Data consistency in an encrypted replication environment

• US 10,484,179 B1
• Filed: 03/31/2015
• Issued: 11/19/2019
• Est. Priority Date: 03/31/2015
• Status: Active Grant

• Current Assignee: Emc IP Holding Company LLC (Dell Technologies Inc.)
• Original Assignee: Emc IP Holding Company LLC (Dell Technologies Inc.)
• Inventors: Natanzon, Assaf, Amit, Amir
• Primary Examiner(s): Shaw, Peter C
• Application Number:
  US14/673,919
• Time in Patent Office: 1,694 Days
• Field of Search: 713193
• CPC Class Codes: G06F 21/64 Protecting data integrity, e.g. using checksums, certificates or signatures
• CPC Class Codes: G06F 3/0619 in relation to data integrity, e.g. data losses, bit errors
• CPC Class Codes: G06F 3/0665 at area level, e.g. provisioning of virtual or logical volumes
• CPC Class Codes: G06F 3/067 Distributed or networked storage systems, e.g. storage area networks [SAN], network attached storage [NAS]
• CPC Class Codes: H04L 9/3236 using cryptographic hash functions
• CPC Class Codes: H04L 9/3239 involving non-keyed hash functions, e.g. modification detection codes [MDCs], MD5, SHA or RIPEMD
• CPC Class Codes: H04L 9/3247 involving digital signatures

Abstract

A System, Computer Program Product, and computer-executable method for testing data consistency in a replicated data storage environment, wherein the replicated data storage environment includes a production site and a target site, wherein the target site is located within a cloud storage provider, the System, Computer Program Product, and computer-executable method includes receiving a request for a data consistency check of encrypted data stored at the target site, retrieving replicated signatures from the target site, retrieving production signatures from the production site, and determining data consistency based on an analysis of the replicated signatures and the production signatures.

Claims

1. A computer-executable method for testing data consistency in a replicated data storage environment, wherein the replicated data storage environment includes data storage systems at a production site and a target site, wherein the target site is located within a cloud storage provider and each of the data storage systems includes one or more processors and memory, the computer-executable method comprising:

receiving a request for a data consistency check of encrypted data stored at the second data storage system at the target site;

retrieving replicated signatures from the second data storage system at the target site, wherein the replicated signatures are based on encrypted data stored at the second data storage system, wherein the encrypted data is data that was encrypted with a production encryption key maintained only at the production site;

retrieving production signatures from a first data storage system from the production site, wherein retrieving production signatures comprises;

encrypting data from the first data storage system at the production site using the production encryption key maintained only at the production site; and

creating the production signatures based on the encrypted data from the production site; and

determining data consistency based on an analysis of the replicated signatures and the production signatures, wherein, to accurately verify consistency between the replicated signatures and the production signatures, the production encryption key maintained only at the production site is used for to encrypt both the encrypted data from the first data storage system and the encrypted data stored at the second data storage system.

2. The computer-executable method of claim 1, further comprising initiating a data consistency check at a host in communication with the replicated data storage environment.

3. The computer-executable method of claim 1, wherein the replicated data storage environment includes a Data Protection Appliance (DPA);

configuring the DPA to conduct the data consistency check.

4. The computer-executable method of claim 3, wherein configuring comprises:

creating a periodic event using the DPA, wherein the periodic event is enabled to initiate the data consistency check.

5. The computer-executable method of claim 1, wherein the replicated data storage environment is enabled to conduct the data consistency check on a periodic basis.

6. The computer-executable method of claim 1, wherein retrieving the signatures from the replica site comprises:

reading data from the replica site; and

creating signatures for the read data using a hashing function.

7. A system, comprising:

a replicated data storage environment, wherein the replicated data storage environment includes data storage systems at a production site and a target site; and

computer-executable program logic encoded in memory of one or more computers enabled to test for data consistency in the replicated data storage environment, wherein the computer-executable program logic is configured for the execution of;

receiving a request for a data consistency check of encrypted data stored at a first storage system at the target site;

retrieving replicated signatures from the target site, wherein the replicated signatures are based on encrypted data stored at a second storage system at the target site, wherein the encrypted data is data that was encrypted with a production encryption key maintained only at the production site;

retrieving production signatures from the production site, wherein retrieving production signatures comprises;

encrypting data from the production site using the production encryption key maintained only at the production site; and

creating the production signatures based on the encrypted data from the production site; and

determining data consistency based on an analysis of the replicated signatures and the production signatures, wherein, to accurately verify consistency between the replicated signatures and the production signatures, the production encryption key maintained only at the production site is used for to encrypt both the encrypted data from the first data storage system and the encrypted data stored at the second data storage system.

8. The system of claim 7, wherein the computer-executable program logic is further configured for the execution of initiating a data consistency check at a host in communication with the replicated data storage environment.

9. The system of claim 7, wherein the computer-executable program logic is further configured for the execution of:

wherein the replicated data storage environment includes a Data Protection Appliance (DPA); and

configuring the DPA to conduct the data consistency check.

10. The system of claim 9, wherein configuring comprises:

5 creating a periodic event using the DPA, wherein the periodic event is enabled to initiate the data consistency check.

11. The system of claim 7, wherein the replicated data storage environment is enabled to conduct the data consistency check on a periodic basis.

12. The system claim 7, wherein retrieving the signatures from the replica site comprises:

reading data from the replica site; and

creating signatures for the read data using a hashing function.

13. A computer program product for testing data consistency in a replicated data storage environment, wherein the replicated data storage environment includes data storage systems a production site and a target site, wherein the target site is located within a cloud storage provider, the computer program product comprising:

a non-transitory computer readable medium encoded with computer-executable code, the code configured to enable the execution of;

receiving a request for a data consistency check of encrypted data stored at a first data storage system at the target site;

retrieving replicated signatures from the target site, wherein the replicated signatures are based on encrypted data stored at a second data storage system at the target site, wherein the encrypted data is data that was encrypted with a production encryption key maintained only at the production site;

retrieving production signatures from the production site, wherein retrieving production signatures comprises;

encrypting data from the production site using the production encryption key maintained only at the production site; and

creating the production signatures based on the encrypted data from the production site; and

determining data consistency based on an analysis of the replicated signatures and the production signatures, wherein, to accurately verify consistency between the replicated signatures and the production signatures, the production encryption key maintained only at the production site is used for to encrypt both the encrypted data from the first data storage system and the encrypted data stored at the second data storage system.

14. The computer program product of claim 13, wherein the code is further configured to initiating a data consistency check at a host in communication with the replicated data storage environment.

15. The computer program product of claim 13, wherein the code is further configured to wherein the replicated data storage environment includes a Data Protection Appliance (DPA);

configuring the DPA to conduct the data consistency check.

16. The computer program product of claim 15, wherein configuring comprises:

creating a periodic event using the DPA, wherein the periodic event is enabled to initiate the data consistency check.

17. The computer program product of claim 13, wherein retrieving the signatures from the replica site comprises:

reading data from the replica site; and

creating signatures for the read data using a hashing function.