Creation and retention of immutable snapshots to facilitate ransomware protection
Systems and methods for creation and retention of immutable snapshots to facilitate ransomware protection are provided. According to one embodiment, multiple use cases for retention of snapshots are supported, including (i) maintaining a locked snapshot on a source volume of a first storage system on which it was originally created for at least an associated immutable retention time; (ii) replicating the locked snapshot to a destination volume of a second storage system and also maintaining the replica of the locked snapshot on the destination volume for at least the associated immutable retention time; and (iii) maintaining an unlocked snapshot on the source volume, replicating the unlocked snapshot to the destination volume, locking the replicated snapshot on the destination volume when it has an associated non-zero immutable retention time, and thereafter maintaining the replica on the destination volume in accordance with the immutable retention time.
1 . A method comprising:
receiving a replica of a snapshot of a source volume of a first storage system by a second storage system, wherein the replica is to be retained in locked form on a destination volume of the second storage system and wherein the snapshot is stored in unlocked form on the source volume;
locking the replica on the destination volume by assigning an immutable retention time to the replica based on a retention time associated with the snapshot; and
precluding deletion of the locked replica until a tamper-proof timer meets or exceeds the immutable retention time.
2 . The method of claim 1 , wherein the replica is received by the second storage system responsive to a request by the second storage system.
3 . The method of claim 2 , further comprising:
maintaining a data protection relationship between with the source volume and the destination volume; and
assigning a snapshot mirroring schedule to the data protection relationship, wherein the snapshot mirroring schedule specifies a frequency at which snapshots stored on the source volume are to be mirrored to the destination volume.
4 . The method of claim 3 , wherein the request is sent by the second storage system to the first storage system in accordance with the snapshot mirroring schedule.
5 . The method of claim 1 , wherein the first storage system is part of a first cluster of storage systems representing a first distributed storage system and the second storage system is part of a second cluster of storage systems representing a second distributed storage system.
6 . The method of claim 1 , wherein the immutable retention time is stored in a private metafile corresponding to the locked replica that is inaccessible to end users of the second storage system.
7 . The method of claim 6 , further comprising:
responsive to receipt of a request to delete the locked replica, determining whether deletion of the locked replica is permissible by accessing the private metafile;
after a negative determination indicating deletion of the locked replica is not permissible, retaining the locked replica; and
after an affirmative determination indicating deletion of the locked replica is permissible, deleting the locked replica.
8 . The method of claim 1 , wherein the tamper-proof timer is initialized with a time value upon creation, stored in memory, and updated independently of a system time of the second storage system.
9 . The method of claim 6 , wherein the private metafile is stored in a private index node (inode) space.
10 . A system comprising:
one or more processing resources; and
instructions that when executed by the one or more processing resources cause the system to:
receive a replica of a snapshot of a source volume of a first storage system by a second storage system, wherein the replica is to be retained in locked form on a destination volume of the second storage system and wherein the snapshot is stored in unlocked form on the source volume;
lock the replica on the destination volume by assigning an immutable retention time to the replica based on a retention time associated with the snapshot; and
preclude deletion of the locked replica until a tamper-proof timer meets or exceeds the immutable retention time.
11 . The system of claim 10 , wherein the replica is received by the second storage system responsive to a request by the second storage system.
12 . The system of claim 11 , wherein the instructions further cause the system to:
maintain a data protection relationship between with the source volume and the destination volume; and
assign a snapshot mirroring schedule to the data protection relationship, wherein the snapshot mirroring schedule specifies a frequency at which snapshots stored on the source volume are to be mirrored to the destination volume.
13 . The system of claim 12 , wherein the request is sent by the second storage system to the first storage system in accordance with the snapshot mirroring schedule.
14 . The system of claim 10 , wherein the first storage system is part of a first cluster of storage systems representing a first distributed storage system and the second storage system is part of a second cluster of storage systems representing a second distributed storage system.
15 . The system of claim 10 , wherein the immutable retention time is stored in a private metafile corresponding to the locked replica that is inaccessible to end users of the second storage system.
16 . The system of claim 13 , wherein the instructions further cause the system to:
responsive to receipt of a request to delete the locked replica, determine whether deletion of the locked replica is permissible by accessing the private metafile;
after a negative determination indicating deletion of the locked replica is not permissible, retain the locked replica; and
after an affirmative determination indicating deletion of the locked replica is permissible, delete the locked replica.
17 . The system of claim 10 , wherein the tamper-proof timer is initialized with a time value upon creation, stored in memory, and updated independently of a system time of the second storage system.
18 . The system of claim 15 , wherein the private metafile is stored in a private index node (inode) space.
19 . A non-transitory machine readable medium storing instructions, which when executed by one or more processing resources of a system including a first storage system and a second storage system, cause the system to:
receive a replica of a snapshot of a source volume of the first storage system by the second storage system, wherein the replica is to be retained in locked form on a destination volume of the second storage system and wherein the snapshot is stored in unlocked form on the source volume;
lock the replica on the destination volume by assigning an immutable retention time to the replica based on a retention time associated with the snapshot; and
preclude deletion of the locked replica until a tamper-proof timer meets or exceeds the immutable retention time.
20 . The non-transitory machine readable medium of claim 19 , wherein the replica is received by the second storage system responsive to a request by the second storage system.
21 . The non-transitory machine readable medium of claim 20 , wherein the instructions further cause the system to:
maintain a data protection relationship between with the source volume and the destination volume; and
assign a snapshot mirroring schedule to the data protection relationship, wherein the snapshot mirroring schedule specifies a frequency at which snapshots stored on the source volume are to be mirrored to the destination volume.
22 . The non-transitory machine readable medium of claim 21 , wherein the request is sent by the second storage system to the first storage system in accordance with the snapshot mirroring schedule.
23 . The non-transitory machine readable medium of claim 19 , wherein the immutable retention time is stored in a private metafile corresponding to the locked replica that is inaccessible to end users of the second storage system.
24 . The non-transitory machine readable medium of claim 23 , wherein the instructions further cause the system to:
responsive to receipt of a request to delete the locked replica, determine whether deletion of the locked replica is permissible by accessing the private metafile;
after a negative determination indicating deletion of the locked replica is not permissible, retain the locked replica; and
after an affirmative determination indicating deletion of the locked replica is permissible, delete the locked replica.
25 . The non-transitory machine readable medium of claim 19 , wherein the tamper-proof timer is initialized with a time value upon creation, stored in memory, and updated independently of a system time of the second storage system.
26 . The non-transitory machine readable medium of claim 23 , wherein the private metafile is stored in a private index node (inode) space.