EMERGENCY DATA CUTOFF FOR STORAGE SYSTEMS

A computer system includes a network switch coupled to a network, a remote cutoff device coupled to the network switch, and a security alert system connected to the network and coupled to the remote cutoff device. The security alert system receives input from the network indicating data that may be harmful to the system and communicates an alert to the remote cutoff device. The remote cutoff device transmits a cutoff signal to the network switch, which causes data flow into or out of the network switch to be immediately interrupted.

BACKGROUND

The present invention relates generally to data storage systems, and more particularly to data storage system security.

In a data storage system, one way to prevent potentially harmful data from being transmitted is to power down the controlling storage server by initiating a prescribed shut-down procedure. However, before such a procedure can complete, harmful data may still be transmitted. Another possibility is to instantly cut off power to the server (assuming that a backup power unit is not automatically activated). However, shutting down data storage by instantly turning off power to a storage server, rather than performing a prescribed shut-down procedure is problematic. For one thing, it may be time consuming to subsequently restart the server. In some cases, qualified personnel may be needed to bring the server back online. And in extreme cases, incorrectly shutting down the server may result in damage to the hardware.

Therefore, it would be advantageous to method to safely and quickly prevent transmittal of potentially harmful data in a data storage system.

SUMMARY

In an aspect of the invention, a computer system includes a network switch coupled to a network, a remote cutoff device coupled to the network switch, and a security alert system connected to the network and coupled to the remote cutoff device. The security alert system receives input from the network indicating data that may be harmful to the system and communicates an alert to the remote cutoff device. The remote cutoff device transmits a cutoff signal to the network switch, which causes data flow into or out of the network switch to be immediately interrupted.

In another aspect of the invention, a computer system includes a storage server connected to a first network via a first network switch and connected to a second network via a second network switch, a remote cutoff device coupled to the first network switch and the second network switch, and a security alert system connected to the first network and the second network and coupled to the remote cutoff device. The security alert system receives input from the first network and the second network indicating data that may be harmful to the system and communicate an alert to the remote cutoff device. The remote cutoff device transmits a cutoff signal to the first network switch and/or the second network switch, which causes data flow into or out of the storage server to be immediately interrupted.

DETAILED DESCRIPTION

Embodiments of the present invention are directed to computer systems for causing data flow in a storage system to be immediately interrupted in case potentially harmful data is detected.

FIGS. 1 and 2are schematic diagrams of computing environments in which embodiments of the present invention may be practiced. Those skilled in the art will appreciate that the computing environments depicted are merely for the purpose of illustration and that embodiments of the invention may also find useful application in other computing environments, for example, in computing environments that combine components ofFIGS. 1 and 2.

FIG. 1is a schematic diagram of a computing environment100, in accordance with an embodiment of the present invention. Computing environment100includes client computing device110connected over network118via a network switch such as LAN switch116to a storage server120. Storage server120is connected over storage area network (SAN)124via a network switch such as FC switch112to a storage device122. Security alert system140is connected to remote cutoff130, to SAN124via a Fibre Channel (FC) connection128, and to network118via an Ethernet connection126. In various embodiments of the invention, remote cutoff130is connected to LAN switch116and/or to FC switch112.

Computing environment100may include one or more storage devices122. Storage devices122may be, for example, solid-state drives (SSD), hard disk drives (HDD), tape units, or cloud storage devices. In an embodiment of the invention, computing environment100may include a sniffer114between storage server120and network118, and/or between storage device122and SAN124. Sniffers114may be connected to security alert system140.

Network118can be, for example, a local area network (LAN), a wide area network (WAN) such as the Internet, or a combination of the two, and can include wired, wireless, or fiber optic connections. In general, network118can be any combination of connections and protocols that will support communications between client computing device110and storage servers120, and between various devices (not shown) attached to network118and security alert system140, in accordance with embodiments of the present invention.

Storage server120can be any server that is used to store, access, secure, and manage data on storage devices such as storage device122, in accordance with an embodiment of the invention. Storage servers are generally designed for storing and accessing varying amounts of data over a shared network, such as the internet, a WAN, a LAN, or a SAN. A typical computing environment may include one or more storage servers120connected to one or more storage devices122via network118and/or SAN124.

SAN124is a specialized, high-speed network that provides block-level network access to data storage such as storage devices122, in accordance with an embodiment of the invention. SANs typically connect servers such as storage servers120, network switches such as FC switch112, and storage devices122, using various technologies, topologies, and protocols. SANs may also span multiple sites. SANs are primarily used to enhance storage devices122, such as disk arrays and tape libraries, making them accessible to storage servers120so that the storage devices appear to computing devices such as client computing device110as if they were attached locally. SAN124typically has its own network of storage devices122that are generally not directly accessible through network118by other devices connected to network118.

Client computing device110represents a computing platform that accesses storage devices122. In various embodiments of the invention, client computing device110may be, for example, a laptop computer, tablet computer, netbook computer, personal computer (PC), a desktop computer, a personal digital assistant (PDA), or a smart phone. In general, a client computing device110may be any programmable electronic device capable of accessing storage device122via network118or via SAN124, and of supporting functionality as required by one or more embodiments of the invention. Client computing device110may include internal and external hardware components as depicted and described in further detail below with reference toFIG. 4, below. In other embodiments, client computing device110may be implemented in a cloud computing environment, as described in relation toFIGS. 5 and 6, below. Computing environment100may include one or more client computing devices110.

Security alert system140operates generally to detect or be notified of an emergency situation and send an alert to a remote cutoff130, in accordance with an embodiment of the invention. An emergency situation may involve data that is potentially harmful to the system. In an embodiment of the present invention, the emergency situation may be an exploit that involves data entering or exiting a storage device or a storage server, such as an attempt to transmit a malicious payload, malware, or a computer virus. Security alert system140may then send an alert to remote cutoff130, which causes data flow to be immediately interrupted, as described in greater detail below.

In one embodiment of the invention, security alert system140may be hosted on an application server or another system server. For example, security alert system140may be integrated in a storage manager. Alternatively, security alert system140may be hosted on a stand-alone system dedicated to system security.

Security alert system140may be coupled to or be integrated in an intrusion detection system, a device or software application that monitors a network for malicious activity or policy violations. Security alert system140may receive inputs from multiple sources, including an intrusion detection system or other security information system, an antivirus software package, or even a building security system. Security alert system140may use various alarm filtering techniques to distinguish malicious activity from false alarms. In an embodiment of the invention, security alert system140may receive input from one or more sniffers114, which intercept network traffic going to or from a storage device122or a storage server120.

In an embodiment of the invention, security alert system140may operate to detect certain emergency situations involving potentially harmful data. Alternatively, or additionally, security alert system140may be notified of an emergency situation by another security system such as an intrusion detection system or an antivirus software package. In various embodiments, security alert system140may initiate an interruption of data flow into or out of storage device122or storage server120in response to a request from a system administrator or storage administrator responding to a perceived emergency situation.

In an embodiment of the invention, security alert system140may also send a notification to a client computing device110which may be affected by the interruption of data flow. In another embodiment, an interruption of data flow is interpreted as packet loss and is handled as such, for example by a storage manager, by standard network data transmission techniques.

Remote cutoff130represents an apparatus or software module that may cause data flow through a network switch such as LAN switch116or FC switch112to be immediately interrupted. In an embodiment of the invention, remote cutoff130causes a network cable coupled to the network switch to become disconnected or blocked. In another embodiment, remote cutoff130sends a signal to a relay coupled to a network switch that causes the relay to instantly cut off power to the network switch or to block data from entering or exiting the network switch. The relay may be, for example, a solid-state relay or a microprocessor-based relay. In various embodiments of the invention, remote cutoff130may be a hardware device controlled by security alert system140or a software module included, for example, in security alert system140or in one or more storage servers120.

Fibre Channel (FC) is a high-speed network technology primarily used to connect storage devices such as storage device122to storage servers such as storage server120, and is a core component of most current storage area networks such as SAN124. An FC switch112is a network switch compatible with the FC protocol. A network switch is a computer networking device that connects devices together on a network using packet switching to receive, process, and forward data to destination devices. Although inFIGS. 1 and 2, FC switches112are depicted as external to SAN124, in practice, an FC switch is considered to be one component of the SAN.

LAN switch116is a hardware device that connects a computer, for example storage server120or client computing device110, to a network such as network118. LAN switches typically support either wired Ethernet or various WiFi wireless standards.

Sniffer114is a packet sniffer, which may also be known as a network analyzer or network protocol analyzer or, for particular types of networks, an Ethernet sniffer, FC sniffer, or wireless sniffer. In various embodiments of the invention, sniffer114may be a software module or hardware device that can intercept packets in a network. For example, sniffer114may be a monitoring port in a network switch such as FC switch112or LAN switch116or a “network tap,” a hardware device that provides access to data in a network. In various embodiments of the invention, sniffer114intercepts data that passes over network118or SAN124. Sniffer114may transmit the intercepted data to security alert system140for analysis or analyze the data and notify security alert system140if a potential emergency situation is detected.

FIG. 2is a schematic diagram depicting an alternative computing environment200, in accordance with certain embodiments of the present invention. Computing environment200includes client computing device110connected over SAN124via FC switch112to storage device122. Client computing device110is also connected to network118via an Ethernet connection126. Security alert system140connects to remote cutoff130, to SAN124via an FC connection128, and to network118via an Ethernet connection126. Remote cutoff130is connected to FC switch112. Computing environment100may include one or more client computing devices110and one or more storage devices122. In an embodiment of the invention, computing environment100may include a sniffer114between storage device122and SAN124, which is connected to security alert system140.

FIG. 3is a flowchart depicting various operational steps performed by security alert system140, in accordance with an embodiment of the invention. Security alert system140detects or is notified of an emergency situation (step310) and sends an alert to remote cutoff130(step312). Remote cutoff130then transmits a cutoff signal to an appropriate network switch such as LAN switch116or FC switch112(step314), which immediately interrupts data flow through the network switch, to or from storage server120or storage device122(step316).

Characteristics are as Follows:

Service Models are as Follows:

Deployment Models are as Follows:

The foregoing description of various embodiments of the present invention has been presented for purposes of illustration and description. It is not intended to be exhaustive nor to limit the invention to the precise form disclosed. Many modifications and variations are possible. Such modification and variations that may be apparent to a person skilled in the art of the invention are intended to be included within the scope of the invention as defined by the accompanying claims.