Data protection using timer controlled unalterable logs

Abstract

The invention discloses data protection using timer controlled unalterable logs. In some examples, a data protection system copies a write input / output (I / O) operation to an entry of a log stored in a storage system, and associates a timer with the entry of the log to provide for timer-controlled non-alterability of the entry of the log. Based on a first timer associated with a first entry of the log entries indicating that a specified duration has elapsed, the data protection system applies a first write I / O operation of the first entry to a backup data store containing a copy of at least a portion of the data in the main data store. The data protection system prevents any modification to a storage location in the storage system containing the first entry before the first timer indicates that the specified duration has elapsed.

Description

BACKGROUND

[0001] Ransomware attacks involve encrypting data on a computer or multiple computers connected through a network. In a ransomware attack, data can be encrypted using an encryption key, which makes the data inaccessible to a user unless a ransom is paid to obtain the encryption key. Ransomware attacks can cause great disruption to businesses, including businesses, government agencies, educational organizations, individuals, and the like. BRIEF DESCRIPTION OF DRAWINGS

[0002] Some implementations of the present disclosure are described with respect to the following drawings.

[0003] Figure 1 is a block diagram of an arrangement including a data protection system according to some examples.

[0004] Figure 2 is a block diagram of a storage location array storing log entries according to some examples.

[0005] Figure 3 is a timing diagram illustrating an update time window during which writes to backup data storage are allowed according to some examples.

[0006] Figure 4 is a block diagram of a storage medium storing machine-readable instructions according to some examples.

[0007] Figure 5 is a block diagram of a system according to some examples.

[0008] Figure 6 is a flowchart of a process according to some examples.

[0009] Throughout the drawings, identical reference numbers designate similar, but not necessarily identical, elements. The drawings are not necessarily to scale and the dimensions of some parts can be exaggerated for clarity of illustration. Also, the drawings provide examples and / or implementations consistent with the description; however, the description is not limited to the examples and / or implementations provided in the drawings. DETAILED DESCRIPTION

[0010] Ransomware attacks can target both primary data and backup data. Primary data is data used during runtime of a computing system. Backup data is based on copying primary data to a backup storage system. If a ransomware attack successfully encrypts both primary data and backup data, a user will not be able to use the backup data to recover the user’s data.

[0011] According to some embodiments of the present disclosure, a protection system or technique is provided to make recovery data immutable under specified conditions, thereby protecting the recovery data from unauthorized modifications, such as encryption performed in ransomware attacks or other types of attacks. In some examples, the recovery data includes logs and backup data. The logs include entries to which a replication controller can replicate write input / output (I / O) operations. The backup data is a copy of some version of the primary data. In some examples, a timer is associated with an entry of the logs to provide timer-controlled immutability of the log entry. Upon expiration of the timer indicating that a specified duration has passed since an I / O operation was added to the log entry, the write I / O operation of the entry is applied to a backup data store containing a copy of at least a portion of data in a primary data store. Any modification to the log entry is blocked until expiration of the timer.

[0012] The logs are stored in a storage system, such as a disk-based storage system, a solid state drive, or other types of storage systems. The “timer-controlled immutability” of a log entry can refer to making the storage location (of the storage system) containing the entry immutable until a condition associated with the timer is satisfied, e.g., the timer expires after counting a specified amount of time, or the timer reaches a specified threshold. A “journal” can refer to a data structure that records write I / O operations that modify data items, where a “data item” can refer to a unit of data, such as a data block, a file, a data object, or any other unit of data. A write I / O operation can update data, add new data, or delete existing data. More generally, a write I / O operation can refer to any I / O operation that, when executed, causes a change in data. Adding a write I / O operation to a log entry can refer to adding information representing the write I / O operation to the log entry.

[0013] Figure 1 is a block diagram of an example arrangement including a data protection system 102 according to some embodiments of the present disclosure. The data protection system 102 can be implemented using one or more computers. Requestors 104 can request data access operations with respect to a primary data store 106. The data access operations can include read operations and write operations. An example of a requestor 104 is a virtual computing entity, such as a virtual machine (VM) or a container. In other examples, a requestor 104 can include a program or a hardware component.

[0014] The primary data store 106 is a data store for storing data used in the operation of the requestor 104, such as when the requestor 104 is executing a workload of an application program, an operating system (OS), or other program. The primary data store 106 can be contained in a storage system that includes one or more storage devices, such as disk-based storage devices, flash memory devices, or other types of storage devices. While Figure 1 Only one requestor is shown in the middle, but in other examples there can be multiple requestors that can access data of the primary data store 106.

[0015] The data protection system 102 includes a log 108 and a backup data store 110. Each of the log 108 and the backup data store 110 can be contained in a storage system. Together, the log 108 and the backup data store 110 form a recovery store from which data of the primary data store 106 can be recovered in the event of a failure or outage of the primary data store 106 that results in data loss. The backup data store 110 contains copies of data items in the primary data store 106. However, the backup data store 110 can not be up-to-date relative to the primary data store 106, because data changes caused by write I / O operations 114 can have been recorded in the log 108 but not yet applied to the backup data store 110. For example, the backup data store 110 can not include a new data item that has been added to the primary data store 106 by a write I / O operation, or a data item in the primary data store 106 that has been modified by a write I / O operation. As a further example, the backup data store 110 can include a data item that has been deleted by a write I / O operation to the primary data store 106. More generally, the data stored in the backup data store 110 is an earlier version of the data in the primary data store 106.

[0016] More specifically, the data stored in the backup data store 110 is a version of the data in the primary data store 106 that is older by a log history length duration. The "log history length duration" refers to the amount of time that a log entry is retained in the log 108 before being applied to the backup data store 110. Thus, any data item in the backup data store 110 can be older than the primary data store 106 by the log history length duration.

[0017] The primary data store 106, log 108, and backup data store 110 can be stored in different physical locations (e.g., different physical facilities, different cities, different states, different countries, or other different geographical locations). In other examples, log 108 and primary data store 106 can be located in the same physical location, or log 108 and backup data store 110 can be located in the same physical location, or log 108, primary data store 106, and backup data store 110 can be located in the same physical location.

[0018] Data protection system 102 includes a replication engine 112 for replicating write I / O operations 114 to log 108 via log driver 116. Data protection system 102 also includes a backup engine 118 for applying write I / O operations, represented by log entries in log 108, to backup data storage 110.

[0019] In some examples, backup engine 118 may be the same as replication engine 112. In other examples, backup engine 118 may be a different instance of replication engine 112 in a different location, such as at a backup location separate from the location of primary data storage 106 and replication engine 112.

[0020] Requester 104 issues access request 120 to access (read or write) data in main data store 106. Although not shown, an intermediate layer exists between requester 104 and main data store 106. In some examples, the intermediate layer may include a hypervisor that creates and manages virtual machines. In other examples, the intermediate layer may include the operating system (OS) of the computer system. The intermediate layer includes a driver that can translate between access request 120 (read or write request) and the corresponding I / O operation (read I / O operation or write I / O operation).

[0021] The replication engine 112 detects write I / O operation 114 and sends it to the journal driver 116 to replicate write I / O operation 114 to the journal 108. The journal driver 116 is the entity that manages access to the storage system 124 containing the journal 108. The journal driver 116 is separate from the driver for the primary data store 106.

[0022] According to some examples of this disclosure, in response to receiving a write I / O operation 114 to be replicated to log 108, log driver 116 determines whether the entity submitting the write I / O operation 114 (e.g., replication engine 112) has permission to update log 108. Log driver 116 may be configured with permission information 130 that identifies one or more entities permitted to update log 108. Permission information 130 may be stored in memory accessible to log driver 116. Permission information 130 may include an identifier for replication engine 112 and indicate the permissions associated with replication engine 112. In some examples, permissions may include read-only permissions or read-write permissions. Read-only permissions grant an entity permission to read (but not write) log 108. Read-write permissions grant an entity authorization to both read and write log 108.

[0023] Permission information 130 can instruct replication engine 112 to have read and write access permissions to log 108. In some examples, permission information 130 can also instruct backup engine 118 to have read-only access permissions to log 108. In other examples, information 130 can instruct backup engine 118 to have read and write access permissions to log 108 (discussed further below).

[0024] The logging driver 116 will deny any attempt by an unauthorized entity to access log 108. For example, if ransomware or malware on the system (or any other unauthorized entity) attempts to write to log 108, the logging driver 116 will deny this write attempt based on the fact that permission information 130 does not indicate that the unauthorized entity has the right to write to log 108. Therefore, unauthorized entities will not be able to modify the log entries in log 108, including updating or deleting log entries.

[0025] Further protection for log 108 is provided by making its entries immutable for a specified duration (i.e., the aforementioned log history length duration). Making log entries immutable for the specified duration prevents attacks capable of performing large-scale writes (e.g., encrypting data) within a short period. If requester 104 is an attacker (such as ransomware), requester 104 might issue a large number of write I / O operations. Without the protection provided by data protection system 102 according to some examples of this disclosure, a large number of write I / O operations from an attacker copied to log 108 could overwrite the contents of existing log entries in log 108.

[0026] Note that the protection provided by the log driver 116 based on permission information 130 and the immutability of the timer control based on log 108 is supplementary to the access control mechanism implemented by the OS or another system module (e.g., a hypervisor). The access control mechanism is designed to ensure that data requesters have the necessary permissions. The immutability of the log driver 116 and the timer control of log 108 provides protection against the failure of the access control mechanism of the OS or another system module, which could allow unauthorized entities to access log 108. In fact, even the log driver 116 itself could be tricked into allowing unauthorized entities to access log 108; in this case, the immutability of the timer control of log 108 provides a further layer of protection against unauthorized modification of log 108 and backup data storage 110.

[0027] exist Figure 1 In the example shown, log 108 includes log entries 122-1, 122-2, and 122-3. While three log entries are shown, in other examples, log 108 may include a different number of log entries. In some examples, log 108 is a first-in, first-out (FIFO) data structure that adds information about write I / O operation 114 in a FIFO manner. Figure 1 In the example shown, log entry 122-3 is added to log 108 before log entry 122-2, and log entry 122-2 is added to log 108 before log entry 122-1. Following FIFO order, earlier added log entries (e.g., 122-3) will be applied by backup engine 118 to backup data store 110 before later added log entries (e.g., 122-2 or 122-1).

[0028] Information indicating write I / O operations in log entries includes: (1) write operation information specifying the write type (e.g., update, add, or delete) and the storage address to which the write is performed (e.g., write to a storage block); and (2) the write data that serves as the subject of the write I / O operation. Figure 1 In the example, log entry 122-1 includes information indicating that data item A was written, log entry 122-2 includes information indicating that data item B was written, and log entry 122-3 includes information indicating that data item C was written. In some examples, each data item includes data in a storage block of the storage system containing the main data storage 106. A "storage block" refers to a portion of the storage system of a specified size.

[0029] According to some examples of this disclosure, each log entry also includes a timer, such as timer T1 in log entry 122-1, timer T2 in log entry 122-2, and timer T3 in log entry 122-3. Each corresponding timer is started in response to adding a log entry to log 108. Thus, for example, timer T2 is started in response to adding log entry 122-2 for the writing of data item B. Although Figure 1 The example shows that timers are included in the corresponding log entries, but in other examples, timers are associated with but separate from the corresponding log entries.

[0030] Starting a timer can mean initializing the timer to zero or some other low value. The timer then increments over time. Alternatively, starting a timer can mean initializing the timer to a specified non-zero value; the timer then decrements from that specified non-zero value. In either case, the timer progresses (increments or decrements) over time until a specified duration has elapsed, at which point the timer expires.

[0031] Each timer is treated as a Time-to-Live (TTL) timer, used to control the amount of time a corresponding log entry is retained in log 108. When different log entries are added to log 108 at different times, the timers associated with these log 108 entries will have different values ​​because the timers are started at different times.

[0032] In some examples, when a timer expires (the decrementing timer reaches zero or the incrementing timer reaches its target time value), the timer can signal the backup engine 118 (e.g., a signal, interrupt, message, or any other type of indicator). Alternatively, the backup engine 118 can continuously poll log entries to detect which entries have expired timers.

[0033] In some examples, backup engine 118 has read access to log 108 (as indicated by permission information 130). With this read access, backup engine 118 is able to read log entries 122-1 to 122-3.

[0034] In response to detecting a timer expiration, backup engine 118 reads information about the log entry associated with the expired timer. Reading the log entry is performed by issuing a read request to the log driver 116 of storage system 124. Backup engine 118 applies a write I / O operation, represented by the information read from the log entry, to backup data store 110. Applying a write I / O operation to backup data store 110 includes updating data items in backup data store 110, deleting data items in backup data store 110, or adding data items to backup data store 110.

[0035] Backup engine 118 issues a write request, represented by a log entry, to backup driver 132 of backup data store 110. Backup driver 132 is the entity that manages access to the storage system containing backup data store 110. Backup driver 132 may be separate from log driver 116 of storage system 124 containing log 108, and separate from driver of primary data store 106. In a further example, backup driver 132 and log driver 116 may be the same.

[0036] In some examples, as part of an application log entry, backup engine 118 can remove a log entry from log 108 (assuming backup engine 118 has read and write access to log 108, as indicated by permission information 130). Removing a log entry from log 108 frees up the underlying storage location of storage system 124 for use by another entry that may be added to log 108 later. To remove a log entry, backup engine 118 can issue a deletion request to log driver 116 to delete the log entry.

[0037] In other examples, instead of removing a log entry when its timer expires, backup engine 118 can mark a given log entry as mutable (e.g., in the metadata associated with log 108), meaning log driver 116 can overwrite the storage location occupied by a given log entry marked as mutable. A log entry can be marked as mutable by setting a flag associated with it to indicate that its storage location can be overwritten.

[0038] In some examples, storage system 124 is a block-based storage system that stores data in storage blocks. Entries for log 108 may be stored in one or more storage blocks. Alternatively, multiple entries may be stored in a single storage block. In some examples, the "storage location" for storing entries for log 108 in storage system 124 may include one or more storage blocks, or a portion of a storage block.

[0039] Figure 2 An array 202 showing the storage locations of storage system 124 is illustrated. Each storage location of array 202 consists of... Figure 2 The rectangle in the image represents... Figure 2 In the example, storage location 212-1 stores the log entry for data item A, storage location 212-2 stores the log entry for data item B, and storage location 212-3 stores the log entry for data item C. The timer in the log entry for data item C has a value of 0 (meaning that, assuming the timer is a decrementing timer, the timer has expired), the timer in the log entry for data item B has a value of 4, and the timer in the log entry for data item A has a value of 5.

[0040] Log driver 116 will refuse any attempt to overwrite the storage location of a given log entry before the timer for that log entry expires. For example, log driver 116 will refuse any attempt to overwrite storage locations 212-1 and 212-2 because the timers for log entries stored in those locations have not yet expired. However, log driver 116 will allow overwriting of storage location 212-3 because the timer for the log entry for data item A has expired.

[0041] Once the timer for a given entry has expired and the backup engine 118 has applied the write I / O operation represented by the given entry to the backup data store 110, the log driver 116 will allow new data (e.g., a new log entry) to overwrite the storage location previously occupied by the given entry.

[0042] In addition to protecting log 108 by only allowing replication engine 112 to write to log 108 and making log entries immutable for the duration of the log history length, data protection system 102 according to some examples of this disclosure also protects backup data storage 110 from attacks.

[0043] For example, backup driver 132 may only allow backup engine 118 to write access to backup data store 110. Backup driver 132 will reject any attempts from other entities that do not have write access.

[0044] Further protection for the backup data store 110 is achieved by allowing writing to the backup data store 110 during a specified update time window. Figure 3 Example update time windows 302-1 and 302-2 are shown. Writes to the backup data store 110 are permitted during each update time window 302-1 or 302-2. Write request W1 is an example of a write request issued during update time window 302-1, and write request W2 is an example of a write request issued during update time window 302-2. Both write requests W1 and W2 (assuming they originate from backup engine 118) will be permitted by backup driver 132.

[0045] Any write outside the specified update time window (such as an attacker-initiated write) will be rejected by the backup driver 132. Write request W3 is an example of a write request outside update time windows 302-1 and 302-2. The backup driver 132 will reject write request W3.

[0046] The specified update time window can be based on the expected write frequency 140 set by the backup engine 118. The backup engine 118 can notify the backup driver 132 of the expected write frequency 140 related to the frequency at which log entries are to be applied to the backup data store 110. The expected write frequency 140 can be once every four hours (or any other specified time interval T). INTERVAL Assuming the expected write frequency of 140 is once every four hours (i.e., T...), INTERVAL The backup driver 132 can define an update time window every four hours, wherein the update time window has a length equal to the expected amount of time (T) required to typically apply log entries to the backup data store 110. LENGTH The expected amount of time required to apply log entries to backup data store 110 typically depends on the average number of log entries that are typically added to log 108 during four-hour intervals. This average number of log entries can be derived empirically based on historical data, or it can be set by a human administrator or other entity.

[0047] In some examples, backup engine 118 may also explicitly notify backup driver 132 when a write to backup data store 110 begins. Backup driver 132 is also notified when a write to backup data store 110 ends. If backup driver 132 receives a write request before the write start notification or after the write end notification, backup driver 132 will reject the write request because it may be an unauthorized write request.

[0048] In a further example, each of the log driver 116 and the backup driver 132 can detect attempted modifications to log 108 or backup data storage 110 that violate access rules. For example, log driver 116 might detect that an entity not identified by permission information 130 has attempted to write to log 108. As a further example, log driver 116 might detect that an entity is attempting to modify the storage location of a log entry before a timer associated with the log entry expires.

[0049] As another example, backup driver 132 may detect that an entity that is not permitted to write to backup data store 110 has attempted to write to backup data store 110. Further, backup driver 132 may detect that an entity has issued a write request to backup data store 110 outside of the update time window, or that the entity has issued a write request before or after the write start notification from backup engine 118. Based on the detected attempted modification of log 108 or backup data store 110 in violation of access rules, log driver 116 or backup driver 132 may issue a violation alert. In response to the alert, log driver 116 will disable any further writes to log 108, and backup driver 132 will disable any further writes to backup data store 110. At this point, an administrator or other entity can investigate the cause of the alert to determine if an attack has occurred.

[0050] Figure 4 This is a block diagram of a non-transitory machine-readable or computer-readable storage medium 400 storing data protection instructions, which, when executed, cause the system to perform various actions. The system can be... Figure 1 Data protection system 102.

[0051] Data protection instructions include write I / O copy instruction 402, used to copy write I / O operations to logs stored in the storage system (such as those stored in...). Figure 1 The log entries in the log 108 of the storage system 124. Write I / O copy commands can be... Figure 1 It is part of the replication engine 112.

[0052] Data protection directives include timer association directive 404, which associates a timer with a log entry to provide immutability of timer control over the log entry. For example, timer association directive 404 may be part of a log driver 116 that can start a timer when an entry is added to the log as part of copying a write I / O operation to the log.

[0053] The data protection instruction includes a log write I / O application instruction 406, used to apply a first write I / O operation of a first entry to a backup data store containing a copy of at least a portion of the data in the primary data store, based on a first timer indication associated with the first entry of the log having elapsed for a specified duration (i.e., the first timer has expired). The log write I / O application instruction 406 may be... Figure 1 It is part of the backup engine 118.

[0054] Data protection directives include a log write blocking directive 408, which prevents any modification to the storage location containing the first entry in the storage system until a specified duration has elapsed according to a first timer. In some examples, the storage location may include one or more storage blocks of the storage system, or a portion of a storage block.

[0055] In some examples, replication is performed using a replication controller, and if the storage location stores information about log entries associated with timers that have not yet expired, data protection directives can prevent any modification to the storage location requested by any party, including the replication controller. An example of a replication controller is... Figure 1 The replication engine 112. As used herein, "controller" can refer to one or more hardware processing circuits, which may include any or a combination of a microprocessor, a core of a multi-core microprocessor, a microcontroller, a programmable integrated circuit, a programmable gate array, or another hardware processing circuit. Alternatively, "controller" can refer to a combination of one or more hardware processing circuits and machine-readable instructions (software and / or firmware) executable on one or more hardware processing circuits.

[0056] In some examples, in response to a first timer indicating that a specified duration has elapsed and a first write I / O operation of the first entry being detected to have been applied to the backup data store, the data protection instruction can enable modification of the storage location.

[0057] In some examples, modifications to the storage location include adding new write I / O operations to new entries in the log, which are then stored in the storage location.

[0058] In some examples, data protection directives can start a timer associated with a new entry.

[0059] In some examples, preventing any modification to the first entry is done by the driver that controls access to the storage system. Examples of such drivers are... Figure 1 Log driver 116.

[0060] In some examples, data protection directives can prevent updates from occurring within a specific time window, such as... Figure 3 No writes are made to the backup data store outside of either of the update time windows 302-1 and 302-2 shown.

[0061] In some examples, preventing any writes to the backup data store outside the update time window is controlled by the driver (e.g., Figure 1 The backup driver (132) executes the command. The driver can be based on the expected write frequency of the backup data storage (e.g., ...). Figure 1 The notification (140) in the middle determines the update time window.

[0062] In some examples, the driver allows writes to the backup data store during the update time window.

[0063] In some examples, the driver allows writes to the backup data store from the backup controller during the update time window, and the driver denies any other writes to the backup data store from requesters other than the backup controller during the update time window. An example of a backup controller is... Figure 1 Backup engine 118.

[0064] In some examples, data protection directives can be directed to the driver of the backup data store (e.g., Figure 1 (132) Notifies the backup controller of the start and end of writes to the backup data store. The driver rejects any writes to the backup data store before or after the backup controller has started or ended writes.

[0065] In some examples, data protection directives can detect attempted modifications to log or backup data that violate access rules. Based on the detected attempted modifications to the log or backup data, the data protection directive disables writes to the log and backup data stores.

[0066] In some examples, violations of access rules include attempts to modify the storage location of an entry before a timer associated with that entry in the log entry has elapsed for a specified duration.

[0067] In some examples, access rule violations include attempts to modify backup data storage by writing to it outside of a specified update time window.

[0068] Figure 5 This is a block diagram of system 500 based on some examples. System 500 can be, for example... Figure 1 Data protection system 102.

[0069] System 500 includes a storage system 502 containing a log 504. System 500 includes a replication controller 505 to replicate write I / O operations to entries in the log. An example of the replication controller 505 is... Figure 1 The replication engine 112.

[0070] System 500 includes storage medium 506 storing data protection instructions, which can be executed by processing resources to perform various actions. The processing resources may include one or more hardware processors. The hardware processors may include a microprocessor, the core of a multi-core microprocessor, a microcontroller, a programmable integrated circuit, a programmable gate array, or another hardware processing circuit.

[0071] The data protection directive includes a log timer association directive 508 for associating a timer with an entry in the log to provide immutability of timer control for the log entry, wherein the timer associated with the entry will advance over time, and wherein a first entry in the entry is associated with a first timer having a first time value, and a second entry in the entry is associated with a second timer having a second time value different from the first value.

[0072] The data protection instructions include a timer expiration determination instruction 510, used to determine if any timers have expired. A timer expires if it has decremented to zero or some other low value, or if it has incremented to a target value.

[0073] The data protection instructions include write I / O application instruction 512, which applies a write I / O operation of a given entry associated with an expired timer to a backup data store containing a copy of at least a portion of the data in the primary data store.

[0074] In some examples, data protection can prevent any modification to the storage location containing information about log entries associated with timers that have not yet expired.

[0075] In some examples, based on the expiration of a timer associated with a given entry and a write I / O operation based on a given entry being applied to the backup data store, the data protection directive allows modification of the storage location containing the information of a given entry.

[0076] In some examples, data protection directives can define an update time window that allows writes to backup data storage, and data protection directives can reject any write requests issued outside of the update time window.

[0077] Figure 6 This is a flowchart of process 600 based on some examples of this disclosure. Although Figure 6 A series of tasks are shown, but note that in other examples these tasks may be performed in a different order, some tasks may be omitted, and other tasks may be added.

[0078] Process 600 includes the replication controller copying (at 602) a write I / O operation to an entry in a log stored in the storage system. Copying the write I / O operation to the log entry includes writing information representing the write I / O operation to a storage location in the storage system, wherein the storage location is allocated for storing the log entry.

[0079] Process 600 includes associating a timer with a log entry (at 604) to provide immutability of timer control over log entries to protect the log.

[0080] Process 600 includes a write to a storage location in the storage system containing information about log entries associated with timers that have not yet expired, which is rejected (at 606) by the storage system's log driver.

[0081] Process 600 includes applying a write I / O operation (at 608) by the backup controller to a backup data store containing a copy of at least a portion of the data in the primary data store.

[0082] Process 600 includes an update time window (defined by the backup driver of the backup data store at 610) that allows writes to the backup data store. The update time window is defined within a corresponding time interval that corresponds to the expected write frequency of the backup data store.

[0083] Process 600 includes the backup driver rejecting (at 612) any writes to the backup data store outside the update time window.

[0084] As used herein, “data storage” can refer to any repository of data. “Engine” can refer to one or more hardware processing circuits, which may include any or a combination of a microprocessor, a core of a multi-core microprocessor, a microcontroller, a programmable integrated circuit, a programmable gate array, or other hardware processing circuits. Alternatively, “engine” can refer to a combination of one or more hardware processing circuits and machine-readable instructions (software and / or firmware) that can be executed on one or more hardware processing circuits.

[0085] Storage media (e.g., Figure 4 400 or Figure 5 506) may include any one or a combination of the following: semiconductor storage devices, such as dynamic or static random access memory (DRAM or SRAM), erasable programmable read-only memory (EPROM), electrically erasable programmable read-only memory (EEPROM), or flash memory; disks, such as fixed disks, floppy disks, and removable disks; another magnetic medium, including magnetic tape; optical media, such as optical discs (CDs) or digital video discs (DVDs); or other types of storage devices. Note that the instructions discussed above may be provided on a single computer-readable or machine-readable storage medium, or alternatively, on multiple computer-readable or machine-readable storage media distributed across a large system having potentially multiple nodes. Such one or more computer-readable or machine-readable storage media are considered part of an article (or article of manufacture). An article or article of manufacture may refer to any single or multiple manufactured components. One or more storage media may be located in a machine that executes the machine-readable instructions or at a remote site from which the machine-readable instructions can be downloaded via a network for execution.

[0086] In this disclosure, unless the context clearly indicates otherwise, the terms “a,” “an,” or “the” are intended to include the plural form as well. Similarly, when used in this disclosure, the terms “includes / including / comprises / comprising” or “have / having” indicate the presence of the said element but do not exclude the presence or addition of other elements.

[0087] In the foregoing description, numerous details have been set forth to facilitate understanding of the subject matter disclosed herein. However, embodiments may be practiced without some of these details. Other embodiments may include modifications and variations of the details discussed above. The appended claims are intended to cover such modifications and variations.

Claims

1. A non-transitory machine-readable storage medium, comprising data protection instructions that, when executed, cause the system to perform the following operations: Write input / output (I / O) operations are copied to entries in the log stored in the storage system; Associating a timer with the entry in the log provides immutability of timer control over the entry in the log; Based on a first timer indication associated with the first entry in the log that a specified duration has elapsed, a first write I / O operation of the first entry is applied to a backup data store containing a copy of at least a portion of the data in the primary data store; as well as Before the first timer indicates that the specified duration has elapsed, any modification to the storage location containing the first entry in the storage system is prevented.

2. The non-transitory machine-readable storage medium as described in claim 1, wherein, The replication is performed using a replication controller, and the data protection instructions, when executed, cause the system to perform the following operations: Prevent any modification to the storage location requested by any requester, including the replication controller.

3. The non-transitory machine-readable storage medium as described in claim 1, wherein, When the data protection instruction is executed, it causes the system to perform the following operations: In response to the first timer indicating that the specified duration has elapsed and the detection that the first write I / O operation of the first entry has been applied to the backup data storage, modification of the storage location is enabled.

4. The non-transitory machine-readable storage medium as described in claim 3, wherein, The modification to the storage location includes adding new write I / O operations to a new entry in the log, the new entry being stored in the storage location.

5. The non-transitory machine-readable storage medium as described in claim 4, wherein, When the data protection instruction is executed, it causes the system to perform the following operations: Start the timer associated with the new entry.

6. The non-transitory machine-readable storage medium as described in claim 1, wherein, The prevention of any modification to the first entry is performed by the driver that controls access to the storage system.

7. The non-transitory machine-readable storage medium as described in claim 1, wherein, When the data protection instruction is executed, it causes the system to perform the following operations: Prevent any writes to the backup data storage outside the update time window.

8. The non-transitory machine-readable storage medium as described in claim 7, wherein, The blocking of any writes to the backup data outside the update time window is performed by the driver, wherein the driver determines the update time window based on notifications of the expected write frequency of the backup data.

9. The non-transitory machine-readable storage medium as described in claim 8, wherein, The driver is used to allow writing to the backup data storage during the update time window.

10. The non-transitory machine-readable storage medium as described in claim 9, wherein, The driver is configured to allow writes to the backup data storage from the backup controller during the update time window, and the driver is configured to deny any other writes to the backup data storage from a requester other than the backup controller during the update time window.

11. The non-transitory machine-readable storage medium as claimed in claim 8, wherein, When the data protection instruction is executed, it causes the system to perform the following operations: The driver for the backup data store notifies the backup controller of the start and end of writes to the backup data store, wherein the driver is configured to reject any writes to the backup data store before the write begins or after the write ends.

12. The non-transitory machine-readable storage medium of claim 7, wherein, When the data protection instruction is executed, it causes the system to perform the following operations: Detecting attempted modifications to the logs or backup data that violate access rules; and Based on the detection of an attempted modification that violates the access rules to the log or backup data storage, writes to both the log and backup data storage are disabled.

13. The non-transitory machine-readable storage medium of claim 12, wherein, The violation of the access rule includes an attempt to modify the destination storage location before a timer associated with an entry in the log has elapsed for the specified duration.

14. The non-transitory machine-readable storage medium of claim 12, wherein, The violation of the access rule includes an attempt to write to the backup data storage outside the update time window.

15. A system comprising: Including the log storage system; A replication controller for replicating write input / output (I / O) operations to entries in the log; as well as A non-transitory storage medium for storing data protection instructions, which can be executed by processing resources to perform the following operations: Associating timers with entries in the log provides immutability of timer control over entries in the log, wherein the timer associated with an entry advances over time, and wherein a first entry in the entry is associated with a first timer having a first time value, and a second entry in the entry is associated with a second timer having a second time value different from the first time value; Determine whether any of the timers has expired; and The write I / O operation of a given entry associated with an expired timer in the entry is applied to a backup data store containing a copy of at least a portion of the data in the main data store.

16. The system of claim 15, wherein, The data protection instruction can be executed by the processing resource to perform the following operations: Reject any modification to the storage location containing information about log entries associated with timers that have not yet expired.

17. The system of claim 16, wherein, The data protection instruction can be executed by the processing resource to perform the following operations: Based on the expiration of the timer associated with the given entry and the application of write I / O operations based on the given entry to the backup data storage, modification of the storage location containing the information of the given entry is permitted.

18. The system of claim 15, wherein, The data protection instruction can be executed by the processing resource to perform the following operations: Define an update time window that allows writing to the backup data storage; and Any write requests issued outside the stated update time window will be rejected.

19. A method comprising: The replication controller copies write input / output (I / O) operations to entries in the log stored in the storage system. Associating a timer with the entry in the log provides immutability of timer control over the entry in the log, thereby protecting the log; The log driver of the storage system refuses to write to the storage location of the storage system containing information about log entries associated with timers that have not yet expired; The backup controller applies a write I / O operation of a given entry in the log associated with an expired timer to a backup data store containing a copy of at least a portion of the data in the primary data store; The backup driver that stores the backup data defines an update time window that allows writing to the backup data store; as well as The backup driver rejects any writes to the backup data storage outside the update time window.

20. The method of claim 19, wherein, The timer in the timer defines the time-based immutability of the corresponding entries in the log.

Images