Disaster recover/continuity of business adaptive solution framework

A framework and method for use in determining appropriate information technology system disaster recovery and operational continuity solutions for an enterprise. In one embodiment the method includes identifying (504) business processes associated with achieving a defined mission of the enterprise. Assets of the information technology system are grouped (508) into one or more functional sub-system/data class groups and one or more of the business processes are selected. The functional sub-system/data class groups are mapped (524) to the selected business processes to establish a correspondence between each selected business process and one or more of the functional sub-system/data class groups. Thereafter, each functional sub-system/data class group corresponding with each selected business process is associated (602) with a solution class included in a three-dimensional disruption tolerance decision matrix.

FIELD OF THE INVENTION

The present invention relates generally to information technology systems, and more particularly to identifying appropriate solutions for providing desired data recovery and continuity of operation capabilities within an enterprise's information technology system.

BACKGROUND OF THE INVENTION

Enterprises such as, for example, a business, a governmental agency, an educational or non-profit institution or other organization, often utilize and rely on information technology (IT) systems of varying complexity in order to assist in accomplishing or directly accomplish desired objectives of the enterprise. Thus, various assets of the enterprise's IT system including data created, updated and accessed by resources of the system, and possibly also resources external to the IT system (e.g., customers and clients), can be very important to continuing operation of an enterprise. Ensuring that such assets remain available and are recoverable in the event of an occurrence effecting one or more assets of the IT system is an important consideration.

Identifying appropriate solutions for providing such disaster recover/continuity of business capabilities within an enterprise IT system is not a trivial undertaking. One reason is that a single category of solution does not fit all enterprises. While scheduled tape-backups or the like may be appropriate for one enterprise where loss of an entire day's data is not problematic, losing one minute or even one second of data may be unacceptable to another enterprise. Likewise, taking several hours to days to recover from a problem while a tape back-up is retrieved and restored may be acceptable to one enterprise, but another enterprise may need to resume normal operations of its IT system within seconds. Furthermore, a monolithic solution across an enterprise's entire IT system, which vendors may often recommend, typically addresses the most stringent requirements and are generally not the most cost effective solution since not all assets of the IT system necessitate the most stringent solution.

SUMMARY OF THE INVENTION

Accordingly, the present invention provides a comprehensive methodology to identify a flexible and cost effective IT system disaster recovery and operational continuity solution at the enterprise level. In accordance with the present invention, a vendor agnostic framework and methodology provide recommendations for flexible, cost effective and proven solutions at a sub-system and data class level within the enterprise's IT system.

In accordance with one embodiment of the present invention, an enterprise's mission is broken into business processes which are tagged as critical or non-critical. This is accomplished by examining impact to the enterprise mission due to disruption of each business process. Assets of the enterprise's IT system are grouped into functional sub-systems and the data is mapped to data class groups. The functional sub-system/data class groups are evaluated against a three dimensional model represented by a disruption tolerance matrix. This matrix has solution classes for each level of disruption tolerance. Each solution class can potentially be supported by multiple architectures which in turn can be implemented using different product vendors. The three axes included in the matrix represent: (1) how much data can the enterprise tolerate losing in case of a disaster; (2) how quickly does the operation being evaluated need to be restored after a disaster; and (3) how far away is the disaster recovery site from the primary site. The recommended solution for each functional sub-system/data class group depends on the disruption tolerance level, the solution class and the cost of the solution changes. This allows for a flexible, cost effective, and vendor agnostic solution framework. Additionally, the approach of the present invention is comprehensive, product agnostic with the best interest of the customer in mind, looks at the enterprise as collection of sub-systems and data classes, and provides the disaster recovery and business continuity solution at that level tempered by actual business impact and disruption that can be tolerated.

According to one aspect of the present invention, a method for use in determining appropriate information technology system disaster recovery and operational continuity solutions for an enterprise includes identifying business processes associated with achieving a defined mission of the enterprise. Assets of the information technology system are grouped into one or more functional sub-system/data class groups, and one or more of the business processes are selected. The functional sub-system/data class groups are mapped to the selected business processes to establish a correspondence between each selected business process and one or more of the functional sub-system/data class groups. Each functional sub-system/data class group corresponding with each selected business process is then associated with a solution class included in a three-dimensional disruption tolerance decision matrix. At least one list of recommended solutions meeting requirements of the solution classes may then referenced to identify one or more recommended solutions for implementation within the information technology system.

In one embodiment of the method, the information technology system includes at least one primary site at which data is stored and at least one secondary site at which the data stored at the primary site is to be replicated, and the disruption tolerance decision matrix includes a first axis representing data loss if a disaster event occurs at the primary site, a second axis representing operational down time following a disaster event at the primary site, and a third axis representing packet delay time between the primary site and the secondary site. In this regard, the secondary site is also sometimes referred to herein as the disaster recovery site and the packet delay time includes the amount of time it takes for a packet of data to be transmitted from the primary site to the disaster recovery site and for an acknowledgment packet to be transmitted back to the primary site indicating that the original packet of data has been stored at the disaster recovery site. In such an embodiment, the step of associating each functional sub-system/data class group corresponding with each selected business process with a solution class may include identifying a location on the third axis based on a packet delay time expected between the primary and secondary sites, identifying a location on the second axis based on an acceptable operational down time if availability of the functional sub-system/data class group is effected, and identifying a location on the first axis based on an acceptable level of data loss if availability of the functional sub-system/data class group is effected, and selecting a solution class cross-referenced by the combination of identified locations on the first, second and third axes.

According to another aspect of the present invention, a framework useful in selecting appropriate information technology system disaster recovery and operational continuity solutions for an enterprise includes a matrix having first, second and third axes. The information technology system may include at least one primary site at which data is stored and at least one secondary site at which the data stored at the primary site is replicated. The first axis represents a range of acceptable data loss if an event that causes loss of the data at the primary site occurs. The second axis represents a range of acceptable operational resumption times following the event that causes loss of the data at the primary site. The third axis represents a packet delay time between the primary and the secondary sites. The framework also includes a plurality of possible solution recommendations, each recommended solution being cross-referenced by at least one combination of locations along the first, second and third axes.

These and other aspects and advantages of the present invention will be apparent upon review of the following Detailed Description when taken in conjunction with the accompanying figures.

DETAILED DESCRIPTION

FIG. 1shows one embodiment of an information technology system10that may be utilized by an enterprise. The information technology system10includes portions located at a primary site12and portions located at a secondary site14. The primary site12may be geographically remote from the secondary site14such that conditions effecting the operation of portions of the information technology system10at the primary site12may not necessarily be present at the secondary site14. In this regard, the primary site12and the secondary site14may, for example, be located in different buildings, in different towns, in different states, or even in different countries. Regardless of the location of the secondary site14relative to the primary site12, both sites12,14are enabled for communication therebetween via a data network16so that data18created and/or stored at the primary site12can be communicated to and replicated at the secondary site14. The data18may be accessed at the secondary site14and recovered therefrom in the event of an occurrence (e.g., an equipment failure, a power failure, a natural disaster, or a terrorist attack or other man-made event) that causes loss of data access at the primary site14. Such an occurrence may be referred to herein as a “disaster event”.

Since, some of the data18may be more critical than other portions of the data18to achieving a defined mission of the enterprise, all of the data18created and/or stored at the primary site12need not necessarily be replicated at the secondary site14or made available from the secondary site14following a disaster event under the same conditions. In view of this and other considerations, one or more disaster recovery and operational continuity solutions may be appropriately employed within the information technology system12.

FIG. 2provides an overview of the operation of one embodiment of a virtualized integration adaptive solution framework100(the framework100) that assists selection of appropriate disaster recovery and operational continuity solutions for incorporation into an enterprise's information technology system, such as, for example the information technology system10shown inFIG. 1. The framework100may also be applied to information technology systems configured differently than inFIG. 1such as, for example, information technology systems having an intermediary site between the primary and secondary sites.

The framework100receives a number of inputs. The inputs to the framework100include a system architecture model102, enterprise business processes104, enterprise functional sub-system/data classes106, business process impact analysis108, cost objectives110, and disaster recovery distance requirements112.

The system architecture model102includes information describing various resources located in the information technology system, the physical location of such resources, and network addresses associated with such resources. The enterprise business processes104include descriptions of one or more business processes that enterprise engages in to accomplish a defined mission of the enterprise. The enterprise functional sub-system/data classes106include one or more groups of various hardware, software and data assets of the information technology system. The business process impact analysis108includes assessments regarding the impact that unavailability of one or more functional sub-system/data classes106is expected to have on executing business processes of the enterprise. The cost objectives110include a range of budget monetary amounts for providing disaster recovery solutions within the information technology system. The disaster recovery distance requirements include information regarding anticipated geographic distances between physical locations in the information technology system.

The various inputs102-112are input to the framework100which processes the inputs102-112to determine an appropriate disaster recovery and operational continuity solution114for the enterprise's information technology system. The solution114derived by the framework100may incorporate one or more different technologies and includes a number of characteristics/considerations116. Among the characteristics/considerations116of the solution114are: (1) the criticality and impact levels associated with the enterprise's business processes are identified; (2) critical impacts are mapped to functional sub-systems/data classes; (3) enterprise disruption tolerance is identified at sub-system/data classes level; (4) solution classes are identified; and (5) pre-qualified product specific solutions are recommended.

FIG. 3shows a disruption tolerance decision matrix200. The disruption tolerance decision matrix200includes a first axis202and a second axis204. The first axis202represents a range of acceptable data loss if a disaster event occurs. The range of acceptable data loss along the first axis202may be divided into a number of different categories such as, for example, a none or no data loss category202A, a minimal data loss category202B, a some data loss category202C and major data loss category202D. In the no data loss category202A, a data writing operation involves synchronously storing the data at both a primary site and a backup site so that there is no amount of lost data with available data backup technology. In the minimal data loss category202B, more lost data than in the no data loss category202A but less than in the some data loss category202C is allowable if a disaster event occurs (e.g., up to few minutes worth of data transaction loss). In the some data loss category202C, more lost data than in the minimal data loss category202B but less than in the major data loss category202D is allowable if a disaster event occurs (e.g., up to few hours worth of data transaction loss). In the major data loss category202D, more lost data than in the some data loss category202C is allowable if a disaster event occurs (e.g., up to days worth of data transaction loss). Although four categories202A-202D of acceptable data loss are described in connection with the present embodiment, in other embodiments, the range of acceptable data loss may be categorized differently and/or categorized using fewer or more than four categories.

The second axis204of the disruption tolerance decision matrix200represents a range of acceptable business resumption times following a disaster event. The range of acceptable business resumption time following a disaster event represents how long an amount of time is acceptable until business critical information technology applications are again available and operational. The range of acceptable business resumption time along the second axis204may be divided into a number of different categories such as, for example, seconds204A, minutes204B, hours204C, and days204D. Although the range of acceptable business resumption time is divided into four categories204A-204D in the present embodiment, in other embodiments, the range of acceptable business resumption time may be categorized differently and/or categorized using fewer or more than four categories.

The disruption tolerance decision matrix200shown inFIG. 3also lists generalized types of data recovery solutions deemed acceptable for the different categories202A-202D of acceptable data loss along the first axis202. For the no data loss category202A of acceptable data loss, synchronous data recovery solutions are acceptable. In this regard, synchronous data recovery solutions include those in which during each data storing operation, both the data being stored and the backup thereof are simultaneously stored during a data storing operation. For the minimal data loss category202B of acceptable data loss, asynchronous data recovery solutions are acceptable. In this regard, asynchronous data recovery solutions include those in which data stored during a data storing operation is also stored in a backup location during another data storing operation that is executed subsequent to the original data storing operation. In case of a disaster, the data that has been written to the primary site storage and has not yet been written to the backup location, is the amount of data that would be lost. For the some data loss category202C of acceptable data loss, snapshot data recovery solutions are acceptable. In this regard, snapshot data recovery solutions include those in which stored data is periodically copied to a backup location with several original data writing operations possibly having occurred between each snap-shot that is written to the backup location. For the major data loss category202D of acceptable data loss, tape data recovery solutions are acceptable. In this regard, tape data recovery solutions include those in which the contents of a data storage device are copied to a tape on a scheduled basis or manually activated basis with significant original data writing operations possibly having occurred in between.

The disruption tolerance decision matrix200shown inFIG. 3also lists generalized types of server recovery solutions deemed acceptable for the different categories204A-204D of acceptable business resumption time along the second axis204. For the seconds category204A of acceptable business resumption time, active/active solutions are acceptable. For the minutes category204B of acceptable business resumption time, active/passive solutions are acceptable. For the hours category204C of acceptable business resumption time, hot backup solutions are acceptable. For the days category204D of acceptable business resumption time, cold backup solutions are acceptable.

The various appropriate types of data recovery solutions appropriate for the categories202A-202D of acceptable data loss on the first axis202and the various appropriate types of server recovery solutions for the categories204A-204D of acceptable business resumption time on the second axis204may be characterized in the manner indicated by the two-headed arrow inFIG. 3. Close to origin where the first and second axes202,204intersect, the data and server recovery solution types become more automated and technology driven, hence typically more expensive. Proceeding away from the origin along the first and second axes202,204, the data and server recovery solutions become more manual and procedure driven, hence typically less expensive.

FIG. 4provides another view of a disruption tolerance decision matrix300. In the disruption tolerance decision matrix300ofFIG. 4, the first axis302represents a range of acceptable data loss should a disaster event occur and the range of acceptable data loss along the first axis302is divided into the same four categories (none or no data loss category302A, minimal data loss category302B, some data loss category302C and major data loss category302D) as in the disruption tolerance decision matrix200ofFIG. 3. The second axis304represents a range of acceptable business resumption times following a disaster event and is divided into the same four categories (seconds304A, minutes304B, hours304C, and days304D) as in the disruption tolerance decision matrix200ofFIG. 3. The disruption tolerance decision matrix300identifies a total of sixteen appropriate data recovery and server recovery solution classes cross-referenced by different combinations of the four categories302A-302D of acceptable data loss and the four categories304A-304D of acceptable business resumption time along the first and second axes302,304. The sixteen appropriate data recovery and server recovery solution classes include: (1) an active/active synchronous replication solution class; (2) a synchronous replication active/passive solution class; (3) a synchronous replication hot backup solution class; (4) a synchronous replication cold backup solution class; (5) an active/active asynchronous replication solution class; (6) an asynchronous replication active/passive solution class; (7) an asynchronous replication hot backup solution class; (8) an asynchronous replication cold backup solution class; (9) an active/active snap-shot replication solution class; (10) a snap-shot replication active/passive solution class; (11) a snap-shot replication hot backup solution class; (12) a snap-shot replication cold backup solution class; (13) an active/active manual data synchronizing solution class; (14) a tape backup active/passive solution class; (15) a tape backup hot backup solution class; and (16) a tape backup cold backup solution class. In embodiments where the range of acceptable data loss along the first axis302is divided into fewer or more than four categories business and/or the range of acceptable business resumption time along the second axis304is divided into fewer or more than four categories, the number of cross-referenced data recovery and server recovery solution classes included in the disruption tolerance decision matrix300may be fewer or more than sixteen.

FIG. 5depicts a three-dimensional solution mapping and disruption tolerance decision matrix400. The three-dimensional solution mapping and disruption tolerance decision matrix400includes first and second axes402,404similar to those in the disruption tolerance decision matrices such as shown inFIG. 3or4, wherein the first axis402represents a range of acceptable data loss and the second axis404represents a range of acceptable operational down-time (acceptable business resumption time inFIGS. 2 and 3) if a disaster event occurs, along with a third axis406representing a range of packet delay times between the primary and disaster recovery sites. The third axis406is oriented such that the packet delay time increases moving away from the intersection of the first, second, and third axes402,404,406. In other embodiments, the third axis may be oriented such that the packet delay time decreases moving away from the intersection of the first, second, and third axes402,404,406.

InFIG. 5, two possible packet delay time situations are illustrated, namely, a small packet delay situation408(e.g., wherein the disaster recovery site is less than 100 km from the primary site) and a large packet delay situation410(e.g., wherein the disaster recovery site is more than 100 km from the primary site). In other embodiments, the third axis406may be resolved into more than two packet delay time situations (e.g., small, medium and large). Applicable solution classes412for various combinations of acceptable data loss along the first axis402and acceptable operational down-time along the second axis404in the case of the small and large packet delay situations408,410are identified inFIG. 5. As depicted inFIG. 5, applicable solution classes412for different combinations of acceptable data loss and acceptable operational down-time may differ between the small packet delay situation408and the large packet delay situation410. In this regard, as an example, in the small packet delay situation408, applicable solution classes412for the “no data loss/seconds operational down-time”, “minimal data loss/seconds operational down-time”, “no data loss/minutes operational down-time”, and “major data loss/hours operational down-time” combinations include Command Communications Survivability Program—Messaging Component Project (CCSP). In the large packet delay situation410, applicable solution classes412for the “minimal data loss/seconds operational down-time” and “minimal data loss/minutes operational down-time” combinations include Army Knowledge Online (AKO) architecture and for the “minimal data loss/hours operational down-time” combination includes Department of Defense Intelligence Information System and Air Force Material Command (DODISS, AFMC) architecture. Where available, the applicable solution class412helps to identify appropriate solutions by pre-identifying solutions meeting requirements for inclusion in such solution class412.

FIG. 6illustrates an exemplary mapping of business processes to supporting information technology sub-system/data classes. The mapping process500includes reviewing a mission definition502of the enterprise and listing504one or more business processes506A-504C (e.g., business processes1to N where N is a positive integer) that enable and/or facilitate achievement of the mission definition502. Where the enterprise does not already have a mission definition502, a mission definition may be developed prior to beginning the mapping process500.

The mapping process500also includes grouping508assets of the enterprise's information technology system510into a number of functional subs-system/data class groups512A,512B,512C,512D,512Z. In this regard, the information technology system510assets may include, for example, several different types of computing systems514,516,518,520and522. Each type of computing system514-522may include various hardware, software and data components, and one or more of the types of computing systems514-522may or may not be connected with one another via one or more networks. AlthoughFIG. 6suggests that there may be five different functional sub-system/data class groups (e.g., functional sub-system/data class groups A, B, C, D and Z), there may be as few as one functional sub-system/data class group or more than five functional sub-system/data class groups identified in the grouping508process.

One or more of the computing system types514-522may be included in more than one of the functional sub-systems/data classes512A,512B,512C,512D,512Z. For example, computing systems of type514may be included in both functional subsystems/data classes512C and512D, computing systems of type516may be included in functional subsystems/data classes512A,512C and512Z, computing systems of type520may be included in functional subsystems/data classes512A,512C and512Z, and computing systems of type522may be included in functional subsystems/data classes512A and512B. Also, one or more computing system types514-522may be included in only one of the functional sub-systems/data classes512A,512B,512C,512D,512Z. For example, computing systems of type518may be included in only functional sub-system/data class512Z.

With the business processes506A-506C identified and the information technology system assets grouped into functional sub-system/data class groups512A,512B,512C,512D, and512Z, the mapping process500continues with identifying524one or more of the functional sub-system/data class groups512A,512B,512C,512D, and512Z that support one or more of the business processes506A-506C. For example, as shown inFIG. 6, functional sub-system/data class groups512A,512C and512Z may be identified as supporting the first business process506A. Other combinations of one or more of the functional sub-system/data class groups512A,512B,512C,512D,512Z may support the other identified business processes506B,506C.

Prior to identifying524functional sub-system/data class groups512A,512B,512C,512D,512Z that support business processes506A-506C, the business processes506A-506C may be classified in accordance with one or more levels that define how critical a particular business process506A-506C is to achievement of the enterprise's mission definition502. For example, the business processes506A-506C may be classified as critical or non-critical. In other embodiments, more than two levels may be used in classifying the criticality of the business processes506A-506C. Thereafter, identification524of supporting functional sub-system/data class groups512A,512B,512C,512D,512Z may only be done for business processes506A-506C classified within certain classes (e.g., for only business processes506A classified as critical).

FIG. 7illustrates an exemplary mapping of the supporting functional sub-system/data class groups associated with a particular business process to appropriate solution categories. The functional sub-system/data class group to solution mapping process600utilizes a three-dimensional solution mapping and disruption tolerance decision matrix400such as shown inFIG. 5. The functional sub-system/data class group to solution mapping process600includes associating602each functional subs-system/data class group512A,512C,512Z associated with the first business process506A with a solution class412in the solution mapping and disruption tolerance decision matrix400. In this regard, reference is made to the appropriate situation (e.g., the large packet delay situation410in the present example) along the third axis406of the matrix400for the packet delay situation between the primary and disaster recovery sites. One or more of the solution classes412may be associated with more than one functional sub-system/data class group512A-512Z, one or more of the solution classes412may be associated with only one functional sub-system/data class group512A-512Z, and one or more of the solution classes412may not be associated with any of the functional sub-system/data class groups512A-512Z. For example, functional sub-system/data class groups512A and512Z may be associated602with a solution class412corresponding with the combination of “no data loss” category along the first axis402and “seconds of operational down-time” category along the second axis404, functional sub-system/data class group512C may be associated602with a solution class412corresponding with the combination of “no data loss” category along the first axis402and “days of operational down-time” category along the second axis404.

Once a functional sub-system/data class group512A-512Z is associated with a solution class412, reference604is made to a list606of solutions corresponding with each solution class412associated with a functional sub-system/data class group512A-512Z to identify one or more appropriate solutions for the recovering data included in the functional sub-system/data class group if a disaster event were to take place. The corresponding lists606include solutions pre-determined to meet the applicable solution class412. For example, the solutions may have been certified by the organization promulgating the applicable solution class. Different lists606may correspond with different solution class412, although one or more solutions may be common to more than one list606. Thereafter, a solution may be selected for each functional sub-system/data class group512A-512Z and implemented within the information technology system to provide the desired level of data protection.

While various embodiments of the present invention have been described in detail, further modifications and adaptations of the invention may occur to those skilled in the art. However, it is to be expressly understood that such modifications and adaptations are within the spirit and scope of the present invention.