IBM DS8000 Safeguarded Copy – Protecting Data

February 22nd, 2019 IBM DS8000 Safeguarded Copy – Protecting Data

Bob Elliott
VP Storage Solutions

 

Customers are looking for help with new security challenges

Cybertheft. Malware. Hackers. Ransomware.

It seems to be coming from all angles.

Remember WannaCry?

It prompted sudden investments in Data Security.
Mainline published a blog on the subject here: https://mainline.com/wannacry-organization-tears

IT teams are charged with protecting their company, their customers, themselves. GDPR brings with it new security requirements. IBM has introduced a new tool to make that easier and more responsive. While the United States has not addressed the issue as thoroughly as some (GDPR is a European Union initiative), there is a lot of investment being brought to bear in cybersecurity.

Building on FlashCopy

The IBM DS8000 storage array was a pioneer in the use of instant copies of volumes or LUN’s to protect data from corruption and accidental (or intentional) deletion. A virtually identical copy was created using FlashCopy commands within the array, from a script or through automation using a pointer-based process. In other words, the array didn’t have to copy the data to create the new volume. Instead, a new set of pointers to the existing data created a virtual view of a new volume, using the original data. If desired, the data from the original volume was copied in the background to create a discrete new volume with its own copy of the data.

DS8000 FlashCopy was architected to be fast and lightweight. The pointer creation process took milliseconds, and while the optional data copy process could take time for a large volume, the FlashCopy output volume was available immediately. An option exists to use thin provisioned volumes as output volumes, which makes the process lightweight and space efficient.

However, there are limitations. While an individual copy is lightning fast, creating thousands of copies at once can begin to slow the process down. And, under the FlashCopy rules, up to 12 relationships can be linked to a source volume. That can be a problem – if you want to make many copies to give you the option of granular points in time for the recovery process. If you can make enough copies, the process becomes more like Continuous Data Protection (CDP) methodologies. Safeguarded copies solve this problem and give you an additional layer of protection from data compromise.

Safeguarded Copy Concepts

As noted, FlashCopy allows up to 12 relationships per source volume, which limits the number of copies that can be made. The copies can be used to repair compromised data by picking one that is known to be safe and then reversing the relationship to restore the condition of the corrupted source volume. The current FlashCopy relationship limit does not provide much granularity of the points in time that can be used, which makes data recovery more cumbersome and time consuming. If the corruption is not recognized immediately, you may not even have a point in time to choose from.

Safeguarded Copy offers dramatically increased targets – up to 500 currently – providing far more granularity and longer time ranges to recover from. The technology also offers data protection beyond what was available with FlashCopy – a concept commonly referred to as immutability. The Safeguarded Copy is not a traditional volume – like a FlashCopy target volume is – and cannot be accessed directly. Therefore, it cannot be compromised or intentionally (or accidentally) deleted. Safeguarded Copy is used instead to recover data to a volume that will be mounted by the host and used for the recovery.

Another benefit over FlashCopy is that since a Safeguarded Copy is not a traditional volume, it also does not use logical volume slots. As you can imagine, making up to 500 copies for each of the hundreds of Production volumes would rapidly consume the entire logical addressing scheme of the array, as well as consume as many volume slots on the host. Safeguarded Copies are stored in a special pool of capacity called Safeguarded Backup Capacity (SGBC). Here is a graphical representation of the relationship between source volumes, SGBC and recovery volumes:

Do Safeguarded Copies replace the need for FlashCopy? No. FlashCopy volumes are used when instant access to the copy is required, and granularity of the recovery point and protection of the copy from corruption is not the goal. Safeguarded Copy processes are compatible with other IBM HA/DR technologies, and copies can be grouped into Consistency Groups so that multi-volume environments can be protected as a single entity. Safeguarded Copy is managed by Copy Services Manager for all server types. It will also available for use with Globally Dispersed Parallel Sysplex (GDPS) for IBM z and Power (scheduled for the second half of 2019), which are IBM’s backup and recovery automation and management tools. IBM’s BC/DR toolset is designed for simplicity in creating an effective data protection scheme and managing a complex environment.

More Information
For 30 years, Mainline has aided many customers in choosing the right storage solution for their specific needs.

Please contact your Mainline Account Executive directly for additional information, or click here to contact us with any questions..

Related Articles:

IBM DS8880 Safeguarded Copy Redbook

Hybrid Storage Solutions

Mainline