Storage system and memory control method

Abstract

Reduce data recovery time. [Solution] The storage system backs up the volume data as multiple generations of snapshots. The storage system can back up snapshots as differential data, which is the difference between snapshots of different generations. When a data restore command is received, the storage system restores one generation of snapshots, applies the differential data to the restored snapshot to restore another generation of snapshots, applies further differential data to the restored snapshot to restore another generation of snapshots, and repeats this process to restore multiple generations of snapshots.

Description

[[Technical Field]]

[0001] The present invention generally relates to storage control, such as data recovery. [[Background Art]]

[0002] Damage caused by ransomware is expanding. Stored data is encrypted due to ransomware infection. Not limited to ransomware, stored data may suffer damage such as encryption or tampering due to infection by some kind of malware, turning normal data into damaged data. Patent Document 1 discloses a technique for recovering data using snapshots. [[Prior Art Documents]] [[Patent Documents]]

[0003] [[Patent Document 1]] Japanese Unexamined Patent Application Publication No. 2015-153298 [[Summary of the Invention]] [[Problem to be Solved by the Invention]]

[0004] Since data may be damaged by ransomware, it is common practice to back up data. Recovery of backed-up data includes repetition of the following (S1) to (S3). (S1) Select data to be recovered. (S2) Restore the data selected in (S1). (S3) Return to (S1) if the restored data has been damaged by ransomware.

[0005] Restore time, which is the time required to perform the restore in (S2), is one of the factors that accounts for a relatively large portion of recovery time, which is the time required for data recovery. Speeding up the restore contributes to shortening the recovery time.

[0006] Furthermore, shortening data recovery time is desirable not only for data recovery in cases of malware infection such as ransomware or so-called cyberattacks, but also in other cases. [Means for solving the problem]

[0007] The storage system backs up volume data as multiple generations of snapshots. The storage system can also back up snapshots as differential data, which is the difference between snapshots of different generations. When a data restore command is received, the storage system restores one generation of snapshots, and then applies the differential data between the restored snapshot and another generation of snapshots to the restored snapshot to restore another generation of snapshots. Furthermore, multiple generations of snapshots can be restored by repeatedly applying differential data to snapshots restored with differential data to restore other generations of snapshots. [Effects of the Invention]

[0008] This can shorten data recovery time. [Brief explanation of the drawing]

[0009] [Figure 1] The configuration of the storage system according to the embodiment is shown. [Figure 2] This shows a partial configuration of the data center. [Figure 3] This shows the memory configuration within the source storage for the backup. [Figure 4] This shows the memory configuration within the backup server. [Figure 5A] This shows an example of data management within the source storage for backups. [Figure 5B] This shows an example of data management within the source storage for backups. [Figure 6]1 shows an example of snapshot management in a backup source storage. [Figure 7] 2 shows the configuration of a mapping table. [Figure 8] 3 shows the flow of backup processing. [Figure 9A] 4 shows the configuration of a catalog. [Figure 9B] 5 shows the configuration of backup information. [Figure 9C] 6 shows the configuration of difference information. [Figure 9D] 7 shows the configuration of backup data. [Figure 10] 8 schematically shows an outline of an example of restoration processing. [Figure 11] 9 shows the configuration of a restored snapshot management table. [Figure 12] 10 shows the flow of processing performed by a first restore program. [Figure 13] 11 shows the flow of processing performed by a scan program. [Figure 14] 12 shows the flow of processing performed by a second restore program. [Figure 15] 13 shows the configuration of a storage system according to a first modification. [Figure 16] 14 shows the configuration of a cloud storage according to the first modification. [Figure 17] 15 shows a partial configuration of a storage system according to a second modification. [Figure 18A] 16 shows the configuration of a server according to the second modification. [Figure 18B] 17 shows the configuration of a VM-VOL table according to the second modification. [Figure 18C] 18 shows an example of the state of snapshots and VM storage areas in the second modification. [Figure 19] 19 shows the flow of backup processing according to the second modification. MODE FOR CARRYING OUT THE INVENTION

[0010] In the following description, "interface device" may refer to one or more communication interface devices. One or more communication interface devices may be one or more identical communication interface devices (for example, one or more NICs (Network Interface Cards)) or two or more different communication interface devices (for example, a NIC and an HBA (Host Bus Adapter)).

[0011] Furthermore, in the following explanation, "memory" refers to one or more memory devices, which are examples of one or more storage devices, and may typically be main memory devices. At least one memory device in memory may be a volatile memory device or a non-volatile memory device.

[0012] Furthermore, in the following explanation, "persistent storage device" may refer to one or more persistent storage devices, which are examples of one or more storage devices. Persistent storage devices are typically non-volatile storage devices (e.g., auxiliary storage devices), and specifically may be, for example, HDDs (Hard Disk Drives), SSDs (Solid State Drives), NVME (Non-Volatile Memory Express) drives, or SCMs (Storage Class Memory).

[0013] Furthermore, in the following explanation, "processor" may refer to one or more processor devices. At least one processor device may typically be a microprocessor device such as a CPU (Central Processing Unit), but may also be other types of processor devices such as a GPU (Graphics Processing Unit). At least one processor device may be single-core or multi-core. At least one processor device may be a processor core. At least one processor device may be a broad-sense processor device such as a circuit that is a collection of gate arrays according to a hardware description language that performs some or all of the processing (e.g., FPGA (Field-Programmable Gate Array), CPLD (Complex Programmable Logic Device), or ASIC (Application Specific Integrated Circuit)).

[0014] Furthermore, in the following explanation, we may use expressions such as "xxx table" or "xxx list" to describe information from which an output is obtained for a given input. This information can be data of any structure (for example, structured data or unstructured data), or it can be a neural network that generates an output for a given input, a learning model such as a genetic algorithm or a random forest. Therefore, "xxx table" or "xxx list" can be referred to as "xxx information." Also, in the following explanation, the structure of each table is just an example; one table may be divided into two or more tables, or all or part of two or more tables may be a single table.

[0015] Furthermore, in the following explanation, the subject of the process may be "program," but since a program is executed by a processor and performs defined processes using memory and / or interface devices as appropriate, the subject of the process may also be the processor (or the device or system having that processor). A program may be installed from a program source into a device such as a computer. The program source may be, for example, a program distribution server or a recording medium readable by a computer (e.g., a non-temporary recording medium). Also, in the following explanation, two or more programs may be implemented as a single program, or one program may be implemented as two or more programs.

[0016] Furthermore, a "volume" (VOL) is a logical storage area. A volume can be a physical volume (RVOL) or a virtual volume (VVOL). An "RVOL" may be a VOL based on a storage device, while a "VVOL" may be a volume that follows capacity virtualization technology (typically Thin Provisioning).

[0017] Furthermore, any information (for example, at least one of "name" or "number") may be used as information to identify an element (ID).

[0018] Furthermore, in the following explanation, when describing similar elements without distinction, the common reference code will be used, and when describing similar elements with distinction, the reference code will be used.

[0019] The embodiments will be described below.

[0020] Figure 1 shows the configuration of a storage system according to an embodiment.

[0021] A data center 1 is constructed as a storage system. Data center 1 includes a server 100, a backup source storage 200 (a storage device used for backups), a backup server 300, a backup destination storage 400 (a storage device used for backups), and a verification storage 900 (a storage device used for verification). Each of these elements 100, 200, 300, 400, and 900 may be a physical device or a logical device (for example, a device as a cloud computing service on a cloud infrastructure). Server 100 may also be included in the backup source storage 200. Backup server 300 may also be included in storage 200, 400, or 900. Furthermore, at least a portion of storage 200, 400, and 900 may be physical or logical storage devices, specifically, for example, one or more physical computers may be constructed as SDx (Software-Defined anything) by having each of them run predetermined software. For SDx, for example, SDS (Software-Defined Storage) or SDDC (Software-defined Datacenter) can be adopted.

[0022] Server 100 performs business processing. For example, by executing programs (software) such as middleware and applications, Server 100 issues I / O requests to perform data I / O (Input / Output) to the volumes provided by the backup source storage 200. Server 100 may also be called a host.

[0023] The backup source storage 200 provides the volume, receives issued I / O requests, and performs I / O operations on the volume according to those requests. In other words, the backup source storage 200 stores the data used for business processing performed by server 100.

[0024] The backup server 300 backs up and restores data. During backup, data is read from the source storage 200 and transferred to the destination storage 400. During restore, data is transferred from the destination storage 400 to the verification storage 900. The verification storage 900 then performs data reverting. In this embodiment, data is reproduced by a combination of restore (data transfer between storages) and revert (data transfer within a storage). Data recovery includes data reproduction and scanning of the reproduced data (checking for infection). The data recovered in the verification storage 900 is transferred to the source storage 200, and the server 100 can perform business processing using the data recovered in the source storage 200. The functions of the verification storage 900 may be provided in the source storage 200. In other words, it may function as both the source storage 200 and the verification storage 900. The data recovery destination may be any storage device instead of the verification storage 900 or the source storage 200.

[0025] The backup destination storage 400 is a storage device that serves as the backup destination for the data stored in the backup source storage 200. Typically, the backup destination storage 400 is a different storage device from the backup source storage 200, but it may be the same device. Furthermore, the backup destination storage 400 can be a storage device that is less expensive than the backup source storage 200, such as object storage, file storage, or block storage, in order to store the backup data (data to be backed up). Generally, object storage and file storage are less expensive than block storage. Therefore, if the backup destination storage 400 is object storage or file storage, the backup source storage 200 may be block storage.

[0026] The verification storage 900 recovers and scans (checks) the backup data to find healthy data (for example, data that has not been affected by infection or cyberattack) if something abnormal happens to the data in the backup source storage 200, specifically if the backup source storage 200 is infected with malware such as ransomware or is subjected to a cyberattack.

[0027] Figure 2 shows a partial configuration of Data Center 1.

[0028] The backup source storage 200 has a group of drives (multiple drives 220) and a redundant controller 210 that performs data I / O to the group of drives. A drive 220 is an example of a persistent storage device. The group of drives may constitute one or more RAID (Redundant Array of Independent (or Inexpensive) Disks) groups. A virtual volume (VVOL) 217V is provided as an example of a volume based on the group of drives.

[0029] The controller 210 includes an F-IF (front-end interface) 211, a B-IF (back-end interface) 212, an M-IF (management interface) 213, a memory 215, and a processor 216 connected to them. IFs 211, 212, and 213 are examples of interface devices.

[0030] F-IF211 is an interface device that communicates with server 100. F-IF211 may have multiple ports (e.g., Fibre Channel ports, iSCSI ports). B-IF214 is an interface device that communicates with each drive 220. M-IF215 is an interface device that communicates with backup server 300.

[0031] Memory 215 stores programs and data. Memory 215 may have, for example, a cache memory area where data is temporarily stored. The processor 216 executes the programs stored in memory 215.

[0032] The backup server 300 may be a computer equipped with an M-IF271, an I / O unit 272, a memory 273, and a processor 274 connected thereto. The M-IF271 is an interface device having a port connected to the network 230. The I / O unit 272 may be a user interface device such as a keyboard, pointing device, and display device. If there is no I / O unit 272, the function of the I / O unit 272 may be performed by a client computer (not shown) connected to the backup server 300 via the network 230. The memory 273 stores programs and data. The processor 274 performs backups and restores by executing programs. The F-IF211 and M-IF215 may be the same interface device.

[0033] Network 230 can be any network, such as the Internet or a WAN (Wide Area Network). Server 100 and the source storage 200 may be connected via network 230 or via a different network. In addition to the source storage 200 and backup server 300, network 230 may also be connected to the destination storage 400 and the verification storage 900. The configurations of storage 200, 400, and 900 may be the same or different.

[0034] Figure 3 shows the configuration of the memory 215 within the backup source storage 200.

[0035] The memory 2159 includes a management area 221, a program area 222, and a cache memory area 223.

[0036] Management information is stored in the management area 221. This management information includes the mapping table 2210. Details of the mapping table 2210 will be described later.

[0037] Programs are stored in the program area 222. These programs include the I / O program 2221, the snapshot acquisition program 2222, the snapshot deletion program 2223, the differential search program 2224, and the revert program 2225. The I / O program 2221 performs data I / O to the volume in response to I / O requests such as backup and restore. The snapshot acquisition program 2222 acquires snapshots. The snapshot deletion program 2223 deletes snapshots. The differential search program 2224 performs differential searches using the mapping table 2210. The revert program 2225 performs reverts. Details of these programs 2221-2225 will be described later.

[0038] The cache memory area 223 temporarily stores data (typically data that is input to and output to drive 220).

[0039] Although not shown in the diagram, the memory configuration within the verification storage 900 may be the same as that of memory 215 shown in Figure 3. The backup source storage 200 does not need to have the revert program 2225.

[0040] Figure 4 shows the configuration of memory 273 within the backup server 300.

[0041] The memory 273 has a management area 302 and a program area 303.

[0042] Management information is stored in the management area 221. This management information includes the restored snapshot management table 304 and the backup destination management table 305. Details of the restored snapshot management table 304 will be described later. The backup destination management table 305 contains the storage number (an example of identification information) and the backup destination area (e.g., bucket information) of the backup destination storage 400.

[0043] Programs are stored in the program area 303. These programs include a difference extraction program 306, a data transfer program 307, a first restore program 308, a second restore program 309, and a scan program 310. The difference extraction program 306 extracts differences during the backup process. The data transfer program 307 transfers data during the backup process. The first restore program 308 and the second restore program 309 each cause the verification storage 900 (and / or another storage device) to perform data restoration. The scan program 310 causes the verification storage 900 (and / or another storage device) to perform a data scan, or performs a data scan itself. Details of these programs 306-310 will be described later.

[0044] Figures 5A and 5B show an example of data management within the backup source storage 200.

[0045] There is a capacity pool 250 as a storage space based on a RAID group 240 composed of a group of drives. VVOL217V is the storage space provided to server 100. When data is written to VVOL217V, the virtual area 50 of the write destination in VVOL217 is allocated to the physical area 60 in capacity pool 250. In other words, so-called Thin Provisioning is applied. Areas 50 and 60 may each be called a block, page, or segment. A concrete example of data management is as follows. For convenience, the data occupying areas 50 and 60 may be called a "data unit".

[0046] In the example shown in Figure 5A, three data units "A", "B", and "C" are stored in three virtual areas 50 in VVOL217. In this example, as indicated by the dotted arrows in Figure 5A, three physical areas in the capacity pool 250 (their addresses are B00, B01, and B02) are allocated to the three virtual areas 50, and the three data units are written to these three virtual areas 50. The correspondence between the addresses of the three virtual areas 50 and the addresses of the three physical areas 60 is recorded in the mapping table 2210.

[0047] Here, as shown in Figure 5B, when the I / O program 2221 of the backup source storage 200 receives a request from the server 100 to write the updated data unit "A'" to the virtual area 50 where the data unit "A" is written, it allocates a new physical area 60 (for example, address B03) in the capacity pool 250 and writes the data unit "A'" to the allocated physical area 60. Next, in the mapping table 2210, the I / O program 2221 associates the address of the newly allocated physical area 60, address B03, with the address of the virtual area 50 where the data unit "A'" is written, replacing the original virtual area (B00). Since the original physical area 60 (B00) is no longer referenced by any virtual area 50, it is determined to be unused physical area 60 and will be reclaimed at the appropriate time (managed as free physical area 60), and therefore will be able to be associated with any of the virtual areas 50.

[0048] Figure 6 shows an example of snapshot management within the backup source storage 200.

[0049] Snapshot VOL(SSVOL)217S1 is a snapshot SS01 representing the first state in VVOL217V where data units "A", "B", and "C" are stored. Here, a "snapshot" (SSVOL) is a virtual copy of the volume (in this case, VVOL217V) at a specific point in time. The first state is the state before data unit "A" is overwritten by data unit "A'".

[0050] SSVOL217S1 indicates that the data units stored in VVOL217V are "A", "B", and "C", and is obtained by copying the information in mapping table 2210. In other words, a snapshot can be obtained by duplicating the information of the volume to be snapshotted, which is stored in mapping table 2210.

[0051] Specifically, SSVOL217S1 contains information representing the correspondence between the addresses of the three virtual areas 50 and the addresses B00, B01, and B02 of the three physical areas 60. SSVOL217S1 is registered in the mapping table 218.

[0052] Subsequently, the data unit of VVOL217V is rewritten from "A" to "A'", and when this state is taken, SSVOL217S2 is taken as snapshot SS02. SSVOL217S2 indicates that the data units stored in VVOL217V at that time are "A'", "B", and "C", and is obtained by copying the information of VVOL217V at that time (information in mapping table 218). SSVOL217S2 includes information representing the correspondence between the addresses of the three virtual areas 50 where the three data units are stored and the addresses B03, B01, and B02 of the physical area 60 where the data units "A'", "B", and "C" are stored.

[0053] According to SSVOL217S1 and 217S2, the correspondence between virtual area 50 and physical area 60 can be identified at a past point in time when a snapshot was taken, and data units can be obtained from the identified physical area 60. Furthermore, if data unit "B'" overwrites a virtual area 50 containing data unit "B", the address of the newly allocated physical area 60 (B04) is associated with the address of the virtual area 50 containing data unit "B'", replacing the original virtual area (B01), and data unit "B'" is written to the physical area 60 at address B04.

[0054] Figure 7 shows the configuration of the mapping table 2210.

[0055] A mapping table 2210 may exist for each VVOL217V. The mapping table 2210 has a column for VVOL217V and a column for each SSVOL217S. A column is added each time an SSVOL217S is added. The example shown in Figure 7 corresponds to the example shown in Figure 6. That is, it has a column 401 for the LBA (Logical Block Address) as the volume address, a column 402V for VVOL217V, a column 402S1 for SSVOL217S1, and a column 402S2 for SSVOL217S2.

[0056] There is a row for each unit area of ​​the volume. Column 401 registers the LBA of the unit area. Column 402V registers the real area address (ADR) assigned to the LBA of the virtual area in VVOL217V. Column 402S registers the ADR (real area address) assigned to the LBA of the virtual area in SSVOL217S.

[0057] In column 402V, B03, B04, and B02 are registered as ADRs for LBA#1 to #3, which are three virtual areas where data units "A'", "B'", and "C" are stored.

[0058] Column 402S1 corresponds to snapshot SS01 of VVOL217V in the state where data units "A", "B", and "C" were stored. Therefore, B00, B01, and B02, which are ADRs of the three physical areas 60 in which data units "A", "B", and "C" are stored, are registered for LBA#1 to #3 of the three unit areas.

[0059] Column 402S2 corresponds to snapshot SS02 of VVOL217V in the state where data units "A'", "B", and "C" were stored. Therefore, B03, B01, and B02, which are ADRs of the three physical areas 60 in which data units "A'", "B", and "C" are stored, are registered for LBA#1 to #3 of the three unit areas.

[0060] In this case, in the backup source storage 200, the physical area 60 corresponding to the ADR registered (referenced) in the mapping table 2210 is not determined to be a free (unused) physical area 60, and the data units stored in that physical area 60 are maintained in their stored state. Therefore, the physical areas 60 of B00 to B04 referenced in the mapping table 2210 are not determined to be unused physical areas 60, and the data units "A", "B", "C", "A'", and "B'" in that physical area 60 are maintained in their stored state.

[0061] Snapshot SS01 can be obtained by copying the information stored in column 402V at the time the snapshot was taken to column 402S1. Snapshots can be taken for multiple VVOL217V instances at once, not just one. Generally, backups of multiple VVOL217V instances can be obtained using snapshot groups or consistency groups. By operating on a group together, backups can be obtained for the same time period. In this case, the mapping table 2210 may include a column where the group ID of the group to which the VVOL217V belongs is registered.

[0062] Snapshot acquisition (creation) is performed by the snapshot acquisition program 2222. Snapshot deletion is performed by the snapshot deletion program 2223. Each column 402S of the mapping table 2210 may contain information representing the snapshot acquisition time.

[0063] The following describes an example of the process performed in this embodiment.

[0064] Figure 8 shows the flow of the backup process.

[0065] The backup process is performed by the backup server 300. In the backup server 300, the differential extraction program 306 and the data transfer program 307 are programs for backing up data to the backup destination storage 400. The differential extraction program 306 is configured to periodically (or in response to an explicit request) cause the snapshot acquisition program 2222 of the backup source storage 200 to take a snapshot of VVOL217V. Specifically, the differential extraction program 306 sends a snapshot acquisition instruction to the snapshot acquisition program 2222 of the backup source storage 200, specifying the volume number to be snapshotted (the volume number of VVOL17V). In response to the snapshot acquisition instruction, the snapshot acquisition program 2222 takes a snapshot of VVOL17V.

[0066] The differential extraction program 306 instructs the backup source storage 200 to take a snapshot (S100). As a result, a snapshot is taken (created) on the backup source storage 200. Specifically, the snapshot acquisition program 2222 on the backup source storage 200 responds to the snapshot acquisition instruction from the differential extraction program 306 by adding and initializing a column in the mapping table 2210 that corresponds to the newly acquired snapshot. Then, the snapshot acquisition program 2222 copies the information from column 402V to the added column 402S.

[0067] The difference extraction program 306 determines the generation number of the snapshot acquired in S100 (S101). "Generation" refers to which snapshot it is for VVOL217V. If the generation is represented by a number, the generation number is incremented in S101.

[0068] The difference extraction program 306 performs difference extraction (S102). Specifically, the difference extraction program 306 extracts the difference between the snapshot taken in the current S100 (the latest generation snapshot) and the snapshot taken in the S100 preceding S100 (the previous generation snapshot). This difference extraction is performed by calling the difference search program 2224 of the backup source storage 200 from the difference extraction program 306. Specifically, in the example in Figure 6, the difference search program 2224 performs a difference search to obtain the LBA in which the data unit "A'" is stored as the difference between the latest generation snapshot SS02 and the previous generation snapshot SS01. In the data transfer in S105 described later, as a backup of the latest generation snapshot SS02, the common data units "B" and "C" which correspond to no difference are not transferred to the backup destination storage 400, and only the data unit "A'" in the ADR corresponding to the LBA obtained as a difference is transferred to the backup destination storage 400. Thus, in the example in Figure 6, the difference between the latest generation snapshot SS02 and the previous generation snapshot SS01 is the LBA where the data unit "A'" is stored. If a data unit is written to VVOL217V after a snapshot is taken, a new ADR is associated with the LBA to which it was written in the mapping table 2210. The difference can be extracted (searched) by comparing the metadata of the previous generation snapshot and the latest generation snapshot (for example, the data in columns 402S1 and 402S2).

[0069] The differential extraction program 306 obtains the transfer destination and determines the format (S103). Specifically, the differential extraction program 306 obtains the ID of the backup destination storage 400 (for example, if the backup destination storage 400 is a storage service in the cloud, information about the transfer destination cloud) and bucket information (information about the backup destination area) from the backup destination management table 305. The differential extraction program 306 decides which data to group together into a single object according to the object size. This example is for the case where the backup destination storage 400 is object storage. Similarly, if the backup destination storage 400 is file storage or block storage, identification information to identify the address where the data is stored is obtained.

[0070] The difference extraction program 306 creates a catalog and metadata (S104). As shown in Figure 9A, the catalog 1000 is the metadata catalog data and includes, for example, information representing the volume number of VVOL217V, the storage number of the backup source storage 200 that has VVOL217V, and the generation number (acquired generation number) determined in S101, as shown in Figure 9A. As shown in Figure 9B, the backup information 1001 as an example of metadata is associated with the catalog 1000 and includes information representing the generation number determined in S101, the volume number of VVOL217V, the storage number of the backup source storage 200 that has VVOL217V, the time of acquisition of the current snapshot, and the backup type. In this embodiment, in the first backup process, all data units in VVOL217V are backed up (a full backup is performed), and in subsequent backup processes, data units as differences from the previous snapshot are backed up (an incremental backup is performed). The backup type is either a full backup or an incremental backup. As shown in Figure 9C, the difference information 1002, as an example of metadata, is associated with catalog 1000 and contains information indicating whether or not there is a difference for each LBA of the volume. Figure 9C may be managed in a data structure other than that shown in the figure. Specifically, LBAs with differences may be recorded in the difference information 1002. LBAs not recorded in the difference information 1002 may be judged as having no differences.

[0071] The data transfer program 307 transfers the backup data to the backup destination storage 400 identified in S103 (S105). The data transfer program 307 also transfers the catalog and metadata to the backup destination storage 400 identified in S103 (S106). As shown in Figure 9D, the backup data 1003 is a collection of differential data (data units) identified in S102.

[0072] The differential extraction program 306 instructs the snapshot deletion program 2223 on the backup source storage 200 to delete the previous snapshot (S107). The snapshot taken in S100 during the current backup process (the latest generation snapshot) is not deleted because it will be used in S102 during the next backup process. Thus, the differential extraction program 306 does not necessarily need to delete all snapshots. If there are many snapshots remaining on the backup source storage 200, the storage capacity consumed on the backup source storage 200 will increase, but there will be more snapshots that can be used as the starting point for transferring differential data during data recovery, thus reducing the amount of data transferred during restoration. For example, when restoring VVOL217V at 11:00 to the source storage 200, if a snapshot at 9:00 exists on the source storage 200, but no snapshots from after 9:00 to 11:00 exist on the source storage 200, then it is necessary to restore VVOL217V at 9:00 on the source storage 200 and transfer the difference from after 9:00 to 11:00 from the destination storage 400 to the source storage 200. However, if the source storage 200 also has a snapshot at 10:00, then only the difference from after 10:00 to 11:00 needs to be transferred from the destination storage 400, reducing the amount of data transferred and shortening the time required for restoration.

[0073] Specifically in S107, the difference extraction program 306 sends a snapshot deletion instruction to the snapshot deletion program 2223 on the backup source storage 200, specifying the snapshot number of the snapshot to be deleted. In response to the snapshot deletion instruction, the snapshot deletion program 2223 deletes the snapshot corresponding to the specified snapshot number. Specifically, snapshot deletion involves deleting (or initializing) the column 402S in the mapping table 2210 that corresponds to the snapshot to be deleted.

[0074] The difference extraction program 306 and the data transfer program 307 described above may be executed on storage 200, 400, or 900 (for example, FI / F within said storage) instead of the backup server 300.

[0075] Figure 10 schematically shows an example of the recovery process. In Figure 10, "6 / X" refers to June X of a given year.

[0076] In Figure 10, "backup data" refers to the backup data for VVOL217V. Specifically, it includes the backup data for 6 / 10, 6 / 11, ..., 6 / 13 for VVOL217V. In the example shown in Figure 10, the data for one VVOL217V is backed up, but the data for multiple VVOL217Vs belonging to the same group may also be backed up. For example, if there are volumes A and B, the backup data for 6 / 10 includes the backup data for volume A and the backup data for volume B. Since the backup data for volumes A and B are managed separately, it is also possible to restore only volume A or only volume B.

[0077] The initial backup data, consisting of 6 / 10 of the data set, is a full backup, meaning it includes all the data in the virtual areas of VVOL217V. However, some measures may be taken to omit data from areas with all zeros.

[0078] The backup data for June 11th, June 12th, and June 13th are incremental backups. Incremental backups only include data updated since the previous backup. The data from June 12th can be reproduced by overwriting the data from June 10th with the data from June 11th, and then overwriting it again with the data from June 12th. In other words, the data from June 12th is not accessed directly on the backup destination storage 400. It is common practice to first reproduce the data on storage and then access the reproduced data. This reproduction is called "restore".

[0079] If ransomware or other malware infection is suspected, backup data is restored from backup storage 400 to verification storage 900 to identify uninfected data, and then checked for infection. This process of restoring data from different generations and scanning, including checking for infection, is repeated until uninfected data is found.

[0080] For example, to reproduce the most up-to-date state possible, the latest generation of backup data is restored and checked for infection. If that generation is infected, the next generation of backup data (one generation prior) is restored and checked for infection. In the example shown in Figure 10, the backup server 300 is instructed to restore the latest generation, the 6 / 13 backup data, and the backup server 300 restores the 6 / 13 backup data. Subsequently, the backup server 300 is instructed to restore the next generation of backup data, the 6 / 12 backup data, and the backup server 300 restores the 6 / 12 backup data.

[0081] In one example, to restore the data from June 13th, backup data from June 10th, 11th, 12th, and 13th are transferred from the backup storage 400 to the verification storage 900. Then, to restore the next generation of data from June 12th, backup data from June 10th, 11th, and 12th are transferred from the backup storage 400 to the verification storage 900. In this way, if the process of restoring data from previous generations sequentially is repeated after restoring the desired generation of data until uninfected data is found, the data from generations already transferred to the verification storage 900 will be repeatedly used during the restoration process. Since at least full backup data will be transferred repeatedly, the amount of data transferred until uninfected data is found will be large, and the time required for restoration will be long.

[0082] Therefore, in this embodiment, the time required for restoration can be shortened by the following process.

[0083] In other words, when the backup server 300 receives a restore command for the latest generation of data from 6 / 13, it has the restore destination VOL17V (VVOL in this embodiment) created on the verification storage 900, and writes the full backup data from 6 / 10 from the backup destination storage 400 to the restore destination VOL17V on the verification storage 900.

[0084] Next, the backup server 300 instructs the verification storage 900 to take a snapshot of the restore destination volume 17V. The image of the restore destination volume 17V for 6 / 10 is saved as a snapshot (SSVOL17S1).

[0085] Next, the backup server 300 overwrites the incremental backup data from 6 / 11 from the backup destination storage 400 to the restore destination VOL17V on the verification storage 900. Note that in the restore destination VOL17V, the LBA to which each data unit in the incremental backup data is written is the same LBA as the LBA of that data unit (the LBA of the virtual area in VVOL217V).

[0086] Next, backup server 300 instructs verification storage 900 to take a snapshot of the restore destination volume 17V. The image of the restore destination volume 17V for June 11th is saved as a snapshot (SSVOL17S2).

[0087] As described above, the process of restoring incremental backup data and taking a snapshot (SSVOL17S) of the restore destination VOL17V overwritten by the incremental backup data is repeated. This repetition continues until the incremental backup data from 6 / 13 is overwritten on the restore destination VOL17V. During this repetition, the mapping table 2210 is created and updated on the verification storage 900. Specifically, column 402V is added when full backup data is written, and column 402S is added each time a snapshot is taken. That is, in the mapping table 2210 of the verification storage 900, column 402V contains the address (ADR) of the actual area of ​​the capacity pool on the verification storage 900 for each LBA of the restore destination VOL17V on which the full backup data from 6 / 10 is written. Column 402S contains the address (ADR) of the actual area of ​​the capacity pool on the verification storage 900 for each LBA of SSVOL17S taken on the verification storage 900.

[0088] The upper half of Figure 10 shows the state after the data from June 13th (data as of June 13th) has been restored to the restore destination VOL17V. In the example shown in the figure, a snapshot was not taken on June 13th, but one could be taken on June 13th. The snapshot taken (created) on the verification storage 900 and the backup generation information are registered in the restored snapshot management table 304.

[0089] Next, the backup server 300 checks whether the restored data from June 13th is infected. If the check reveals that the data from June 13th is infected, the backup server 300 then receives a new restore instruction for June 12th, as shown in the lower half of Figure 10. For example, the backup server 300 may output information (e.g., display information) indicating that the data from June 13th is infected to the source of the June 13th restore instruction, and then receive a new restore instruction for June 12th after outputting this information.

[0090] In response to the restore instruction for 6 / 12, the backup server 300 reflects the snapshot (SSVOL17S3) taken on 6 / 12 in the verification storage 900 to the restore destination volume. This process is called "reverting". Reverting is achieved solely by updating the mapping table 2210 in the verification storage 900. Reverting is performed by the revert program 2225. Specifically, the backup server 300 instructs the revert program 2225 on the verification storage 900 to overwrite the information in column 402S corresponding to the 6 / 12 snapshot in column 402V. In other words, the mapping between the virtual area and the physical area in the restore destination VOL17V is updated. In this way, data can be reproduced within the verification storage 900 without copying the actual data (data can be reproduced by changing the mapping between the virtual area and the physical area in the restore destination VOL17V), making it possible to reproduce the data from 6 / 12 at high speed.

[0091] As described above, during the process of restoring the latest generation of data from June 13, snapshots of the data from June 10, June 11, and June 12 are taken, and by managing the backup generation and snapshots in association, the amount of data copied can be reduced, and the time required to check for infection can be shortened.

[0092] Furthermore, in this embodiment, the data for 6 / 10, 6 / 11, 6 / 12, and 6 / 13 can be saved as snapshots in the verification storage 900. That is, data at addresses that have not been updated are physically shared between the data for 6 / 10 and the data for 6 / 11. Therefore, the storage cost of the verification storage 900 can be reduced.

[0093] Furthermore, if the backup destination storage 400 is cloud storage (for example, storage outside of data center 1) and the verification storage 900 is installed in data center 1, it is expected that the costs incurred for data transfer from the cloud to the verification storage 900 will be reduced.

[0094] Figure 11 shows the configuration of the restored snapshot management table 304.

[0095] The Restored Snapshot Management Table 304 has a column 1101 for the volume number, a column 1102 for the backup generation, a column 1103 for the snapshot device, and a column 1104 for the snapshot number. Each row in the Restored Snapshot Management Table 304 corresponds to a restored snapshot (SSVO17S1 to 17S3 in the example in Figure 10).

[0096] Column 1101 contains a number that identifies the volume to be backed up. A column containing a number that identifies the storage having the volume may also be added. In this embodiment, volume 1-1 is volume 1 of storage 1, and is represented by concatenating the storage identification number and the volume identification number.

[0097] Column 1102 registers the backup generations of the volume identified by the volume number. The backup generation can be a generation number as described above, or it can be a date, time, etc. instead of a number.

[0098] Column 1103 registers the identification number of the storage device from which snapshots are being taken. In this embodiment, the identification number of the verification storage 900 is registered in column 1103 as the identification number of the snapshot device.

[0099] Column 1104 contains the snapshot number identified by the snapshot device. This number identifies each of the multiple snapshots located on the aforementioned verification storage 900.

[0100] Figure 12 shows the processing flow performed by the first restore program 308.

[0101] The first restore program 308 accepts a restore instruction (S200). The restore instruction specifies the volume number and generation of the target volume (VVOL217V). In addition, the restore instruction may also specify the storage number of the verification storage 900 and the volume number of the destination VOL. The first restore program 308 may determine the storage number of the verification storage 900 and the volume number of the destination VOL and return these numbers to the source of the restore instruction as a processing result.

[0102] The first restore program 308 refers to snapshot information corresponding to the specified generation (S201). The "snapshot information" referred to here is the information updated (created) in S205 or S208 described later, and specifically refers to the information of the row in the restored snapshot management table 304 that has backup generation information (information representing the backup generation) that matches the specified generation (the generation specified in the restore instruction received in S200).

[0103] The first restore program 308 determines whether snapshot information corresponding to the specified generation exists (S202). For example, as explained with reference to Figure 10, if the restore instruction received in S200 is the first restore instruction received (i.e., if the process shown in Figure 12 is performed for the first time), the result of S202 is false. On the other hand, if the restore instruction received in S200 is one in which an infection has been detected from the data reproduced in response to a previous restore instruction, and an older generation than the one specified in the previous restore instruction is specified, the result of S202 is true.

[0104] If the result of S202 is false (S202: No), the first restore program 308 copies the full backup data (data 6 / 10 in Figure 10) from the backup destination storage 400 to the restore destination VOL17V on the verification storage 900 (S203). In this paragraph, "copying" means reading the data from the backup destination storage 400 and writing that data to the restore destination VOL17V. By accessing the catalog 1000 and backup information 1001 shown in Figures 9A and 9B, information regarding the generation number and type can be referenced, and the generation information and full backup data 1003 can be obtained.

[0105] The first restore program 308 sends a snapshot acquisition command (S204) to the snapshot acquisition program 2222 of the verification storage 900 to take a snapshot of the restore destination VOL17V. As a result, the snapshot acquisition program 2222 takes a snapshot (SSVOL17S1) of the restore destination VOL17V (data from 6 / 10) on the verification storage 900, to which the full backup data has been copied.

[0106] The first restore program 308 updates the restored snapshot management table 304 (S205). Specifically, for example, a row corresponding to the oldest backup generation is added to the restored snapshot management table 304.

[0107] The first restore program 308 overwrites the incremental backup data corresponding to the next generation after the previous generation from the backup destination storage 400 to the restore destination VOL17V (S206).

[0108] The first restore program 308 sends a snapshot acquisition command to the snapshot acquisition program 2222 of the verification storage 900 to take a snapshot of the restore destination VOL17V (S207). As a result, the snapshot acquisition program 2222 takes a snapshot (e.g., SSVOL17S2) of the restore destination VOL17V (e.g., the data from 6 / 11) to which the incremental backup data was copied in S206 on the verification storage 900.

[0109] The first restore program 308 updates the restored snapshot management table 304 (S208). Specifically, for example, rows corresponding to the backup generations of the incremental backup data copied in S206 are added to the restored snapshot management table 304.

[0110] The first restore program 308 determines if there is a next generation (S209). Specifically, if the backup generation of the incremental backup data copied in the previous S206 does not match the specified generation, the result of the determination in S209 is true. If the result of the determination in S209 is true (S209:Yes), the process returns to S206, and the next generation of incremental backup data of the incremental backup data copied in the previous S206 is copied.

[0111] On the other hand, if the backup generation of the incremental backup data copied in the preceding S206 matches the specified generation, the result of S209 is false. If the result of S209 is true (S209: No), the process terminates.

[0112] If the result of S202 is false (S202: No), the first restore program 308 sends a snapshot revert instruction to the revert program 2225 of the verification storage 900 (S211). Note that if the specified generation is a full backup generation, the process may be terminated immediately after step S203 or S206. This can be achieved by adding processing equivalent to S209 immediately after S203 or S206.

[0113] Figure 13 shows the processing flow performed by the scan program 310.

[0114] The scan program 310 is a program that sets up an environment for checking whether the data reproduced by the first restore program 308 (or the second restore program 309 described later) is infected, and issues a scan command. The scan itself may be implemented by calling an existing check function, such as a so-called virus check program. In the explanation of Figure 13, the first restore program 308 is used as an example, but in the explanation of Figure 13, the first restore program 308 may be read as the second restore program 309.

[0115] The scan program 310 issues a restore command to the first restore program 308 (S300). For example, the first restore command specifies the latest backup generation. Multiple generations may be specified in a single restore command. The user may specify a backup generation via the I / O unit 272, or the scan program 310 may identify the latest backup generation, the next oldest backup generation, etc., from the catalog and metadata stored in the backup destination storage 400 and specify the identified generation.

[0116] The scan program 310 deploys a virtual server for scanning (S301). This virtual server mounts the volume where the data to be scanned is stored and runs existing check functions (e.g., a virus check program) on the data on that volume. The virtual server may be deployed on any device, for example, the backup server 300 or the verification storage 900.

[0117] The scan program 310 mounts the volume containing the data to be scanned to the deployed virtual server (S302). The mounted volume is the restore destination VOL17V, which contains data from a specified generation reproduced in response to the restore command in S300.

[0118] The scan program 310 instructs the existing check function to start scanning the data on the mounted volume (checking for infection) (S303). When the data scan is complete, the scan program 310 retrieves the scan results from the existing check function (S304). The scan program 310 refers to the scan results (S305) and determines whether the specified generation is a normal generation or not (S306). If the result of the determination in S306 is true (S306: Yes), the process ends.

[0119] If the result of the S306 determination is false (S306: No), the scan program 310 determines a generation older than the generation specified in the previous restore instruction in S300 (S307), and issues a restore instruction specifying the generation determined in S307 (S300). In other words, after S307, the process returns to S300. The generation determined in S307 may be the latest generation among the unspecified generations (for example, one generation older than the previously specified generation). Also, multiple generations may be determined in S307.

[0120] The process shown in Figures 12 and 13 can be explained using the example shown in Figure 10 as follows: In the initial restore instruction, the generation corresponding to 6 / 13 is specified. However, since an infection is detected from the scan results of the reproduced and scanned data, in S307, an older generation, i.e., the generation corresponding to 6 / 12, is determined, and in S300, a restore instruction is issued specifying the determined generation. In the reproduction of the 6 / 13 data, a snapshot of the 6 / 12 data has already been restored. Therefore, in the reproduction of the 6 / 12 data, copying from the backup destination storage 400 to the verification storage 900 is unnecessary. In other words, S211 is performed via S202:Yes. By reverting the 6 / 12 data to the restore destination VOL17V (solely by copying between columns in the mapping table 2210), the 6 / 12 data can be reproduced on the restore destination VOL17V.

[0121] By the way, in the process shown in Figures 12 and 13, the scan is performed each time the data of a specified generation is reproduced. In other words, the scan is performed sequentially. The scan program 310 may be included in the first restore program 308.

[0122] In contrast, the second restore program 309 performs scans in parallel. This further speeds up the infection detection process. Note that the scan program 310 may also be included in the second restore program 309.

[0123] Figure 14 shows the processing flow performed by the second restore program 309.

[0124] The difference from the process shown in Figure 12 is that S400 to S402 are present instead of S200 to S202 and S211, while S203 to S209 are the same as S203 to S209 shown in Figure 12. Therefore, we will mainly explain S400 to S402.

[0125] In S400, the second restore program 309 accepts restore instructions that specify multiple generations. That is, in a restore instruction, multiple generations of the same VVOL217V are specified as targets for restoration. The second restore program 309 provides an interface that accepts multiple generations of the same VVOL217V. This interface may be, for example, a GUI (Graphical User Interface) and may be displayed by the I / O unit 272, and multiple generations may be specified via the GUI displayed by the I / O unit 272. Alternatively, for example, this interface may be provided to the scan program 310, and multiple generations determined by the scan program 310 based on the catalog and metadata stored in the backup destination storage 400 may be specified by the scan program 310 via this interface. As shown in the example in Figure 10, for example, multiple generations may be specified, such as four generations corresponding to 6 / 10 to 6 / 13.

[0126] In S401, the second restore program 309 provides the virtual server deployed by the scan program 301 with a snapshot (SSVOL17S) in addition to the restore destination VOL17V. Here, multiple specified generations of VOLs (restore destination VOLs and snapshots) are provided. As shown in the example in Figure 10, four VOLs (VOL17V and SSVOL17S1~17S3) corresponding to 6 / 10~6 / 13 are provided. Here, "providing" means making them mountable, as explained in Figure 13. For example, to make the VOL accessible from the virtual server, the volume number (e.g., LUN) of the snapshot is assigned to the virtual server, and port settings (setting access routes that allow access to the VOL from which ports) are configured. Alternatively, the administrator may specify the restore destination LUN, etc. In that case, the LUN specified by the administrator and the snapshot may be associated in S401.

[0127] Note that the process shown in Figure 14 demonstrates the reproduction of multiple consecutive generations, but these generations do not need to be consecutive. In this case, for generations not included in the specified multiple generations, steps S204 and S205, and S207 and S208 may be skipped. Furthermore, if the specified generation is a full backup generation, the process may be terminated immediately after step S203 or S206. This can be achieved by adding a process equivalent to S209 immediately after S203 or S206.

[0128] In S402, the second restore program 309 instructs the existing scan function to perform a parallel scan on all VOLs corresponding to the specified multiple generations (e.g., VOL17V and SSVOL17S1~17S3). For this purpose, it notifies the existing scan function of the volume numbers (snapshot numbers), etc., of all VOLs corresponding to the specified multiple generations. If scanning N generations is specified, the scan program 310 deploys N virtual servers in S301. In S302, it mounts the VOLs of each generation to each of the N deployed virtual servers. In S303, it instructs the N deployed virtual servers to start scanning the target VOLs on each virtual server. In S304, it retrieves the results from each virtual server. Step S300 is not necessary. Step S300 is an instruction to reproduce the target generation on VOL17V. This is because scanning multiple generations accesses snapshots (such as S17S1 and S172) to perform the scan. The second restore program 309 may identify generations without infection based on the scan results from the existing scan function and reproduce the data of the most recent generation among the generations without infection in the restore destination VOL17V.

[0129] The restored VOL17V containing the uninfected data may be provided to server 100 and used as the I / O destination for business processing by server 100. Alternatively, the restored VOL17V containing the uninfected data may be copied from the verification storage 900 to another storage (e.g., the backup source storage 200) by the first restore program 308 or the second restore program 309, and the copied VOL on that other storage may be provided to server 100 and used as the I / O destination for business processing by server 100.

[0130] The storage system according to this embodiment is data center 1, but the storage system can be modified in the following ways, for example.

[0131] Figure 15 shows the configuration of the storage system according to the first modified example.

[0132] Data center 1 has server 100, backup source storage 200, and backup server 300. Backup destination storage 400 is located in cloud 2. Cloud 2 further includes cloud storage 500, cloud server 600, and cloud backup server 700.

[0133] Cloud Storage 500 is a storage device used as verification storage 900. Cloud Storage 500 may also be built using software by combining servers and storage provided by Cloud 2. Cloud Storage 500 may also be a storage device as part of the cloud computing services provided by Cloud 2. Cloud Storage 500 is storage as SDS (Software-Defined Storage).

[0134] Cloud Server 600 can be used as the server to perform scans or as the server to take over operations from Server 100 on the Cloud 2 side. When performing a scan, the existing scan function will be executed. When taking over operations, applications and other tasks that were running on Server 100 will be executed on Cloud Server 600.

[0135] The cloud backup server 700 is the server that performs the restoration of backup data on behalf of the backup server 300. While the cloud backup server 700 is not strictly necessary, there are cases where a configuration including the cloud backup server 700 is preferable for the reasons exemplified below. Instead of backup data being read from backup destination storage 400 to backup server 300 outside of Cloud 2 and then written from backup server 300 outside of Cloud 2 to cloud storage 500, the data transfer from backup destination storage 400 to cloud storage 500 within Cloud 2 is performed by cloud backup server 700. This ensures that the data being transferred does not leave Cloud 2 during the data transfer process. Backup server 300 itself becomes unusable due to ransomware infection or other issues.

[0136] The present invention can also be applied to configurations where elements 500, 600, and 700 are not in Cloud 2, and only the backup destination storage 400 is in Cloud 2. That is, in such a configuration, server 100, backup source storage 200, and backup server 300 exist in Data Center 1, and backup destination storage 400 exists in Cloud 2. When the present invention is applied in such a configuration, the amount of backup data transferred from Cloud 2 to Data Center 1 can be reduced. Furthermore, since data transfer from Cloud 2 to outside Cloud 2 may incur charges, not only can the restore speed be improved, but cost reduction effects can also be expected.

[0137] Alternatively, data center 1 may be cloud 2. That is, a configuration may be adopted in which server 100, backup source storage 200, backup server 300, and backup destination storage 400 are located within cloud 2. The configuration of data center 1 and cloud 2 may also be reversed.

[0138] Specifically, for example, the following are possible for each of (A) the main entity performing the backup process, (B) the backup destination storage, and (C) the verification storage. Any combination of (A), (B), and (C) is acceptable. Specifically, Figure 1 shows (a3)+(b1)+(c1). Figure 15 shows (a3)+(b2)+(c4). (A) The main body of the backup process (a1) The source storage 200 itself (e.g., the processor) (a2) The FI / F feature of the backup source storage 200 (a3) Backup server 300 (B) Backup destination storage (b1) A storage other than the backup source storage 200 of data center 1 (b2) Storage as a Cloud 2 storage service (e.g., object storage service, file storage service or block storage service) (b3) SDS operating on Cloud 2 (see Figure 16, for example) (C) Verification storage (c1) A storage device separate from the backup source storage 200 of data center 1 (c2) Backup source storage 200 of data center 1 (c3) Storage as Cloud2 storage service (e.g., object storage service, file storage service or block storage service) (c4) SDS operating on Cloud 2 (see, for example, Figure 16)

[0139] Figure 16 shows the configuration of Cloud Storage 500.

[0140] Cloud storage 500 is composed of multiple storage servers 503 connected to and bundled with network 502 within Cloud 2. Network 502 may be network 230 or a network connected to network 230. By running storage processing software on each storage server 503, cloud storage 500 as SDS is realized.

[0141] Each storage server 503 is connected to the cloud server 600, receives I / O requests (write requests / read requests) from the cloud server 600, and performs I / O to the VOL 509 provided by the cloud storage 500. The storage server 503 may consist of at least one of the following: a physical server, a virtual machine, or a container. The storage server 503 has, for example, an interface (IF) 504, a processor 504, and memory 506.

[0142] The cloud storage 500 has one or more cloud storage devices 507 that constitute a capacity pool 508. The cloud storage devices 507 are storage areas managed by the storage server 503. For example, in a public cloud, the cloud storage devices 507 may be storage devices created from the public cloud's storage service (for example, EBS (Elastic Block Store) provided by AWS®). When a storage device created by a storage service is attached to the storage server 503, the storage server 503 can treat that storage device as if it were an internal drive of the storage server 503.

[0143] Based on the capacity pool 508, a VOL509 (e.g., VVOL) is provided. The data written to VOL509 may be redundant across two or more storage servers 503, or simply duplicated, and techniques such as Erasure Coding may be used for redundancy. Since this type of technique is well known, a detailed description is omitted herein.

[0144] The management server 501 connected to network 502 may be a server for managing and maintaining the cloud storage 500. Any of the storage servers 503 may also take on the role of the management server 501.

[0145] In this modified example, cloud storage 500 is SDS, but cloud 2 may operate with storage such as the backup source storage 200. Each storage server 503 may have dedicated hardware, such as hardware for compression / decompression or hardware for encryption / decryption.

[0146] Furthermore, each storage server 503 may be located in a different Availability Zone of the public cloud. If one Availability Zone fails, the other Availability Zones will not be affected by that failure. The cloud server 600 and cloud storage 500 may reside in different Availability Zones or in different Regions. The cloud server 600 and cloud storage 500 may reside on a cloud service provided by another vendor on the public cloud vendor (for example, VMware Cloud on AWS). The cloud server 600 and cloud storage 500 may reside in a different cloud 2.

[0147] Figure 17 shows a partial configuration of the storage system according to the second modified example.

[0148] In the second variation, a virtualization environment is built on server 100. Depending on the virtualization infrastructure (e.g., hypervisor 140), the data between VVOL217V on the backup source storage 200 and VM (virtual machine) 110 may not have a one-to-one correspondence. In the example shown in Figure 17, data 150 from multiple VMs 110 are mixed within a single VVOL217V on the backup source storage 200. VM 110 may also be a container.

[0149] As shown in the example in Figure 17, backing up VVOL217V itself backs up all VM data 150 in that VVOL217V. During restoration, all VM data 150 are restored. Therefore, it is difficult to reproduce data from an arbitrary generation for each VM. For example, it is difficult to reproduce data 6 / 10 for VM1 and data 6 / 11 for VM2.

[0150] In such cases, backups can be obtained on a per-VM basis in conjunction with the virtualization infrastructure. The hypervisor 140 manages the VM storage area 120 (e.g., a drive) for each VM 110. The dotted line between VM 110 and VM storage area 120 indicates that VM storage area 120 is allocated to VM 110.

[0151] For each VM110, the VM storage area 120 may include a delta area 120S in addition to the base area 120V. For example, delta area 120S1 is the storage area for new write data generated to the base area 120V of VM1 when a snapshot of VM1 is taken.

[0152] VVOL217V includes VM data 150 for each VM 110. VM data 150 is data stored in the VM storage area 120. In addition to base data 150V, which is data stored in the base area 120V, there may also be delta data 150S, which is data stored in the delta area 120S.

[0153] For each VM110, the correspondence between the VM storage area 120 provided by the hypervisor 140 (an example of a virtualization infrastructure) on server 100 and the VM data 150 in VVOL217V is shown in VM-VOL table 1802.

[0154] Figure 18 shows the configuration of server 100 according to the second modified example.

[0155] Server 100 has memory 1800. Although not shown in the diagram, in addition to memory 1800, server 100 also has an interface device and a processor. Programs in memory 1800 are executed by the processor. Communication such as issuing I / O requests is performed via the interface device.

[0156] Memory 1800 stores differential information 1801, VM-VOL table 1802, VM snapshot acquisition program 1803, VM snapshot deletion program 1804, and differential notification program 1805.

[0157] The differential information 1801 records the updated addresses made to the VM storage area 120. It can be managed using a bitmap, such as 1 bit per unit of several kilobytes to several hundred kilobytes. When a backup is performed, the differential information 1801 is reset to its initial state, and the differences since the backup are recorded in the differential information 1801. This allows for the management of addresses that have been updated between backups.

[0158] The VM-VOL table 1802 is a table that shows the correspondence between the addresses of VM storage area 120 and the LBA of VVOL217V. Specifically, as shown in Figure 18B, for each VM110, the VM-VOL table 1802 shows the VM number (identification number of VM110), the address of VM storage area 120 (base area 120V and delta area 120S), and the LBA in VVOL217V.

[0159] The VM snapshot acquisition program 1803 takes a snapshot for each VM 110. Taking a VM snapshot is done by creating a delta area 120S. All data that is an update to the base area 120V is stored in the delta area 120S. For example, as shown in Figure 18C, if a snapshot is taken for the base area 120V at 10:00, updates to the base area 120V stop at 10:00. Data written after 10:00 is written to the delta area 120S. By accessing the base area 120V, the VM data as of 10:00 can be accessed. By accessing the delta area 120S, and for data not present in the delta area 120S, the latest VM data can be accessed by accessing the base area 120V.

[0160] The VM snapshot deletion program 1804 deletes the VM snapshot. For example, as shown in Figure 18C, the VM snapshot deletion program 1804 copies (overwrites) the data stored in the delta area 120S (data written from after 10:00 to 11:00) to the base area 120V. At this point, the state of the base area 120V becomes the state of the current time (11:10) when the copy is completed. After that, the VM snapshot deletion program 1804 deletes the delta area 120S.

[0161] The differential notification program 1805 notifies external software of the differential information 1801. The differential notification program 1805 obtains the update address on the VM storage area 120 from the differential information 1801, uses that address to identify the LBA of VVOL217V from the VM-VOL table 1802, and returns the identified LBA to the requester.

[0162] Figure 19 shows the backup process flow for the second modified example.

[0163] The difference from the backup process shown in Figure 8 is that S500-S504 are present instead of S100 and S102, while S101 and S103-S107 are the same as S101 and S103-S107 shown in Figure 8. Therefore, we will mainly explain S500-S504.

[0164] In S500, the differential extraction program 306 instructs the VM snapshot acquisition program 1803 of server 100 to acquire (create) a VM snapshot. This instruction specifies the VM number of the target VM. When the VM snapshot acquisition program 1803 responds to the instruction and acquires a VM snapshot (delta area 120S) of the target VM, the update of the VM data 150 stops. The VM data at this point can be finalized. Data (updates) to the VM data after S500 are stored in the VM data 150S (VM delta) as differential data in VVOL217V via the delta area 120S.

[0165] In S501, the difference extraction program 306 calls the difference notification program 1805 on the server 100 to obtain the difference information 1801. The difference notification program 1805 obtains the update address on the VM storage area 120 recorded in the difference information 1801, identifies the LBA corresponding to the update address from the VM-VOL table 1802, and returns the identified LBA (the LBA of VVOL217V) to the difference extraction program 306.

[0166] In S502, the differential extraction program 306 instructs the backup source storage 200 to take a snapshot. S502 may be the same as S100 in Figure 8. Alternatively, at this point, the differential extraction program 306 may instruct the differential notification program 1805 to clear (initialize) the differential information 1801, thereby clearing the differential information 1801.

[0167] In S503, the differential extraction program 306 instructs the VM snapshot deletion program 1804 of server 100 to delete the VM snapshot taken in S500. At this point, server 100 stops storing data in the delta area 120S, and the VM snapshot deletion program 1804 copies the data stored in the delta area 120S to the base area 120V. This update to the base area 120V due to the copy is also recorded in the differential information 1801.

[0168] In S504, the differential extraction program 306 reads data from the snapshot obtained in S502 using the LBA corresponding to the update address obtained in S501. This allows the data updated since the last backup process to be read. Server 100 has also started recording updates that occurred after S500 for the next backup process.

[0169] According to the second modification, the above process allows backup data to be stored in the backup destination storage 400 for each VM. Restoring backup data can also be performed on a VM-by-VM basis. In other words, it is possible to change the generation to be restored for each VM. Note that the second modification is just one example of a method for performing backup and restore on a VM-by-VM basis, and since the present invention is not dependent on the backup method, it can be applied even when VM-by-VM backups are performed using other methods.

[0170] Although embodiments and several modifications have been described above, these are merely illustrative examples for explaining the present invention and are not intended to limit the scope of the present invention to these embodiments and modifications. The present invention can be implemented in various other forms. For example, both the first restore program 308 and the second restore program 309 may be provided on the backup server 300, and programs 308 and 309 may be used interchangeably depending on the case. For example, in a case where cloud storage 500 is used as verification storage 900, it is expected that there are sufficient computing resources in cloud 2 to perform parallel scans, so the second restore program 309 may be executed.

[0171] The above explanation can be summarized as follows. This summary may include supplementary explanations or variations of the above explanation.

[0172] A data recovery device (e.g., backup server 300 or cloud backup server 700) is constructed, having memory (e.g., memory 273) and a processor (e.g., processor 274) that performs processing using the memory. The data recovery device is an example of a computer. The processor receives a restore instruction specifying one or more generations. For example, a first restore program 308 executed by the processor receives a restore instruction specifying one generation. A second restore program 309 executed by the processor receives a restore instruction specifying multiple generations (or even just one generation).

[0173] The processor restores full backup data of a predetermined storage area (e.g., VVOL217V or VM storage area 120 (especially base area 120V)) to the restore destination area in the restore destination storage (e.g., verification storage 900 or cloud storage 500), which is storage having a restore destination area (e.g., list destination VOL17V) and a snapshot acquisition function (e.g., snapshot acquisition program 2222) for acquiring snapshots of the restore destination area. The processor overwrites the restore destination area with incremental backup data corresponding to each generation, starting from the oldest generation, for one or more generations from the generation corresponding to the full backup data (e.g., the generation corresponding to 6 / 10) up to the latest generation among the specified one or more generations (e.g., the generation corresponding to 6 / 13). Each time full backup data or incremental backup data is written to the restore destination area, the processor causes the snapshot acquisition function to take a snapshot (e.g., SSVOL17S) of the restore destination area on which the full backup data or incremental backup data was written, if the generation corresponding to the written data belongs to at least one of the specified generations. The processor then reproduces the data of the predetermined storage area for that generation in the restore destination area by reflecting the snapshot corresponding to at least one of the generations in the restore destination area.

[0174] This allows for the reproduction of data for at least one generation without the need to restore the backup data again, thereby reducing the time required for data reproduction and thus shortening data recovery time. Specifically, for example, to ensure that healthy data remains even if the source is infected, the backup destination storage device is usually physically or logically different from the backup source storage device. Even when the backup source and backup destination are different devices in this way, data recovery time can be shortened. For example, if the backup source storage device is an on-premises device, the backup destination storage device can be a cloud-based device, such as a Software Defined Storage (SDS) implemented in the cloud.

[0175] A processor (for example, the first restore program 308) may receive a restore instruction that specifies a generation N (for example, this N is the generation corresponding to 6 / 13). The processor may perform a snapshot existence check to determine whether a snapshot corresponding to the generation N specified in the restore instruction has already been taken at the restore destination storage. To this end, the processor may record information in memory (for example, S205 or S208) indicating that the acquired snapshot has already been restored each time a snapshot is taken, and perform the snapshot existence check by referring to the information recorded in memory.

[0176] If the result of the snapshot existence check is false (e.g., S202: No), the processor may reproduce the data of a predetermined storage area of ​​generation N in the restore area by overwriting the data of the specified storage area of ​​generation N in the restore area with incremental backup data corresponding to the generation, starting from the oldest generation, for one or more generations from the generation corresponding to the full backup data restored to the restore area up to a specified generation N (e.g., by a loop from S206 to S209). The processor may have the snapshot acquisition function take a snapshot of the restore area for the generation corresponding to the written data each time full backup data or incremental backup data is written to the restore area (e.g., S204 or S207). The processor may perform a damage check on the data of generation N reproduced in the restore area, including checking whether the data is damaged data, and whether damage has been detected as a result of the scan (e.g., S306).

[0177] If the result of the damage assessment is true (for example, S306: No), the processor may receive a restore instruction in which an older N than the N specified in the previous restore instruction is specified as generation N, and may perform a snapshot existence assessment to determine whether a snapshot corresponding to the generation N specified in the restore instruction has already been taken on the restore destination storage.

[0178] If the snapshot existence check is true, the processor may reproduce the data of the predetermined storage area of ​​that generation N in the restore destination area by reflecting the snapshot corresponding to that generation N in the restore destination area (for example, S211), and then perform a check for damage.

[0179] This allows for the rapid reproduction of data from a specified generation N, thereby shortening the data recovery time until no damage (all data being intact) is detected. The processor may determine the oldest N from the generations of backed-up data (for example, all generations identified by referencing the catalog and metadata of all backup data). This enables efficient data recovery.

[0180] A restore instruction may be a restore instruction specifying multiple generations. The processor (for example, the second restore program 309) may overwrite the restore destination area with incremental backup data corresponding to one or more generations, starting from the oldest generation, for each generation from the generation corresponding to the full backup data up to the latest generation among the specified multiple generations (for example, the loop from S206 to S209 in Figure 14). Each time full backup data or incremental backup data is written to the restore destination area, the processor may have the snapshot acquisition function take a snapshot of the restore destination area on which the full backup data or incremental backup data was written, if the generation corresponding to the written data belongs to at least one of the specified multiple generations (i.e., if the generation corresponding to the written data does not belong to any of the specified generations, snapshot acquisition may be skipped). The processor may, in parallel for multiple generations, perform a damage determination on the data in the restore destination area and snapshots of multiple generations, including a scan to check whether the data is damaged or not, and determine whether damage has been detected as a result. The processor may, for at least one generation among multiple generations in which the damage status determination was false (for example, the latest generation among the generations in which no damage was detected), reproduce the data of a predetermined storage area of ​​that generation in the restore destination area by reflecting a snapshot corresponding to that generation in the restore destination area.

[0181] This allows for high-speed scanning and rapid reproduction of data from generations where no damage was detected. The destination storage may have a scanning function (e.g., an existing scanning function) to perform the scan. Parallel scanning may be performed in response to instructions from the processor to the scanning function. The destination storage may be storage as a storage service in the cloud (e.g., Cloud2). Parallel scanning may require many computing resources, but such resources are likely to be available in the cloud, and therefore, high-speed execution of parallel scanning can be expected.

[0182] Full backup data and incremental backup data may be stored in a backup destination storage (e.g., backup destination storage 400) separate from the restore destination storage. The processor may be configured to read full backup data from the backup destination storage and write said full backup data to the restore destination area, and similarly, to read incremental backup data from the backup destination storage and overwrite said incremental backup data in the restore destination area.

[0183] The designated storage area is a volume (e.g., VVOL217V), and the restore destination area may be a volume corresponding to that volume.

[0184] Furthermore, the specified storage area may be the storage area corresponding to the target virtual server among multiple storage areas (e.g., multiple VM storage areas 120) that correspond to multiple virtual servers (e.g., multiple VMs 110) and are managed by the virtualization infrastructure (e.g., hypervisor 140). The restore destination area may be the storage area for the target virtual server.

[0185] Furthermore, the present invention can be applied even if the devices are not separated, as in the data recovery device, backup source storage device, and backup destination storage described above. For example, a storage system may be constructed that includes at least one of the functions of a data recovery device, a backup source storage device, and a backup destination storage. The storage system may have a volume and a processor, and provide a volume to which data is input and output. The processor may back up the data of the volume as multiple generations of snapshots. The processor can back up snapshots as differential data, which is the difference between snapshots of other generations. When a data restore command is received, the processor may restore one generation of snapshots, restore another generation of snapshots by applying the differential data to the restored snapshot, and then restore other generations of snapshots by applying further differential data to the snapshots restored by applying the differential data, and so on, thereby restoring multiple generations of snapshots. The term "backup" of a snapshot here may correspond to "acquisition" in the embodiments. Also, the term "restore" of a snapshot here may correspond to "revert" in the embodiments.

[0186] The processor may restore snapshots from multiple generations to recreate a second generation of data that is different from the first generation of data recreated for the volume. The first generation and the second generation may be the newer generation.

[0187] The processor may recreate the volume data using full backup data, and then, for each generation of the volume, overwrite the recreated data of that generation with differential backup data from other generations, backing up a snapshot of that generation. This allows the processor to recreate the data of the generation to be restored for the volume and back up snapshots of multiple generations. Note that "generational order" can be from oldest to newest or from newest to oldest. For example, if the first storage has newer generation data and the second storage (the backup source storage) has older generation data, it is expected that recreating from the newer generation data will result in shorter data recovery time.

[0188] Furthermore, for each generation, a "snapshot" is a volume at a specific point in time, and logically, it can be all the data within the volume. Also, for each generation, the "snapshot data" can consist of base data, differential data, and incremental data. "Base data" can be all the data in the volume. "Differential data" can be the data that is the difference from the base data (i.e., differential data in the narrow sense). "Incremental data" can be the data that is the difference updated from the data of the previous generation snapshot, and can be included in the broad sense of differential data. For example, in the above sentence, "The processor restores a snapshot of one generation, and by applying the differential data from the snapshot to the restored snapshot, restores a snapshot of another generation," the "differential data" can be differential data in the broad sense, and can be incremental data. On the other hand, "backup data" can be data that is created and saved on storage that has a primary VOL (e.g., the VVOL mentioned above), and that is used as a unit to move multiple snapshot data together to the backup destination storage. The backup destination storage can be, for example, object storage or file storage, and the data can be read out in units of backup data. "Full backup data" includes the base data and may be sufficient to reproduce the volume's data on its own. "Differential backup data" consists of differential data and may be used to reproduce the data in combination with full backup data (for example, differential backup data in the narrow sense is sufficient). "Incremental backup data" consists of incremental data and may be used to reproduce the data in combination with full backup data and other incremental data, and may be included in the broad sense of differential backup data. [Explanation of symbols]

[0189] 200: Source storage for backup, 300: Backup server, 400: Destination storage for backup, 900: Test storage

Claims

1. In a storage system having memory and a processor, and providing a volume through which data is input and output, The aforementioned processor, The data on the aforementioned volume is backed up as multiple generations of snapshots. The aforementioned snapshot can be backed up as differential data, which is the difference between it and snapshots of other generations. When an instruction to restore the aforementioned data is received, the processor: Restore a snapshot of one generation, By applying the difference data between the restored snapshot and the previous snapshot, a snapshot of a different generation is restored. The process involves repeatedly applying the aforementioned differential data to a restored snapshot, then applying further differential data to restore snapshots of other generations, thereby restoring multiple generations of snapshots. Storage system.

2. The processor restores snapshots corresponding to the second generation to the first generation data in order to reproduce second generation data, which is different from the first generation data reproduced for the volume by restoring the multiple generations of snapshots. The storage system according to claim 1.

3. The processor, after reproducing the data of the volume using the full backup data of the volume, overwrites the reproduced data of the volume with the data of that generation using differential backup data from other generations for each generation in the generational order of the volume, thereby reproducing the data of the generation to be restored for the volume and backing up the snapshots of the multiple generations. The storage system according to claim 1.

4. The processor acquires the full backup data and the differential backup data from the backup source device. The storage system according to claim 3.

5. The aforementioned processor, For the data of the generation reproduced for the aforementioned volume, a determination of whether or not damage was detected is performed as a result of a scan that includes checking whether or not the data is damaged. If the result of the damage assessment is true, in order to reproduce the data of the current generation and another generation, a snapshot corresponding to the other generation is restored to the data of the current generation, and the damage assessment is performed using the data of the other generation as the reproduced generation data. The storage system according to claim 1.

6. The processor determines the other generation from the generation of backed-up data. The storage system according to claim 4.

7. The processor performs a damage determination, which includes checking whether damage was detected as a result of a scan of at least one of the multiple generations of snapshots. The storage system according to claim 1.

8. The aforementioned processor, For the snapshots of the aforementioned multiple generations, the damage determination is performed in parallel. For at least one of the aforementioned generations in which the damage determination was false, the data for that generation is reproduced on the volume by restoring the snapshot corresponding to that generation. The storage system according to claim 7.

9. At least the portion related to the scanning function that performs the aforementioned scan is included in the storage as a storage service in the cloud. The storage system according to claim 8.

10. The aforementioned volume is a volume corresponding to a target virtual server among multiple storage areas managed by a virtualization infrastructure that correspond to multiple virtual servers. The storage system according to claim 1.

11. When backing up data on a volume where data is input and output as multiple generations of snapshots, the snapshots are backed up as differential data, which is the difference between each generation of snapshots. When an instruction is received to restore the aforementioned data, Restore a snapshot of one generation, By applying the difference data between the restored snapshot and the previous snapshot, a snapshot of a different generation is restored. By repeatedly applying the aforementioned differential data to restore a snapshot, and then applying other differential data to restore snapshots of other generations, multiple generations of snapshots can be restored. A memory control method that performs this operation using a computer.

Images