data. At 710, a software component running on node 120a issues an attribute-only read request 112ao to a specified data element, such as a logical block, identifying parameters 340, such as parameters indicating a sequence pattern. At 720, read request 112ao determines whether the specified data element is part of a sequence pattern. For example, read request 112ao searches forward and / or backward from the specified logical block in namespace 210 to identify a contiguous range of the logical block, traces the logical block through data path 160 to the corresponding virtual layer 228, and (e.g., based on virtual address 262) determines whether virtual layer 228 itself is contiguous. At 730, if one or more of the virtual layers 228 are adjacent to the virtual layer of the specified data element, read request 112ao may return a value indicating a sequence pattern; otherwise, read request 112ao may return a value indicating no sequence pattern. As an alternative or supplement to the return value indicating whether a sequence pattern was found, the read request 112ao can return the length of the detected sequence pattern, for example, the number of sequence blocks.

[0057] In some examples, the attribute-only read request 112ao can specify a range of logical blocks instead of a single block, and node 120a can return a value indicating whether the range of logical blocks forms a sequence pattern (e.g., whether the logical blocks in the range are mapped to a virtual layer at sequence virtual address 262). The returned information can also indicate a partial sequence pattern. For example, if the specified range of logical blocks includes 16 blocks but only the first 8 blocks are mapped to a sequence virtual layer, the read request 112ao can indicate the sequence range in its response.

[0058] Figure 8 An exemplary method 800 for obtaining attributes associated with data is shown, and an overview of some of the aforementioned features is provided. At 810, a read request 112ao is formed. For example, a software component running on node 120a uses, for example... Figure 3 The format shown is used to create read request 112ao. Read request 112ao is for a specified data element and, for example, indicates an attribute-only read of the attribute set 170 associated with the specified data element by providing parameter 340. For example, the specified data element may be logical block 212 or multiple logical blocks 212.

[0059] At 820, in response to read request 112ao, the metadata structure set of the collection of stored attributes 170 is accessed. For example, read request 112ao traces path 216 from a specified data element to the associated leaf pointer structure 226 and / or virtual layer 228. Then read request 112ao accesses one or more attributes 170 of the specified data from the associated leaf pointer structure 226 and / or virtual layer 228.

[0060] At 830, in response to read request 112ao, a set of attributes is returned instead of the specified data element itself. For example, attributes obtained from leaf pointer structure 226 and / or virtual layer 228 are returned to the requester of read request 112ao as one or more data structures. However, data from one or more physical blocks 232 is not returned.

[0061] An improved technique for obtaining attributes 170 associated with data has been described. The technique includes: providing an attribute-only read request 112ao for a specified data element; accessing a leaf pointer structure 226 and / or a virtual layer 228 storing one or more attributes 170 associated with the specified data element; and returning the attributes (or multiple attributes) instead of the data itself in response to the request 112ao.

[0062] Having described certain implementations, many alternative implementations or variations can be made. For example, an implementation in which a read request returns attribute 170 instead of data has been described. However, it is also possible to construct an implementation in which a read request returns both attributes and data. Such implementations can be arranged similarly to the implementations described above, except that, in addition to accessing and returning attribute 170, they also access and return one or more associated physical blocks 232, which may include decompression of such blocks.

[0063] Furthermore, an implementation of accessing attribute 170 from leaf pointer structure 226 and / or virtual layer 228 has been described. However, this is merely an example, as some implementations may obtain the attribute from middle layer 224, top layer 222, or other metadata structures.

[0064] Moreover, although an implementation in which only attribute read requests originate from a component operating within the data storage system has been described, this is only an example, as only attribute read requests 112ao can also originate from host 110.

[0065] Furthermore, while implementations involving one or more data storage systems have been described, other implementations may involve computers, including those not typically considered data storage systems. Such computers may include servers, such as those used in data centers and enterprises, as well as general-purpose computers, personal computers, and many devices such as smartphones, tablets, personal data assistants, etc.

[0066] Furthermore, although features have been shown and described with reference to their particular embodiments, such features may be included and therefore included in any disclosed embodiments and variations thereof. Thus, it should be understood that features disclosed in connection with any embodiment are included in any other embodiment.

[0067] Furthermore, the improvement or a portion thereof may be embodied in a computer program product comprising one or more non-transitory computer-readable storage media, such as magnetic disks, magnetic tapes, optical discs, DVDs, optical discs, flash drives, solid-state drives, SD (Secure Digital) chips or devices, application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), etc. Figure 8 (Example shown as medium 850). Any number of computer-readable media may be used. The medium may be encoded with instructions that, when executed on one or more computers or other processors, perform one or more processes described herein. Such a medium may be considered an article of manufacture or a machine and may be transported from one machine to another.

[0068] The word "" is used throughout this document include ( comprising / including )" Include "and" have "The intention is to describe aspects of certain projects, steps, elements, or things in an open-ended manner. Moreover, as used herein and unless specifically stated to the contrary, the term ''..." gather "" refers to one or more of something. Regardless of the phrase "...a collection" "This applies regardless of whether the following object is singular or plural, and regardless of whether it is used with a singular or plural verb. Furthermore, the element..." gather "It can describe fewer than all existing elements. Therefore, there may be additional elements of the same type that do not belong to the set. Furthermore, such as " First "", second "", third Ordinal expressions such as “” can be used as adjectives in this text for identification purposes. Unless otherwise specified, these ordinal expressions are not intended to imply any order or sequence. Thus, for example, “ second "The incident may occur in" First Event "Before or after, or even if the first event did not occur, the second event would still occur. Furthermore, this article refers to specific elements, characteristics, or behaviors as..." First "The identification of such elements, characteristics, or behaviors should not be interpreted as requiring their continued existence." second "or other such elements, characteristics, or behaviors. Conversely, " First "The project may be unique. And unless there is an explicit statement to the contrary, otherwise..." based on "Intent is non-exclusive. Therefore, unless otherwise expressly instructed," based on "Should be interpreted as meaning" At least in part based on Although some implementations are disclosed herein, it should be understood that these are provided by way of example only and should not be construed as restrictive.

[0069] Therefore, those skilled in the art will understand that various changes in form and detail may be made to the embodiments disclosed herein without departing from the scope of the appended claims.

Claims

1. A method for obtaining attributes associated with data, comprising: The ransomware detection facility of the node generates a read request for a specified data element associated with a logical block, the logical block corresponding to a compressed physical block, the read request indicating an attribute-only read of a set of attributes associated with the specified data element, the attribute set including at least a compression size and a deduplication flag, wherein the compression size indicates the size of the compressed physical block, the deduplication flag indicates whether the physical block has been deduplicated, wherein compression is performed block by block in response to a deduplication attempt failing; In response to the read request, the data path of the node accesses the metadata structure set storing the attribute set; and The data path, in response to the read request, returns the set of attributes to the ransomware detection facility instead of the specified data element itself; and The ransomware detection facility determines whether a ransomware attack is suspected, based at least on the compression size and deduplication flag associated with the specified data element.

2. The method of claim 1, wherein forming the read request includes specifying the data element at least in part based on the logical address of the specified data element.

3. The method of claim 2, wherein accessing the metadata structure set includes accessing a mapping structure in the path between logical address data associated with the logical address.

4. The method of claim 3, wherein the mapping structure includes a block virtualization structure disposed in the path between the leaf pointer structure and the data associated with the logical address.

5. The method of claim 3, wherein the mapping structure includes a leaf pointer structure disposed in a path leading to the data associated with the logical address.

6. The method of claim 3, further comprising: Access the metadata structure of multiple data elements whose logical addresses are adjacent to the logical address of the specified data element; and Determine whether the specified data element is part of a sequence pattern of data elements written sequentially to the data storage system. The returned set of attributes includes providing attributes that indicate whether the specified data element is part of a sequence pattern.

7. The method of claim 6, wherein returning the set of attributes includes providing the length of the sequence pattern.

8. The method of claim 3, wherein the specified data element is stored in a first data storage system, wherein the set of attributes includes a storage hierarchy attribute indicating the hierarchy level of the specified data element in the first data storage system, and wherein the method further includes copying the specified data element to a second data storage system in the storage layer, the storage layer providing the hierarchy level indicated by the hierarchy attribute.

9. The method of claim 8, wherein accessing the metadata structure set includes obtaining the hierarchical attribute from a leaf pointer structure in the data path.

10. The method of claim 8, wherein accessing the metadata structure set includes obtaining the hierarchical attributes from the block virtualization structure in the data path.

11. The method of claim 1, wherein forming the read request includes specifying an opcode that identifies the read request as an attribute-only read request, and wherein in response to the opcode, an action is taken to return the attribute set instead of the specified data element.

12. The method of claim 1, wherein forming the read request includes specifying a set of parameters, the set of parameters individually identifying an attribute to be returned in response to the read request, and wherein the method further includes obtaining the individually identified attribute from the metadata structure set.

13. The method of claim 1, wherein the set of attributes includes at least one of: (i) an indication of the compressed size of the specified data element; and (ii) an indication of whether the specified data element has been deduplicated.

14. The method of claim 1, wherein the set of attributes includes a fingerprint calculated based on the specified data element, and wherein the method further includes comparing the fingerprint from the specified data element with a fingerprint calculated based on another data element to determine whether the specified data element matches the other data element.

15. The method of claim 1, wherein accessing the metadata structure set storing the attribute set comprises obtaining the metadata structure set from a cache.

16. A computerized device comprising control circuitry, the control circuitry including a set of processing units coupled to a memory, the control circuitry being configured and arranged such that: A ransomware detection facility on a node generates a read request for a specified data element associated with a logical block, which corresponds to a compressed physical block. The read request instructs an attribute-only read of a set of attributes associated with the specified data element, the attribute set including at least the compression size and a deduplication flag. The compression size indicates the size of the compressed physical block, and the deduplication flag indicates whether the physical block has been deduplicated. In response to the failure of deduplication attempts, compression is performed in blocks; In response to the read request, the data path of the node accesses the metadata structure set storing the attribute set; as well as The data path responds to the read request by returning the set of attributes to the ransomware detection facility instead of the specified data element itself; as well as The ransomware detection facility determines whether a ransomware attack is suspected, based at least on the compression size and deduplication flag associated with the specified data element.

17. A computer program product comprising a collection of non-transitory computer-readable media having instructions which, when executed by control circuitry of a computerized device, cause the computerized device to perform the method as described in any one of claims 1-15.

Images