Memory devices, memory systems, data protection methods, and programs

Abstract

When a large volume of abnormal data is supplied, this system quickly and accurately detects the abnormal supply and protects the normal data. [Solution] A duplicate redirect table is generated by duplicating a redirect table that stores location information indicating the location of a storage area that stores the actual data to be read and written via a logical disk, in the order of the data sequence on the logical disk. One of the multiple duplicate redirect tables is used as the source for comparison, and one of the duplicate redirect tables generated after the source is used as the target for comparison. Based on the frequency of occurrence of words in the differential data, which is data stored in the storage area indicated by location information in the target that does not match the location information in the source, and a predetermined frequency threshold, it is determined whether or not a predetermined protection process should be performed when writing to the logical disk.

Description

Technical Field

[0001] The present disclosure relates to a memory device, a memory system, a data protection method, and a program.

Background Art

[0002] Patent Document 1 discloses a storage device that, when detecting access behavior deviating from a steady state in a certain volume, creates backup data or a snapshot image of the volume in another volume, and sets and manages a restore point.

Prior Art Documents

Patent Documents

Patent Document 1

Summary of the Invention

Problems to be Solved by the Invention

[0004] In the technology disclosed in Patent Document 1, the indicators used when detecting access behavior deviating from a steady state are the number of write I / Os (Input / Outputs), the number of read I / Os, the amount of read data, the amount of write data, the compression ratio of read data, the compression ratio of write data, the data compression ratio of the volume, and the capacity increase rate. The reason for using such detection indicators is that in the technology disclosed in Patent Document 1, mainly, cyberattacks of the data destruction type such as ransomware are targeted for detection.

[0005] In contrast, in recent years, there has been an increase in cyberattacks called data poisoning, which intentionally degrade the accuracy of machine learning models. In cyberattacks aimed at data poisoning, large amounts of data containing specific keywords or phrases are supplied to machine learning models. However, it is common for machine learning models to receive a certain amount of data continuously. Therefore, there is a problem in that it is difficult to distinguish with high accuracy between normally supplied data and abnormal data supplied for the purpose of data poisoning using the detection indicators mentioned above. Consequently, there is a challenge in quickly and accurately detecting the supply of abnormal data when a large amount is supplied, and protecting the normal data.

[0006] The purpose of this disclosure is to provide a storage device, a storage system, a data protection method, and a program that solve the aforementioned problems. [Means for solving the problem]

[0007] A storage device according to one aspect of the present disclosure includes: a snapshot processing means that generates a duplicate redirect table by duplicating a redirect table that stores location information indicating the location of a storage area that stores the actual data to be read and written via a logical disk, in the order of the data arrangement on the logical disk; and a monitoring means that uses one of the plurality of duplicate redirect tables as a comparison source and one of the duplicate redirect tables generated later than the comparison source as a comparison target, and determines whether or not to perform a predetermined protection process when writing to the logical disk, based on the frequency of occurrence of words in the differential data which is data stored in the storage area indicated by location information in the location information included in the comparison target that does not match the location information included in the comparison source, and a predetermined frequency threshold.

[0008] A storage system according to one aspect of the present disclosure includes a storage device equipped with a snapshot processing means that generates a duplicate redirect table by duplicating a redirect table that stores location information indicating the location of a storage area that stores the actual data to be read and written via a logical disk in the order of the data arrangement on the logical disk; and an analysis host device that detects words from given data and detects the frequency of occurrence of each detected word in the data, wherein the storage device takes one of the plurality of duplicate redirect tables as a comparison source, one of the duplicate redirect tables generated later than the comparison source as a comparison target, outputs differential data which is data stored in the storage area indicated by location information in the location information included in the comparison target that does not match the location information included in the comparison source, to the analysis host device, obtains the frequency of occurrence of words detected by the analysis host device from the differential data, and determines whether or not to perform a predetermined protection process when writing to the logical disk based on the obtained frequency of occurrence and a predetermined frequency threshold.

[0009] A data protection method according to one aspect of the present disclosure includes: a snapshot processing step of generating a duplicate redirect table by duplicating a redirect table that stores location information indicating the location of a storage area that stores the actual data to be read and written via a logical disk, in the order of the data arrangement on the logical disk; and a monitoring step of determining whether or not to perform a predetermined protection process when writing to the logical disk, based on the frequency of occurrence of words in differential data which is data stored in the storage area indicated by location information in the location information included in the location information included in the comparison source that does not match the location information included in the comparison source, and a predetermined frequency threshold.

[0010] A program according to one aspect of this disclosure is a program for causing a computer to function as a snapshot processing means that generates a duplicate redirect table by duplicating a redirect table that stores location information indicating the location of a storage area that stores the actual data to be read and written via a logical disk, in the order of the data sequence on the logical disk; and a monitoring means that takes one of the plurality of duplicate redirect tables as a comparison source and one of the duplicate redirect tables generated later than the comparison source as a comparison target, and determines whether or not to perform a predetermined protection process when writing to the logical disk, based on the frequency of occurrence of words in the differential data which is data stored in the storage area indicated by location information in the location information included in the comparison target that does not match the location information included in the comparison source, and a predetermined frequency threshold. [Effects of the Invention]

[0011] According to one embodiment described above, when a large amount of abnormal data is supplied, it is possible to quickly and accurately detect such supply and protect normal data. [Brief explanation of the drawing]

[0012] [Figure 1] This block diagram shows an example of the configuration of the memory system related to this disclosure. [Figure 2] This diagram illustrates the relationship between the logical disk, snapshot image, redirection table, and data pool related to this disclosure. [Figure 3] This figure shows an example of a redirect table management table related to this disclosure. [Figure 4] This figure shows an example of a snapshot generation time record table related to this disclosure. [Figure 5] This figure shows an example of a processing conditions table related to this disclosure. [Figure 6] This figure shows an example of a differential record table related to this disclosure. [Figure 7]It is a flowchart showing an example of processing a snapshot by a storage device according to the present disclosure, and an example of processing performed along with the snapshot processing. [Figure 8] It is a flowchart showing an example of processing performed when the storage device according to the present disclosure receives a data write request. [Figure 9] It is a block diagram showing an example of the configuration of a storage system according to the present disclosure. [Figure 10] It is a block diagram showing an example of the hardware configuration of a storage device according to the present disclosure. [Figure 11] It is a block diagram showing an example of the configuration of a storage device according to the present disclosure. [Figure 12] It is a flowchart showing an example of processing by a storage device according to the present disclosure.

Mode for Carrying Out the Invention

[0013] Hereinafter, each embodiment will be described with reference to the drawings. In all the drawings, the same or corresponding components are denoted by the same reference numerals, and common descriptions are omitted.

[0014] <First Embodiment> A storage system 100 according to an embodiment of the present disclosure is a computer system, and as shown in FIG. 1, includes a storage device 1 which is an information processing device (computer), a host device 2, and a maintenance terminal device 3. The host device 2 is, for example, a computer such as a server device, and writes data to the storage device 1 or reads data from the storage device 1. Although not shown in FIG. 1, a plurality of host devices 2 are connected to the storage device 1 via a communication network such as the Internet, and it is also possible to assume a scenario where a user of any one of the host devices 2 maliciously supplies a large amount of abnormal data including a specific word to the storage device 1. The maintenance terminal device 3 is, for example, a computer such as a personal computer, and is used when setting or referring to conditions of processing performed in the storage device 1 with respect to the storage device 1.

[0015] The memory device 1 is a so-called storage device, and includes a data operation unit 11, a snapshot processing unit 12, a monitoring unit 13, a timing unit 17, a maintenance terminal IF (Interface) unit 18, a data pool 21, and a memory unit 22. The monitoring unit 13 includes a difference detection unit 14, a word detection unit 15, and a determination unit 16. The memory unit 22 is a non-volatile memory device, and for example, an HDD (Hard Disk Drive), an SDD (Solid Sate Drive), etc. are applicable. The memory unit 22 stores redirect tables 31, 41, 42, 43, …, a redirect table management table 51, a snapshot generation time recording table 52, a processing condition table 53, and a difference recording table 54.

[0016] Here, while referring to FIG. 2, the relationship among the first logical disk 131, the first snapshot 141, the second snapshot 142, the third snapshot 143, …, the redirect tables 31, 41, 42, 43, … stored in the memory unit 22, and the data pool 21 will be described.

[0017] As a method for backing up data in the memory device 1, for example, a snapshot of the RoW (Redirect-on-Write) method is applied. In the snapshot of the RoW method, the entity of the data is recorded in the data pool 21. The data pool 21 has a storage capacity of, for example, several hundred gigabytes or terabytes, and a plurality of physical disks, etc. that are made to be regarded as a single storage means apparently by a single physical disk or a RAID (Redundant Arrays of Inexpensive Disks) are applied. Here, the physical disk is, for example, an HDD or an SDD, etc.

[0018] The data pool 21 has multiple memory areas, each with the same storage capacity, and data is recorded in an empty memory area that is randomly selected. Each memory area is assigned an address, which is location information indicating its position, and the data stored in each memory area is referenced by this address. Figure 2 shows an example of the data format of the data pool 21, with a two-column data format where the left column is the address and the right column is the memory area, and shows an example where the addresses "00", "01", "02", ... are assigned to each memory area from the beginning.

[0019] Figure 2 shows an example where, for the sake of explanation, two-letter abbreviations such as "FF" and "BB" are stored in some of the memory areas of the data pool 21, and the addresses increase by "1" each time. However, in reality, the storage capacity of one memory area of ​​the data pool 21 is not a small amount like 2 bytes to store two letters, but rather several hundred megabytes or several gigabytes. For example, if one memory area is 5 megabytes, the address will start at "0 [Mbyte]" and increase sequentially thereafter as "5 [Mbyte]", "10 [Mbyte]", and so on.

[0020] The first logical disk 131 is a logical disk appropriately defined as a data management unit in the storage device 1. The actual data on the first logical disk 131 is recorded in one of the storage areas of the data pool 21. A redirect table 31 is generated in the storage unit 22 and associated with the first logical disk 131, storing the addresses of the data pool 21 where the actual data is recorded, in the order of the data arrangement on the first logical disk 131. Although not shown in Figure 2, each section of the redirect table 31 that stores each address of the storage area of ​​the data pool 21 is assigned an address for referencing the address of the data pool 21 storage area stored within that section.

[0021] For example, as shown in Figure 2, the first logical disk 131 at times t0, t1, and t2 are represented as first logical disk 131-t0, 131-t1, and 131-t2, respectively, and the redirect table 31 at times t0, t1, and t2 are represented as redirect table 31-t0, 31-t1, and 31-t2, respectively. The relationship between t0, t1, and t2 representing the times is t2 > t1 > t0.

[0022] Assume that the data in the first logical disk 131-t0 is in the order of "AA", "BB", "CC", "DD", and "EE", as shown in Figure 2. In this case, the redirect table 31-t0 stores the addresses of the storage areas of the data pool 21 that store "AA", "BB", "CC", "DD", and "EE", respectively, "05", "01", "03", "02", and "06", in order from the beginning.

[0023] A Row-of-Work (RoW) snapshot records the state of the first logical disk 131 at a given point in time by duplicating the redirection table 31 of the first logical disk 131, rather than duplicating the actual data. When a snapshot is taken of the first logical disk 131-t0 at time t0, a redirection table 41 is generated, which is a duplicate of redirection table 31-t0, as shown by the vertical arrow. Redirection table 41 is associated with the first snapshot 141, which is a snapshot image of the first logical disk 131-t0 at time t0. Since the redirection table 31-t0 stores addresses of the data pool 21, a Row-of-Work (RoW) snapshot can significantly reduce storage capacity consumption compared to duplicating the actual data.

[0024] When data on the first logical disk 131 is to be rewritten, the RoW method performs the rewrite by overwriting the data. Overwriting means that instead of overwriting the original data with the new data, the original data is left in the data pool 21, a new storage area is allocated in the data pool 21, and the new data is written to the allocated storage area. After the overwriting is performed, the address in the redirection table 31 of the first logical disk 131 that indicates the location of the storage area that stores the original data is rewritten to the address that indicates the location of the storage area to which the new data has been written.

[0025] For example, suppose at time t0, the memory areas corresponding to addresses "00", "04", "07", and "08" in data pool 21 are free. Between time t0 and time t1, suppose the second entry from the top of the first logical disk 131-t0, "BB", is overwritten to "FF", and the fourth entry from the top, "DD", is overwritten to "GG". In this case, for example, the memory area at address "00" in data pool 21 is allocated and the data "FF" is recorded, and the memory area at address "04" is allocated and the data "GG" is recorded. The second entry from the top of redirect table 31-t0, "01", is overwritten to "00", and the fourth entry, "02", is overwritten to "04". Therefore, redirect table 31-t1 will contain "05", "00", "03", "04", and "06" in that order from the top. When data is read from the storage area of ​​data pool 21 indicated by each address in the order of the addresses stored in redirect table 31-t1, the following are obtained: "AA", "FF", "CC", "GG", and "EE", which match the order of the data on the first logical disk 131-t1.

[0026] When a snapshot is taken of the first logical disk 131-t1 at time t1, redirection table 31-t1 is duplicated and redirection table 42 is generated, as shown by the vertical arrow. Redirection table 42 is associated with the second snapshot 142, which is a snapshot image of the first logical disk 131-t1 at time t1.

[0027] For example, suppose that between time t1 and time t2, the leading "AA" in the first logical disk 131 is overwritten to "HH". In this case, for example, the storage area at address "08" in data pool 21 is allocated and the data "HH" is recorded. The leading "05" in redirect table 31-t1 is overwritten to "08". Therefore, redirect table 31-t2 will store "08", "00", "03", "04", and "06" in order from the beginning. If we read the data from the storage area of ​​data pool 21 indicated by each address in the order of the addresses stored in redirect table 31-t2, we obtain "HH", "FF", "CC", "GG", and "EE", which match the order of the data on the first logical disk 131-t2.

[0028] When a snapshot is taken of the first logical disk 131-t2 at time t2, redirection tables 31-t2 are duplicated and redirection table 43 is generated, as indicated by the vertical arrow. Redirection table 43 is associated with the third snapshot 143, which is a snapshot image of the first logical disk 131-t2 at time t2.

[0029] Between time t0 and time t2, the data stored in each of the storage areas of the data pool 21 remains unchanged. Furthermore, redirect tables 41, 42, and 43 are unaffected by data rewrites on the first logical disk 131 and remain unchanged. Therefore, no matter how many times data is rewritten on the first logical disk 131, the data on the first logical disk 131 at each of the times t0, t1, and t2 can be accessed by referring to redirect tables 41, 42, and 43. In this way, by taking multiple snapshots, backups of multiple generations of the first logical disk 131 can be saved as the first snapshot 141, the second snapshot 142, the third snapshot, and so on.

[0030] From time t2 onward, when host device 2 accesses storage device 1, the screen of host device 2 displays that storage device 1 contains the first logical disk 131, the first snapshot 141, the second snapshot 142, and the third snapshot 143. For example, suppose a user of host device 2 selects the first snapshot 141 and performs an operation to read data within a certain address range. In this case, the address of the data pool 21 corresponding to the address range is identified from the redirection table 41 corresponding to the first snapshot 141, and the data stored in the storage area of ​​the data pool 21 indicated by the identified address is output to host device 2.

[0031] Thus, access to the actual data stored in the data pool 21 from the host device 2 is performed via the first logical disk 131, the first snapshot 141, the second snapshot 142, and the third snapshot 143, and through the redirect tables 31, 41, 42, and 43. Hereafter, when referring to any one of the redirect tables 41, 42, 43, ... that are replicated from redirect table 31 by snapshots, it will also be referred to as the replicated redirect table 40.

[0032] As shown in Figure 3, the redirect table management table 51 has the following fields: "Redirect Table Identification Information," "Name," "Source," and "Operation Restrictions." The redirect table management table 51 stores one record for each redirect table that corresponds to that redirect table. The "Redirect Table Identification Information" field records redirect table identification information that identifies each of the redirect tables 31, 41, 42, 43, ... and serves as reference information to the redirect tables 31, 41, 42, 43, ...

[0033] The "Name" field records the name of the logical disk or snapshot image associated with the redirect table identified by the redirect table identification information shown in the "Redirect Table Identification Information" field. This name is used to distinguish whether the redirect table corresponds to a logical disk or a snapshot image. Therefore, the name is generated such that, for example, the name for a logical disk includes the string "Logical Disk," and the name for a snapshot image includes the string "Snapshot." The name recorded in this "Name" field is displayed on the screen of host device 2 when storage device 1 is accessed from host device 2.

[0034] The "Source" field records the name of the logical disk from which the snapshot image is copied. Note that the logical disk is not copied, so the "Source" field is left blank. Figure 3 shows an example where the first snapshot 141, the second snapshot 142, and the third snapshot 143 are each copied from the first logical disk 131, similar to the examples shown in Figures 1 and 2.

[0035] The "Operation Restrictions" section records restrictions on operations performed on logical disks and snapshot images corresponding to the redirect table identifier shown in the "Redirect Table Identifier" section, such as "Write Prohibited" or "Backup Prohibited."

[0036] The snapshot creation time record table 52 has the fields "Name" and "Creation Time," as shown in Figure 4. The "Name" field records the name of the snapshot image, which is the name recorded in the "Name" field of the redirection table management table 51. The "Creation Time" field records the time when each of the replication redirection tables 40 is created.

[0037] As shown in Figure 5, the processing conditions table 53 has the items "snapshot generation interval", "selection conditions", "occurrence frequency threshold", and "protection processing", and the "selection conditions" item has sub-items "detection target data length" and "excluded words".

[0038] The "Snapshot Generation Interval" field records the time interval at which snapshots are taken. The "Detection Target Data Length" field, a sub-item of the "Selection Criteria" field, records the threshold data length, which indicates the acceptable data length for a word selected from multiple words. The "Excluded Words" field, another sub-item of the "Selection Criteria" field, records the words that are not selected from multiple words. Hereafter, the threshold data length and excluded words will be collectively referred to as the selection criteria.

[0039] The "Frequency Threshold" field records the frequency threshold used to determine whether the frequency of a word's occurrence indicates the occurrence of a cyberattack. The unit of the frequency threshold is, for example, the number of occurrences per minute. The "Protection Action" field records the predetermined protection action that will be applied when a cyberattack is determined to have occurred, at the time of writing data to the logical disk from which the snapshot image being analyzed is copied.

[0040] As shown in Figure 6, the difference recording table 54 has the following items: "Comparison target", "Comparison target generation time", "Comparison source", "Comparison source generation time", "Difference address", "Detected word", "Number of occurrences", and "Occurrence frequency". The "Comparison target" item records the name of the snapshot image to be compared, which is recorded in the "Name" item of the redirect table management table 51. The "Comparison target generation time" item records the time recorded in the "Generation time" item of the snapshot generation time recording table 52, which is the time when the replica redirect table 40 corresponding to the snapshot image with the name shown in the "Comparison target" item is generated.

[0041] The "Source" field records the name of the snapshot image used for comparison, which is recorded in the "Name" field of the redirect table management table 51. The "Target Generation Time" field records the time recorded in the "Generation Time" field of the snapshot generation time recording table 52, which is the time when the replicated redirect table 40 corresponding to the snapshot image with the name indicated in the "Source" field is generated.

[0042] As shown in Figure 6, one record in the differential record table 54 is generated from two consecutive snapshot images in chronological order. The "Source" and "Source Generation Time" fields record information corresponding to the older snapshot image, i.e., the snapshot image generated first in chronological order, while the "Target" and "Target Generation Time" fields record information corresponding to the newer snapshot image, i.e., the snapshot image generated later in chronological order. When two snapshots are taken, the first record in the differential record table 54 is generated, and thereafter, each time a snapshot is taken, the number of records in the differential record table 54 increases.

[0043] The "Difference Address" field records addresses in the replication redirect table 40 corresponding to the snapshot image with the name indicated in the "Comparison Target" field that do not match the addresses in the replication redirect table 40 corresponding to the snapshot image with the name indicated in the "Comparison Source" field (hereinafter also referred to as difference addresses). A difference address is an address that is included in the replication redirect table 40 corresponding to the comparison target snapshot image, but not in the replication redirect table 40 corresponding to the comparison source snapshot image. More specifically, the difference address is the address of the storage area of ​​the data pool 21 that stores data that has been added to or rewritten on the source logical disk between the time the comparison source snapshot image is generated and the time the comparison target snapshot image is generated. Hereinafter, the data stored in the storage area of ​​the data pool 21 indicated by the difference address in the "Difference Address" field will also be referred to as difference data. If multiple difference addresses are stored in the "Difference Address" field, the data that combines the multiple data stored in each of the storage areas of the data pool 21 indicated by each difference address will be referred to as difference data.

[0044] The "Detected Words" field records words that are frequently detected from the difference data derived from the difference addresses shown in the "Difference Addresses" field, and that are selected according to the selection conditions shown in the "Selection Conditions" of the processing condition table 53.

[0045] The "Number of Occurrences" column records the number of times the word shown in the "Detected Word" column appears in the differential data of the source from which the word was detected. The "Frequency of Occurrences" column records the frequency of occurrence, which is calculated based on the difference between the number of occurrences shown in the "Number of Occurrences" column and the times shown in the respective "Comparison Target Generation Time" and "Comparison Source Generation Time" columns. For example, the frequency of occurrence is recorded as the number of occurrences per minute.

[0046] As shown in the first row of the difference record table 54 in Figure 6, the "Detected Word" field may contain multiple words. When multiple words are recorded in the "Detected Word" field, the "Number of Occurrences" and "Frequency of Occurrence" fields will each record the number of occurrences and frequency of occurrence corresponding to each word shown in the "Detected Word" field.

[0047] The data manipulation unit 11 is connected to the host device 2 and receives data read requests and data write requests from the host device 2 for any of the first logical disk 131, first snapshot 141, second snapshot 142, third snapshot 143, ... The data manipulation unit 11 reads data from the data pool 21 or writes data via redirection tables 31, 41, 42, 43, ... in response to requests received from the host device 2.

[0048] The snapshot processing unit 12 performs snapshot processing. In the monitoring unit 13, the difference detection unit 14 compares the snapshot image corresponding to the name shown in the "comparison target" item of the difference recording table 54 with the snapshot image corresponding to the name shown in the "comparison source" item, and detects the difference address to be recorded in the "difference address" item.

[0049] The word detection unit 15 detects frequently occurring words from the difference data derived from the difference addresses stored in the "Difference Address" column of the difference recording table 54, based on a predetermined algorithm. For example, TF-IDF (Term Frequency-Inverse Document Frequency) or BoW (Bag-of-Words) may be applied as the predetermined algorithm. The word detection unit 15 selects a word from the frequently occurring words it detects according to the selection conditions shown in the "Selection Conditions" column of the processing condition table 53, and records the selected word in the "Detected Word" column of the difference recording table 54. The word detection unit 15 detects the number of times the selected word appears in the difference data from which the word was detected, and records the detected number of occurrences in the "Number of Occurrences" column of the difference recording table 54. The word detection unit 15 calculates the frequency of occurrence based on the detected number of occurrences and the difference in the time shown in the "Comparison Target Generation Time" and "Comparison Source Generation Time" columns of the record in the difference recording table 54 corresponding to the number of occurrences. The word detection unit 15 records the calculated frequency of occurrence in the "frequency of occurrence" column of the difference recording table 54.

[0050] The determination unit 16 compares the frequency of occurrence shown in the "Occurrence Frequency" item of the differential recording table 54 with the occurrence frequency threshold shown in the "Occurrence Frequency Threshold" item of the processing condition table 53. Based on the comparison result, the determination unit 16 determines whether or not to perform the predetermined protection processing shown in the "Protection Processing" item of the processing condition table 53 when data is written to the logical disk that is the source of the snapshot image to be determined.

[0051] The timekeeping unit 17 is, for example, a clock, and when it receives a time acquisition request signal from another functional unit, it outputs the time at the time the time request signal was received to the requesting functional unit. The maintenance terminal IF unit 18 is connected to the storage unit 22 and the maintenance terminal device 3, and records data contained in the signals output by the maintenance terminal device 3 in the processing condition table 53 of the storage unit 22.

[0052] (Processing by memory) The processing performed by memory device 1 will be explained with reference to Figures 7 and 8.

[0053] (Snapshot processing, and processes performed in conjunction with snapshot processing) Assuming that the process shown in Figure 7 is performed, the storage device 1 is in the following state: The memory unit 22 has generated a redirect table 31 corresponding to the first logical disk 131, but no snapshot has ever been taken for the first logical disk 131. The data pool 21 stores the actual data of the first logical disk 131. The redirect table management table 51 has generated a record that is the first row record shown in Figure 3, with the "operation restriction" field blank. The processing condition table 53 has the contents shown in Figure 5. The snapshot generation time record table 52 and the difference record table 54 are assumed to be empty.

[0054] The snapshot processing unit 12 starts up, for example, when the storage device 1 starts up, and the process shown in Figure 7 begins. The snapshot processing unit 12 performs the snapshot processing in the following procedure. The snapshot processing unit 12 detects records from the redirect table management table 51 in which the "Name" field of the redirect table management table 51 contains a string that includes "logical disk". Here, the snapshot processing unit 12 detects the first record in the redirect table management table 51 in which the "Name" field contains "First Logical Disk". The snapshot processing unit 12 reads the "01" stored in the "Redirect Table Identification Information" field of the detected record, and based on the read "01", detects the redirect table 31 from the storage unit 22. The snapshot processing unit 12 duplicates the detected redirect table 31 and generates the redirect table 41 in the storage unit 22.

[0055] The snapshot processing unit 12 generates new redirect table identification information that is different from all the redirect table identification information stored in the "Redirect Table Identification Information" field of the redirect table management table 51. Here, let's assume that the snapshot processing unit 12 generates "02" as the new redirect table identification information. The snapshot processing unit 12 creates one record in the redirect table management table 51 and records the generated redirect table identification information "02" in the "Redirect Table Identification Information" field of the created record. The snapshot processing unit 12 associates the redirect table identification information "02" with the redirect table 41 and uses the redirect table identification information "02" as reference information to the redirect table 41.

[0056] The snapshot processing unit 12 records "First Logical Disk," which is the name of the source logical disk in the redirect table 41, in the "Source" field of the record it generates in the redirect table management table 51, and initializes the "Operation Restriction" field to blank. The snapshot processing unit 12 generates a name for the snapshot image associated with the redirect table 41, a name that can identify the generation, for example, "First Snapshot." The snapshot processing unit 12 records "First Snapshot," the generated name, in the "Name" field of the record it generates in the redirect table management table 51.

[0057] The snapshot processing unit 12 creates one record in the snapshot creation time recording table 52 and records the created name, "First Snapshot," in the "Name" field of the created record. The snapshot processing unit 12 outputs a time acquisition request signal to the timing unit 17 and acquires the time output by the timing unit 17. Here, let's assume that the snapshot processing unit 12 acquired the time, for example, "2024 / 9 / 16 02:00:00." The snapshot processing unit 12 records the acquired time, "2024 / 9 / 16 02:00:00," in the "Creation Time" field of the created record in the snapshot creation time recording table 52.

[0058] The snapshot processing unit 12 reads the time interval at which snapshots are taken, which is stored in the "Snapshot Generation Interval" item from the processing condition table 53. The snapshot processing unit 12 has an internal timer, and sets the read snapshot interval time length to the timer and starts the timer. The snapshot processing unit 12 outputs a difference detection instruction signal containing the string "First Logical Disk" to the difference detection unit 14 (Sa1).

[0059] When the difference detection unit 14 receives a difference detection instruction signal from the snapshot processing unit 12, it reads the "first logical disk" included in the difference detection instruction signal. The difference detection unit 14 detects all records from the redirection table management table 51 in which the read "first logical disk" is stored in the "source" column of the redirection table management table 51. In this case, only the second row record stores the "first logical disk" in the "source" column of the redirection table management table 51, so the difference detection unit 14 detects the second row record (Sa2). If the difference detection unit 14 cannot detect two or more records from the redirection table management table 51, it cannot detect the difference address. Therefore, the difference detection unit 14 proceeds to the process in Sa3 to determine whether or not the difference address has been detected (Sa3), and in the process in Sa3, it determines that the difference address has not been detected (Sa3, No).

[0060] If the difference detection unit 14 determines "No" in the processing of Sa3, it terminates the process and then proceeds to the processing of Sa6. The snapshot processing unit 12 waits until its internal timer expires (Sa6), and once the timer expires, it performs the processing of Sa1 again.

[0061] Assume that the snapshot processing unit 12 performs the second processing of Sa1, generating a redirect table 42 in the storage unit 22, creating the third record shown in Figure 3 in the redirect table management table 51, and creating the second record shown in Figure 4 in the snapshot generation time record table 52. The snapshot processing unit 12 outputs a difference detection instruction signal including "first logical disk" to the difference detection unit 14.

[0062] When the difference detection unit 14 receives a difference detection instruction signal from the snapshot processing unit 12, it performs the second Sa2 process. At the time of the second Sa2 process, records up to the third row have been generated in the redirect table management table 51. Therefore, the difference detection unit 14 detects the second and third rows of records from the redirect table management table 51, where the read "first logical disk" is stored in the "Replication Source" column of the redirect table management table 51.

[0063] The difference detection unit 14 retrieves the generation times corresponding to "First Snapshot" and "Second Snapshot," which are stored in the "Name" field of the two detected records, from the snapshot generation time record table 52. In this case, the snapshot generation time record table 52 contains the records shown in the first and second rows of Figure 4. Therefore, the difference detection unit 14 detects "2024 / 9 / 16 02:00:00" for "First Snapshot" and "2024 / 9 / 17 02:00:00" for "Second Snapshot."

[0064] The difference detection unit 14 generates one record in the difference recording table 54. Based on the detected generation time, the difference detection unit 14 determines that the second snapshot 142 was generated later in chronological order than the first snapshot 141. Therefore, the difference detection unit 14 records "Second Snapshot" in the "Comparison Target" field of the generated record in the difference recording table 54, records "2024 / 9 / 17 02:00:00" in the "Comparison Target Generation Time" field, records "First Snapshot" in the "Comparison Source" field, and records "2024 / 9 / 16 02:00:00" in the "Comparison Source Generation Time" field.

[0065] The difference detection unit 14 detects the second row record in the redirect table management table 51 in which the "Name" field of the redirect table management table 51 contains the "First Snapshot" of the comparison source. Based on the "02" stored in the "Redirect Table Identification Information" field of the detected record, the difference detection unit 14 detects the redirect table 41 from the storage unit 22.

[0066] The difference detection unit 14 detects the third row record in the redirect table management table 51 in which the "Name" field of the redirect table management table 51 contains the "Second Snapshot" of the comparison target. Based on the "03" stored in the "Redirect Table Identification Information" field of the detected record, the difference detection unit 14 detects the redirect table 42 from the storage unit 22.

[0067] The difference detection unit 14 detects addresses in the redirect table 42 of the comparison target that are not shown in the redirect table 41 of the comparison source. For example, if the redirect tables 41 and 42 are as shown in Figure 2, the difference detection unit 14 detects the second "00" and the fourth "04" from the beginning of the redirect table 42. The difference detection unit 14 records the detected "00" and "04" in the "Difference Address" field of the record generated in the difference recording table 54 (Sa2).

[0068] The difference detection unit 14 determines whether or not it has detected a difference address (Sa3). Here, the difference detection unit 14 has detected "00" and "04" as difference addresses, so it determines that it has detected a difference address (Sa3, Yes) and outputs a word detection instruction signal including the "second snapshot" to be compared to to the word detection unit 15.

[0069] When the word detection unit 15 receives a word detection instruction signal from the difference detection unit 14, it reads the "second snapshot" included in the received word detection instruction signal. The word detection unit 15 detects the first row record containing the read "second snapshot" in the difference recording table 54 and places it in the "comparison target" field of the difference recording table 54. The word detection unit 15 reads the data stored in the storage area of ​​the data pool 21 indicated by the addresses "00" and "04" shown in the "difference address" field of the first row record of the detected difference recording table 54, and uses the read data as difference data.

[0070] In the example of the data pool 21 shown in Figure 2, the word detection unit 15 reads "FF" from the memory area indicated by address "00" and reads "GG" from the memory area indicated by address "04". However, as mentioned above, "FF" and "GG" are just examples of data, and in reality, the storage capacity of one memory area in the data pool 21 is several hundred megabytes or several gigabytes. Therefore, the word detection unit 15 reads data of an amount equal to "(storage capacity of one memory area in the data pool 21) × 2" and uses the read data as differential data. The word detection unit 15 detects frequently occurring words from the differential data based on a predetermined algorithm (Sa4).

[0071] The word detection unit 15 determines whether or not one or more words have been detected (Sa5). If the word detection unit 15 determines that there are not one or more words detected (Sa5, No), it terminates the process and then proceeds to process Sa6. On the other hand, suppose the word detection unit 15 determines that there are one or more words detected (Sa5, Yes). In this case, the word detection unit 15 selects the detected words one by one and repeats the processes from Sa7 to Sa10 for each selected word.

[0072] The word detection unit 15 determines whether the data length of the selected word is equal to or greater than the threshold data length indicated in the "Data Length to be Detected" item of the processing condition table 53 (Sa7). For example, if it is possible to estimate the minimum data length of a specific keyword or phrase supplied during a data poisoning cyberattack, setting that minimum value as the threshold data length will allow the detection to narrow down to words with a high probability of being involved in a cyberattack.

[0073] If the word detection unit 15 determines that the data length of the selected word is equal to or greater than the threshold data length (Sa7, Yes), it then determines whether the selected word does not match any of the excluded words listed in the "excluded words" section of the processing condition table 53 (Sa8). For example, by excluding words that are not expected to be specific keywords or phrases supplied during a data poisoning cyberattack, the system can narrow down the search to words that are highly likely to be involved in a cyberattack.

[0074] The word detection unit 15 determines that the selected word does not match any of the excluded words (Sa8, Yes). In this case, the word detection unit 15 detects the number of occurrences of the selected word in the differential data used in the processing of Sa4 (Sa9). The word detection unit 15 calculates the time difference between the generation times of the first snapshot 141 and the second snapshot 142 by subtracting the time shown in the "comparison target generation time" item from the time shown in the "comparison target generation time" item of the first row record detected from the differential record table 54 in the processing of Sa4. The word detection unit 15 calculates the occurrence frequency by dividing the number of occurrences detected in the processing of Sa9 by the calculated time difference between the generation times of the first snapshot 141 and the second snapshot 142. Note that the unit of this time difference needs to match the unit of the occurrence frequency threshold stored in the "occurrence frequency threshold" item of the processing condition table 53, so here it is in "minutes".

[0075] The word detection unit 15 records the selected word in the "Detected Word" field of the first row record detected from the differential record table 54 during the processing of Sa4. The word detection unit 15 also records the detected number of occurrences in the "Occurrence Count" field of the record associated with the word, and records the calculated occurrence frequency in the "Occurrence Frequency" field (Sa10).

[0076] The word detection unit 15, in the process of Sa7, determines if the data length of the selected word is not equal to or greater than the threshold data length (Sa7, No), in the process of Sa8, determines if the selected word matches any of the excluded words (Sa8, Yes), and after the process of Sa10, selects the next word and repeats the process from Sa7 onwards (loop La1s~La1e). If there is no word to select, the word detection unit 15 terminates the processing of loop La1s~La1e and outputs a determination instruction signal to the determination unit 16 that includes the "second snapshot" to be compared.

[0077] For example, in the processing of Sa4, suppose the word detection unit 15 detects two frequently occurring words: "abcdefgh" and "OPSRSTUV". The word detection unit 15 processes each of the two detected words in the loop La1s to La1e. As a result, suppose the word detection unit 15 detects that the word "abcdefgh" has an occurrence count of "7200" and the word "OPSRSTUV" has an occurrence count of "10000", as shown in Figure 6. The time difference between the generation times of the first snapshot 141 and the second snapshot 142 calculated by the word detection unit 15 is "24 hours", or "1440 minutes". Therefore, the word detection unit 15 calculates the occurrence frequency of the word "abcdefgh" as "5" by dividing "7200" by "1440". The word detection unit 15 calculates the occurrence frequency of the word "OPSRSTUV" as "7" by dividing "10000" by "1440". In this case, the first record in the difference recording table 54 will be as shown in Figure 6.

[0078] When the determination unit 16 receives a determination instruction signal from the word detection unit 15, it reads the "second snapshot" included in the received determination instruction signal. The determination unit 16 detects the first row record containing the read "second snapshot" from the differential record table 54 and places it in the "comparison target" item of the differential record table 54. The determination unit 16 determines whether any of the occurrence frequencies indicated in the "occurrence frequency" item of the detected record is equal to or greater than the occurrence frequency threshold indicated in the "occurrence frequency threshold" item of the processing condition table 53 (Sa11).

[0079] Here, the occurrence frequencies of the first row of records detected by the determination unit 16 from the differential record table 54 are "5" and "7", and the occurrence frequency threshold indicated in the "occurrence frequency threshold" item of the processing condition table 53 is "100". Therefore, the determination unit 16 determines that neither occurrence frequency is equal to or less than the occurrence frequency threshold (Sa11, No), terminates processing, and then proceeds to processing Sa6. The snapshot processing unit 12 waits until its internal timer expires (Sa6), and once the timer expires, it performs processing Sa1 again.

[0080] Assume that when the snapshot processing unit 12 performs the third Sa1 process, a redirect table 43 is generated in the storage unit 22, the fourth record shown in Figure 3 is generated in the redirect table management table 51, and the third record shown in Figure 4 is generated in the snapshot generation time record table 52. The snapshot processing unit 12 outputs a difference detection instruction signal (Sa1) to the difference detection unit 14, which includes "first logical disk".

[0081] When the difference detection unit 14 receives a difference detection instruction signal from the snapshot processing unit 12, it performs the third Sa2 process. At the time of the third Sa2 process, records up to the fourth row have been generated in the redirect table management table 51. Therefore, the difference detection unit 14 detects the records in the second, third, and fourth rows of the redirect table management table 51, where the read "first logical disk" is stored in the "source" column of the redirect table management table 51.

[0082] When the difference detection unit 14 detects two or more records from the redirect table management table 51, it selects the record corresponding to the latest snapshot image in chronological order and the record corresponding to the snapshot image immediately preceding the latest snapshot image in chronological order. Here, the difference detection unit 14 compares the generation times of the snapshot images corresponding to the 2nd, 3rd, and 4th rows of records detected from the redirect table management table 51 based on the generation times stored in the snapshot generation time record table 52. As a result of the comparison, the difference detection unit 14 selects the record in the 4th row of the redirect table management table 51 as the record corresponding to the latest snapshot image in chronological order, and the record in the 3rd row of the redirect table management table 51 as the record corresponding to the snapshot image immediately preceding the latest snapshot image.

[0083] The difference detection unit 14 performs the same processing on the records in the third and fourth rows of the redirect table management table 51 as it did on the records in the second and third rows of the redirect table management table 51. As a result, the second row of the difference record table 54 shown in Figure 6 is generated, and the contents of the items "comparison target", "comparison target generation time", "comparison source", "comparison source generation time", and "difference address" in that record become as shown in Figure 6 (Sa2). Here, as shown in Figure 6, the difference detection unit 14 detects one difference address "08", so in the processing of Sa3, it determines that a difference address has been detected (Sa3, Yes) and outputs a word detection instruction signal including the "third snapshot" of the comparison target to the word detection unit 15.

[0084] When the word detection unit 15 receives a word detection instruction signal from the difference detection unit 14, it performs the second Sa4 process and determines that it has detected one or more frequently occurring words (Sa4). In this case, the word detection unit 15 determines that one or more words have been detected (Sa5, Yes), and performs the loop La1s to La1e process for each detected word.

[0085] The processing in loops La1s to La1e results in, for example, the second row of the differential recording table 54 having the content shown in Figure 6, and the word detection unit 15 outputs a judgment instruction signal to the judgment unit 16 that includes the "third snapshot" of the comparison target. When the judgment unit 16 receives the judgment instruction signal from the word detection unit 15, it performs the second Sa11 process. The judgment unit 16 reads the "third snapshot" included in the judgment instruction signal received from the word detection unit 15. The judgment unit 16 detects the second row of the differential recording table 54, which includes the read "third snapshot," in the "comparison target" item of the differential recording table 54. The judgment unit 16 determines whether any of the occurrence frequencies shown in the "occurrence frequency" item of the detected record is equal to or greater than the occurrence frequency threshold shown in the "occurrence frequency threshold" item of the processing condition table 53 (Sa11).

[0086] Here, the occurrence frequency shown in the "Occurrence Frequency" item of the second record detected by the determination unit 16 from the difference record table 54 is "278", and the occurrence frequency threshold shown in the "Occurrence Frequency Threshold" item of the processing condition table 53 is "100". Therefore, the determination unit 16 determines that the occurrence frequency is equal to or greater than the occurrence frequency threshold (Sa11, Yes).

[0087] In this case, the determination unit 16 detects the fourth row record in the redirect table management table 51, which stores the "third snapshot" read from the determination instruction signal in the "Name" field of the redirect table management table 51. The determination unit 16 reads the "first logical disk" stored in the "Source" field of the detected record. The determination unit 16 detects the first row record in the redirect table management table 51, which stores the read "first logical disk" in the "Name" field of the redirect table management table 51.

[0088] The determination unit 16 records "Write prohibited," which is stored in the "Protection Processing" field of the processing condition table 53, in the "Operation Restriction" field of the first row record of the detected redirect table management table 51 (Sa12). The determination unit 16 records "Backup not possible" in the "Operation Restriction" field of the fourth row record detected from the redirect table management table 51 (Sa13), and then terminates the process.

[0089] In the processing of Sa11 in Figure 7, if the determination unit 16 determines "Yes", it is necessary to stop the snapshot for the first logical disk 131, so one of the following methods is applied. For example, if the determination unit 16 determines "Yes" in the processing of Sa11, it notifies the snapshot processing unit 12 of the redirect table identification information "01" for the first logical disk 131 whose snapshot should be stopped. The snapshot processing unit 12 records the redirect table identification information "01" notified by the determination unit 16 in its internal storage area, and in the processing of Sa1, if the redirect identification information detected from the redirect table management table 51 matches the redirect identification information stored in the internal storage area, it stops further processing.

[0090] Alternatively, the snapshot processing unit 12 may be modified as follows to stop snapshots of the first logical disk 131. In the processing of Sa1 in Figure 7, the snapshot processing unit 12 is made to detect records in the redirection table management table 51 where the "Name" field contains a string including "logical disk" and the "Operation Restriction" field is blank. In this way, when "Write Prohibited" or "Alert Notification" is written to the "Operation Restriction" field, the logical disk corresponding to the written record will no longer be detected by the snapshot processing unit 12 in the processing of Sa1, and snapshots can be stopped.

[0091] The flowchart in Figure 7 shows that if a "No" result is obtained in the processes of Sa3, Sa5, and Sa11, the process proceeds to Sa6. The time length stored in the "Snapshot Generation Interval" item of the processing condition table 53 shown in Figure 5 is generally set to be sufficiently longer than the time required for the series of processes from Sa2 to Sa13. Therefore, the timer will not expire and Sa1 will not be processed before a "No" result is obtained in the processes of Sa3, Sa5, and Sa11. However, the snapshot processing unit 12 does not start the process of Sa1 in response to a "No" result in the processes of Sa3, Sa5, and Sa11, but rather autonomously starts the process of Sa1 when the timer expires. Therefore, depending on the size of the time length stored in the "Snapshot Generation Interval" item, it is possible that the next process, Sa1, may start while the series of processes from Sa2 to Sa13 are being performed. In this case, the series of processes from Sa2 to Sa13 will be performed in parallel.

[0092] (Processing performed when a data write request is received) Figure 8 is a flowchart showing the processing flow when the storage device 1 receives a data write request signal to the logical disk from the host device 2. For example, suppose the host device 2 outputs a write request signal to the storage device 1 that includes the name of the first logical disk 131, "First Logical Disk," the data to be written, and the address indicating the writing location. When the data manipulation unit 11 of the storage device 1 receives the write request signal output by the host device 2, it reads "First Logical Disk," the data to be written, and the address from the received write request signal (Sb1).

[0093] The data manipulation unit 11 detects the first record in the redirection table management table 51 of the storage unit 22, in which the read "first logical disk" is stored in the "Name" field. The data manipulation unit 11 then checks whether the first logical disk 131 corresponding to the read "first logical disk" is in a write-protected state by checking whether "write-protected" is stored in the "operation restriction" field of the detected record (Sb2).

[0094] If the data manipulation unit 11 detects that "write prohibited" is stored in the "operation restriction" field of the detected record, it determines that the first logical disk 131 corresponding to the read "first logical disk" is in a write-prohibited state (Sb2, Yes), outputs a "write error" message to the host device 2 (Sb3), and terminates the process.

[0095] On the other hand, if the data manipulation unit 11 detects that "write prohibited" is not stored in the "operation restriction" field of the detected record, it determines that the first logical disk 131 corresponding to the read "first logical disk" is not in a write-prohibited state (Sb2, No). In this case, the data manipulation unit 11 secures an empty storage area in the data pool 21. The data manipulation unit 11 records the read write data in the secured storage area and obtains the address of the storage area in the data pool 21 where the write data was recorded. The data manipulation unit 11 reads "01" stored in the "redirect table identification information" field of the first row record detected from the redirect table management table 51. Based on the read redirect table identification information "01", the data manipulation unit 11 detects the redirect table 31 from the storage unit 22. In the detected redirect table 31, the data manipulation unit 11 rewrites the address of the data pool 21 stored in the section indicated by the address read from the write request signal to the address of the storage area in the data pool 21 where the write data was recorded (Sb4), and terminates the process.

[0096] In the above explanation, when the host device 2 accesses the storage device 1, the names of the logical disks and snapshot images shown in the "Name" column of the redirection table management table 51 are displayed on the screen of the host device 2. Alternatively, the contents stored in the "Operation Restrictions" column, associated with the names of the logical disks and snapshot images shown in the "Name" column of the redirection table management table 51, may be displayed on the screen of the host device 2. In this way, the user of the host device 2 can confirm that the first logical disk 131 is in a write-protected state and that the third snapshot 143 is in a backup-unavailable state.

[0097] Furthermore, if a record with "Backup Not Possible" stored in the "Operation Restrictions" field is stored in the redirect table management table 51, the data manipulation unit 11 may, upon receiving a signal from the host device 2 requesting to back up data from the snapshot image corresponding to that record, output a message to the host device 2 indicating "Backup Not Possible" without performing the backup.

[0098] (Effects and effects of memory devices) In the storage device 1, the monitoring unit 13 uses one of the multiple duplicate redirect tables 40 replicated from the redirect table 31 of the first logical disk 131 as the comparison source, and the duplicate redirect table 40 generated one step later than the comparison source as the comparison target. Based on the frequency of occurrence of words in the differential data, which is data stored in the storage area of ​​the data pool 21 indicated by addresses in the comparison target that do not match the addresses in the comparison source, and an occurrence frequency threshold, the monitoring unit 13 determines whether or not to prohibit writing to the first logical disk 131. When a large amount of abnormal data containing specific keywords or phrases is supplied, such as in a data poisoning cyberattack, the frequency of occurrence of those specific words in the data written to the storage device 1 increases. In order to quickly and accurately detect such specific words, the storage device 1 focuses on the differential data to detect the frequency of occurrence of those specific words. If the detected frequency of occurrence exceeds, for example, the occurrence frequency threshold, the monitoring unit 1 determines that a cyberattack may be occurring and prohibits writing data to the first logical disk 131. Therefore, by using the storage device 1, when a large amount of abnormal data is supplied, it is possible to quickly and accurately detect such supply and protect normal data.

[0099] Furthermore, in the storage device 1, in the replicated redirect table 40 replicated from the redirect table 31 of the first logical disk 131, information indicating "backup not possible" is recorded in relation to the replicated redirect table 40 that was compared to the first logical disk 131, which was the basis for determining that writing data to the first logical disk 131 should be prohibited. Therefore, it is also possible to restore the first logical disk 131 before a large amount of abnormal data was supplied using the replicated redirect table 40 that was replicated immediately before the replicated redirect table 40 that contains the "backup not possible" information.

[0100] <Second Embodiment> A storage system 100a according to one embodiment of the present disclosure, as shown in Figure 9, comprises a storage device 1a, a host device 2, a maintenance terminal device 3, and an analysis host device 4. The storage device 1a comprises a data manipulation unit 11a, a snapshot processing unit 12, a monitoring unit 13a, a timing unit 17, a maintenance terminal IF unit 18, an analysis host IF (Interface) unit 19, a data pool 21, and a storage unit 22. The monitoring unit 13a comprises a difference detection unit 14 and a determination unit 16.

[0101] The analysis host device 4 includes a word detection unit 15a and a cache memory 25. The analysis host IF 19 provided in the storage device 1a connects the word detection unit 15a, the monitoring unit 13a, and the storage unit 22 of the analysis host device 4. The analysis host device 4 is connected to the data manipulation unit 11a.

[0102] When the difference detection unit 14 of the monitoring unit 13a of the storage device 1a determines "Yes" in the process of Sa3 in Figure 7, it outputs a word detection instruction signal including the name of the comparison target snapshot image to the word detection unit 15a via the analysis host IF19. When the word detection unit 15a receives the word detection instruction signal from the difference detection unit 14 via the analysis host IF19, it performs the following processing as the process of Sa4.

[0103] The word detection unit 15a outputs the word detection instruction signal received from the difference detection unit 14 to the data manipulation unit 11a. When the data manipulation unit 11a receives the word detection instruction signal from the word detection unit 15a, it reads out the name of the snapshot image included in the received word detection instruction signal. The data manipulation unit 11a finds a record in the difference recording table 54 that contains the name of the read snapshot image in the "comparison target" item of the difference recording table 54. The data manipulation unit 11a reads the data stored in the storage area of ​​the data pool 21 indicated by the address shown in the "difference address" item of the detected record in the difference recording table 54, and uses the read data as difference data.

[0104] The data manipulation unit 11a outputs the differential data to the analysis host device 4. The cache memory 25 of the analysis host device 4 receives and stores the differential data output by the data manipulation unit 11a. When the word detection unit 15a detects that the cache memory 25 has stored the differential data, it detects frequently occurring words from the differential data stored in the cache memory 25 based on a predetermined algorithm, similar to the word detection unit 15. Subsequently, the word detection unit 15a performs the same processing as the Sa5 processing and the loop La1s~La1e processing performed by the word detection unit 15. When the loop La1s~La1e processing is completed, the word detection unit 15a outputs a judgment instruction signal including the name of the comparison target snapshot image to the judgment unit 16 via the analysis host IF unit 19. After that, the processing from Sa11 onwards is performed.

[0105] The difference between memory system 100 and memory system 100a is that in memory system 100, the storage device 1 has a word detection unit 15 in its internal monitoring unit 13, whereas in memory system 100a, the analysis host device 4 has a word detection unit 15a. Therefore, in addition to the effects obtained by memory system 100, memory system 100a has the effect of reducing the processing load on storage device 1a because it can have the processing of Sa4, Sa5 and loop La1s~La1e in Figure 7 performed by the analysis host device 4, which is different from storage device 1a.

[0106] <Regarding other configuration examples> In the processing conditions table 53 of Figure 5, "Alert notification" may be stored in the "Protection processing" item instead of "Write prohibition" as a predetermined protection processing, and the data manipulation units 11,11a may be connected to the maintenance terminal IF unit 18. In this case, when the processing of Sa12 is performed, "Alert notification" will be recorded in the "Operation restriction" item of the record in the redirect table management table 51 corresponding to the logical disk from which the snapshot image to be processed is copied. The processing of Sb2 in Figure 8 is the processing in which "Write prohibition" is read as "Alert notification". When the data manipulation units 11,11a perform the processing of Sb2 in which "Write prohibition" is read as "Alert notification" and make a "Yes" judgment, in the processing of Sb3, for example, they output an alert signal to the maintenance terminal device 3 via the maintenance terminal IF unit 18 that includes information indicating the logical disk to which data is to be written. When the maintenance terminal device 3 receives the alert signal from the data manipulation units 11,11a, it displays alert information on the screen, for example, indicating that the logical disk may be under cyberattack, based on the information indicating the logical disk included in the received alert signal. This allows the maintenance personnel to know if the logical disk may be under cyberattack. In the case of "alert notification," the Sb3 process may include both the output of an alert signal and the Sb4 process, i.e., the data writing process. Alternatively, both "write protection" and "alert notification" may be stored in the "protection process" item. In this case, writing data to the logical disk will be prohibited, and an alert signal will be output to the maintenance terminal device 3.

[0107] The examples shown in Figures 1 and 9 illustrate a scenario where there is one logical disk, the first logical disk 131. However, it is possible to define multiple logical disks in the storage device 1,1a. In this case, a record corresponding to each of the multiple logical disks will be generated in the redirection table management table 51. When multiple logical disks exist, the snapshot processing unit 12 takes a snapshot for each of the multiple logical disks, and is equipped with a timer corresponding to each of the multiple logical disks. The processing in Figure 7 will be performed in parallel for each of the multiple logical disks.

[0108] The difference detection unit 14, when a new replica redirect table 40 is generated by the snapshot processing unit 12, uses the generated replica redirect table 40 as the comparison target and the replica redirect table 40 generated immediately before the comparison target replica redirect table 40 as the comparison source, and detects the difference address from the two replica redirect tables 40, the comparison target and the comparison source. Alternatively, the difference detection unit 14 may use all or some of the multiple replica redirect tables 40 generated before the comparison target replica redirect table 40 as the comparison source. In this case, the difference detection unit 14 detects the difference address for each of the multiple comparison target and comparison source combinations, which are combinations of one comparison target and multiple comparison sources. The word detection units 15 and 15a calculate the frequency of occurrence by performing the processing shown in Sa4 and Sa5 in Figure 7, and the processing in the loop La1s to La1e, on the difference data derived from all the difference addresses detected for the comparison target replica redirect table 40.

[0109] Furthermore, the word detection units 15 and 15a perform the Sa4 process on the latest record in the differential recording table 54. Alternatively, the word detection units 15 and 15a may select a snapshot image record from the records stored in the differential recording table 54 that is replicated from the same logical disk as the logical disk corresponding to the latest record, and combine the data stored in the storage area of ​​the data pool 21 indicated by the address stored in the "Difference Address" item of all selected records into differential data, and detect frequently occurring words from this differential data. By selecting the comparison source and comparison target across multiple generations in this way, the determination unit 16 can make the determination of Sa11 in Figure 7 based on the frequency of occurrence which reflects the long-term trend of word frequency.

[0110] In the processing of Sa13 in Figure 7, if the comparison target snapshot image is, for example, the third snapshot 143, the determination unit 16 records "Backup not possible" in the "Operation Restrictions" field of the record corresponding to the third snapshot 143 in the redirect table management table 51. Alternatively, the differential record table 54 may have a field called "Backup Use". In this case, when the differential detection unit 14 generates a new record in the differential record table 54, it records "OK" in the "Backup Use" field of the generated record. In the processing of Sa13, instead of recording "Backup not possible" in the "Operation Restrictions" field of the record corresponding to the third snapshot 143 in the redirect table management table 51, the determination unit 16 records "Not possible" in the "Backup Use" field of the record that includes "Third Snapshot" in the "Comparison Target" field of the differential record table 54.

[0111] In the processing of Sa1 shown in Figure 7, the snapshot processing unit 12 is set to start up when the storage device 1 starts up. However, after starting up, it may wait for a predetermined time before starting the processing of Sa1. Alternatively, instead of starting the snapshot processing unit 12 when the storage device 1 starts up, a maintenance worker may operate the maintenance terminal device 3 to start the snapshot processing unit 12 at any time.

[0112] The word detection units 15 and 15a are designed to detect frequently occurring words from the difference data, but instead of detecting frequently occurring words, they may also perform morphological analysis on the difference data to detect all words included in the difference data. In the processing of loops La1s to La1e, the word detection units 15 and 15a may omit either or both of the processing of Sa7 and Sa8. If the processing of Sa7 is not performed, it is not necessary to include the "Data Length to be Detected" item in the processing condition table 53, and if the processing of Sa8 is not performed, it is not necessary to include the "Excluded Words" item in the processing condition table 53. Note that in the processing of loops La1s to La1e, the order of the processing of Sa7 and Sa8 may be reversed.

[0113] In the process shown in Figure 7, the process of Sa11 is performed after the process of loop La1s to La1e is completed. However, in order to apply the prescribed protection process more quickly, the process of Sa11 may be performed after the process of Sa10. In this case, if the result of the process of Sa11 is "Yes", the process of Sa12 and Sa13 is performed after exiting loop La1s to La1e. If the result is "No", the process of loop La1s to La1e continues, and once the process of loop La1s to La1e is completed, the process proceeds to the process of Sa6.

[0114] In the processing of Sa11 in Figure 7, the determination unit 16 determines whether the frequency of occurrence is equal to or greater than the frequency threshold, but depending on how the frequency threshold is defined, it may also determine whether the frequency of occurrence exceeds the frequency threshold. In the processing of Sa7, the word detection units 15 and 15a determine whether the data length is equal to or greater than the threshold data length, but depending on how the threshold data length is defined, it may also determine whether the data length exceeds the threshold data length.

[0115] In the storage devices 1,1a, the data pool 21 may be located outside of the storage devices 1,1a, rather than inside them.

[0116] <Hardware Configuration> Figure 10 shows an example of the hardware configuration of the storage devices 1 and 1a shown in Figures 1 and 9 of this disclosure. The storage devices 1 and 1a of this disclosure are, for example, a computer 200 comprising a CPU (Central Processing Unit) 201, RAM (Random Access Memory) 202, ROM (Read Only Memory) 203, auxiliary storage device 204, and interface module 205. The CPU 201, RAM 202, ROM 203, auxiliary storage device 204, and interface module 205 are interconnected by a bus 206. The auxiliary storage device 204 is, for example, an HDD or an SSD. The interface module 205 is included in the data manipulation unit 11 and 11a, the maintenance terminal IF unit 18, and the analysis host IF unit 19.

[0117] The application program pre-stored in the ROM 203 or auxiliary storage device 204 is executed by the CPU 201, thereby configuring the snapshot processing unit 12, monitoring units 13, 13a, and timing unit 17, as well as the software portions of the data manipulation units 11, 11a, maintenance terminal IF unit 18, and analysis host IF unit 19. In the auxiliary storage device 204, the data pool 21 and storage unit 22 are configured.

[0118] <Third Embodiment> Hereinafter, an embodiment relating to the present disclosure will be described with reference to the figures. The storage device 300 includes a snapshot processing means 301 that generates a duplicate redirect table by duplicating a redirect table that stores location information indicating the location of a storage area that stores the actual data to be read and written via a logical disk, in the order of the data arrangement on the logical disk; and a monitoring means 302 that uses one of the multiple duplicate redirect tables as the source for comparison and one of the duplicate redirect tables generated later than the source for comparison, and determines whether or not to perform a predetermined protection process when writing to the logical disk, based on the frequency of occurrence of words in the differential data, which is data stored in a storage area indicated by location information in the location information included in the source that does not match the location information included in the source, and a predetermined frequency threshold.

[0119] The snapshot processing means 301 generates a duplicate redirect table by duplicating a redirect table that stores location information indicating the location of a storage area that stores the actual data to be read and written via the logical disk, in the order of the data sequence on the logical disk (S301). The monitoring means 302 uses one of the multiple duplicate redirect tables as the source for comparison and one of the duplicate redirect tables generated later than the source as the target for comparison. Based on the frequency of occurrence of words in the differential data, which is data stored in the storage area indicated by location information in the target that does not match the location information in the source, and a predetermined frequency threshold, the monitoring means 302 determines whether or not to perform a predetermined protection process when writing to the logical disk (S302).

[0120] Although the present disclosure has been described above with reference to embodiments, the present disclosure is not limited to the embodiments described above. Various modifications to the structure and details of the present disclosure are possible, as can be understood by those skilled in the art within the scope of the present disclosure. Furthermore, each embodiment can be combined with other embodiments as appropriate.

[0121] Some or all of the embodiments described above may also be described as follows, but are not limited to the following.

[0122] (Note 1) A storage device (for example, storage device 1, 1a) comprising: a snapshot processing means (for example, snapshot processing unit 12) that generates a duplicate redirect table (for example, duplicate redirect table 40) by duplicating a redirect table (for example, redirect table 31) that stores location information (for example, the address of the data pool 21) indicating the location of a storage area (for example, the storage area of ​​the data pool 21) that stores the actual data read and written via a logical disk (for example, the first logical disk 131) in the order of the data arrangement on the logical disk; and a monitoring means (for example, monitoring unit 13, 13a) that determines whether or not to perform a predetermined protection process when writing to the logical disk, based on the frequency of occurrence of words in the differential data which is data stored in the storage area indicated by location information that does not match the location information contained in the comparison source among the location information contained in the comparison source, and a predetermined occurrence frequency threshold.

[0123] (Note 2) The storage device described in (Note 1), wherein the predetermined protection process is either a process that prohibits writing data to the logical disk, and a process that notifies an alert indicating that an abnormality has occurred in the logical disk, or both.

[0124] (Note 3) The storage device described in (Note 1) or (Note 2), wherein the monitoring means determines that the predetermined protection process should be performed, and associates information indicating that backup is not possible with the comparison target replication redirect table.

[0125] (Note 4) The storage device according to any one of (Note 1) to (Note 3), wherein the monitoring means detects frequently occurring words from the differential data and determines whether or not to perform the predetermined protection processing when writing to the logical disk based on the frequency of occurrence of the detected words and the frequency threshold.

[0126] (Note 5) The storage device according to any one of (Note 1) to (Note 4), wherein the monitoring means detects the word from the differential data, selects the word that satisfies predetermined selection conditions from among the detected words, and determines whether or not to perform the predetermined protection processing when writing to the logical disk based on the frequency of occurrence of the selected word and the frequency threshold.

[0127] (Note 6) The storage device described in (Note 5), wherein the selection conditions specify either the conditions for the data length of the word to be selected, and / or excluded words that are not selected.

[0128] (Note 7) The monitoring means, when the snapshot processing means generates the replica redirect table, uses the generated replica redirect table as the comparison target and the replica redirect table generated one step before the comparison target in chronological order as the comparison source, as described in any one of (Note 1) to (Note 6).

[0129] (Note 8) A storage system (for example, storage system 100a) comprising: a storage device equipped with a snapshot processing means that generates a duplicate redirect table by duplicating a redirect table that stores location information indicating the location of a storage area that stores the actual data to be read and written via a logical disk in the order of the data arrangement on the logical disk; and an analysis host device that detects words from given data and detects the frequency of occurrence of each of the detected words in the data, wherein the storage device takes one of the plurality of duplicate redirect tables as a comparison source, one of the duplicate redirect tables generated later than the comparison source as a comparison target, outputs differential data which is data stored in the storage area indicated by location information in the location information included in the comparison target that does not match the location information included in the comparison source, to the analysis host device, obtains the frequency of occurrence of the words detected by the analysis host device from the differential data, and monitors whether or not to perform a predetermined protection process when writing to the logical disk based on the obtained frequency and a predetermined frequency threshold.

[0130] (Note 9) The storage system as described in (Note 8), wherein the predetermined protection process is either a process that prohibits writing data to the logical disk, and a process that notifies an alert indicating that an abnormality has occurred in the logical disk, or both.

[0131] (Note 10) The storage system as described in (Note 8) or (Note 9), wherein the monitoring means determines that the predetermined protection process should be performed, and associates information indicating that backup is not possible with the comparison target replication redirect table.

[0132] (Note 11) The analysis host device detects frequently occurring words from the differential data and outputs the frequency of occurrence of the detected words to the monitoring means, the storage system according to any one of (Note 8) to (Note 10).

[0133] (Note 12) The analysis host device detects the word from the difference data, selects the word that satisfies predetermined selection conditions from among the detected words, and outputs the frequency of occurrence of the selected word to the monitoring means, the storage system according to any one of (Note 8) to (Note 11).

[0134] (Note 13) The storage system described in (Note 12), wherein the selection conditions specify either the conditions for the data length of the word to be selected, and / or excluded words that are not selected.

[0135] (Note 14) The storage system according to any one of (Note 8) to (Note 13), wherein when the snapshot processing means generates the replica redirect table, the generated replica redirect table is used as the comparison target, and the replica redirect table generated one step before the comparison target in chronological order is used as the comparison source.

[0136] (Note 15) A data protection method comprising: a snapshot processing step of generating a duplicate redirect table by duplicating a redirect table that stores location information indicating the location of a storage area that stores the actual data to be read and written via a logical disk, in the order of the data sequence on the logical disk; and a monitoring step of determining whether or not to perform a predetermined protection process when writing to the logical disk, based on the frequency of occurrence of words in differential data which is data stored in the storage area indicated by location information in the location information included in the location information included in the comparison source that does not match the location information included in the comparison source, and a predetermined frequency threshold.

[0137] (Note 16) The data protection method described in (Note 15), wherein the predetermined protection process is either a process that prohibits writing data to the logical disk, and a process that notifies an alert indicating that an abnormality has occurred in the logical disk, or both.

[0138] (Note 17) The data protection method according to (Note 15) or (Note 16), wherein the monitoring step determines that the predetermined protection process should be performed, and associates information indicating that backup is not possible with the comparison target replication redirect table.

[0139] (Note 18) The data protection method according to any one of (Note 15) to (Note 17), wherein the monitoring step detects frequently occurring words from the differential data and determines whether or not to perform the predetermined protection process when writing to the logical disk based on the frequency of occurrence of the detected words and the frequency threshold.

[0140] (Note 19) The data protection method according to any one of (Note 15) to (Note 18), wherein the monitoring step involves detecting the word from the differential data, selecting the word that satisfies predetermined selection conditions from among the detected words, and determining whether or not to perform the predetermined protection process when writing to the logical disk based on the frequency of occurrence of the selected word and the frequency threshold.

[0141] (Note 20) The data protection method described in (Note 19), wherein the selection conditions specify either the conditions for the data length of the selected word, or the exclusion words which are words not to be selected, or both.

[0142] (Note 21) The data protection method according to any one of (Note 15) to (Note 20), wherein the monitoring step, when the snapshot processing means generates the replica redirect table, uses the generated replica redirect table as the comparison target and the replica redirect table generated one step before the comparison target in chronological order as the comparison source.

[0143] (Note 22) A program for causing a computer to function as: a snapshot processing means that generates a duplicate redirect table by duplicating a redirect table that stores location information indicating the location of a storage area that stores the actual data to be read and written via a logical disk, in the order of the data sequence on the logical disk; and a monitoring means that uses one of the plurality of duplicate redirect tables as a comparison source and one of the duplicate redirect tables generated later than the comparison source as a comparison target, and determines whether or not to perform a predetermined protection process when writing to the logical disk, based on the frequency of occurrence of words in the differential data which is data stored in the storage area indicated by location information in the location information contained in the comparison target that does not match the location information contained in the comparison source, and a predetermined frequency threshold.

[0144] (Note 23) The program described in (Note 22) wherein the predetermined protection process is either a process that prohibits writing data to the logical disk, or a process that notifies an alert indicating that an abnormality has occurred in the logical disk.

[0145] (Note 24) The program described in (Note 22) or (Note 23), which, when the monitoring means determines that the predetermined protection process should be performed, associates information indicating that backup is not possible with the comparison target replication redirect table.

[0146] (Note 25) The monitoring means detects frequently occurring words from the differential data and determines, based on the frequency of occurrence of the detected words and the frequency threshold, whether or not to perform the predetermined protection processing when writing to the logical disk, according to the program described in any one of (Note 22) to (Note 24).

[0147] (Note 26) The monitoring means is a program according to any one of (Note 22) to (Note 25), which detects the word from the differential data, selects the word that satisfies predetermined selection conditions from among the detected words, and determines whether or not to perform the predetermined protection processing when writing to the logical disk based on the frequency of occurrence of the selected word and the frequency threshold.

[0148] (Note 27) The selection conditions include either the conditions for the data length of the word to be selected, or the exclusion words that are not selected, or both, as described in (Note 26).

[0149] (Note 28) The monitoring means is a program as described in any one of (Note 22) to (Note 27), wherein when the snapshot processing means generates the replica redirect table, the generated replica redirect table is used as the comparison target, and the replica redirect table generated one step before the comparison target in chronological order is used as the comparison source. [Explanation of Symbols]

[0150] 1. Storage device (information processing device) 2 Host device 3. Maintenance terminal equipment 11 Data manipulation section 12 Snapshot Processing Unit 13 Monitoring Department 14 Difference detection unit 15 Word detection unit 16 Judgment section 17 Timing section 18 Maintenance Terminal Interface Section 21 Data Pools 22 Memory section 31,41,42,43 Redirect Table 51 Redirect Table Management Table 52 Snapshot generation time record table 53 Processing Conditions Table 54 Difference Recording Table 131 First Logical Disk 141 First Snapshot 142 Second Snapshot 143 Third Snapshot

Claims

1. A snapshot processing means generates a duplicate redirect table by replicating a redirect table that stores location information indicating the location of a storage area that stores the actual data to be read and written via a logical disk, in the order in which the data is arranged on the logical disk. A monitoring means that determines whether or not a predetermined protection process should be performed when writing to the logical disk, based on the frequency of occurrence of words in the differential data, which is data stored in the storage area indicated by location information that does not match the location information contained in the comparison source among the multiple replication redirect tables, and the destination replication redirect table which is generated after the comparison source, and a predetermined frequency threshold; A storage device equipped with the following features.

2. The aforementioned predetermined protection process is either a process that prohibits writing data to the logical disk, or a process that notifies an alert indicating that an abnormality has occurred in the logical disk, or both of these processes. The storage device according to claim 1.

3. The aforementioned monitoring means is When it is determined that the aforementioned predetermined protection process should be performed, information indicating that backup is not possible is associated with the comparison target replication redirect table. The storage device according to claim 1.

4. The aforementioned monitoring means is The system detects frequently occurring words from the differential data and determines whether or not to perform the predetermined protection process when writing to the logical disk based on the frequency of occurrence of the detected words and the frequency threshold. The storage device according to claim 1.

5. The aforementioned monitoring means is The system detects the word from the differential data, selects the word that satisfies a predetermined selection condition from among the detected words, and determines whether or not to perform the predetermined protection process when writing to the logical disk based on the frequency of occurrence of the selected word and the frequency threshold. The storage device according to claim 1.

6. The selection criteria include either the acceptable data length for the selected word, or the exclusion words that are not selected, or both. The storage device according to claim 5.

7. The aforementioned monitoring means is When the snapshot processing means generates the replica redirect table, it uses the generated replica redirect table as the comparison target and the replica redirect table generated immediately before the comparison target in chronological order as the comparison source. The storage device according to claim 1.

8. A storage device comprising a snapshot processing means that generates a duplicate redirect table by duplicating a redirect table that stores location information indicating the location of a storage area that stores the actual data to be read and written via a logical disk, in the order of the data sequence on the logical disk, and The system comprises an analysis host device that detects words from given data and detects the frequency of occurrence of each detected word in the data, The aforementioned storage device is Monitoring means that compares one of the multiple replication redirect tables as the source, one of the replication redirect tables generated later than the source as the target, outputs differential data which is data stored in the storage area indicated by location information in the target that does not match the location information contained in the source to the analysis host device, obtains the frequency of word occurrences detected by the analysis host device from the differential data, and determines whether or not to perform a predetermined protection process when writing to the logical disk based on the obtained frequency and a predetermined frequency threshold. A memory system equipped with the following features.

9. A snapshot processing step to generate a duplicate redirect table by replicating a redirect table that stores location information indicating the location of a storage area that stores the actual data to be read and written via a logical disk, in the order of the data sequence on the logical disk; A monitoring step that determines whether or not a predetermined protection process should be performed when writing to the logical disk, based on the frequency of occurrence of words in the differential data, which is data stored in the storage area indicated by location information that does not match the location information contained in the comparison source among the multiple replication redirect tables, and the frequency of occurrence of words in the differential data, which is data stored in the storage area indicated by location information contained in the comparison source among the location information contained in the comparison source, and a predetermined frequency threshold; Data protection methods including

10. Computers, A snapshot processing means generates a duplicate redirect table by replicating a redirect table that stores location information indicating the location of a storage area that stores the actual data to be read and written via a logical disk, in the order in which the data is arranged on the logical disk. A monitoring means that determines whether or not a predetermined protection process should be performed when writing to the logical disk, based on the frequency of occurrence of words in the differential data, which is data stored in the storage area indicated by location information that does not match the location information contained in the comparison source among the multiple replication redirect tables, and the destination replication redirect table which is generated after the comparison source, and a predetermined frequency threshold. A program designed to function as such.

Images