Granted Patent B1

US 12,621,145 · App. 18/938,459 · Granted May 5, 2026

Inventors: Dennis J. Trulli, Jr. (Hudson, BE); Peter Callewaert (Eernegem, BE)

Assignee: Dell Products, L.P.

H04L9/0894H04L9/3247

Abstract

Claims (53)

1 . A method of using a storage-based secure communication system to communicate between a production site and a cyber recovery vault on a data replication facility, comprising:

writing control information to a control file by a first communication subtask on the production site;

encrypting the control file, by the first communication subtask on the production site, using a cyber recovery vault public key, to create an encrypted control file;

digitally signing the encrypted control file, by the first communication subtask on the production site, using a production site private key to create a control file digital signature;

reading the encrypted control file by a second communication subtask on the cyber recovery vault;

decrypting the encrypted control file, by the second communication subtask on the cyber recovery vault, using a cyber recovery vault private key, to recreate the control file;

verifying the control file digital signature, by the second communication subtask on the cyber recovery vault, using a production site public key; and

in response to a determination that the control file digital signature is valid and that the control file is able to be recreated by decrypting the encrypted control file using the cyber recovery vault private key, implementing control operations on the cyber recovery vault in accordance with control information contained in the control file.

2 . The method of claim 1 , wherein the control file is a set of one or more files implemented in a controller-based file system.

3 . The method of claim 2 , wherein the controller-based file system is an accessible file system that is accessible by both the production site and the cyber recovery vault, whereby communication between the production site and the cyber recovery vault is restricted to remote data forwarding links between a storage system at the production site and a storage system at the cyber recovery vault site.

4 . The method of claim 3 , wherein the controller-based file system is implemented on the production site.

5 . The method of claim 3 , wherein the controller-based file system is implemented on the cyber recovery vault.

6 . The method of claim 2 , further comprising implementing public key exchange between the production site and the cyber recovery vault, the public key exchange comprising:

writing the production site public key by the first communication subtask on the production site to a key exchange file in the controller-based file system;

writing the cyber recovery vault public key by the second communication subtask on the cyber recovery vault to the key exchange file in the controller-based file system;

reading the cyber recovery vault public key by the first communication subtask on the production site from the key exchange file in the controller-based file system; and

reading the production site public key by the second communication subtask on the cyber recovery vault from the key exchange file in the controller-based file system.

7 . The method of claim 6 , further comprising deleting the key exchange file after implementing the public key exchange between the production site and the cyber recovery vault.

8 . The method of claim 1 , wherein the control information specifies a data replication modality to be used to transmit data on a set of one or more remote data forwarding links between the production site and the cyber recovery vault on the data replication facility; and

wherein implementing control operations on the cyber recovery vault in accordance with control information contained in the control file comprises changing the data replication modality used to transmit data on the set of one or more remote data forwarding links to match the control information.

9 . The method of claim 1 , further comprising:

creating snapsets of storage volumes in the cyber recovery vault at a predetermined cadence; and

in response to a determination that the control file digital signature is not valid or that the control file is not able to be recreated by decrypting the encrypted control file using the cyber recovery vault private key, pausing creation of the snapsets of the storage volumes in the cyber recovery vault.

10 . The method of claim 1 , wherein the control information further contains heartbeat information, the method further comprising:

creating snapsets of storage volumes in the cyber recovery vault at a predetermined cadence;

determining whether a recent portion of the heartbeat information is absent from the control information and, in response to a determination that the recent portion of the heartbeat information is absent from the control information, pausing creation of the snapsets of the storage volumes in the cyber recovery vault.

11 . A system for using a storage-based secure communication system to communicate between a production site and a cyber recovery vault on a data replication facility, comprising:

one or more processors and one or more storage devices storing instructions that are operable, when executed by the one or more processors, to cause the one or more processors to perform operations comprising:

writing control information to a control file by a first communication subtask on the production site;

encrypting the control file, by the first communication subtask on the production site, using a cyber recovery vault public key, to create an encrypted control file;

digitally signing the encrypted control file, by the first communication subtask on the production site, using a production site private key to create a control file digital signature;

reading the encrypted control file by a second communication subtask on the cyber recovery vault;

decrypting the encrypted control file, by the second communication subtask on the cyber recovery vault, using a cyber recovery vault private key, to recreate the control file;

verifying the control file digital signature, by the second communication subtask on the cyber recovery vault, using a production site public key; and

in response to a determination that the control file digital signature is valid and that the control file is able to be recreated by decrypting the encrypted control file using the cyber recovery vault private key, implementing control operations on the cyber recovery vault in accordance with control information contained in the control file.

12 . The system of claim 11 , wherein the control file is a set of one or more files implemented in a controller-based file system.

13 . The system of claim 12 , wherein the controller-based file system is an accessible file system that is accessible by both the production site and the cyber recovery vault, whereby communication between the production site and the cyber recovery vault is restricted to remote data forwarding links between a storage system at the production site and a storage system at the cyber recovery vault site.

14 . The system of claim 13 , wherein the controller-based file system is implemented on the production site.

15 . The system of claim 13 , wherein the controller-based file system is implemented on the cyber recovery vault.

16 . The system of claim 12 , the operations further comprising implementing public key exchange between the production site and the cyber recovery vault, the public key exchange comprising:

writing the production site public key by the first communication subtask on the production site to a key exchange file in the controller-based file system;

writing the cyber recovery vault public key by the second communication subtask on the cyber recovery vault to the key exchange file in the controller-based file system;

reading the cyber recovery vault public key by the first communication subtask on the production site from the key exchange file in the controller-based file system; and

reading the production site public key by the second communication subtask on the cyber recovery vault from the key exchange file in the controller-based file system.

17 . The system of claim 16 , the operations further comprising deleting the key exchange file after implementing the public key exchange between the production site and the cyber recovery vault.

18 . The system of claim 11 , wherein the control information specifies a data replication modality to be used to transmit data on a set of one or more remote data forwarding links between the production site and the cyber recovery vault on the data replication facility; and

wherein implementing control operations on the cyber recovery vault in accordance with control information contained in the control file comprises changing the data replication modality used to transmit data on the set of one or more remote data forwarding links to match the control information.

19 . The system of claim 11 , the operations further comprising:

creating snapsets of storage volumes in the cyber recovery vault at a predetermined cadence; and

in response to a determination that the control file digital signature is not valid or that the control file is not able to be recreated by decrypting the encrypted control file using the cyber recovery vault private key, pausing creation of the snapsets of the storage volumes in the cyber recovery vault.

20 . The system of claim 11 , wherein the control information further contains heartbeat information, the operations further comprising:

creating snapsets of storage volumes in the cyber recovery vault at a predetermined cadence;

determining whether a recent portion of the heartbeat information is absent from the control information and, in response to a determination that the recent portion of the heartbeat information is absent from the control information, pausing creation of the snapsets of the storage volumes in the cyber recovery vault.

Assignments (1)

References Cited (12)