Memory and data protection method of memory

Abstract

In order to securely store data, a memory (200) connected to another memory (400) via a network is provided with a processor (216) for processing data stored in a storage device (220), and the processor (216) acquires a first snapshot for a volume generated using a storage area of the storage device and stores the first snapshot for a second snapshot for a volume generated using a storage area of the storage device. And a controller configured to compare a second snapshot, which is a snapshot acquired last time, with the first snapshot to extract incremental data, transfer the incremental data to the other storage, store the incremental data as backup data, and set a lock of the backup data stored in the other storage.

Description

Technical Field

[0001] The present disclosure relates to a storage and a data protection method for the storage. Background Art

[0002] The storage has a snapshot function for protecting data. The snapshot function is a logical copy of a volume that stores user data at a certain moment. Furthermore, in recent years, a backup method has emerged that stores backup data in a public cloud. Specifically, backups to object storage services in a public cloud characterized by low prices have emerged. In Patent Document 1, there is the following description: "The local storage creates a backup area that serves as a backup destination for data written to the business volume. The local storage associates the backup area with a server system that provides access from the local storage to the cloud storage. The local storage writes the data accompanying the write request to the business volume and backs up the data in the backup area. The local storage sends the data from the backup area to the server system so that the data is written to the cloud storage."

[0003] Prior art literature

[0004] Patent Literature

[0005] Patent Document 1: Japanese Patent Application Laid-Open No. 2021-149773 Summary of the Invention

[0006] Problems to be solved by the invention

[0007] In recent years, cyberattacks (network attacks) represented by ransomware have been increasing. In order to protect the data stored in the storage against such attacks, the snapshot function is used. On the other hand, cyberattacks are becoming more advanced year by year, and attacks on protected data are also increasing. Specifically, attacks such as deleting snapshots or destroying data by writing to snapshots can be imagined. Furthermore, data backed up to object storage containers represented by the above-mentioned public clouds may also become targets of attacks. In the case of public clouds, since IT equipment set up in data centers on-premises is connected via the network, there are access paths from outside the public cloud, which poses a security risk.

[0008] An object of the present disclosure is to provide a data protection method for making data protection in a memory using a snapshot function and data protection of data transferred to the outside of the memory more secure.

[0009] Means used to solve problems

[0010] In order to achieve the above-mentioned purpose, a technical solution of a representative memory of the present invention is provided, which is connected to other memories via a network and has a processor for processing data stored in the storage device. The above-mentioned memory is characterized in that the above-mentioned processor obtains a first snapshot of a volume generated using the storage area of ​​the above-mentioned storage device, compares the second snapshot, which is the last snapshot obtained, with the above-mentioned first snapshot to extract incremental data, transfers the above-mentioned incremental data to the above-mentioned other memories and stores it as backup data, and sets a lock for the above-mentioned backup data stored in the above-mentioned other memories.

[0011] In addition, a technical solution of a representative storage data protection method of the present invention is a data protection method for a storage having a processor for processing data stored in a storage device and connected to other storage via a network, characterized in that the processor obtains a first snapshot for a volume generated using a storage area of ​​the storage device, compares the last snapshot obtained, i.e., a second snapshot, with the first snapshot to extract incremental data, transfers the incremental data to the other storage and stores it as backup data, and sets a lock on the backup data stored in the other storage.

[0012] Effects of the Invention

[0013] According to the present invention, data can be stored more securely. Other problems, structures, and effects than those described above will become apparent from the following description of the embodiments. BRIEF DESCRIPTION OF THE DRAWINGS

[0014] Figure 1 This is a diagram showing a storage system according to the first embodiment of the present disclosure.

[0015] Figure 2 This is a diagram showing an example of the configuration of a memory.

[0016] Figure 3 This is a diagram showing an example of information stored in the memory of a storage device.

[0017] Figure 4 This diagram explains the overview of snapshots and snapshot protection.

[0018] Figure 5 This is a flowchart for explaining an example of snapshot lock processing.

[0019] Figure 6 This is a diagram showing an example of a snapshot table.

[0020] Figure 7 This is a flowchart for explaining an example of snapshot deletion processing.

[0021] Figure 8 This is a flowchart for explaining an example of write processing.

[0022] Figure 9 This is a diagram for explaining the outline of the backup process.

[0023] Figure 10 This is a flowchart for explaining an example of backup processing.

[0024] Figure 11 This is a diagram showing an example of a catalog, generation information, difference information, and data.

[0025] Figure 12 This is a diagram showing an example of a backup table.

[0026] Figure 13 This is a flowchart for explaining an example of lock setting processing.

[0027] Figure 14 This is a flowchart for explaining an example of cyber attack detection processing.

[0028] Figure 15 This is a flowchart for explaining an example of backup processing delay detection processing.

[0029] Figure 16 This is a diagram showing an example of a backup performance table.

[0030] Figure 17 This is a flowchart for explaining an example of data transfer processing.

[0031] Figure 18 This is a flowchart for explaining an example of backup deletion processing.

[0032] Figure 19 This is a flowchart for explaining an example of object deletion processing.

[0033] Figure 20 This is a diagram showing an example of a lock management table.

[0034] Figure 21 This is a flowchart for explaining an example of lock extension processing.

[0035] Figure 22 This is a diagram showing another configuration example of a memory.

[0036] Figure 23 This diagram explains the relationship among volumes, capacity pools, and pool volumes (volume pool) 291 .

[0037] Figure 24 This is a diagram showing an example of a pool table.

[0038] Figure 25 This is a diagram showing an example of a volume table.

[0039] Figure 26 This is a flowchart for explaining an example of tearing processing.

[0040] Figure 27 This is a flowchart for explaining an example of demotion processing.

[0041] Figure 28 This is a flowchart for explaining an example of promotion processing.

[0042] Figure 29 This is a diagram showing an example of information recorded in the memory and the management server.

[0043] Explanation of Figure Numbers

[0044] 1: Data center; 2: Cloud; 100: Server; 200: Storage; 210: Controller; 211: I / F; 212: I / F; 213: Management I / F; 214: I / F; 215: Memory; 216: Processor; 217: Volume; 220: Physical drive; 221: Control information; 222: Program; 223: Cache unit; 230: Management network; 270: Management terminal; 271: Management port; 272: Input / output unit; 273: Memory; 274: CPU; 300: Network; 400: Object storage. DETAILED DESCRIPTION

[0045] Hereinafter, embodiments of the present disclosure will be described with reference to the accompanying drawings.

[0046] In addition, the following describes the process using "program" as the main body of action, but since the program is executed by the processor unit and thus performs the prescribed process while appropriately using at least one of the storage unit and the interface unit, the subject of the process can also be set to the processor unit (or a computer or storage system having a processor unit). The program can also be installed in the computer from a program source. The program source can be, for example, a program distribution server or a computer-readable storage medium. In addition, in the following description, both two or more programs can be implemented as one program, and one program can be implemented as two or more programs. In addition, at least a portion of the process implemented by executing the program can be implemented by a hardware circuit (for example, ASIC (Application Specific Integrated Circuit) or FPGA (Field-Programmable Gate Array).

[0047] [Example 1]

[0048] Figure 1 This is a diagram showing a storage system according to the first embodiment of the present disclosure. Figure 1 The storage system shown includes a data center (on-premises) 1 equipped with servers 100 and storage 200, and a cloud 2 equipped with object storage 400 and external management software 410. Data center 1 and cloud 2 are interconnected and communicative via a network 300. Multiple configurations are possible. Data center 1 may also be a public cloud.

[0049] Data Center 1 normally functions as a primary site for business processing. Cloud 2 stores backup data related to data processing in Data Center 1 and, in certain circumstances such as disasters, functions as a secondary site (secondary environment) to take over business processing for Server 100. A secondary server may also be deployed at the secondary site. External management software 410 manages storage 200 and target storage 400. While this example shows operations in Cloud 2, operations may also be performed in Data Center 1 or other data centers.

[0050] Server 100 is a host computer that executes computer programs (hereinafter referred to as applications) such as applications and middleware used to perform business processing, thereby performing business processing. Memory 200 is a first storage device that stores data used and generated in business processing performed by server 100, and stores data corresponding to I / O requests (read and write requests) from server 100.

[0051] Object storage 400 is a storage device that stores backup data of the data stored in storage 200. In this embodiment, the backup data is used as recovery data for restoring data at a secondary site, and object storage 400 functions as a recovery storage device for storing this recovery data. Object storage 400 can be a storage device that is lower cost than storage 200. In this embodiment, it is an object storage device that stores data in units of objects, which is generally less expensive. In this embodiment, object storage is used as an example, but any storage device other than object storage can be used, as long as it is lower cost than storage 200. It can also be a file storage device, etc. Alternatively, it can be a storage service provided by a storage vendor on a public cloud. Cloud 2 can also be a data center separate from Data Center 1, rather than a public cloud.

[0052] Figure 2 2 is a diagram showing an example of the configuration of the storage 200 and the management terminal 270 connected to the storage 200. Figure 2 As shown, the storage 200 has one or more controllers 210 and one or more physical drives 220. Figure 2 In the example of FIG, two controllers 210 and five physical drives 220 are shown.

[0053] The controller 210 is a control unit that controls I / O requests from the server 100, reads and writes data to the physical drive 220, and transfers data to the cloud. The controller 210 includes a FE (Front-End) I / F 211, a BE (Back-End) I / F 212, a management I / F 213, an RC (Remote Copy) I / F 214, memory 215, and a processor 216.

[0054] The FE I / F 211 is an interface for communicably connecting to the server 100 and includes a plurality of Fibre Channel ports in this embodiment. However, the FE I / F 211 may include ports other than Fibre Channel ports, such as iSCSI ports, instead of Fibre Channel ports.

[0055] The BE I / F 212 is an interface for communicably connecting to the physical drive 220. The management I / F 213 is an interface for communicably connecting to the management terminal 270 via the management network 230. The RC I / F 214 is an interface for communicably connecting to the object storage 400 of the cloud 2 via the network 300. The RC I / F 214 has, for example, multiple IP (Internet Protocol) ports. It may also have a Fibre Channel port. Furthermore, the FE I / F 211, RC I / F 214, and BE I / F 212 may share a single I / F port.

[0056] The memory 215 stores programs that define the operations of the processor 216 and control information used by the programs. The memory 215 can also serve as a cache for storing data stored in the physical drive 220. The processor 216 executes various processes by executing the programs stored in the memory 215.

[0057] Physical drives 220 are physical data storage devices that store data. Multiple physical drives 220 can form one or more RAID (Redundant Array of Independent (or Inexpensive) Disks) groups. A primary volume 217 is created across multiple physical drives 220 and provided to the server 100.

[0058] Management terminal 270 is a terminal used for maintaining and managing storage 200. It includes a management port 271, an input / output unit 272, a memory 273, and a CPU 274. Management port 271 is communicatively connected to storage 200 via management network 230. The input / output unit 272 has an input function for receiving various information from a user using management terminal 270, and an output function for outputting various information to the user. Memory 273 stores various programs that define the operations of CPU 274. CPU 274 reads and executes the programs stored in memory 273, thereby performing various processes for maintaining and managing storage 200.

[0059] in addition, Figure 2 The structure of the memory 200 shown is just a simple example and is not limited thereto. For example, the memory 200 may be an SDS (Software Defined Storage) that implements the storage function by using a program that executes storage processing in each of a plurality of servers. Figure 22 An example of SDS is shown in FIG. Figure 22 Since the SDS operates in a public cloud, the storage server 503 is a virtual machine, but it may also be a physical server.

[0060] The memory 200 may include hardware for performing specific processing, etc. Examples of such hardware include hardware for compressing data and hardware for encrypting data. The memory 200 may also be a storage device provided as a service.

[0061] Figure 3 2 is a diagram showing an example of information stored in the memory 215 of the memory 200. Figure 3 As shown, the memory 215 stores control information 221 and a program 222 as information related to the snapshot process or the backup process. In addition, the memory 215 includes a cache unit 223 for temporarily storing data.

[0062] The control information 221 includes a snapshot table 2210, a backup table 2211, and a transfer amount table 2212. Details of these tables will be described later. The program 222 includes a snapshot lock program 2221, a snapshot delete program 2222, a write program 2223, a backup program 2224, a data transfer program 2225, a package setting program 2226, and an attack detection program 2227.

[0063] Figure 3 The program shown is a program related to this embodiment. In fact, other programs may also be included. For example, there is a reading program for reading data from volume 217.

[0064] Figure 4 This figure illustrates the content of the invention. One method for restoring data after a cyberattack involves pre-creating a data backup and restoring the data from the backup. Storage can also create data backups using a snapshot function.

[0065] A snapshot is a logical copy of a volume that stores user data at a specific moment. Snapshots can be created in a short time without copying the actual user data.

[0066] The snapshot creates a logical copy by pointing to the data stored in volume 241. This pointer information is called metadata. If data is written to volume 241 after the snapshot is created, the data is saved to a different physical address, and the metadata of volume 241 is updated to the new physical address. The same applies if data is written to snapshot 242. This ensures that the data in volume 241 and snapshot 242 are correctly stored.

[0067] By using snapshots, data can be protected from cyber attacks against business data. If business data is attacked and cannot be used for business processing, the data can be restored by writing the snapshot data back to the volume 241 (hereinafter referred to as restore).

[0068] However, if a cyber attack is launched against a snapshot, normal data before the attack cannot be restored to volume 241. For example, an attack may include writing data to a snapshot or deleting a snapshot. Writing data also includes encrypting the snapshot data.

[0069] Therefore, a protection function (locking function) for snapshots is required. Locking means prohibiting the physical deletion or modification of data. The locking function is a function that prohibits access (writing, reading) to snapshots and prohibits deletion of snapshots. It can also be a function that only permits reading of data. It can also be possible to set a locking period, which is a period during which access is prohibited or snapshots are prohibited. For example, access and deletion are prohibited for a period of 1 month. It can also be possible to allow administrators with specific roles to access and delete snapshots. When the locking period expires, the lock is released, and access to the snapshot or deletion of the snapshot can be performed.

[0070] The lockout period is set to a limited duration. However, if a longer period is set, the snapshot cannot be deleted even if it is no longer needed, resulting in the continued storage of unnecessary data. Furthermore, it is conceivable that in order to recover from such a cyberattack, snapshots 242 would be acquired frequently in order to use the latest data. Therefore, it is unlikely that a very long period would be set.

[0071] If volume 241 is infected with ransomware due to a cyberattack, the data in snapshots created after the ransomware attack will also be infected. In the example shown in the figure, snapshot 242 created on April 4th is infected.

[0072] In this case, it is necessary to restore the snapshot before April 3. On the other hand, if the time has passed, the snapshot before April 3 may not be locked or may be released after the lock period has expired.

[0073] In this invention, if a cyberattack is detected, a lockout is initiated, or a lockout period is extended if it is nearing its expiration date. In the following description, data that may be infected with ransomware, other viruses, or encrypted by ransomware is collectively referred to as "attacked data." Furthermore, data that has not been attacked is referred to as "normal data."

[0074] Figure 5 2 is a diagram showing an example of processing of the snapshot lock program 2221. The snapshot lock program 2221 is a program that identifies a snapshot to be locked when a cyber attack is detected and sets the lock or extends the lock period.

[0075] The snapshot lock program 2221 can be operated in any of the storage 200 , the management terminal 270 , and the external management software 410 .

[0076] Several methods for detecting cyberattacks are already known. Techniques that learn about memory I / O and data compression rates and detect attacks based on these changes are known. If an attack is detected using these functions, the process from step S101 onwards is executed to lock the snapshot.

[0077] The detection of cyber attacks does not necessarily require the detection of cyber attacks against storage, and the steps after step S101 may also be performed when an attack against a network, server, middleware, application, etc. is detected.

[0078] The snapshot locking program 2221 executes a cyber attack detection program to determine whether an attack occurs (step S100 ).

[0079] If there is no attack, the process ends (step S107).

[0080] In the event of an attack, the snapshot lock program 2221 determines the snapshot that has been acquired (step S102 ). This process can be implemented by referring to the snapshot table in the memory 200 .

[0081] Next, the snapshot lock program 2221 determines whether the snapshot is locked (step S103). If not, it instructs the object snapshot to be locked (step S104). This process is achieved by storing information such as the snapshot lock setting, snapshot lock period, and access mode in the snapshot table. On the other hand, if the object is locked, the process proceeds to step S105.

[0082] In step S105 , the snapshot lock program 2221 determines whether the set remaining lock time is equal to or longer than a predetermined time (step S105 ). This can be achieved by referring to the snapshot lock period information in the snapshot table.

[0083] If the remaining time is less than the specified time, the snapshot lock program 2221 instructs the lock period to be extended (step S106). This is accomplished by changing the snapshot lock period value in the snapshot table 2210. On the other hand, if the remaining time is greater than the specified time, the process proceeds to step S107, where the process ends (step S107).

[0084] The snapshot lock program 2221 may be executed somewhere in the management terminal 270, the external management software 410, or the storage 200. When the snapshot lock program 2221 is executed in the management terminal 270 or the external management software 410, the information in the snapshot table 2210 is obtained and updated by the program executed in the storage 200 during the processing of steps S102, S104, and S106.

[0085] This program is executed periodically. The snapshot lock program 2221 can also be called from the cyber attack detection program.

[0086] In the above description, the processing after step S102 is executed for the snapshot. However, when the lock period is set in units of a group of a plurality of snapshots, the processing after step S102 may be executed in units of the group.

[0087] If it is detected that the cyber attack is targeting a specific volume, the processing from step S102 onwards may be performed on the snapshot of that volume. Alternatively, the processing from step S102 onwards may be prioritized for the attacked volume. Alternatively, the processing from step S102 to S107 may be performed on a volume 241 previously specified by the user.

[0088] Since the snapshot created after a cyber attack is detected may have been attacked, the snapshot table 2210 may be used to manage the possibility of an attack, and the possibility of an attack may be displayed through management software or the like.

[0089] Figure 6 This is a diagram showing an example of the snapshot table 2210 .

[0090] exist Figure 6 The snapshot table 2210 is used to manage information related to snapshots created for volumes. The snapshot table 2210 stores information such as the consistency group number, volume number, snapshot number, snapshot lock setting, snapshot lock period, and access mode.

[0091] The volume number is a volume number for identifying the target volume 217 for snapshot creation.

[0092] The snapshot number is a number for identifying a snapshot created for the volume identified by the volume number.

[0093] Multiple snapshots can be taken from a single snapshot. Snapshots can also be managed as volumes, and by assigning volume numbers, snapshots can be taken from that snapshot.

[0094] The snapshot lock setting indicates whether a lock has been set for the snapshot identified by the snapshot number. If "ON" is set, the lock is set, prohibiting deletion of the snapshot. Access to the snapshot is controlled according to the access mode.

[0095] When a lock is set for a snapshot, the snapshot lock period is information indicating the end date and time of the lock.

[0096] The access mode manages the types of access that can be performed on the object snapshot. It can store values ​​such as read-disabled, write-disabled, both read and write-disabled, and both read and write-allowed.

[0097] In the example shown in the figure, snapshot 1 is locked until 15:00 on April 25th, which means that reading is possible but writing is not possible.

[0098] The consistency group number is information used to associate multiple volumes for management as a group. By using consistency groups, when an application uses multiple volumes, snapshots of these volumes can be taken together at the same time and date. In the example shown, volumes 1-1 and 1-2 belong to consistency group 1.

[0099] Snapshot table 2210 may also have Figure 6 Information other than the information shown, such as the time when the snapshot was created, may also be included.

[0100] It is also possible to determine that a snapshot lock is set by storing a limited value during the snapshot lock period. In this case, the value set for the snapshot lock may not be necessary.

[0101] Figure 7 This is a diagram showing an example of processing of the snapshot deletion program 2222 for deleting a snapshot.

[0102] The snapshot deletion program 2222 operates in the memory 200 and deletes the snapshot by updating the snapshot table 2210 .

[0103] The snapshot deletion program 2222 receives a snapshot deletion instruction via the management terminal 270 and the external management software 410 (step S200 ).

[0104] The snapshot deletion program 2222 checks the snapshot lock setting to determine whether a lock has been set for the snapshot (step S201 ).

[0105] If the snapshot has already been locked, that is, if the snapshot lock setting value is ON, an error report is made in step S203 and the process ends (step S204).

[0106] On the other hand, when the snapshot is not locked, that is, when the value of the snapshot lock setting is "OFF", the snapshot is deleted in step S202 and the process ends (step S204).

[0107] Since snapshot deletion is a general process, Figure 7 Detailed description is omitted in the flowchart. A snapshot can be deleted by deleting the snapshot information of the deleted object from the snapshot table 2210 and deleting the data referenced only from the snapshot. In addition, the deletion of the data can also be implemented asynchronously.

[0108] Figure 8 This diagram shows an example of processing of the write program 2223 that receives a write request from the server 100 and stores write data in a volume.

[0109] The writing program 2223 operates in the memory 200 .

[0110] The write program 2223 receives a write request from the server 100 (step S205 ).

[0111] The write program 2223 checks the snapshot lock setting to determine whether a lock has been set for the snapshot (step S206 ).

[0112] If writing is not possible, that is, if the access mode value does not include "WR", an error report is made in step S209 and the process ends (step S210).

[0113] On the other hand, when writing is possible, that is, when the value of the access mode includes "WR", the write process is executed in step S207 and the process ends (step S210).

[0114] Through the above process, the backup data obtained in the memory 200 can be protected from cyber attacks or attacks from malicious administrators.

[0115] Next, a case will be described where the backup data is acquired from an external storage rather than from the storage 200. While the target storage 400 is used as an example of the external storage, other storage may also be used.

[0116] Figure 9 This is a diagram for explaining the flow of processing for acquiring a backup in the object storage 400 .

[0117] There are various methods for transferring backup data to the object storage 400. For example, incremental backup, differential backup, and remote copy are examples of transfer methods. Incremental and differential backups periodically transfer backup data. Incremental backup transfers updated data since the last backup data transfer as the next backup data. Differential backup transfers the difference between the initial transferred backup data and the initial transferred backup data as the backup data. Remote copy allows updates to volume 241 to be reflected in the object storage 400. Remote copy can transfer data sequentially as it is written to volume 241, or periodically transfer all written data at once. Furthermore, in the periodic data transfer method, if multiple updates are made to the same address, only the most recently updated data may be transferred. In this embodiment, the transfer method is incremental backup. By changing the snapshot used to extract differential data (described later) to the currently acquired snapshot and the snapshot corresponding to the initially transferred backup data, the technology of this embodiment can be applied to differential backup.

[0118] In incremental backups, periodically (in Figure 9 In the example, a snapshot of the data stored in the storage 200 (more specifically, the data stored in the volume 241 of the protection target among the data stored in the storage 200) is created every day and transferred to the target storage 400.

[0119] For example, at the initial transfer time of April 1, the data stored in volume 241 is transferred to and stored in object storage 400 as object 3000. Typically, the ratio of the number of volumes 241 to the number of objects 3000 is 1:N (N is an integer greater than or equal to 2), but it may also be 1:1.

[0120] At the next transfer timing, April 2, the snapshot holds only the difference data generated between April 1 and April 2, and this snapshot is transferred to the object storage 400 and stored. Figure 9 In the example shown in Figure 4, data A0 is updated to data A1 between April 1st and April 2nd. Therefore, A1 is transferred to the target storage 400 as the difference. The write destination address generated between April 1st and April 2nd (the storage address of A0 and A1) is extracted, and the data at that address is read from the snapshot of April 2nd, thereby extracting the difference data. Similarly, at the next transfer timing, April 3rd, the snapshot only contains the difference data generated between April 2nd and April 3rd, and this snapshot is transferred to the target storage 400 and stored.

[0121] Furthermore, the frequency of snapshot generation and the frequency of snapshot transfer to object storage 400 can be different. For example, snapshots that have not been referenced in storage 200 for a certain period of time can be transferred to object storage 400. Furthermore, the transfer of data identical to data stored in object storage 400 can be avoided. In this case, management information representing the identical data can be transferred instead of transferring the data. This reduces the amount of transferred data and the amount of data stored in object storage 400.

[0122] exist Figure 1 The object storage is described as the object storage 400 provided by the cloud 2, but it may also be an appliance type object storage. For example, it may be an object storage installed in the data center 1 or in another data center.

[0123] Each object can be compressed to reduce its data size. Compression can be performed either when transferring data from storage 200 or in object storage 400. Compression during transfer from storage 200 not only reduces the amount of data stored in object storage 400 but also reduces the amount of data transferred over the network.

[0124] Next, problems caused by cyber attacks will be described.

[0125] Problem 1: While extracting the difference between the April 3rd and April 2nd snapshots and transferring them to the object storage, the April 3rd snapshot could be attacked. For example, an attack could overwrite the data. In this case, the attacked data would also be stored in object storage 400. To protect data from such an attack, the April 3rd snapshot is locked until the transfer of object 3002 is complete. Snapshot deletion and write permissions are set. Since data must be read to transfer to object storage 400, read access is permitted.

[0126] Question 2: Next, consider the scenario where an attack targeting the April 2nd snapshot occurs while transferring the April 3rd backup. For example, if all the data on April 2nd has been overwritten, extracting the difference between April 2nd and April 3rd will extract data at all addresses as differences. This is because the April 2nd data has been completely overwritten, resulting in data that differs from that on April 3rd. In this case, even the unnecessary data must be transferred to the target storage 400. In the example shown in the figure, if the April 2nd snapshot B0 is overwritten to B5, the address of B0 is also extracted as a difference during the transfer of the April 3rd data, and B0 is also transferred to the target storage. While this does not cause a data mismatch, it does consume the target storage capacity. In the cloud, if charges corresponding to storage capacity are incurred, this will result in unnecessary costs. Therefore, to protect data from such an attack, it is preferable to lock the April 2nd snapshot during the transfer of the April 3rd data. However, since locking on April 2 is not essential, it is possible to lock only the snapshot on April 3 and not the snapshot on April 2. This is because even if the above attack occurs, although the amount of data transferred to the target storage increases, the data itself can be transferred to the target storage.

[0127] Question 3: As Question 3, consider an attack on the object storage 400. Objects stored in the object storage 400 may be overwritten or deleted due to a cyber attack. In the event of such an attack, the correct data can no longer be restored from the object storage 400. In order to protect data from such an attack, the objects stored in the object storage 400 themselves need to be locked. Object locking applies the locking function provided by object storage products or public cloud object storage services. Basically, normal data can be prevented from being lost by deleting or updating objects. In addition, the lock period can be set in the same way as the snapshot lock. In addition, a function for extending the set lock period is also provided.

[0128] Use the following figures to illustrate how to avoid these problems.

[0129] Figure 10 This example illustrates a backup process performed on an object storage device. This process avoids the aforementioned problems 1, 2, and 3 by locking the snapshot created in storage device 200 and the object stored in object storage device 400. These processes are implemented by backup program 2224 and data transfer program 2225. These programs operate in storage device 200.

[0130] When the snapshot is created, the backup program 2224 determines the locking period (step S300). The locking of the snapshot is used to solve the above-mentioned problems 1 and 2. In the case where only problem 1 is to be solved, it is sufficient to only lock the snapshot created in this step S301. The locking period is sufficient as long as the snapshot is locked during the execution of steps S301 to S309. Most of the time for steps S301 to 309 is the data transfer time of step S307. The data transfer time depends on the amount of differential data transferred. The locking period can be determined by estimating the amount of differential data transferred. The amount of differential data transferred can be estimated based on the amount of differential data between volume 241 and the previous snapshot 242. Figure 9 Let's use an example to illustrate this. If the snapshot created this time is April 3rd, and before creating the April 3rd snapshot, the difference between volume 241 and the April 2nd snapshot is calculated, the difference data is A2. This difference data indicates that the April 3rd snapshot is substantially identical to the April 2nd snapshot. Knowing this difference allows the transfer time to be calculated based on, for example, the actual transfer performance from storage 200 to object storage 400. Alternatively, the lock period for the April 3rd snapshot can be determined using the following method: Create a snapshot for April 3rd. At this time, set a lock period sufficient for calculating the difference, such as 10 minutes. Calculate the difference between the created April 3rd snapshot and the previous April 2nd snapshot, and calculate the transfer time. Then, use the calculated transfer time to extend the lock period for the April 3rd snapshot. Alternatively, the lock period can be determined simply based on past transfer time. For example, in the case of date-time backups, this would be a situation where the transfer time falls within 5 hours. Alternatively, management and application of the situation can be performed by day of the week.

[0131] Next, if you want to solve problem 2 or solve problem 1 and problem 2, you need to lock both the snapshot created in step S301 and the snapshot created in step S301 last time. That is, the snapshot created in step S301 needs to be locked until the next snapshot is created. The locking period is calculated based on the frequency of obtaining backups stored in the backup table described later. Figure 9 In the example, a backup is taken once a day. That is, the snapshot used in the backup process is also created once a day. Figure 9In the example above, a one-day lock period for the snapshot created in step S301 is sufficient. Alternatively, to account for delays in snapshot creation or backup scheduling, a lock period of one day plus several hours to one day can be added to the remaining lock period. After determining the lock period, the backup program creates a snapshot for each volume 241 to be protected (step S301). In this case, the snapshot lock is set within the lock period determined in step S300. This avoids the aforementioned problems and allows normal data to be stored in the target storage.

[0132] The backup program 2224 determines the generation number of the current snapshot obtained in step S300 (step S302). For example, if the generation numbers are consecutive, the backup program 2224 increments the previous generation number to determine the current generation number.

[0133] The backup program 2224 extracts the difference between the previous snapshot and the current snapshot (step S303). This difference can be extracted by, for example, retaining the write address of the data written to the main volume 217 after the snapshot is taken, or by comparing the snapshot metadata of the previous snapshot with the snapshot metadata of the current snapshot. Snapshot metadata is information indicating the address where the snapshot data is physically stored. If the data is identical to the data in the protection target volume, by retaining the address indicating the physical location where the data in the protection target volume is stored, capacity consumption caused by the snapshot can be reduced.

[0134] The last snapshot refers to the snapshot created in step S301 of the last executed backup procedure. In addition to backing up the object storage 400, a function is also available for taking a snapshot of the volume 241. Considering this situation, by storing snapshot creation source information in the snapshot table 2210, it is possible to identify the snapshot created in step S301 of the last executed backup procedure.

[0135] The backup program 2224 refers to the backup table 2211 to determine the difference in the snapshot, i.e., the cloud 2 to which the backup data should be transferred, and the packet, and then determines the format used to transfer the data (step S304). For example, the backup program 2224 determines which data should be grouped together as a single object based on the upper limit of the object size.

[0136] The backup program 2224 creates a directory, which is management information for managing the backup process, and metadata for managing the backup data (step S305). A more detailed description of the directory and metadata will be given in Figure 11 This will be described later.

[0137] The data transfer program 2225 then transfers the backup data to the object storage 400 in Cloud 2 according to the format determined in step S304 (step S307). At this point, the data transfer program 2225 specifies locking the object to be transferred. The locking period is specified as the period stored in the backup table described later. Furthermore, the data transfer program 2225 may also perform other processing related to the transfer of the backup data, such as processing the headers assigned to the objects.

[0138] Next, the data transfer program 2225 records the transfer amount table transferred to the object storage (step S308). The details of the transfer amount table are omitted, but it is a table that manages the history of the transfer data amount transferred so far for each packet at the transfer destination. Next, the data transfer program 2225 transfers the directory and metadata created in step S305 (step S309). For example, the data transfer program 2225 can transfer the directory and metadata as objects to the object storage 400, or to other storage mechanisms such as the database on the cloud 2. It can also be saved as information in the object key (objectkey) of the object. For example, if the number of the protection object volume is used as the object key name, it is not necessary to save the protection object volume number in the object.

[0139] Furthermore, the backup program 2224, which has delegated data transfer to the data transfer program 2225, monitors the snapshot lock period during data transfer to ensure that the lock period does not exceed the specified time limit. If the lock period falls below a certain time limit, the lock period is extended (step S306). This allows the snapshot to remain locked even if the backup data transfer is delayed due to a large number of differences, network failure, or the like.

[0140] After the data transfer program 2225 completes its processing, the backup program 2224 waits for the previous snapshot in the memory 200 to be unlocked (step S310). If the lock is unlocked, the previous snapshot is deleted (step S311), and the process ends (step S312). In addition, the current snapshot is not deleted because it is used in the next backup process step S303. Figure 10 In the example, the backup program 2224 waits for the lock to be unlocked and deletes the previous generation snapshot, but other programs may delete the previous generation snapshot at other opportunities.

[0141] Furthermore, all snapshots up to the previous one do not need to be deleted. If snapshots remain in storage 200, while the capacity consumed in storage 200 increases, the time required for data restoration can be reduced. For example, when restoring a snapshot taken at 11:00 from Cloud 2, if a snapshot from 9:00 is stored in storage 200, the difference between 9:00 and 11:00 is retrieved from Cloud 2. In contrast, if a snapshot from 10:00 is stored in storage 200, only the difference between 10:00 and 11:00 is retrieved from Cloud 2, reducing the amount of data transferred and the time required for restoration. Furthermore, the example of transferring data from storage 200 is described using a program stored in memory 215. However, data stored in the volume can also be transferred to Cloud 2 using RC I / F 212 as the primary processor. In this case, backup table 2211 is also stored in memory within the RC I / F, or information can be retrieved from a table stored in memory in storage 200. While other approaches to sharing functions are possible, the present invention is applicable regardless of these approaches.

[0142] While a lock is specified in step S307, if a lock is set for the forwarding destination packet itself, the lock specification in step S307 can be omitted. Furthermore, if the lock period specified in step S307 is longer than the lock period set for the forwarding destination packet, a lock can be specified in step S307. In this case, information indicating whether the packet is locked is stored in the backup table. Furthermore, after the package setting program sets a lock on the packet, the lock setting is notified so that the backup table in memory 200 can be updated.

[0143] A step of checking whether the two snapshots 242 used in step S303 are locked may be added immediately before step S303. An alarm may also be issued if the snapshot used in step S303 is not locked. If not locked, the backup data saved in steps S307 to S309 is stored with information indicating whether the snapshot used for the backup is locked. Information indicating the lock status of the snapshot used for the backup is stored in backup information 1001, described later. If the snapshot is locked, "locked" is stored; if the snapshot is not locked, "not locked" is stored.

[0144] It is possible to lock the snapshot in step S301 without locking the data transferred to the object storage in step S307. In this case, while attacks against the object storage cannot be prevented, attacks against the snapshot can be prevented. This improves security compared to conventional technologies. Conversely, it is also possible to lock only the data transferred to the object storage in step S307 without locking the snapshot in step S301. Furthermore, users can configure whether to lock data transferred to the object storage for each volume or consistency group.

[0145] Alternatively, data transferred to the object storage can be locked in step S307, bypassing the locking in step S301. Furthermore, users can configure whether to lock snapshots for each volume or consistency group. This approach avoids issues 1, 2, and 3.

[0146] Figure 11 This is a diagram showing an example of objects stored in the object memory 400 and data stored in the objects.

[0147] exist Figure 11 In the example, the objects are directory 1000, backup information 1001, difference information 1002, and data 1003. Each object can also be divided into multiple objects for storage. Furthermore, the object structure is merely an example; other storage methods and object keys can also be used. The present invention is applicable to any object structure. The object key is information that specifies the object for retrieval.

[0148] Figure 11 Directory 1000 shown includes a volume number, a storage number, and retrieval generation information. The volume number identifies the volume 241 being protected. The storage number identifies the storage device containing the volume 241 being protected. Retrieval generation information is information acquired for each volume number and manages the generation information of backups stored in object storage 400. Directory 1000 is updated each time a backup is retrieved from object storage 400. The object key used to access directory 1000 can be, for example, the volume number. By specifying the volume number, generation information for the backup acquired for that volume can be retrieved.

[0149] Next, the backup information 1001 includes a generation number, a volume number, a storage number, a time, and a type.

[0150] The generation number is the generation number of the backup. The time is the time when the current backup was acquired. The type is the type of backup process, such as "full backup," "incremental backup," or "differential backup." The object key used to access backup information 1001 can be, for example, a volume number + generation number. The generation number is obtained by accessing directory 1000. Lock status information may also be stored, indicating whether the backup data for the backup generation identified by the generation number was acquired with snapshot 242 locked or unlocked.

[0151] Next, the difference information 1002 includes information on whether or not there is difference data. The difference information 1002 includes information on whether or not there is difference data for each generation of the backup target volume. Figure 11 The object key for accessing the difference information 1002 may be information indicating volume number + generation number + difference information acquisition request, etc. The difference data presence information stores information indicating whether there is difference information for each address of the backup target volume. Figure 11 The "difference data presence information (address 0)" indicates whether the data at address 0 of the backup target volume is included in the data 1003 described later. For example, it can be managed with 1 bit of information. If the bit is 1, it means that the data is saved, and if the bit is 0, it means that the data is not saved.

[0152] Finally, data 1003 has data. The data has the backup data itself. For example, in the difference information 1002, the difference data indicating the address with the difference data is stored in a forward-filled manner. In the case where information indicating the difference is stored in addresses 0, 2, and 3 in the difference information 1002, data 1003 stores the data stored in addresses 0, 2, and 3 in a forward-filled manner. By comparing data 1003 with the information in the difference information 1002, the data at each address of the backup object volume can be retrieved. The address is, for example, LBA (Logical Block Addressing). The object key used to access data 1003 can be information indicating volume number + generation number + data acquisition request, etc.

[0153] You can also use external management software 410 or management terminal 270 to Figure 11 The directory information 1000 and the backup information 1001 shown are provided to the user as information of backup data.

[0154] Figure 12 This is a diagram showing an example of the backup table 2211.

[0155] exist Figure 12The backup table is used to manage backup target volumes, backup destinations, backup schedules, and backup data lock settings. The backup table stores information such as volume numbers, target packages, target lock settings, acquisition frequency, lock period, and backup retention period.

[0156] The volume number records the volume number of the backup target.

[0157] The object package is information about the object storage that stores the backup data.

[0158] The object lock setting is information indicating whether a lock is set for the object constituting the backup data stored in the object package. "ON" means the lock is set. "OFF" means the lock is not set.

[0159] The lock period manages the period during which the object is locked.

[0160] The acquisition frequency manages the frequency of backup acquisition. "Daily" means acquiring a backup once a day. You can also manage the time of day when the backup is acquired. The acquisition frequency can also store a value entered by the management software from the user.

[0161] The backup retention period manages the period during which backups are stored. In the example shown, a weekly backup is taken for volume 1-1. Each backup is stored in the target storage for four weeks. Furthermore, a lock is set during this four-week period, preventing deletion and overwriting.

[0162] The value of the lock period can be saved as a value input by the management software from the user, or it can be determined by the management software, etc. Information such as the backup retention period can also be used to make the decision. In addition, in order to determine the lock period, the lock period can also be calculated based on the number of backups retained and the backup frequency. For example, a backup is obtained once a week, and input information can be obtained from the user to maintain 10 backups. In this case, if the 11th backup is obtained, the first backup is no longer needed. The first backup is required during the 10 weeks until the 11th backup is obtained. Therefore, 10 weeks is set as the lock period. The acquisition frequency, backup retention period, number of backups retained, etc. are called backup schedule information.

[0163] Information on whether or not a lock is set may be managed in package units.

[0164] exist Figures 9 to 12 In the example above, setting a lock on an object was described. The public cloud object locking function also allows you to lock packages, which are areas where objects are stored. In this case, you can also lock packages. Furthermore, you can set a default lock period for objects stored in packages.

[0165] like Figure 13 As shown, the package setting program 2226 is a program for setting a lock in package units for the target storage.

[0166] The package setting program 2226 is executed in the management terminal or external management software. It can also be executed in the memory 200, but it is preferably set by the management software mainly for the settings when creating the package.

[0167] The packet setting program 2226 obtains the forwarding destination packet information (step S400 ). This process can be realized by obtaining the value of the target packet in the backup table 2211 .

[0168] Next, the package setting program 2226 sets a lock on the acquired package (step S401). The shortest period among the lock periods managed by the backup table 2211 may be set as the lock period of the package.

[0169] The lock period can also be set to the package only when the lock periods of all backup target volumes are the same lock period. By doing so, the lock setting under the target unit can be avoided and the number of communications with the target storage can be greatly reduced.

[0170] exist Figure 13 In the example, a lock period is set for the created packages stored in the backup table. However, a lock period can also be set when creating a new package. For example, the following processes are performed: creating a new package, setting a lock period for the created package, notifying the created package information and the set lock period to the memory 200, and setting the target package and target lock information in the backup table.

[0171] use Figure 5 The method of extending the lock period of a snapshot of the storage 200 after a cyber attack is detected has been described. Similarly, the lock period of an object transferred and stored in the object storage 400 can also be extended.

[0172] use Figure 14 An example of a cyber attack detection method in a configuration in which backup data is stored in the object storage 400 is shown.

[0173] The object storage attack detection program is an example of a program that detects cyber attacks on object storage.

[0174] The object storage attack detection program obtains the transfer amount history from the storage (step S500) and calculates the total transfer amount (step S501). Through this process, the amount of data stored in the object storage is calculated during the backup process.

[0175] Next, the object storage attack detection program accesses the object storage and obtains the amount of data stored in the object storage (step S502). Next, the object storage attack detection program obtains the cumulative reduction amount of the object storage (step S503). The capacity obtained in steps S502 and S503 may be in units of packets rather than the object storage 400.

[0176] Next, the object storage attack detection program compares the storage capacity (the capacity stored in the object storage) with the transfer capacity (the amount of data transferred to the object storage by the backup process) to detect a cyber attack (step S504).

[0177] In object storage 400, backups may be deleted in response to user instructions. Specifically, the value obtained by subtracting the cumulative reduction amount from the transferred amount is compared with the stored amount. The calculation formula is: stored amount > (transferred amount - cumulative reduction amount). If the stored amount is greater than (transferred amount - cumulative reduction amount), it can be determined that data has been transferred to the object storage outside of the backup process. This indicates the possibility of a cyberattack.

[0178] If the answer to step S504 is "yes," meaning there is a possibility of a cyber attack, the object storage attack detection program issues an alarm (step S505) and extends the object's lock period (step S506). Step S506 prevents the lock period from expiring and being released during a cyber attack.

[0179] If the answer to step S504 is "No", steps S505 and S506 are skipped, and the processing ends in step S507.

[0180] In step S506, it is not necessary to extend the locking of all objects. It is sufficient to extend the locking of only objects whose remaining locking time is less than a certain number.

[0181] Furthermore, if a volume has multiple generations of backups, it is possible to extend the lock on only the objects in the latest generation. For example, if a volume has backup data from April 1, April 2, and April 3, it is possible to extend the lock on only the objects that comprise the latest backup data from April 3. Furthermore, it is possible to extend the lock on objects that comprise a specified number of backups from the latest backup generation onwards.

[0182] In the case where there are multiple backup data (snapshots) obtained at different times for the same volume (storage area), as long as the latest backup data is retained in a locked state, correct data can be restored from the backup data. On the other hand, if multiple locked data obtained at different times are continuously retained for the same volume (storage area), data that is no longer needed cannot be deleted, resulting in a waste of capacity. Therefore, the lock period is set so that at least the latest locked backup data exists, that is, the number of locked backup data that is longer than the backup interval is less than the specified number. In addition, when a cyber attack is detected, the lock period is extended to maintain the state of the latest locked backup data. By controlling in this way, it is possible to ensure the state of normal data and to appropriately delete unnecessary data.

[0183] Step S506 may not extend the lock period, but instead update the access control list for the object storage to prevent access. For example, access to the object storage may be prevented while the cause of a cyberattack is being investigated. It is also possible to both extend the lock period for the object and update the access control list.

[0184] You can also use the object storage attack detection program to detect a cyber attack as an opportunity to execute Figure 5 The locking of the snapshot in the memory 200 is extended due to the processing.

[0185] In object storage 400, even if an object lock is set, updates are not prohibited. Instead, the object is versioned, retaining data prior to the update as an old version. In this case, while writing to object storage 400 is not an error, normal data is retained as an old version. Especially in object storages with such specifications, the difference between the storage capacity and the transfer capacity is significant, making cyber attacks more likely to be detected. Object storage attack detection programs can be applied only to object storage 400 that implements versioning. When data is transferred using compression, the transferred capacity must be calculated taking this into account.

[0186] use Figure 14 An example of a method for detecting a cyber attack is described. Cyber ​​attacks can also be detected by other methods. Figure 14The transfer amount used in the backup information 1001 can also be stored as information. Backup information 1001 consists of a generation number, volume number, storage number, time, type, and transfer amount. The transfer amount is the same as the data size of the backup generation. Therefore, when managing the backup size, there is no need to additionally manage the transfer amount. In this case, the sum of the storage capacity of the object storage 400 and the transfer amount of the backup information 1001 can be used to detect cyber attacks. Retrieving information from the object storage 400 alone makes it possible to detect cyber attacks without accessing the storage 200.

[0187] Figure 14 In the example, the backup data stored in object storage 400 is considered necessary, so the objects constituting this backup data are assumed to be locked. On the other hand, it is also conceivable that backup data that has aged beyond the lock period may remain without being deleted. Such backup data could be vulnerable to cyberattacks.

[0188] If the backup data of the object storage 400 is deleted due to a cyber attack, the cyber attack can be detected because the transfer amount and the storage amount do not match. In this case, since the storage amount is smaller than the transfer amount, step S504 needs to determine whether the storage amount ≠ (transfer amount - reduction amount).

[0189] When backup data is updated, the data volume generally changes (increases or decreases), so this can be detected by determining that the stored volume ≠ (transferred volume - reduced volume).

[0190] If backup data is updated but the data volume remains unchanged, this cannot be detected due to the fact that the stored data ≠ (transferred data minus reduced data). To detect such cyberattacks, a checksum can be applied to the backup data and periodically checked for changes. Checksums can be applied to both the target data and the backup data. Regular checks can also be performed on a sample of a specified amount of data, rather than all data.

[0191] use Figure 14 , describes a method for extending the lock period of an object after detecting a cyber attack. Other situations exist where the lock period may be extended. This could include delays in transferring backup data from storage 200 to target storage 400. Backup delays can also occur due to network failures or large backup data volumes.

[0192] If the transfer of backup data is delayed, the lock period of the backup data stored in the object storage 400 (i.e., older generation backup data) may expire and the lock may be unlocked. If there is a delay due to a network failure or other reasons that require a long time to restore, there is a high possibility that no locked backup data will be restored. To avoid such a situation, Figure 15 The delay detection program shown in FIG. 1 extends the lock period if a delay in the backup data transfer is detected.

[0193] The delay detection program is an example of a program for detecting a delay in backing up data from the storage 200 to the target storage 400 .

[0194] The delay detection program can be executed in any of the memory 200 , the management terminal 270 , and the external management software 410 .

[0195] The delay detection program obtains the difference and transferred capacity extracted by the backup process in step S303 from the memory 200 (steps S900 and S901).

[0196] Next, the delay detection program calculates the progress of the backup process and the estimated completion date (steps S902 and S903). The progress can be calculated by dividing the transferred capacity (obtained in step S901) by the difference (obtained in step S900). If the data is transferred in compressed form, the transferred capacity is calculated taking this into account.

[0197] Next, the delay detection program determines whether there is any backup data that was locked and unlocked at a date and time earlier than the date and time calculated in step S903 (step S904). If step S904 returns "yes," that is, if there is a backup that was locked and unlocked before the backup in progress was completed due to a backup delay, the lock of the object constituting the backup data is extended to the date and time calculated in step S903 (step S905).

[0198] In the case of "No" in step S904, that is, when the acquired backup is not locked before the backup in progress is completed due to a delay in the backup, the process ends in step S906.

[0199] Step S903 may also calculate the estimated completion date and time by linear completion, or by other methods.

[0200] In step S905, a date and time calculated in step S903 + α may be set. This α is the number of days used as a buffer in case the backup process is delayed again in the future.

[0201] The objects for which the lock extension is to be performed may also be limited based on the number of backups retained. For example, if there are five backups and three backups are required to be retained, steps S904 and S905 may be performed on the three backups with the newer acquisition dates.

[0202] In the event of a network device failure or a line carrier failure, the backup completion date and time may not be calculated in step S903. Specifically, the actual transfer rate of the network is 0 MB / s, and the estimated completion date and time is infinite when calculated. In such a case, in step S905, the lock is extended for a certain period of time (one week, etc.). In addition, the delay detection program can be executed again after a certain period of time has passed (one week, etc.). In addition, if the lock period to be extended is longer than a specified length (one month, etc.), the lock period can also be extended for a specified length and the delay detection program can be implemented again.

[0203] Figure 16 This is a diagram showing an example of a backup performance table.

[0204] exist Figure 16 The backup performance table manages the actual status of transfer performance to the target storage. Using this transfer performance, the date and time when the backup process is completed can be calculated. The backup performance table stores information on the volume number, target package, and transfer performance.

[0205] The volume number records the volume number of the backup target.

[0206] The target package is information about the target storage where the backup data is stored.

[0207] The transfer performance manages the actual status of the performance of the backup process for the volume identified by the volume number.

[0208] The actual amount of transferred data can also be managed.

[0209] [Example 2]

[0210] In Example 1, we described methods for locking snapshots and objects, and extending the locks (snapshot lock, object lock) when a specified condition is detected. In Example 2, we describe a method for setting a lock period shorter than the originally set lock period for object storage 400 and, if necessary, extending the set lock period. The originally set lock period can be, for example, a user-specified lock period or a lock period stored in the backup table. The reasons why this method is effective are explained.

[0211] Regarding the lock of the object storage 400, once the lock is set, data can no longer be deleted while the lock is applied. On the other hand, in the case of backup data, there are cases where a specific generation of backup is no longer needed and it is desired to be deleted. In addition, there are cases where it is desired to transfer the backup data to other storage with lower costs. When a lock is applied to an object, the object cannot be deleted even if the backup of an unnecessary generation is deleted. In addition, when the backup data is transferred to other storage, the data that is no longer needed after the transfer cannot be deleted. In the case of the object storage 400 provided as a storage service, such as a public cloud, fees are incurred for unnecessary data that cannot be deleted. In the case of device-type object storage, storage capacity is continuously consumed by unnecessary data.

[0212] Later, use Figure 17 To explain how to transfer backup data to other storage. Figure 18 To explain how to delete backup data of a specific generation. Figure 19 To illustrate the process of deleting objects that are no longer needed.

[0213] Figure 17 The data migration program shown is an example of a program for migrating an object stored in the object memory 400 to another memory.

[0214] The data migration program receives a request to migrate backup data (step S700). At this point, it receives backup information (target volume and / or generation) and the migration destination (for other target storage devices, target storage device information and the destination package, etc.). If migrating multiple backup generations, the subsequent process can be performed multiple times.

[0215] Next, the data migration program identifies an object to be migrated (step S701), and copies the object to the migration destination (step S702).

[0216] Finally, the object of the copy source is recorded as an unnecessary object (step S703), and the process is terminated (step S704). In step S703, the lock is unlocked and the unnecessary object can be deleted.

[0217] Step S701 is explained. Step S701 is processed differently depending on the target of the migration. The target of the migration may be (a) all backups of all volumes, (b) backups of a specific generation of a specific volume, or (c) all backups of a specific volume.

[0218] Scenario (a) will be explained. This scenario is used, for example, when changing the backup destination. Simply copy the directory 1000, backup information 1001, difference information 1002, and data 1003 to the transfer destination. If a subsequent backup is also transferred to the transfer destination, the target package in the backup table of storage 200 and the information in the transfer destination storage can also be updated.

[0219] The case (b) will be described below. For example, it is used to migrate backup data that has become outdated for a certain period of time to a cheaper storage.

[0220] The data migration program uses the volume number and generation of the target backup received in step S700 to obtain the difference information 1002. As described above, the object key of the difference information 1002 is information indicating volume number + generation number + difference information acquisition request, and can be accessed using the information received in step S700.

[0221] Next, the data migration program uses the volume number and generation of the target backup received in step S700 to retrieve data 1003. As described above, the object key of data 1003 is information indicating volume number + generation number + data retrieval request, and can be accessed using the information received in step S700.

[0222] The data migration program writes the acquired difference information 1002 and data 1003 to the migration destination storage. To access the backup of the generation after migration, the migration destination storage information must be managed. This can be achieved by storing the difference information 1002 and the storage information for storing the data 1003 in backup information 1001. Backup information 1001 includes fields such as generation number, volume number, storage number, time, type, and storage information. The storage information contains the target storage and package information for the migration destination.

[0223] The case of (c) will be described below. All backups of a specific volume can be migrated by executing the process shown in (b) for each generation of the specific volume.

[0224] The data transfer program can operate not only on external management software and management terminals, but also on virtual machines (VMs) in Cloud 2. This can also be achieved through serverless services such as those provided by Cloud 2. It is assumed that the unnecessary objects in step S703 are notified to the external management software and management terminal, and are managed by the external management software and management terminal. As described above, if the data transfer program waits for the lock and unlock to delete the unnecessary objects, there is no need to manage the unnecessary objects. If the unnecessary objects are managed and deleted asynchronously with the data transfer program, it is assumed that the object deletion program described later deletes the objects.

[0225] Figure 18 An example of processing for merging objects that make up a backup is shown. Figure 18 The example in FIG shows the process for merging objects when a backup deletion is received.

[0226] Figure 18 The backup deletion program shown is a program for deleting backups, and the differential merging program is a program for merging objects.

[0227] The backup deletion program and the difference merging program can be run not only on external management software and management terminals but also on VMs in Cloud 2. Alternatively, they can be implemented using serverless services provided by Cloud 2. These two programs can also be run on different devices; for example, the backup deletion program can be run on external management software, while the difference merging program can be run through Cloud 2 services or VMs.

[0228] The backup method of the present invention is as follows: Figure 9 As described above, only the difference data generated between backups is stored in the object storage 400.

[0229] For example, the backup on April 1st has data at addresses 1, 2, and 3. The backup on April 2nd has data at addresses 4, 5, and 6. The backup on April 3rd has data at addresses 5 and 6. When restoring the data on April 3rd, the data from April 1st to 3rd is written to the volume of the recovery destination in order from oldest to newest. That is, in order to restore the data on April 3rd, the data from April 1st and 2nd are also needed. If all the data on April 2nd is deleted at the same time as the backup on April 2nd, the backup on April 3rd can no longer be restored. The data on April 2nd required for the recovery of April 3rd is only the data at address 4. This is because the data at addresses 1, 2, and 3 are included in the backup on April 1st, and the data at addresses 5 and 6 are also included in the backup on April 3rd. Because of the above, when the backup on April 2nd is deleted, the data at address 4 on April 2nd is merged into the backup data on April 3rd. This merging of objects is called a differential merge.

[0230] The backup deletion program receives the backup deletion request (step S600). At this time, the volume number and generation of the deletion object are received. The generation can also specify multiple generations. The backup deletion program starts the difference merging program and notifies the information of the generation of the deletion object and the information of the generation to be merged with the difference. The generation to be merged with the difference becomes the backup of the next generation of the backup generation of the deletion object. Figure 18 In the example, generations 1 to 4 are deleted and the necessary data from generations 1 to 4 are merged into generation 5.

[0231] The difference merging program obtains difference information 1002 for each generation (in the example shown, generations 1 to 4 and generation 5) (step S601). Next, the difference merging program uses this difference information to determine the data required after merging (step S602). In the example above, the data for address 4 on April 2nd is determined.

[0232] Next, the difference merge program reads the data from each generation, generates merged data (step S603), and saves the merged data (step S604). In the above example, data is generated by merging address 4 on April 2nd with addresses 5 and 6 on April 3rd, and this data is saved. The object to be saved can be saved using the object key of generation 5. In other words, generation 5 can be overwritten. Alternatively, data can be saved using another object key.

[0233] The differential merge program notifies the backup deletion program of the increase in capacity of generation 5 due to the differential merge (step S605).

[0234] The backup deletion program records the objects that are no longer needed due to the deletion of the backup (step S606). This process is the same as step S703. Next, the backup deletion program records the increased capacity (step S607).

[0235] When the objects are merged, the increased capacity recorded in step S607 is added to the storage capacity determined in step S504. Therefore, the storage capacity is recorded in step S607.

[0236] Finally, the backup deletion program deletes the backup information 1001 of the backup object, updates the generation information of the directory 1000 (step S608), and ends the processing (step S609).

[0237] Figure 19 This is an example of a process for deleting an object that is no longer needed. An object that is no longer needed is an object that was recorded as no longer needed in steps S606 and S703. The object deletion program deletes the no longer needed object by instructing the object storage 400 to delete the object.

[0238] The object deletion program can be executed not only on external management software and management terminals but also on VMs in the cloud 2. It can also be implemented using serverless services provided by the cloud 2.

[0239] The object deletion program obtains a list of unnecessary objects (step S800). This is achieved by obtaining the information recorded in steps S606 and S703.

[0240] Next, the object deletion program executes steps S801 to S804 for each acquired object. In step S801, the object deletion program determines whether the object can be deleted. Specifically, if the object's lock period has expired, the object is considered deletable. On the other hand, if the object's lock period has not expired, the object cannot be deleted.

[0241] If the result of step S801 is that deletion is impossible, the object deletion program skips steps S802 and S803 and ends the processing (step S804).

[0242] On the other hand, if the result of step S801 is that the object can be deleted, the object deletion program will not delete the object (step S802), add the size of the deleted object to the cumulative deletion capacity (step S803), and end the process (step S804).

[0243] Management of unnecessary objects can be achieved, for example, by adding unnecessary generation information to directory 1000. In this case, directory 1000 consists of a volume number, a storage number, an acquisition generation, and unnecessary generation information. The object deletion program can periodically access directory 1000 to identify unnecessary generations. Once an unnecessary generation is identified, the unnecessary object can be deleted by deleting the backup information 1001, difference information 1002, and data 1003 for the unnecessary generation.

[0244] In steps S606 and S703 , the unnecessary generation information or unnecessary object information may be recorded in a management terminal, external management software, or other databases.

[0245] When a long-term lock is set for the object storage 400, Figure 17 、 Figure 18 until the object is no longer needed. Figure 19 The object deletion process takes a long time to delete.

[0246] Therefore, a method of setting a lock period shorter than the lock period that should be set for the target storage 400 and extending the set lock period if necessary will be described.

[0247] Figure 20 This is an example of a lock management table for managing the lock period that should be set originally and the lock period actually set for the target storage 400 .

[0248] The lock management table manages the volume number, backup generation, requested lock period, set lock period, and whether the lock is required.

[0249] The volume number records the volume number of the backup target.

[0250] The backup generation is generation information of the backup of the volume identified by the volume number.

[0251] The requested lock period is information indicating the period during which the backup must be locked. Specifically, it manages the date when the lock can be released. The requested lock period can be stored as a value input by the management software from the user, or it can be determined by the management software.

[0252] The set lock period manages the lock period actually set for the target storage 400 .

[0253] exist Figure 20 In the example, the lock is required until 15:00 on September 30. In contrast, the lock is set to 15:00 on April 25 for the object storage 400. And, as the time of 15:00 on April 25 approaches, the lock period is extended as needed. Figure 21 Explain the process of extending the lockout period.

[0254] Whether it is necessary to use Figure 19 This is an example of information used to manage unnecessary generations. Indicates whether a backup specified by the volume number and backup generation is necessary. Figure 17 Step S703 and Figure 18 In step S606, the value of "necessary or not" is set to not necessary. Figure 17 、 Figure 18 In the record that is set as not requiring the object, but in Figure 17 、 Figure 18 In the example above, since all objects constituting a specific generation of backup data are no longer needed, the need for objects can be managed for each backup generation. Using the "necessity" field in the lock management table, the need for objects for each backup generation can be managed. Furthermore, the need for objects can be managed for each object. For example, this can be achieved by managing a list of the object keys of no longer needed objects.

[0255] The lock management table is stored in external management software, a management terminal, or a database service provided by the cloud 2. Since the object deletion program refers to it, if it is stored in the same device as the device that executes the object deletion program, communication between devices is minimized, thereby improving efficiency.

[0256] Figure 21 This is an example of a program for extending the lock period set for the target memory 400 .

[0257] The lockout extension program can be executed not only on external management software and management terminals, but also on VMs in Cloud 2. It can also be implemented using serverless services provided by Cloud 2. Because the lockout extension program is vulnerable to cyberattacks, it can also be executed in a data center other than Data Center 1 or Cloud 2. It can also be executed in a logically isolated environment within Cloud 2.

[0258] The lock extension program acquires the lock period actually set for the target storage 400 (step S1000). This process is realized by acquiring the set lock period from the lock management table.

[0259] Next, the lock extension program determines whether the lock end date obtained in step S1000 is less than a certain number of days (step S1001). For example, whether it is within 5 days. In other words, the lock extension program determines whether it is within the specified range before the expiration of the set lock period. This process is achieved by comparing the lock unlock date with the current date.

[0260] If the result of step S1001 is "No", that is, if there are more than a certain number of days until the lock is unlocked, the lock extension program ends the processing (step S1004).

[0261] On the other hand, if the result of step S1001 is "yes", that is, the number of days until the lock is unlocked is less than a certain number, the lock extension program determines whether to extend the lock (step S1002). The requested lock period is compared with the set lock period. If the requested lock period is a date and time closer to the future, the lock may be extended. In other words, if the expiration of the set lock period is earlier than the expiration of the requested lock period, the lock extension program may extend the set lock period. In addition to this condition, if the object as the target is needed for backup, it is determined that the lock period is extended. Since unnecessary objects are recorded in steps S703, S606, and S802, the lock period is extended if no unnecessary objects are recorded in these steps.

[0262] If the result of step S1002 is "No", that is, if the lock period does not need to be extended, the lock extension program ends the processing (step S1003).

[0263] On the other hand, if the result of step S1002 is "YES", that is, if the lock period needs to be extended, the lock extension program extends the lock period (step S1003) and ends the processing (step S1004).

[0264] The extension period in step S1003 can be any period. For example, it can be a one-week period. This can also be determined based on the period during which the lock extension procedure is implemented. It can also be determined based on the requested lock period and the number of extensions. For example, if the requested lock period is 10 months and the number of extensions is 10, updates can be made in monthly increments. Depending on the object storage 400, there may be an upper limit on the number of extensions. In this case, a method based on the requested lock period and the number of extensions as described above is preferred.

[0265] When determining the extension period, control is performed to prevent the date and time from being earlier than the requested lock period. For example, in the case of a one-week extension, if the date and time is later than the requested lock period, the requested lock period is set to the extended date and time.

[0266] The lock is extended for each object constituting the backup data. If the backup data is composed of multiple objects, the lock is extended for each object in sequence.

[0267] [Example 3]

[0268] In Example 1 and Example 2, the configuration of only the data center 1 or the configuration of the data center 1 linked with the cloud 2 is described as an example. In Example 3, the configuration of only the cloud 2 is described. In the cloud 2 represented by the public cloud, the object storage 400 is flexibly utilized. For example, the data of the software-defined storage (SDS, software-defined storage) operating in the cloud 2 is backed up to the object storage 400. In addition, it is also considered to move the low-frequency access data of the SDS to the object storage 400. Even if the security of the SDS itself is reliable, it is possible to access the data configured in the object storage 400 using the access method of the object storage 400 without going through the SDS. Therefore, it is necessary to lock the data stored in the object storage 400.

[0269] Figure 22 It is a diagram showing a configuration example of the memory 500 . Figure 22 The storage 500 shown is constructed using an SDS operating on a public cloud. However, the storage 500 may include hardware for performing specific processing, etc. Examples of such hardware include hardware for data compression and hardware for data encryption. The storage 500 may also be provided as a service.

[0270] like Figure 22As shown, the storage 500 is communicably connected to a management server 501 via a network 502. The storage 500 also includes a plurality of storage servers 503 and a plurality of cloud storages 507 constituting volumes 509.

[0271] Storage server 503 is composed of a physical server, a virtual machine, or a container. Furthermore, storage server 503 has a communication port 504, memory 505, and a CPU 506. Communication port 504 is communicatively connected to management server 501 via network 502. Furthermore, communication port 504 is connected to object storage 400. Communication port 504 may also be connected to a server that executes an application. A server may also be composed of a physical server, a virtual machine, or a container. It may also store data used in services such as databases provided by a public cloud or computing.

[0272] Memory 505 stores programs that define the operations of CPU 506, as well as control information used by these programs. CPU 506 is a processor that reads and executes programs stored in memory 505, thereby performing various processes. In this embodiment, the storage function is implemented by CPU 506 executing programs in each memory. CPU 506 accepts I / O requests from servers executing the aforementioned applications, and writes and reads data to and from cloud storage 507 in accordance with these I / O requests.

[0273] Cloud storage 507 is a storage area for storage server 503. A storage area can be created using a public cloud storage service and installed on storage server 503 as cloud storage 507. Volumes 509 can also be created across multiple cloud storages 507 and provided to the server. Furthermore, data written to a volume can be made redundant across multiple cloud storages 507. The redundancy method is not particularly limited and may include methods such as data duplication and erasure coding.

[0274] in addition, Figure 22 The structure of the memory 500 shown is only a simple example and is not limited to this. For example, the memory 500 may also have the same structure as the memory 200. In addition, each storage server 503 may be set across multiple areas that can work and operate independently (data centers, areas that ensure availability, areas that are logically divided according to purpose or each user (tenants, etc.), etc.). In addition, the memory 500 and the server may be set across multiple areas (data centers, areas that ensure availability, areas that are logically divided according to purpose or each user (tenants, etc.), etc.). In addition, the memory 500 and the server may be set up on different clouds or on cloud services provided by other vendors on a public cloud vendor.

[0275] Management server 501 is a management device used to manage and maintain secondary storage 500. Management server 501 includes memory 501a and CPU 501b. Memory 501a stores programs that define the operations of CPU 501b and various information used by these programs. CPU 501b is a processor that reads and executes the programs stored in memory 501a, thereby performing various processes. Alternatively, the functions of management server 501 may be implemented by one of storage servers 503.

[0276] The method for locking the object of object storage 400 when backing up data stored in storage 500 to object storage 400 is the same as that described in Examples 1 and 2. This is the case where storage 200 is storage 500 and data center 1 is cloud 2. Storage 500 includes a backup program, a data transfer program, and other necessary tables, which are also included in storage 200.

[0277] This section describes a method for locking an object in object storage 400 when partially storing data stored in storage 500 operating on cloud 2 in object storage 400. This example is also applicable to storing partially stored data in storage 200 in object storage 400. However, considering the long distance between data center 1 and cloud 2 and the long access time, it is conceivable that storing partially stored data in storage 500 in object storage 400 is a more common configuration.

[0278] Use the following diagram Figures 23 to 28 , the hierarchical control function of moving infrequently accessed data of the SDS to the object storage 400 will be described.

[0279] The hierarchical control function uses the frequency of access to data to determine and change the storage destination of data. It is common to move data in a more granular unit rather than a volume. Figure 23 Describes the basic structure of data movement units, etc. Figure 23 While the description above describes movement in units smaller than volumes, called pages, the present invention is also applicable to movement in units of volumes.

[0280] Figure 23 This diagram illustrates the relationship among the volume 509 , the capacity pool 290 , the pool volume 291 , and the cloud storage 507 .

[0281] The storage 500 creates a pool volume 291 from storage areas of multiple cloud storages 507. The capacity pool 290 includes one or more pool volumes 291. The pool volume 291 includes pages 292, which are physical storage areas that are allocated to the volume 509. The capacity of a page 292 is, for example, several KB to several dozen MB.

[0282] If data is written to a storage area within volume 509, the storage system 500 allocates pages 292 within pool volume 291 to that area. In other words, since pages 292 are not allocated to unused areas of volume 509, the storage area of ​​cloud storage 507 is not consumed. Alternatively, pages can be created as physical storage areas for cloud storage 507. In this case, pool volume 291 is no longer required. In this case, the pool table (described later) manages the addresses of cloud storage 507 as the start and end addresses.

[0283] Figure 24 This shows an example of a pool table.

[0284] The pool table is a table for managing each page 292 in the capacity pool 290 , and is stored in, for example, a control information unit of the memory of the storage 500 .

[0285] The pool table manages records (entries) created by mapping fields such as page number, start address, end address, status, and dispatch destination. The page number identifies page 292 in capacity pool 290. The start address and end address are used to identify the area of ​​page 292. These addresses are used to manage the entire capacity pool 290. Of course, the area of ​​page 292 can also be managed using the pool volume number and the address within the pool volume. If the page size is fixed, the end address is not required.

[0286] The start address stores the start address of the corresponding page 292. The end address stores the end address of the corresponding page 292. The status stores information indicating whether the corresponding page 292 has been allocated to volume 509 or is unallocated. The allocation destination stores the volume number to which the corresponding page 292 is allocated. As can be seen from the top record of the pool table, the page with page number "1" has a start address of "0" and an end address of "99" and has been allocated to volume 509 with volume number "1." A table or the like for managing unallocated page numbers may also be provided. In this case, unallocated pages can be retrieved at high speed.

[0287] Figure 25 This shows an example of a volume table.

[0288] The volume table is a table for managing the pages 292 allocated to the volume 509 , and is stored in, for example, a control information unit of the memory of the storage 500 .

[0289] The volume table 225 manages records containing fields such as volume number, address, page allocation status, page number, read frequency (times / hr), and write frequency (times / hr). The address range within the volume 509 is divided into regions of the same size as a page 292. Each record represents a region. This region is also referred to as a virtual page.

[0290] The volume number identifies the volume 509. The address stores the address range within the corresponding volume 509. The page allocation status stores information indicating whether a page has been allocated to the region indicated by the corresponding address range. The page allocated to the region may correspond to a page 292 within the capacity pool 290 or not. The page number stores the page number of the page allocated to the region, or an identifier indicating that the page allocated to the region does not correspond to a page 292 within the capacity pool 290. When the data stored in the region is physically stored in the capacity pool 290, the page number stores the number of the page 292 within the capacity pool 290. When the data stored in the region is not physically stored in the capacity pool 290 but in the object storage 400, the page number does not store information indicating the page 292 within the capacity pool 290, but instead stores information indicating the object storage 400, such as object storage information and package information.

[0291] The read frequency (times / hr) stores the number of reads issued per unit time for the corresponding area. The write frequency (times / hr) stores the number of writes issued per unit time for the corresponding area. In this example, the unit time is set to one hour, but it can also be one day, one minute, or one second. The memory 500 measures the access frequency (read frequency and write frequency) of each area and updates the volume table.

[0292] According to the top record of the volume table, page 292 with page number "2" is allocated to the area of ​​addresses 0 to 99 of volume 509 with volume number "1", and its read frequency and write frequency are higher than those of other addresses.

[0293] Figure 26This is an example of a flowchart of a tearing program that stores low-frequency access data (Cold Data) stored in the memory 500 in the object memory 400 and stores high-frequency access data (Hot Data) in the memory 500. The tearing program calculates the optimal data storage layout based on changes in IO frequency information and activates a demotion program and a promotion program to actually change the data configuration. In addition, changing the data storage location as hot data changes to cold data is called demotion. Furthermore, changing the data storage location as cold data changes to hot data is called promotion. The tearing program is executed periodically in the memory 500. For example, if the frequency of re-evaluation of data configuration is once per hour, the tearing program is activated once per hour. The frequency of re-evaluation of data configuration can be set by the user or storage administrator via a management server, etc.

[0294] First, the tearing program obtains I / O frequency information for each area of ​​volume 509 from the volume table (step S3000) and uses this I / O frequency information to calculate the optimal data allocation (step S3001). Next, the tearing program compares the optimal allocation with the current allocation to determine which data should be promoted and demoted (steps S3002 and S3003).

[0295] As an example of a placement decision, the tearing program sorts the areas of volume 509 in descending order of I / O frequency. Next, based on the capacity of the storage 500 capacity pool 290, the tearing program derives I / O frequency thresholds for identifying hot data and cold data, and determines which area's data should be stored as hot data in the storage 500 capacity pool.

[0296] Furthermore, the tearing program determines data to be upgraded, in addition to the data already stored in the capacity pool 290. Similarly, the tearing program determines data not yet stored in the capacity pool 290 as downgrade targets.

[0297] The following describes the steps following step S3004 of the tearing program. The tearing program specifies the downgrade target and calls the downgrade program (step S3004). Finally, the tearing program 511 specifies the upgrade target, calls the upgrade program, and ends the process (step S3005). In many cases, the capacity of the memory 500 is smaller than the capacity of the object memory 400. To create free pages in the capacity pool 290, the tearing program basically executes the downgrade program first. When upgrading and downgrading multiple data, alternating between downgrading and upgrading allows for efficient use of the hot data storage area.

[0298] According to the tearing procedure, the memory 500 classifies each region into either a first group or a second group based on the access frequency of each region. Regions classified in the first group are assigned pages associated with the capacity pool 290, while regions classified in the second group are assigned pages not associated with the capacity pool 290. The first group, for example, includes regions corresponding to hot data. The second group, for example, includes regions corresponding to cold data. This prevents a decrease in access performance for data stored in the memory 500 and conserves the capacity of the memory 500.

[0299] Figure 27 This is an example of a flowchart of the downgrade procedure.

[0300] The downgrade program is called from the tearing program and executed in the memory 500 .

[0301] First, the downgrade program receives a downgrade instruction (step S4000). At this time, the downgrade program receives as parameters the areas within one or more volumes 509 to be downgraded (areas specified by volume numbers and addresses within the volumes).

[0302] In this embodiment, it is assumed that the degrading program receives information of multiple regions and processes multiple regions. However, the degrading program may also be called multiple times by the tearing program to implement the degrading function of one region.

[0303] Next, the downgrade program selects an unprocessed area from the downgrade target (step S4001) and transfers the data stored in this area to the target storage 400 (step S4003). At this point, the data transfer program specifies the lock for the target to be transferred. The downgrade program then records the amount of data transferred to the target storage in the transfer table (step S4004). This process is identical to steps S307 and S308 described using the data transfer program.

[0304] Next, the downgrade program updates the volume table for volume 509 using this area (step S4005). Specifically, the downgrade program saves the object storage information and package information to the page number. After the change, the downgrade program releases the area of ​​capacity pool 290 storing hot data (step S4006).

[0305] Next, the downgrade program checks whether all the indicated areas have been processed (step S4007). If all the indicated areas have been processed, the downgrade program ends processing (step S4008). On the other hand, if there are still unprocessed areas, the downgrade program returns to S4001 and executes S4001 to S4006 for the next unprocessed area.

[0306] Figure 28 This is an example of a flowchart for the upgrade procedure.

[0307] The upgrade program is called from the teardown program 511 and executed in the memory 200 .

[0308] First, the update program receives an update instruction (step S5000). At this time, the update program receives as parameters the areas within one or more volumes to be updated (areas specified by volume numbers and addresses within the volumes).

[0309] Next, the upgrade program selects an unprocessed region from the upgrade target (step S5001) and reserves a region in the capacity pool 290 to store the region (step S5002). Specifically, the upgrade program updates the status 224d and the allocation destination of the pool table 224. Furthermore, the upgrade program updates the page number 225d of the volume table 225.

[0310] Next, the upgrade program issues a read request to the object storage 400, reads the object data, and stores it in the area reserved in step S5002 (step S5003).

[0311] Furthermore, the upgrade program records the object of the copy source as an unnecessary object (step S5004). In step S5004, the unnecessary object can also be deleted after waiting for the unlocking of the lock. Figure 17 、 Figure 18 、 Figure 20 In the example, this is achieved by changing the value of "Necessary" in the lock management table to "Not Necessary". In the case of hierarchical control, it is not like this. Figure 17 、 Figure 18 、 Figure 20 That would make the entire backup data unnecessary. Therefore, the necessity of each unnecessary object should be managed. For example, this can be achieved by managing a list of the object keys of the unnecessary objects.

[0312] The page number 225d of the volume table 225 stores the page number of the pool volume 291. This data is stored in the cloud storage 507 mounted on the storage 500 by the storage 500.

[0313] Next, the upgrade program checks whether all the instructed areas have been processed (step S5005). If all the instructed areas have been processed, the upgrade program ends the processing (step S5006).

[0314] On the other hand, if there are unprocessed areas remaining, the upgrade program returns to step S5001 and executes steps S5001 to S5005 for the next unprocessed area.

[0315] In hierarchical control, it is difficult to determine the lock period because the access frequency of data changes. Even if a long-term lock is set, if the access frequency increases and data is updated to the memory 500, the object will not be deleted for a long time in the object memory 400 and will remain. Therefore, it is preferable to Figure 20 、 Figure 21 Set the lockout period to a shorter one and extend it periodically. Figure 20 、 21 The difference is that there is no requested lock period. It is assumed that data stored in object storage 400 should be locked until the volume is deleted and the data itself becomes unnecessary. In other words, the requested lock period is the period until the data becomes unnecessary. This allows the lock period to be periodically extended simply by referring to the set lock period.

[0316] In the above description, hierarchical control is used as an example to illustrate locking when moving infrequently accessed data to object storage 400. However, the snapshot function described in storage 200 can also be applied to data referenced only from a snapshot and saved in object storage 400. In other words, instead of identifying infrequently accessed data and moving it to object storage 400, data referenced only from a snapshot can be moved to object storage 400.

[0317] Furthermore, the present invention can also be applied when substantially all data is stored in the object storage 400, and a portion of the data is stored in the cache of the storage 500 or in the cloud storage 507. Furthermore, when a public cloud is used in addition to the cache or cloud storage 507, an instance store or the like provided by the storage server 503 may also be used.

[0318] Most of the data stored in object storage 400 is locked and the lock period is periodically extended. The lock period is periodically extended until the object becomes unnecessary due to volume deletion or data updates. If storage 500 stores data using a log structure, data updates may generate data that is no longer referenced from any volume. In such cases, even if the volume is not deleted, the data is no longer necessary, so there is no need to extend the lock period.

[0319] exist Figure 29 5 shows the programs and control tables stored in the memory 505 of the storage 500 and the programs and control tables stored in the management server 501.

[0320] The hierarchy control program, upgrade program, downgrade program, pool table, and volume table are stored in the memory 505. These programs and tables have been described using the above-mentioned figures.

[0321] The lock extension program and the unnecessary object table are stored in the management server 501. These programs and tables have been described using the above-mentioned diagrams.

[0322] As described above, data stored in the object storage 400 can be securely stored by being locked.

[0323] As described above, the disclosed storage device includes a processor 216 for processing data stored in a storage device (220). The above-mentioned storage device is a storage device 200 connected to another storage device (400) via a network. The above-mentioned processor 216 obtains a first snapshot of a volume generated using a storage area of ​​the above-mentioned storage device, compares a second snapshot which is a snapshot obtained last time with the above-mentioned first snapshot, extracts incremental data, transfers the above-mentioned incremental data to the above-mentioned other storage device, stores it as backup data, and sets a lock on the above-mentioned backup data stored in the above-mentioned other storage device.

[0324] Therefore, data can be stored more securely.

[0325] Furthermore, the processor 216 sets a lock on the first snapshot and the second snapshot when acquiring the first snapshot and the second snapshot.

[0326] Therefore, even if the snapshot before transfer is attacked by a cyber attack or the object storage is attacked by a cyber attack, normal data can be restored.

[0327] Furthermore, when the cyber attack is detected, the processor 216 extends the lock period of the backup data transferred to the other memory.

[0328] Furthermore, the lock prohibits deletion and overwriting of the data targeted by the lock.

[0329] Therefore, it is possible to avoid a situation where the backup data becomes a new target of attack after the lock is released, and to ensure normal data.

[0330] For example, the processor 216 calculates the lock period set for the first snapshot when the first snapshot is acquired, based on backup schedule information set in advance by the user.

[0331] For example, the processor 216 calculates and determines the lock period set for the backup data based on the lock period previously designated by the user or the number of backups to be retained and the backup frequency set by the user.

[0332] As an example, the processor 216 is characterized in that when the first snapshot and the second snapshot are not locked, an alarm is issued.

[0333] For example, the processor 216 determines whether to set a lock for the snapshot and the backup data based on a lock target specified by a user.

[0334] Therefore, it is possible to avoid a situation where the lock is released due to a transfer delay or the like, thereby becoming a target of an attack, and to ensure normal data.

[0335] Furthermore, the processor 216 calculates the total amount of data transferred to the other memory, obtains the amount of data stored in the other memory, and detects a cyber attack if the total amount of data transferred does not match the amount of data stored.

[0336] Furthermore, the processor 216 may extend a lock period of the backup data transferred to the other memory when the cyber attack is detected.

[0337] Therefore, it is possible to detect cyber attacks with high accuracy and protect backup data.

[0338] In addition, the processor 216 sets a lock period for the backup data that is shorter than the lock period specified by the user, i.e., the requested lock period. If the lock period expires earlier than the requested lock period, the lock period is extended if the expiration of the set lock period is within the prescribed range before expiration and the object backup data does not become unnecessary.

[0339] Furthermore, after the backup data is transferred to the other storage, the processor 216 waits for the lock of backup data older than the transferred backup data to be released and deletes the older backup data.

[0340] For example, when receiving a deletion instruction for the backup data, the other storage device determines an object that becomes unnecessary due to the deletion of the backup data, records the object, monitors whether the lock of the determined object is released, and deletes the object if the lock of the determined object is released.

[0341] Therefore, it is possible to avoid a situation where unnecessary backup data remains.

[0342] Furthermore, the other storage is a storage configured in the cloud, and the storage connected to the other storage is a storage configured on-premises. Therefore, when the on-premises data is saved in the cloud, the data can be protected.

[0343] The above-mentioned embodiments of the present disclosure are examples for explaining the present disclosure and are not intended to limit the scope of the present disclosure to these embodiments. A person skilled in the art can implement the present disclosure in various other forms without departing from the scope of the present disclosure.

Claims

1. A memory having a processor for processing data stored in a storage device, the memory being connected to other memories via a network, wherein the memory is characterized in that: The processor obtains a first snapshot of a volume generated using a storage area of ​​the storage device, compares a second snapshot obtained last with the first snapshot to extract incremental data, transfers the incremental data to the other storage device for storage as backup data, and sets a lock on the backup data stored in the other storage device.

2. The memory according to claim 1, wherein: The processor sets a lock on the first snapshot and the second snapshot when acquiring the first snapshot and the second snapshot.

3. The memory according to claim 2, wherein: The above-mentioned lock prohibits deletion and overwriting of the data that is the target of the lock.

4. The memory according to claim 3, wherein: The processor calculates a lock period set for the first snapshot when the first snapshot is acquired, based on backup schedule information set in advance by a user.

5. The memory according to claim 3, wherein: The processor calculates and determines a lock period set for the backup data based on a lock period previously designated by a user or a number of backups to be retained and a backup frequency set by the user.

6. The memory according to claim 3, wherein: The processor issues an alarm when the first snapshot and the second snapshot are not locked.

7. The memory according to claim 3, wherein: The processor determines whether a lock needs to be set for the snapshot and the backup data based on a lock target specified by a user.

8. The memory according to claim 1, wherein: The processor calculates a total transfer amount of data transferred to the other memory, obtains a storage amount of the transferred data in the other memory, and detects a cyber attack when the total transfer amount does not match the storage amount.

9. The memory according to claim 8, characterized in that When the cyber attack is detected, the processor extends a lock period of the backup data transferred to the other memory.

10. The memory according to claim 1, wherein: The processor sets a lock period for the backup data that is shorter than the lock period specified by the user, i.e., the requested lock period. If the lock period expires earlier than the requested lock period, the lock period is extended if the set lock period is within a prescribed range before expiration and the object backup data has not become unnecessary.

11. The memory according to claim 1, wherein: After the transfer of the backup data to the other memory is completed, the processor waits for the lock of backup data older than the transferred backup data to be released, thereby deleting the old backup data.

12. The memory according to claim 11, wherein: When receiving the instruction to delete the backup data, the other storage device identifies and records the object that becomes unnecessary due to the deletion of the backup data, monitors whether the lock of the identified object is released, and deletes the object if the lock of the identified object is released.

13. The memory according to claim 1, wherein: The other storage is configured in the cloud. The storage connected to the other storage is the storage configured in the local deployment.

14. A method for protecting data in a memory, the method being a method for protecting data in a memory connected to another memory via a network and having a processor for processing data stored in the storage device, the method for protecting data in the memory being characterized in that: The processor obtains a first snapshot of a volume generated using a storage area of ​​the storage device, compares a second snapshot obtained last with the first snapshot to extract incremental data, transfers the incremental data to the other storage device for storage as backup data, and sets a lock on the backup data stored in the other storage device.

Images