Method, apparatus and computer program product for recovering data

Abstract

The embodiment of the invention relates to a method and equipment for recovering data and a computer program product. The method includes, in response to detecting that data blocks in the storage system are attacked, determining one or more attacked data blocks, where a snapshot of a plurality of snapshots of the storage system has a snapshot copy number. The method also includes determining one or more data block copy numbers for the one or more data blocks that are attacked. The method further includes identifying a latest target snapshot of the plurality of snapshots based on a snapshot copy number of a snapshot of the plurality of snapshots and the one or more data block copy numbers, where all data blocks in the target snapshot are not attacked. In addition, the method further comprises the step of recovering the data of the storage system based on the latest target snapshot. According to the method provided by the embodiment of the invention, a user is helped to quickly determine the latest clean snapshot by using less manual inspection, so that quick recovery can be carried out from the detected attack.

Description

Technical Field

[0001] Embodiments of the present disclosure generally relate to the field of computers, and more particularly, to methods, devices, and computer program products for recovering data. Background Art

[0002] The field of computer storage is a vital area in computer science and information technology, which involves technologies and methods for storing, managing and retrieving data. The development of the storage field also involves challenges in data compression, backup and recovery, data security, and big data processing. In modern computer systems, the selection and management of storage technology is crucial to ensure data availability and performance.

[0003] Snapshot technology is an important technology widely used in the field of computer storage. It allows you to capture a copy of data at a certain moment without interrupting the running system or application. These data copies are called snapshots and are usually used for backup, recovery, version control, and data analysis. Snapshot technology records the status of a file system or storage volume at a specific point in time, and provides flexibility and recoverability, which helps improve the availability and reliability of the storage system. Summary of the invention

[0004] Embodiments of the present disclosure provide a method, device, and computer program product for recovering data.

[0005] In one aspect of the present disclosure, a method for recovering data is provided. The method includes, in response to detecting that a data block in a storage system is attacked, determining one or more data blocks that are attacked, wherein a snapshot in a plurality of snapshots of the storage system has a snapshot copy number. The method also includes determining one or more data block copy numbers of the one or more data blocks that are attacked. The method also includes identifying the latest target snapshot in the plurality of snapshots based on the snapshot copy number and one or more data block copy numbers of the snapshot in the plurality of snapshots, wherein all data blocks in the target snapshot are not attacked. In addition, the method also includes recovering data of the storage system based on the latest target snapshot.

[0006] In another aspect of the present disclosure, an electronic device is provided. The device includes a processing unit and a memory, wherein the memory is coupled to the processing unit and stores instructions. When the instructions are executed by the processing unit, the following actions are performed: in response to detecting that a data block in a storage system is attacked, determining one or more data blocks that are attacked, wherein a snapshot in a plurality of snapshots of the storage system has a snapshot copy number; determining one or more data block copy numbers of the one or more data blocks that are attacked; based on the snapshot copy number and one or more data block copy numbers of the snapshot in the plurality of snapshots, identifying the latest target snapshot in the plurality of snapshots, wherein all data blocks in the target snapshot are not attacked; and restoring data of the storage system based on the latest target snapshot.

[0007] In yet another aspect of the present disclosure, a computer program product is provided, which is tangibly stored on a non-transitory computer-readable medium and includes computer-executable instructions, which, when executed, cause a computer to perform a method or process according to an embodiment of the present disclosure.

[0008] This summary is provided to introduce a selection of concepts in a simplified form, which are further described in the detailed description below. This summary is not intended to identify key features or essential features of the disclosure, nor is it intended to limit the scope of the various embodiments of the disclosure.

[0009] This summary is provided to introduce a selection of concepts in a simplified form, which are further described in the detailed description below. This summary is not intended to identify key features or essential features of the disclosure, nor is it intended to limit the scope of the various embodiments of the disclosure. BRIEF DESCRIPTION OF THE DRAWINGS

[0010] The above and other objects, features and advantages of the present disclosure will become more apparent through a more detailed description of exemplary embodiments of the present disclosure in conjunction with the accompanying drawings, wherein like reference numerals generally represent like elements throughout the exemplary embodiments of the present disclosure.

[0011] Figure 1 A schematic diagram showing an example environment of a storage system according to an embodiment of the present disclosure is shown;

[0012] Figure 2 A flow chart of a method for recovering data according to the present disclosure is shown;

[0013] Figure 3A A flowchart of a method for updating a snapshot copy number of a snapshot according to an embodiment of the present disclosure is shown;

[0014] Figure 3B A flow chart of a method for updating a data block replica number of a data block according to an embodiment of the present disclosure is shown;

[0015] Figure 4 A schematic diagram showing a process for determining the latest clean snapshot according to an embodiment of the present disclosure;

[0016] Figure 5 A schematic diagram showing another process for determining the latest clean snapshot according to an embodiment of the present disclosure; and

[0017] Figure 6 A schematic block diagram of a device that can be used to implement an embodiment of the present disclosure is shown. DETAILED DESCRIPTION

[0018] The preferred embodiments of the present disclosure will be described in more detail below with reference to the accompanying drawings. Although some specific embodiments of the present disclosure are shown in the accompanying drawings, it should be understood that the present disclosure can be implemented in various forms and should not be limited by the embodiments set forth herein. On the contrary, these embodiments are provided to make the present disclosure more thorough and complete, and to fully convey the scope of the present disclosure to those skilled in the art.

[0019] As used herein, the term "including" and its variations mean open inclusion, i.e., "including but not limited to". Unless otherwise stated, the term "or" means "and / or". The term "based on" means "based at least in part on". The terms "an example embodiment" and "an embodiment" mean "at least one example embodiment". The term "another embodiment" means "at least one additional embodiment". The terms "first", "second", etc. may refer to different or the same objects, unless explicitly indicated to be different.

[0020] Typically, data attacks pose a significant threat to user data security, and data storage servers are often the target of attacks. Scheduling snapshots is a good way to protect data. Users can select a snapshot to restore the storage system to the state before the attack. However, since data attacks are not easily detected by the storage system, there may be many damaged snapshots when the attack is discovered. The traditional method requires manual rollback and checking of each snapshot. Since there are many snapshots, they are mounted in sequence according to the generation time of the snapshots to check them. This method is very time-consuming. During the manual check, users cannot access the original data, which will have a significant adverse impact on the user's business.

[0021] Performance is also an issue. Usually, there are multiple storage objects in one storage server. Sometimes only some objects are affected by middleware attacks, and unaffected objects still need to work in a normal way. However, since scanning and checking the attacked data blocks involves a large amount of data reading from the system, this will affect system performance and slow down normal IO. This brings a bad user experience especially in a multi-tenant environment. When one tenant is attacked by malware, all other tenants will be affected during the scanning process.

[0022] To this end, an embodiment of the present disclosure proposes a method for recovering data. The method first obtains the data block copy numbers of the attacked data blocks when it is found that there are data blocks in the storage system that have been attacked, and then obtains the latest clean snapshot in the storage system that has not been attacked by using the copy numbers and data block copy numbers of multiple snapshots of the storage system, and then uses the latest clean snapshot to recover the data of the storage system. The method provided by the embodiment of the present disclosure helps users to quickly determine the latest clean snapshot with less manual inspection to quickly recover from the detected attack.

[0023] The following references Figures 1 to 6 It should be understood that these exemplary embodiments are provided only to enable those skilled in the art to better understand and implement the embodiments of the present disclosure, and are not intended to limit the scope of the present disclosure in any way.

[0024] Figure 1 FIG. 1 is a schematic diagram of an example environment 100 of a storage system according to an embodiment of the present disclosure. Figure 1 As shown, the storage system 110 includes a snapshot 112 and a primary storage object 114. It should be understood that the storage system 110 often includes a large number of snapshots, and the example environment 100 shows one snapshot only for the purpose of example. The primary storage object 114 is a storage object currently working in the storage system 110, and the corresponding snapshot can be obtained by creating a snapshot of the primary storage object 114 at a certain moment. The storage system 110 also includes indirect blocks 116 to 126, which do not store data and are used to help the snapshot 112 or the primary storage object 114 index the location of the data block. The snapshot 112 is a set of reference marks of data at a specific point in time. For example, the snapshot 112 is a reference mark of the data block 128, the data block 130, the data block 130, and the data block 134. The role of the snapshot 112 is similar to a detailed table of contents, providing users with an accessible copy of data that can be rolled back, which can reduce the threat of data attacks. For example, if your storage service is attacked by ransomware or malware encryption, but you have a clean snapshot that is not affected by these encryptions, you can roll back to the clean version to eliminate the threat of the encryption attack.

[0025] In some embodiments, the storage system 110 uses redirect-on-write (ROW) for new write request operations to the snapshot 112 of the primary storage object 114. When a new write request arrives at the primary storage object 114, the data will be written to a new data block, and the original data will be marked to be used by the snapshot 112. For example, when subjected to a data encryption attack, for the primary storage object 114 being served, the original data block 134 will be replaced by the encrypted data block 134', and then it will be saved in the next snapshot.

[0026] In some embodiments, the storage system 110 is scheduled to automatically generate snapshots at a specific time or at a specific frequency, which helps to protect data using an automatic snapshot scheduling strategy. For example, in some embodiments, the snapshot program can be scheduled once every hour, that is, a new snapshot is generated every hour; in some embodiments, the snapshot program can be scheduled once a day, that is, a new snapshot is generated every day; in some embodiments, the snapshot program can be scheduled once a week, that is, a new snapshot is generated every week. It should be understood that the snapshot scheduling strategy can be determined by the user, depending on the characteristics and importance of the data in the storage system, and the present disclosure does not limit this.

[0027] In some embodiments, when replacing files and folders with encrypted content, if the attack cannot be discovered in time, the encrypted data blocks will be brought into the next snapshot. When the attack is discovered, since it is necessary to roll back to the unattacked state, it is necessary to find the latest clean snapshot among multiple snapshots. However, usually at this time, there are already many attacked data blocks and files in the storage system 110. It is often difficult for users to select and determine the latest clean snapshot. If the selected snapshot still contains the attacked data blocks, the recovery will fail; if the selected snapshot is too old, many recent data blocks may not be recovered as expected.

[0028] Continue to refer Figure 1 , snapshot 112 includes a copy number to mark the version of the snapshot. In addition, data block 128, data block 130, data block 132, data block 134, and data block 134' all have a data block copy number to mark in which version the data block is changed. It should be understood that the copy number of the data block can be stored together with the data block or stored in other locations, and the present disclosure does not limit this. In some embodiments, if the data block 134' in the primary storage object 114 being served is attacked, then the snapshot of the storage system 110 generated at the next moment has the attacked data block 134', which is not a clean snapshot.

[0029] Figure 2A flow chart of a method 200 for recovering data according to the present disclosure is shown. At box 202, in response to detecting that a data block in a storage system is attacked, one or more data blocks attacked are determined, wherein a snapshot in a plurality of snapshots of the storage system has a snapshot copy number. For example, when it is detected that a data block in the storage system is attacked, the attack has often been going on for a while, and the storage system has even been informed by the attacker (e.g., the developer of ransomware) that the storage system has been attacked. Therefore, when it is detected that a data block in the storage system is attacked, it is first necessary to determine the one or more data blocks attacked, so as to obtain some information about the attacked data blocks.

[0030] At block 204, one or more data block replica numbers of the attacked one or more data blocks are determined. For example, at 202, the attacked one or more data blocks are determined, and some information of the attacked data blocks can be obtained to determine one or more data block replica numbers of the attacked one or more data blocks.

[0031] At box 206, based on the snapshot copy number and one or more data block copy numbers of the snapshots in the multiple snapshots, the latest target snapshot in the multiple snapshots is identified, wherein all data blocks in the target snapshot have not been attacked. For example, the latest target snapshot (i.e., the clean snapshot) is determined from the multiple snapshots in the system through the snapshot copy number and the data block copy number. In addition, at box 208, the data of the storage system is restored based on the latest target snapshot. For example, the storage system is restored to a state consistent with the latest clean snapshot through the latest clean snapshot.

[0032] Through the method 200 proposed in the embodiment of the present disclosure, the snapshot copy number and the data block copy number can be used to obtain the latest clean snapshot in the storage system that has not been attacked, and then the latest clean snapshot can be used to restore the data of the storage system, so as to help users quickly determine the latest clean snapshot with less manual inspection to quickly recover from the detected attack.

[0033] Figure 3A A flow chart of a method 300A for updating a snapshot copy number of a snapshot according to an embodiment of the present disclosure is shown. As shown in FIG3 , at block 302 , a snapshot is created in the system. The storage system can be scheduled to automatically generate snapshots at a specific time or at a specific frequency, so new snapshots are often generated in the storage system, which helps to protect data using an automatic snapshot scheduling strategy.

[0034] In box 304, the current snapshot copy number and the next snapshot copy number are obtained from the storage system. For example, the current snapshot copy number and the next snapshot copy number can be stored in a data block at a certain location in the storage system, so as to be easily obtained when needed. In some embodiments, the current snapshot copy number and the next snapshot copy number are stored in the superblock of the file system. The superblock is the most basic metadata of the file system, which defines the similarity, size, status, and other metadata structure information of the file system (metadata of metadata). In addition, since the superblock is very critical to the file system, it will be redundantly stored, so the previous snapshot copy number and the next snapshot copy number will also be redundantly stored accordingly, thereby improving reliability.

[0035] At box 306, the current snapshot copy number is assigned to the new snapshot. For example, when a new snapshot is taken, the current snapshot copy number obtained at 304 is assigned to the new snapshot, then in the storage system, the new snapshot will have the snapshot copy number, and the previous snapshot number is X, then the snapshot copy number of the new snapshot is also X. At box 308, the current snapshot copy number and the next snapshot copy number are updated. In some embodiments, the update operation can be to use the next snapshot copy number as the current snapshot copy number, and increment the next snapshot copy number as the new next snapshot copy number. For example, the current snapshot copy number is X, and the next snapshot copy number is X+1, then after the update, the current snapshot copy number is X+1, and the next snapshot copy number is X+2.

[0036] Thus, through the method 300A of the embodiment of the present disclosure, a snapshot copy number can be assigned to the newly created snapshot, and the snapshot copy number can be updated to ensure that the snapshot copy number is updated when executing the following steps: Figure 2 When describing method 200 , each of the multiple snapshots of the storage system has a respective snapshot copy number.

[0037] Figure 3B A flow chart of a method 300B for updating a data block replica number of a data block according to an embodiment of the present disclosure is shown. In block 312, a data block in a storage system is written or a new data block is allocated in the storage system. In some embodiments, when a data block in the storage system is changed (e.g., a write operation or an encryption attack is performed), the data block replica number of the data block needs to be updated. In addition, in some embodiments, when a new data block is allocated in the storage system, the new data block also needs to be assigned a data block replica number.

[0038] At block 314, the current snapshot copy number is obtained from the storage system. Figure 3AAs described above, the current snapshot copy number can be obtained from the superblock. At block 316, the current snapshot copy number can be used as the data block copy number of the data block. For example, if the current snapshot copy number is X, then the data block copy number of the data block is also X. In addition, it should be understood that the snapshot copy number of the snapshot will not change after it is determined; and after the data block copy number of the data block is determined, if the data block itself changes, then its data block copy number may also change.

[0039] Thus, through the method 300B of the embodiment of the present disclosure, a data block copy number can be determined for each data block in the storage system and the data block copy number can be updated, so as to ensure that the data block copy number is updated when executing the following steps: Figure 2 When the method 200 is described, the multiple data blocks of the storage system all have their own data block replica numbers.

[0040] Figure 4 FIG. 4 is a schematic diagram of a process 400 for determining the latest clean snapshot according to an embodiment of the present disclosure. Figure 4 As shown, at block 402, multiple attacked data blocks may be found. For example, if the attacked data blocks are detected in the primary storage object 424, all data blocks in the primary storage object 424 may be scanned and detected to find one or more attacked data blocks. Figure 4 As shown, data blocks 430, 432, 434, and 436 in the dashed box are attacked data blocks. For example, the data in the storage system may be attacked, which may lead to new file encryption, in-place file encryption, file deletion, moving files to encrypted compressed files, etc. It should be understood that four data are shown here for the purpose of illustration, and there are often many attacked data blocks in practice.

[0041] In block 404, the smallest data block copy number among the attacked one or more data blocks may be determined. For example, the data block copy number of data block 430 may be N-2, the data block copy number of data block 432 may be N-1, the data block copy number of data block 434 may be X+1, and the data block copy number of data block 436 may be X. According to the arrangement order of snapshot 410 (copy number is 1) to snapshot 424 (copy number is N-2), it may be determined that the copy number X of data block 436 is the smallest data block copy number.

[0042] In some embodiments, the file system block numbers (FSBNs) of the attacked data blocks can be collected by means of block mapping. For example, when a file with inode 9424 is found to be a file under encryption attack, the following blk_mapping.pl can be used to find the underlying FSBN:

[0043]

[0044] In addition, for LUNs, the attacked data blocks can be observed from the application layer, and then mapped and the FSBN of these blocks can be found.

[0045] In some embodiments, each data block may be extended with an external block metadata object (BMD) that records certain states about the data block. Changing the contents of a data block will cause its BMD to be updated to reflect the change, such as Figure 3B The update process of the data block replica number of the data block shown in FIG. 1 is a process for updating the data block replica number of the data block shown in FIG. 1 . In some embodiments, the versionSetId (version number) and replicaId (replica number) in the BMD can be used to track the allocation and / or writing of the data block. For example, the versionSetId can be used to determine the owner of the data block, such as whether the data block belongs to the product department, the development department, or the testing department; the replicaId is the data block replica number of the data block.

[0046] In some embodiments, when a block is allocated and / or written, the current replicaId and versionSetId will be set into the BMD entry for that data block, and then the FSBN can be used to get the BMD result:

[0047]

[0048]

[0049] In some embodiments, the BMD is not currently directly accessible, but new API interfaces may be developed to provide block mapping and BMD information query in the data path, thereby speeding up the mapping and query process, especially for batch mapping and query of encrypted file clusters and block ranges.

[0050] Continue to refer Figure 4 , in block 406, the latest clean snapshot may be determined. For example, at 404, it may be determined that the smallest data block copy number is X, which means that the snapshot first affected by the attack is snapshot 414 (snapshot copy number is X), and then it may be directly determined that the latest clean snapshot is snapshot 412 (snapshot copy number is X-1).

[0051] Therefore, through the method 400 of the embodiment of the present disclosure, the latest clean snapshot can be quickly located by the smallest data block copy number among the multiple attacked data blocks, avoiding the user from manually loading multiple snapshots to determine the latest clean snapshot one by one, saving time and improving efficiency.

[0052] In some embodiments, there may be a large number of attacked data blocks. In this case, sampling can be performed on multiple attacked data blocks, and then the smallest data block copy number and the latest clean snapshot in the sampled data blocks can be confirmed, which can further improve the efficiency of data recovery.

[0053] In some embodiments, there may be a large number of attacked data blocks, but by confirming the important data blocks in the attacked data blocks, the smallest data block copy number is determined, so as to determine the latest "clean" snapshot. This means that the latest "clean" snapshot found may contain attacked data blocks, but since these data blocks are not important, for example, some unimportant log data is encrypted, they can be not restored.

[0054] In some embodiments, after the process 400, it may be found that the data blocks in all snapshots are attacked. In this case, the snapshots cannot be used to restore the data in the storage system, and the backup storage system may need to be used for recovery. Nevertheless, the embodiment of the present disclosure can still quickly locate the first snapshot among all snapshots that has been attacked, avoiding the discovery after loading all snapshots, and saving analysis time.

[0055] Figure 5 A schematic diagram of another process 500 for determining the latest clean snapshot according to an embodiment of the present disclosure is shown. At box 502, data block 0 is allocated and / or written. For example, when data block 0 does not exist in the storage system, it can be an allocation process; when data block 0 already exists in the storage system, it can be a writing process. In some embodiments, the replica number in record block 522 can be assigned to the data block 0, for example, the replicaId field in the BMD of write box 532, that is, replicaId=0. In addition, when snapshot 512 is generated, the replica number in record block 522 is also assigned to the replica number of snapshot 512. As previously described, record block 522, record block 524, record block 526, and record block 528 here can be superblocks in the file system to manage the replica number and the next replica number of the storage system.

[0056] In block 504, data block 1 is allocated and / or written. At this stage, the replica number and the next replica number in record block 524 are updated by the replica number and the next replica number of record block 522. For example, the replica number of record block 524 is set to the next replica number of record block 522, and the next replica number of record block 522 is set to the next replica number of record block 522. Similarly, the replica number of snapshot 514 is the same as the replica number of record block 524, and the replicaId field of the BMD of data block 1 in block 534 is also the same as the replica number of block 524.

[0057] In block 506, data block X is attacked. In some cases, the data block in the storage system is attacked for the first time, but it is often difficult to detect at this time. The copy number of the snapshot 516 and the data block copy number of the data block X in block 536 are still updated.

[0058] At block 508, an attack is detected. At this point, the snapshot copy number of snapshot 518 is N, and the data block copy number of data block N in block 538 is also N. As previously described, at this point, the primary storage object in the current storage system is scanned to determine the multiple data blocks that were attacked and the corresponding data block copy numbers, and to find the smallest data block copy number. Finally, the first attacked data block X is found, so that it can be determined that the cleanest snapshot is the snapshot with the same copy number as block 524 but with copy number X-1.

[0059] Figure 6 1 shows a schematic block diagram of a device 600 that can be used to implement an embodiment of the present disclosure. The device 600 may be a device or apparatus described in an embodiment of the present disclosure. Figure 6 As shown, the device 600 includes a central processing unit (CPU) 601, which can perform various appropriate actions and processes according to computer program instructions stored in a read-only memory (ROM) 602 or loaded from a storage unit 608 into a random access memory (RAM) 603. In the RAM 603, various programs and data required for the operation of the device 600 can also be stored. The CPU 601, the ROM 602, and the RAM 603 are connected to each other via a bus 604. An input / output (I / O) interface 605 is also connected to the bus 604.

[0060] A number of components in the device 600 are connected to the I / O interface 605, including: an input unit 606, such as a keyboard, a mouse, etc.; an output unit 607, such as various types of displays, speakers, etc.; a storage unit 608, such as a disk, an optical disk, etc.; and a communication unit 609, such as a network card, a modem, a wireless communication transceiver, etc. The communication unit 609 allows the device 600 to exchange information / data with other devices through a computer network such as the Internet and / or various telecommunication networks.

[0061] The various methods or processes described above may be performed by the processing unit 601. For example, in some embodiments, the methods may be implemented as a computer software program, which is tangibly contained in a machine-readable medium, such as the storage unit 608. In some embodiments, part or all of the computer program may be loaded and / or installed on the device 600 via the ROM 602 and / or the communication unit 609. When the computer program is loaded into the RAM 603 and executed by the CPU 601, one or more steps or actions in the methods or processes described above may be performed.

[0062] In some embodiments, the methods and processes described above may be implemented as a computer program product. The computer program product may include a computer-readable storage medium carrying computer-readable program instructions for executing various aspects of the present disclosure.

[0063] Computer readable storage medium can be a tangible device that can hold and store instructions used by an instruction execution device. Computer readable storage medium can be, for example, but not limited to, an electrical storage device, a magnetic storage device, an optical storage device, an electromagnetic storage device, a semiconductor storage device, or any suitable combination thereof. More specific examples (non-exhaustive list) of computer readable storage medium include: a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), a static random access memory (SRAM), a portable compact disk read-only memory (CD-ROM), a digital versatile disk (DVD), a memory stick, a floppy disk, a mechanical encoding device, for example, a punch card or a convex structure in a groove on which instructions are stored, and any suitable combination thereof. The computer readable storage medium used here is not interpreted as a transient signal itself, such as a radio wave or other freely propagating electromagnetic wave, an electromagnetic wave propagated by a waveguide or other transmission medium (for example, a light pulse by an optical fiber cable), or an electrical signal transmitted by a wire.

[0064] The computer-readable program instructions described herein can be downloaded from a computer-readable storage medium to each computing / processing device, or downloaded to an external computer or external storage device via a network, such as the Internet, a local area network, a wide area network, and / or a wireless network. The network can include copper transmission cables, optical fiber transmissions, wireless transmissions, routers, firewalls, switches, gateway computers, and / or edge servers. The network adapter card or network interface in each computing / processing device receives the computer-readable program instructions from the network and forwards the computer-readable program instructions for storage in the computer-readable storage medium in each computing / processing device.

[0065] The computer program instructions for performing the disclosed operation may be assembler instructions, instruction set architecture (ISA) instructions, machine instructions, machine-related instructions, microcode, firmware instructions, state setting data, or source code or object code written in any combination of one or more programming languages, including object-oriented programming languages, and conventional procedural programming languages. Computer-readable program instructions may be executed completely on a user's computer, partially on a user's computer, executed as an independent software package, partially on a user's computer, partially on a remote computer, or completely on a remote computer or server. In the case of a remote computer, the remote computer may be connected to the user's computer via any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computer (e.g., utilizing an Internet service provider to connect via the Internet). In certain embodiments, by utilizing the state information of a computer-readable program instruction to customize an electronic circuit, such as a programmable logic circuit, a field programmable gate array (FPGA), or a programmable logic array (PLA), the electronic circuit may execute a computer-readable program instruction, thereby realizing various aspects of the present disclosure.

[0066] These computer-readable program instructions can be provided to a processing unit of a general-purpose computer, a special-purpose computer, or other programmable data processing device, thereby producing a machine, so that when these instructions are executed by the processing unit of the computer or other programmable data processing device, a device that implements the functions / actions specified in one or more blocks in the flowchart and / or block diagram is generated. These computer-readable program instructions can also be stored in a computer-readable storage medium, and these instructions cause the computer, programmable data processing device, and / or other equipment to work in a specific manner, so that the computer-readable medium storing the instructions includes a manufactured product, which includes instructions for implementing various aspects of the functions / actions specified in one or more blocks in the flowchart and / or block diagram.

[0067] Computer-readable program instructions may be loaded onto a computer, other programmable data processing apparatus, or other device so that a series of operational steps are performed on the computer, other programmable data processing apparatus, or other device to produce a computer-implemented process, thereby causing the instructions executed on the computer, other programmable data processing apparatus, or other device to implement the functions / actions specified in one or more blocks in the flowchart and / or block diagram.

[0068] The flow charts and block diagrams in the accompanying drawings show the possible architecture, functions and operations of the equipment, methods and computer program products according to multiple embodiments of the present disclosure. In this regard, each block in the flow chart or block diagram can represent a part of a module, a program segment or an instruction, and a part of the module, a program segment or an instruction includes one or more executable instructions for realizing the specified logical function. In some alternative implementations, the functions marked in the blocks can also occur in a sequence different from that marked in the accompanying drawings. For example, two continuous blocks can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each block in the block diagram and / or flow chart, and the combination of the blocks in the block diagram and / or flow chart can be implemented with a dedicated hardware-based system that performs a specified function or action, or can be implemented with a combination of dedicated hardware and computer instructions.

[0069] The embodiments of the present disclosure have been described above, and the above description is exemplary, not exhaustive, and is not limited to the disclosed embodiments. Many modifications and changes will be apparent to those of ordinary skill in the art without departing from the scope and spirit of the described embodiments. The choice of terms used herein is intended to best explain the principles of the embodiments, practical applications, or technical improvements to the technology in the market, or to enable other persons of ordinary skill in the art to understand the embodiments disclosed herein.

Claims

1. A method for recovering data, comprising: In response to detecting that a data block in a storage system is attacked, determining one or more data blocks that are attacked, wherein a snapshot in a plurality of snapshots of the storage system has a snapshot copy number; Determining one or more data block replica numbers of the attacked one or more data blocks; Based on the snapshot copy number and the one or more data block copy numbers of the snapshots in the multiple snapshots, identifying a latest target snapshot in the multiple snapshots, wherein all data blocks in the target snapshot have not been attacked; and Based on the latest target snapshot, data of the storage system is restored.

2. The method according to claim 1, wherein identifying the latest target snapshot among the plurality of snapshots comprises: Determining a smallest data block copy number among the one or more data block copy numbers; as well as The latest target snapshot among the multiple snapshots is identified based on the smallest data block copy number.

3. The method according to claim 1, further comprising: In response to creating a new snapshot in the storage system: Obtaining a current snapshot copy number and a next snapshot copy number from the storage system; Assigning the current snapshot copy number to the new snapshot; as well as The current snapshot copy number and the next snapshot copy number are updated.

4. The method according to claim 3, wherein updating the current snapshot copy number and the next snapshot copy number comprises: Using the next snapshot copy number as the current snapshot copy number; as well as The next snapshot copy number is incremented as the new next snapshot copy number.

5. The method according to claim 1, further comprising: In response to a data block in the storage system being changed: Obtaining a current snapshot copy number from the storage system; as well as The current snapshot copy number is used as the data block copy number of the data block.

6. The method according to claim 5, further comprising: In response to allocating a new data block in the storage system: Obtain the current snapshot copy number from the storage system; as well as The current snapshot copy number is used as the data block copy number of the new data block.

7. The method according to claim 6, wherein restoring the data of the storage system comprises: By mounting the latest target snapshot, the storage system is restored to a state corresponding to the latest target snapshot.

8. The method of claim 1 , wherein determining the one or more data block copy numbers of the attacked one or more data blocks comprises: Collecting one or more file system numbers of the attacked one or more data blocks; Determining one or more file system entries of the attacked one or more data blocks based on the one or more file system numbers; as well as Based on the one or more file system entries, the one or more data block copy numbers are determined.

9. The method of claim 8, wherein determining the one or more attacked data blocks further comprises: In response to determining that the number of attacked data blocks is greater than a predetermined threshold, sampling the attacked data blocks; as well as The sampled attacked data blocks are used as the attacked one or more data blocks.

10. The method of claim 9, wherein identifying the latest target snapshot among the plurality of snapshots comprises: If the snapshot copy number of the snapshot in the multiple snapshots is greater than or equal to each of the one or more data block copy numbers, it is determined that the storage system does not have the latest target snapshot.

11. An electronic device, comprising: Processing unit; as well as A memory coupled to the processing unit and storing instructions that, when executed by the processing unit, perform the following actions: In response to detecting that a data block in a storage system is attacked, determining one or more data blocks that are attacked, wherein a snapshot in a plurality of snapshots of the storage system has a snapshot copy number; Determining one or more data block replica numbers of the attacked one or more data blocks; Based on the snapshot copy number and the one or more data block copy numbers of the snapshots in the multiple snapshots, identifying a latest target snapshot in the multiple snapshots, wherein all data blocks in the target snapshot have not been attacked; and Based on the latest target snapshot, data of the storage system is restored.

12. The electronic device of claim 11, wherein identifying the latest target snapshot among the plurality of snapshots comprises: Determining a smallest data block copy number among the one or more data block copy numbers; as well as The latest target snapshot among the multiple snapshots is identified based on the smallest data block copy number.

13. The electronic device according to claim 11, further comprising: In response to creating a new snapshot in the storage system: Obtaining a current snapshot copy number and a next snapshot copy number from the storage system; Assigning the current snapshot copy number to the new snapshot; as well as The current snapshot copy number and the next snapshot copy number are updated.

14. The electronic device according to claim 13, wherein updating the current snapshot copy number and the next snapshot copy number comprises: Using the next snapshot copy number as the current snapshot copy number; as well as The next snapshot copy number is incremented as the new next snapshot copy number.

15. The electronic device according to claim 11, further comprising: In response to a data block in the storage system being changed: Obtaining a current snapshot copy number from the storage system; as well as The current snapshot copy number is used as the data block copy number of the data block.

16. The electronic device according to claim 15, further comprising: In response to allocating a new data block in the storage system: Obtain the current snapshot copy number from the storage system; as well as The current snapshot copy number is used as the data block copy number of the new data block.

17. The electronic device according to claim 16, wherein restoring the data of the storage system comprises: By mounting the latest target snapshot, the storage system is restored to a state corresponding to the latest target snapshot.

18. The electronic device of claim 11, wherein determining the one or more data block copy numbers of the one or more data blocks that were attacked comprises: Collecting one or more file system numbers of the attacked one or more data blocks; Determining one or more file system entries of the attacked one or more data blocks based on the one or more file system numbers; as well as Based on the one or more file system entries, the one or more data block copy numbers are determined.

19. The electronic device of claim 18, wherein determining the one or more attacked data blocks further comprises: In response to determining that the number of attacked data blocks is greater than a predetermined threshold, sampling the attacked data blocks; as well as The sampled attacked data blocks are used as the attacked one or more data blocks.

20. A computer program product tangibly stored on a non-transitory computer readable medium and comprising machine executable instructions which, when executed, cause a machine to perform the following actions: In response to detecting that a data block in a storage system is attacked, determining one or more data blocks that are attacked, wherein a snapshot in a plurality of snapshots of the storage system has a snapshot copy number; Determining one or more data block replica numbers of the attacked one or more data blocks; Based on the snapshot copy number and the one or more data block copy numbers of the snapshots in the multiple snapshots, identifying a latest target snapshot in the multiple snapshots, wherein all data blocks in the target snapshot have not been attacked; and Based on the latest target snapshot, data of the storage system is restored.

Images