• 专利附录
  • 专利说明
  • 权利要求
  • 类似技术
  • 同族专利
  • 引用文献
  • 法律状态
  • 优先权
    • 专利摘要:
    The invention comprises a system and a method for selectively restoring a computer system to an operational state. The method creates a backup image of the computer system comprising a set of data blocks and can store the backup image of the computer system in an archive database (214). The method determines a subset of the backup image data blocks that are required to keep the computer system operational. In response to the determination that the computer system needs to be restored, the method can restore the subset of data blocks so that the computer system is operational during startup and can restore a remaining set of data blocks from backup image after starting the computer system.
    公开号:CH717425A2
    申请号:CH00679/20
    申请日:2020-06-08
    公开日:2021-11-15
    发明作者:Beloussov Serguei；Sergeev Alexey；Strogov Vladimir；Protasov Stanislav；Anton Enakiev
    申请人:Acronis Int Gmbh；
    IPC主号:
    专利说明:

    FIELD OF TECHNOLOGY
    The present disclosure relates in general to the field of data recovery and, more specifically, to systems and a method for selectively restoring a computer system to an operational state.
    STATE OF ART
    [0002] Conventionally, recovery (e.g. disaster recovery) of a computer system and computer system data is very often performed by extracting data from a previously made backup copy which contains an image of the system being carrying out the recovery. In many cases, during recovery, the system needs to be restored to an operational state as soon as possible after a computer crash or disaster occurs. However, when restoring the system and data from a backup copy, the data blocks obtained from the backup copy are read sequentially, i.e. in the order in which the data blocks were stored in the backup copy . Data recovery is not done in the order in which the data is needed for the fastest possible recovery of the system.
    Also, during retrieval, not all blocks of data stored in the archive may be needed. However, finding and retrieving those blocks that are required for retrieval and startup can take a long time, particularly if the archive is particularly large. For example, an archive such as that shown in Fig. 1 contains a backup archive (or image) 100 of a computer, server or similar device. A recovery agent starts the recovery process starting from the 1st block and proceeds to recover data up to the last data block sequentially. However, only a small number of blocks, such as blocks 3, 7, 12 and the like, may be required for initial system recovery to launch and boot the system. Such blocks might be scattered across archive 100 in random order, not at the beginning of archive 100, but in the center or at the end of the archive, so the recovery agent may take a significantly longer period of time to restore the 'archive.
    [0004] Therefore, the operation of the system is restored only after the entire archive 100 and all the blocks contained therein are restored. Only then can the system be loaded and run. As a result, there is a need to reduce system recovery times during recovery.
    SUMMARY
    In order to overcome these shortcomings, methods and systems for the selective restoration of a computer system to an operational state are described here.
    In one example, the method may create a backup image of the computer system comprising a set of data blocks and could store the backup image of the computer system in an archive database. The method can determine a subset of the backup image data blocks that are required to keep the computer system operational. In response to the determination that the computer system needs to be restored, the method can restore the subset of data blocks so that the computer system is operational during startup and can restore a remaining set of data blocks from backup image after starting the computer system.
    In one example, the method can determine the subset by creating and starting a virtual machine based on the backup image, by monitoring the data blocks accessed from the backup image during machine startup virtual, identifying the monitored data blocks in the subset and placing the monitored data blocks in a persistent data cache.
    In one example, the method may monitor data blocks by means of a filter driver.
    [0009] In an example, the monitored data blocks are requested, from a virtual disk of the virtual machine, starting from the backup image.
    In one example, the method can determine the subset by detecting that the computer system has initiated a first boot, by monitoring the data blocks read from a computer system disk during the first boot, and by identifying the monitored data blocks in the subset.
    In one example, the backup image is stored in a first type of archive of the computer system and the method can place the monitored data blocks in a second type of archive.
    In one example, the first type of storage is secure offline storage and the second type of storage is frequently accessed storage, where the data read / write speeds of the second storage type are faster compared to the data read / write speeds of the first type of storage.
    [0013] In one example, the method can determine the subset by evaluating a criticality of the data blocks and events that occur at the first start of the computer system, creating a set of rules based on the evaluated criticism and applying the set of rules to data blocks to divide the data blocks into a subset and a remainder set.
    In one example, the method can arrange the data blocks in an order in which the data blocks are to be read during the restore and can perform the restore of the data blocks based on that arrangement.
    In one example, the method may determine that the computer system needs to be recovered based on the detection of at least one of the following: (1) a malware attack on the computer system, (2) a disaster recovery request and (3) an event that causes the computer system to crash.
    In one example, the computer system is deemed to be operational when a plurality of pre-identified applications and important data associated with the plurality of pre-identified applications are functional and accessible on the computer system.
    It should be noted that the methods described above can be implemented in a system comprising a hardware processor. Alternatively, the methods can be implemented using computer executable instructions of a non-transient machine-readable medium.
    The aforementioned simplified summary of aspects of the example serves to provide a basic understanding of the present disclosure. This summary is not a complete overview of all aspects covered and is not intended to identify key or fundamental elements of all aspects or to outline the scope of any or all aspects of this disclosure. Its sole purpose is to present one or more aspects in simplified form in view of a more detailed description of the disclosure which follows. To achieve this objective, the aspect or aspects of the present disclosure include the features described and indicated by way of example in the claims.
    BRIEF DESCRIPTION OF THE DRAWINGS
    The accompanying drawings, which are integrated and form an integral part of the present specifications, illustrate one or more exemplary aspects of the present disclosure and, together with the detailed description, serve to explain the respective principles and implementations.
    Figure 1 is an illustration of a data archive containing a backup image of a computer or server.
    Figure 2 is a block diagram illustrating a system for selective restoring of a computer system to an operational state.
    FIG. 3 is a block diagram illustrating another system for selectively restoring a computer system to an operational state.
    Fig. 4 is a flowchart illustrating a method for selectively restoring a computer system to an operational state.
    Figure 5 is a block diagram of a computer system in which the disclosed system and method can be implemented based on an example.
    DETAILED DESCRIPTION
    An example in the context of a computer program system, method and product for selective restoration of a computer system to an operational state is disclosed herein. It is clear to those skilled in the art that the following description is purely illustrative and is not intended to be limiting in any way. Other aspects will readily be suggested to those skilled in the art who will benefit from this disclosure. At this point reference will be made in detail to the implementations of the exemplary aspects illustrated in the accompanying drawings. The same reference indicators will be used to the extent possible through the drawings and subsequent description with reference to the same or similar elements.
    In order to boot up a device or computer system that needs to be recovered as quickly as possible, the data blocks that are needed for booting should be identified as soon as possible. In the event of a disaster recovery where rapid recovery is desirable, those identified data blocks should be recovered first, without having to wait for the remaining blocks to be recovered. The recovery process, therefore, may not start from the 1st block in a backup image of a machine, but in this example starting with the 3rd block, then the 7th block, 12th block etc., as illustrated in Fig. 1. As a result, the blocks required for retrieval are collected and archived in a faster archive ("frequently accessed archive"), while the entire archive is stored in a relatively slower "secure offline archive" (where the secure offline archive and less expensive than the frequently accessed archive).
    [0027] In one example, the secure offline archive is intended for long-term archiving of data and, in particular, for archives that are not intended for frequent access. As a result, Secure Offline Storage prioritizes secure data storage, sacrificing data read and search speed, thereby significantly reducing secure offline storage costs. On the other hand, frequently accessed archive refers to storage that prioritizes quick access to frequently used data, capable of providing much faster searches than secure offline storage due to reading speeds and / or higher writing. In particular, frequently accessed storage has minimal processing requirements for data access and search speed, and possibly data writing. Therefore, frequently accessed storage is much more expensive than secure offline storage and therefore only stores data that needs to be accessed quickly and is therefore critical to a user or business. Frequently accessed storage may refer to a local storage disk in one example, while secure offline storage may refer to cloud storage or similar in one example, although aspects of this disclosure are not limited to such archives. On a more technical level, any type of storage where the access time to a block of data is greater than a predetermined time threshold (e.g. 500 milliseconds), due to both physical limitations of a disk and speed of Internet connection, can be classified as secure offline storage. If the access time is less than the predetermined time threshold, the storage type can be classified as frequently accessed storage.
    Fig.2 is a block diagram illustrating a system 200 for selective restoration of a computer system to an operational state, according to an example of the present disclosure.
    The system 200 comprises a recovery controller 202, a recovery machine 204, a virtual machine for running tests 206, a driver 208, a secure offline storage 210 and a frequently accessed storage 212. The recovery controller 202 controls various components of system 200 which work together to recover machine 204 to a point where machine 204 can be booted, i.e. the operating system of machine 204 can enter an operational state and a user is able to use the machine 204 by first restoring those data blocks which are necessary to return the machine 204 to an operational state.
    In one example, an operational state refers to a state in which the machine can be used for any operation or, in one example, a portion of operations. An administrator can define what the operational status consists of; the operational state may be, for example, a state in which the machine can be used to access installed applications and data stored on associated disks or the like. In one example, an operational state indicates a state where important data is restored, important data is used by important applications, as determined by an administrator and / or a corporate security policy.
    In one example, the recovery controller 202 instructs a backup and recovery agent 205 to take a snapshot of the machine 204 and store the snapshot in the secure offline storage 210. The secure offline storage 210 represents any device data storage which stores large amounts of data that may not be needed immediately in the process of recovering a computer device (term used interchangeably with "operating system"). In one example, snapshots and full data backups of machines that are part of a network are stored in a backup archive 214 in the secure offline storage 210 by the backup and recovery agent 205. In another example, the secure offline storage 210 may include only inactive data or unnecessary data within a predetermined window of time by a computer or organization (for example, the first 10 minutes of startup). In this way, Secure Offline Storage 210 allows companies to keep data inactive in an offsite location and provide bulk data access only when needed to reduce network congestion and reduce local network storage.
    [0032] After the backup and recovery agent 205 performs the trusted image backup (s) of machines on a network, including machine 204, there may be an instance where an event occurs which causes a failure of the machine 204 and / or other computing device within the network. Machine 204 may contain important business data or it may be a server handling requests for important customer services or data. If the 204 machine or other machines fail, customers, business users, and administrators may not be able to perform important work functions, thereby reducing efficiency within the organization.
    Accordingly, in one example, in order to speed up the recovery of the important machine, for example the machine 204, the recovery controller 202 determines which portions of data from the snapshot are needed to restore the machine 204 to an operational state. In this example, the machine 204 can be considered operational (expression used interchangeably with "being in an operational state") when a plurality of pre-identified applications and important data associated with the plurality of pre-identified applications is functional and accessible on the machine 204. For example, machine 204 can be configured to receive data and perform a data filter to output the processed data. Suppose the filter eliminates empty elements in an input dataset. The filter can be an application that is manually identified by an administrator as an application that should be functional and accessible on the 204 machine. Any data that allows the filter application to be performed is therefore considered important data, which may include files of the operating system to run the operating system (which in turn performs the filter application) and DLL files. It should be noted that not all data associated with a pre-identified application is in fact important data. For example, a print plug-in on a word-editing application may not be required to enable word-editing functionality on the application. Consequently, the plug-in is not an important data. In one example, the recovery controller 202 can identify a subset of data blocks that include the important data and store the subset in the frequently accessed archive.
    In one example, the recovery controller 202 may maintain a list of portions of data, such as blocks of data, a backup image or snapshot that are used when booting or restoring a computer to a operational status. In one example the number of data portions is kept at the minimum number necessary to fully restore the machine 204 to an operational state. Consequently, the recovery controller 202 determines a subset of backup image data blocks that are required to keep the computer system operational.
    In this example, the administrator can determine which services or functions are available on the machine 204 so that it is considered operational. In other examples, machine learning can be leveraged to monitor machine 204 to learn, at boot time, which data is accessed first and which data is accessed last, as well as monitor which portions of the data are used when booting. particular services, the order of start-up services and the like. The data can change over time, taking into account historical restore operations, updating and maintaining a new list of data considered "important" or a block of data necessary to restore the machine to an operational state.
    In one example, the recovery controller 202 can start a virtual machine to run tests 206 with a snapshot or archive of the machine 204 saved in the backup storage 214. In this instance, the recovery controller 202 can mount a virtual disk 207 and also inject a filter or driver of the file 208 to monitor requests made by the test virtual machine 206 to the virtual disk 207. In an example, the virtual disk 207 can be in the format VHD, VHDX, VMDK or similar, although this disclosure is not limited to such formats. The recovery controller 202 then monitors, through the driver 208, which blocks of snapshot or archive data have been accessed during machine startup or until the test virtual machine 206 has reached an operational state, such as defined by an administrator, through machine learning or similar.
    [0037] In one example, the data blocks accessed during startup or until the virtual machine 206 has reached an operational state are defined as the minimum data portions or the "minimum" data blocks, i.e. the blocks which are, at a minimum, used to start the machine 204. Such data blocks are then stored in the form of a list or any type of data structure in the frequently accessed archive 212, for example in a persistent cache 216 which is also maintained when an event occurs that causes the network or machines on the network to crash, such as a malicious attack, natural disaster, or similar event. In another example, the frequently accessed archive 212 is replicated and / or stored offsite in order to isolate the persistent cache 216 from attack or disaster. In other examples, the data blocks themselves are not cached in the persistent cache 216, but the links to the data blocks in the backup storage 214 are persistently cached. Although storing the minimum data blocks in the secure offline storage 210 requires of a longer recovery time than the operational state, in some cases it may be desirable to save space in the frequently accessed repository 212 for data that may be more important.
    In one example, the recovery controller 202 may subsequently reorder the list of data blocks in the persistent cache 216 in the order in which they were accessed while starting the computer in an operational state, to further reduce the recovery times. In further examples, the test virtual machine can be recalled after each new scheduled backup of machine 204. Since data blocks can be changed or updated (removed or added), the persistent cache contents are updated each time. In one example, persistent cache 216 is stored in a frequently accessed store 212, for example, as a data file or set of data files, that is, persistent cache 216 is stored in hard disk memory. In some other examples, however, the hot-access storage 212, and therefore the persistent cache 216, may be in RAM, in scenarios where no-loss of RAM is assured or the probability of such loss due to restart of the server, power loss or the like is below a predetermined threshold. In this case, persistent cache 216 can be restored from backup storage 214.
    Another example is shown in Fig. 3. In this example, instead of the recovery controller 202 which starts a test virtual machine 206 to determine a minimum number of data blocks, the recovery controller 202 implements a recovery driver monitor 300 to monitor the startup of the machine 204 whenever it is started. As monitoring occurs, the recovery controller 202 calls the backup and recovery agent 205 to initiate a backup operation 304 to create a backup image of the machine 204 and store the backup image in an archive of backup 214 of secure offline storage 210. Backup operation 304 stores the data blocks accessed during boot, that is, the hot blocks 302, in the persistent cache 216 on the hot storage server 212, while all the data blocks, including the minimum data blocks for restoring an operational state, are stored in the backup archive 214 in a secure offline archive 210. In a modification, the recovery controller 202 stores only "cold" blocks, that is, data blocks that are not 302 frequently accessed blocks, in secure offline storage 210.
    In another example illustrated in Figure 3, a machine learning (ML) module 310 is invoked by the retrieval controller 202 which collects information and events occurring on the machine 204 and other machines on the network. In one example, information and events include data about files and other objects that are required during particular events, such as computer startup, application launch, maintenance, or the like. Based on the collected information and events, the machine learning module 310 can create a set of rules on how to divide blocks of data into blocks that include important data and therefore need to be stored in the frequently accessed repository, and blocks that can be restored after restoring important data blocks (e.g. from secure offline storage). In one example, the rule set is based on preliminary data classifications regarding the criticality and / or usefulness of particular data, depending on various criteria. Criteria can include data location (e.g. dedicated folders or disks), access frequency, data ownership, and the like.
    For example, a rule may classify whether a certain data block is to be included in a subset of the plurality of data blocks or in a remaining subset of the plurality of data blocks. In one example, a rule can be formatted into an 'if-else' statement. Some rules, by way of example, can be (1) "if the data block in question includes a file of a pre-identified important application, place in the subset, otherwise place in the remaining set", (2) "if the data block in question includes a file that is included in an initial startup of the computer system, place in the subset, otherwise place in the remaining set ", (3)" if the data block in question includes a file that has been used in a threshold period of time prior to the restoration, place in the subset, otherwise place in the remaining set “etc.
    Using the methods described above, the persistent cache 216 stores the frequently accessed data blocks or the minimum data blocks necessary to restore the machine 204 to an operational state. In a disaster situation, after a malicious attack, during a disaster recovery or the like, the recovery controller 202 restores the frequently accessed blocks (e.g. minimal data blocks) identified in the persistent cached list 216 starting from the backup image. Subsequently, the recovery controller 202 performs a boot of the computer system with the blocks associated with restoring an operational state of the restored machine 204. The recovery controller 202 then restores a remaining set of blocks from the backup image after the computer system is booted.
    Fig. 4 is a flowchart illustrating a method 400 for selectively restoring a computer system to an operational state, according to an example of the present disclosure.
    At operation 402, the recovery controller 202 entrusts the backup and recovery agent 205 with the task of creating a backup image of a computer system, for example the machine 40 illustrated in Figure 2, comprising a set of data blocks.
    At operation 404, the recovery controller 202 controls the backup and recovery agent 205 to store the backup image of the computer system in an archive database. In one example, the archive database and the secure offline archive.
    At operation 406, the recovery controller 202 identifies a data block from the set of data blocks. At operation 408, the recovery controller 202 determines whether the identified data block is necessary to keep the computer system operational. In one example, operational is understood to be in an operational state after the completion of computer startup or when a plurality of pre-identified applications and important data associated with the plurality of pre-identified applications are functional and accessible on the computer system, such as defined by machine learning or by an administrator or a combination thereof.
    If the absence of the data block prevents the computer system from being operational, at operation 410, the recovery controller 202 identifies the data block as part of a subset of data blocks that should be prioritized during recovery . In one example, the subset of data blocks is determined by the recovery controller 202 which starts a test virtual machine and restores the backup image to a virtual disk of the test virtual machine. A filter driver intercepts requests from the virtual hard disk to the backup image during boot to determine which data blocks are needed to restore the machine to an operational state - those data blocks are logged and persistently cached. In an alternate example, the recovery check inserts a monitor driver into machine 204, observes the machine boot and the data blocks called during boot. These retrieved data blocks are referred to as "frequently accessed blocks" and are stored in a persistent cache for quick future retrieval.
    [0048] When the virtual machine starts up, the virtual machine reads data from the hard drive. The disk is virtualized (mounted) using a driver so that the data is read directly from the backup archive (e.g. backup archive 214). Data that has already been read (or written by the virtual machine) is placed on the "real" virtual disk so that no repeated reads from the archive are made. During the virtual machine startup, not all the data required for subsequent processing is read. For example, the entire database is not readable by programs such as Exchange or SQL. The minimum set of data consists of the data that the virtual machine reads up to the point where the virtual machine is considered to be in an "operational state" like the one defined above.
    In one example, a dedicated filter driver is used to keep track of which sectors, data blocks or files are used on first boot. Using this filter driver, you can determine the files that are needed to restore a machine to an operational state (according to a default configuration). The virtual test machine offers a realistic environment in which such tracing can be performed.
    However, if the data block is not needed, the recovery controller 202 identifies the data block as part of a remaining set of data blocks (e.g., blocks that are not to be prioritized). At operation 414, the recovery controller 202 determines whether there are other data blocks in the set of data blocks to consider (which were not evaluated at operation 408). If there are other data blocks to consider, method 400 returns to operation 406 and another data block is selected. The loop between 406 and 414 can continue until all data blocks in the set have been classified.
    In one example, after classifying each data block, the recovery controller 202 can store the subset of data blocks in a persistent cache 216 and keep the remaining set of data blocks in the secure offline storage (e.g. hard drive).
    At operation 416, the recovery controller 202 determines that the computer system needs to be recovered. In one example, the determination that the computer system needs to recover is based on the detection of at least one of the following: (1) a malware attack on the computer system, (2) a disaster recovery request, and (3) an event that causes the computer system to crash.
    At operation 418, the recovery controller 202 restores the subset of the data blocks so that the computer system is operational during startup.
    At operation 420, the recovery controller 202 restores a remaining set of data blocks from the backup image after the computer system is started. In one example, the recovery controller 202 accesses the secure offline storage to retrieve the entire backup image, then compares the image blocks to the persistent cache blocks. If the blocks are contained in the persistent cache 216, the block is skipped (having already been restored at operation 418) and only the blocks not found in the persistent cache are restored to the computer system.
    Figure 5 is a block diagram illustrating a computer system 20 on which aspects of systems and methods of selective restoration of a computer system to an operational state can be implemented according to an example. It should be noted that the computer system 20 can correspond to any component of the system 100 described above. The computer system 20 can be in the form of multiple computing devices or in the form of a single computing device, for example a desktop computer, a notebook, a portable computer, a mobile computing device, a smartphone, a tablet, a server, a mainframe, embedded device, or other form of computing device.
    As illustrated, the computer system 20 includes a central processing unit (CPU) 21, a system memory 22 and a system bus 23 which connects the various components of the system, including the memory associated with the processing unit central 21. The system bus 23 can comprise a bus memory or a bus memory controller, a peripheral bus and a local bus which is capable of interacting with any other bus architecture. Examples of buses may include PCI, ISA, PCI-Express, HyperTransport ™, InfiniBand ™, Serial ATA, I <2> C, and other suitable interconnects. The central processing unit 21 (also called processor) can include one or more sets of processors equipped with single or multiple cores. The processor 21 can execute one or more computer executable code, implementing the techniques of the present disclosure. System memory 22 may be any memory for storing used data and / or computer programs which are executable by processor 21. System memory 22 may include volatile memory such as random access memory (RAM) 25 and non-volatile memory such as read-only memory (ROM) 24, flash memory etc. or any combination thereof. The basic entry / exit system (BIOS) 26 can store basic procedures for transferring information between elements of the computer system 20, such as those when loading the operating system using ROM 24.
    The computer system 20 may include one or more storage devices such as one or more removable storage devices 27, one or more non-removable storage devices 28, or a combination thereof. One or more removable storage devices 27 and non-removable storage devices 28 are connected to the system bus 23 via a storage interface 32. In one example, the storage devices and corresponding computer-readable storage media are independent modules. 'power supply for storing computer instructions, data structures, program modules and other computer system data 20. System memory 22, removable storage devices 27, and non-removable storage devices 28 can use a variety of computer readable storage media. Examples of computer readable storage media include machine memory, such as cache, SRAM, DRAM, zero capacitor RAM, twin transistor RAM, eDRAM, EDO RAM, DDR RAM, EEPROM, NRAM, RRAM, SONOS, PRAM; flash memory or other storage technology such as solid state drives (SSDs) or flash drives; magnetic cassettes, magnetic tape and magnetic disk storage such as hard disk drives or floppy disks; optical archive such as compact discs (CD-ROMs) or digital versatile discs (DVDs); and any other medium that can be used to store the desired data and which can be accessed through the computer system 20.
    The system memory 22, the removable storage devices 27 and the non-removable storage devices 28 of the computer system 20 can be used to store an operating system 35, further program applications 37, other program modules 38 and data of the program 39. The computer system 20 may include a peripheral interface 46 for communicating data from input devices 40, such as keyboard, mouse, stylus, game controller, voice input device, touch input device or other peripheral devices, such as a printer or scanner through one or more I / O ports, such as a serial port, parallel port, universal serial bus (USB), or other peripheral interface. A display device 47 such as one or more integrated monitors, projectors or displays, can be connected to the system bus 23 through an output interface 48, such as a video adapter. In addition to the display devices 47, the computer system 20 can be equipped with other peripheral output devices (not shown), such as speakers and other audiovisual devices.
    [0059] The computer system 20 can operate in a network environment, using a network connection to one or more remote computers 49. The remote computer (s) 49 can be workstations or local computer servers, including most some or all of the above elements in describing the nature of a computer system 20. Other devices may also be present in the computer network, such as, but not limited to, routers, network stations, peer devices or other network nodes. The computer system 20 may include one or more network interfaces 51 or network adapters for communicating with remote computers 49 via one or more networks such as a local range computer network (LAN) 50, a wide range computer network (WAN ), an intranet and the Internet. Examples of the 51 network interface may include an Ethernet interface, a Frame Relay interface, a SONET interface, and wireless interfaces.
    Aspects of the present disclosure may be a computer program system, method and / or product. The computer program product may include a computer readable storage medium (s) having computer readable program instructions thereon that causes a processor to perform aspects of this disclosure.
    The computer-readable storage medium may be a tangible device that can store and store program code in the form of instructions or data structures accessible by a processor of a computing device, such as a computer system 20. Readable storage device may be an electronic storage device, a magnetic storage device, an optical storage device, an electromagnetic storage device, a semiconductor storage device, or any suitable combination thereof. By way of example, such computer-readable storage medium may comprise a random access memory (RAM), a read-only memory (ROM), an EEPROM, a portable compact disk (CD-ROM) read-only memory, a versatile digital disk (DVD), a flash memory, a hard disk, a laptop disk, a memory stick, or even a mechanically encoded device such as punch cards or embossed structures in a groove on which instructions are recorded. According to this usage, the computer readable storage medium is not to be understood as transient signals per se, such as radio waves or other freely propagating electromagnetic waves, electromagnetic waves propagating through a waveguide or transmission media or electrical signals transmitted via cable.
    The computer-readable program instructions described herein can be downloaded to the respective computing devices from a computer-readable storage medium or an external computer or an external storage device via a network, e.g. the Internet, an area network local, a wide-range network and / or a wireless network. The network may include copper transmission cables, optical transmission fibers, wireless transmission, routers, firewalls, switches, computer gateways, and / or perimeter servers. A network interface in each computing device receives computer-readable program instructions from the network and forwards the computer-readable program instructions to store in a computer-readable storage medium within the respective computing device.
    The computer-readable program instructions for performing the operations of the present disclosure can be assembly instructions, instruction set architecture (ISA), machine instructions, machine-dependent instructions, microcode, firmware instructions, setup data state or source code or object code written in any combination of one or more programming languages, including an object-oriented programming language and conventional procedural programming languages. The machine-readable program instructions can run entirely on the user's computer, partly on the user's computer in the form of a stand-alone software package, partly on the user's computer and partly on a remote computer or entirely on the computer or remote server. In the latter scenario, the remote computer can be connected to the user's computer via any type of network, including a LAN or WAN, or the connection can be made to an external computer (for example, via the Internet). In one example, electronic circuitry, including, for example, programmable logic circuitry, field programmable gate arrays (FPGAs) or programmable logic arrays (PLAs), can execute computer-readable instructions using human-readable program instruction status information. by computer to customize the electronic circuit in order to perform aspects of this disclosure.
    In various examples, the systems and methods described in the present disclosure can be addressed in terms of modules. The term "module" used here refers to a real world device, component or arrangement of components implemented via hardware, such as from an application specific integrated circuit (ASIC) or FPGA, for example, or as a combination of hardware and software, for example from a microprocessor system and a set of instructions to implement the functionality of the module, which (during execution) transforms the microprocessor system into a device for specific purposes. A module can also be implemented as a combination of the two, with certain functions facilitated by hardware alone and other functions facilitated by a combination of hardware and software. In certain implementations, at least a portion, and in some cases all portions, of a module can be executed on the processor of a computer system (for example the one described in greater detail in the aforementioned Fig. 5). Consequently, each module can be built in a variety of suitable configurations and should not be limited to any particular implementation exemplified here.
    For the sake of clarity, not all routine features of the embodiments are disclosed here. It would be appreciated that, in the development of any actual implementation of this disclosure, numerous decisions for specific implementations are made in order to achieve the specific goals of the developer and those specific goals will vary for different implementations and different developers. It is understood that such a development effort could be complex and time-consuming but would nevertheless be a routine engineering activity for those skilled in the art benefiting from this disclosure.
    [0066] Furthermore, it is understood that the phraseology or terminology used in this context is purely descriptive and not limiting, therefore the terminology or phraseology referred to in these specifications must be interpreted by the experts in the field in the light of the teachings and guidelines presented here, in combination with the knowledge of experts in the respective field (s). In addition, any terms in the specifications or claims are not intended to be attributable to an unusual or special meaning, unless explicitly indicated as such.
    The various embodiments disclosed herein include present and future known equivalents to the known modules, referred to herein by way of illustration. Furthermore, although embodiments and applications have been illustrated and described, it is evident to those skilled in the art that they have the benefit of consulting the present disclosure, that many more modifications are possible than those mentioned above, without departing from the inventive concepts disclosed herein. .
    权利要求:
    Claims (15)
    [1]
    1. A method for selectively restoring a computer system to an operational state, comprising:creating a back-up image of the computer system comprising a set of data blocks;archive the back-up image of the computer system in the archive storage database;determining a subset of backup image data blocks that are required to keep the computer system operational;in response to the determination that the information system should be reset:restoring the subset of data blocks so that the computer system is operational during startup; Andrestoring a remaining set of data blocks from the backup image after the computer system is booted.
    [2]
    The method of claim 1, wherein the determination of the subset comprises:create and start a virtual machine based on the backup image;monitor blocks of data accessed from the backup image during virtual machine startup;identify the data blocks monitored in the subset; Andplace the monitored data blocks in a persistent data cache.
    [3]
    The method according to claim 2, which monitors the data blocks by means of a filter driver.
    [4]
    The method according to claim 2, wherein the monitored data blocks are requested, from a virtual disk of the virtual machine, starting from the backup image.
    [5]
    The method according to claim 1, wherein determining the subset comprises:note that the computer system has started its first startup;monitor the data blocks read from a disk of the computer system during the first start; Andidentify the data blocks monitored in the subset.
    [6]
    The method according to claim 5, wherein the backup image is stored in a first type of computer system memory, further comprising:place the monitored data blocks in a second type of memory.
    [7]
    The method according to claim 6, wherein the first type of storage is the secure offline storage and the second type of storage is the frequently accessed archive, and wherein the data read / write speeds of the second type storage are faster than the data read / write speeds of the former storage type.
    [8]
    The method of claim 1, wherein determining the subset further comprises:evaluate a criticality of the data blocks and events that occur in an initial start-up of the computer system;create a series of royals based on the criticism assessed;apply the rule set to data blocks to divide the data blocks into a subset and a remainder set.
    [9]
    The method according to claim 1, further comprising:arrange the data blocks in an order in which the data blocks are to be read during restore; Andperform recovery of data blocks based on the disposition.
    [10]
    10. The method of claim 1, wherein determining that the backup image should be restored is based on the detection of at least: (1) a malware attack on the computer system, (2) a disaster recovery request, and ( 3) an event that causes the computer system to crash.
    [11]
    The method of claim 1, wherein the computer system is deemed operational when a plurality of pre-identified applications and important data associated with the plurality of pre-identified applications are functional and accessible on the computer system.
    [12]
    12. A system for the selective restoration of a computer system to an operational state, comprising:a hardware processor configured to:creating a backup image of the computer system comprising a set of data blocks;archive the backup image of the computer system in the archive storage database;determining a subset of backup image data blocks that are required to keep the computer system operational;in response to the determination that the information system should be reset:restore the subset of data blocks so that the computer system is operational during startup; Andrestore a remaining set of data blocks from the backup image after booting the computer system.
    [13]
    The system according to claim 12, wherein the hardware processor is configured to determine a subset by:creating and starting a virtual machine based on the backup image;monitoring the data blocks accessed from the backup image during the virtual machine startup;the identification of the data blocks monitored in the subset; and the placement of monitored data blocks in a persistent data cache.
    [14]
    The system according to claim 12, wherein the hardware processor is configured to determine a subset by:the detection that the computer system has started the first start;monitoring the blocks of data read from a disk of the computer system during the first start; Andthe identification of the data blocks monitored in the subset.
    [15]
    The system according to claim 12, wherein the hardware processor is further configured to determine a subset by:the evaluation of a criticality of the data blocks and events that occur in an initial start-up of the computer system;the creation of a series of royals based on the criticism assessed;applying the rule set to data blocks to divide the data blocks into a subset and a remainder set.
    类似技术:
    公开号 | 公开日 | 专利标题
    KR102294568B1|2021-08-26|Method and apparatus for security checking of image for container
    US20170083359A1|2017-03-23|System and method for deploying a virtual machine
    EP2840495B1|2016-04-13|Container-based processing method and apparatus
    US8191063B2|2012-05-29|Method for migrating a plurality of virtual machines by associating files and state information with a single logical container
    EP2726977B1|2019-12-11|Virtual machine image analysis
    US8694983B1|2014-04-08|Systems and methods for providing guidance on the potential impact of application and operating-system changes on a computing system
    US10204019B1|2019-02-12|Systems and methods for instantiation of virtual machines from backups
    US9760447B2|2017-09-12|One-click backup in a cloud-based disaster recovery system
    JP6186374B2|2017-08-23|System and method for secure migration to a virtualized platform
    US8065272B2|2011-11-22|Systems and methods for tracking changes to a volume
    US20160232065A1|2016-08-11|Preserving management services with self-contained metadata through the disaster recovery life cycle
    US10037276B1|2018-07-31|Systems and methods for accelerating access to data by pre-warming the cache for virtual machines
    US9336131B1|2016-05-10|Systems and methods for enabling virtual environments to mount non-native storage disks
    US20160004577A1|2016-01-07|Technology for stall detection
    US10534617B2|2020-01-14|Backing up virtual machine operating system data on sequential-access data storage systems
    US9003139B1|2015-04-07|Systems and methods for recovering virtual machines after disaster scenarios
    CH717425A2|2021-11-15|System and method for the selective restoration of a computer system to an operational state.
    US20160210198A1|2016-07-21|One-click backup in a cloud-based disaster recovery system
    US10372547B1|2019-08-06|Recovery-chain based retention for multi-tier data storage auto migration system
    CN106775451A|2017-05-31|A kind of method and device for processing logical volume
    US9110918B1|2015-08-18|Systems and methods for measuring compliance with a recovery point objective for an application
    US20160266951A1|2016-09-15|Diagnostic collector for hadoop
    US9798573B1|2017-10-24|Physical to virtual scheduling system and method
    US11200206B2|2021-12-14|Maintaining metadata consistency of a mounted file system during runtime
    US11188249B2|2021-11-30|Storage alteration monitoring
    同族专利:
    公开号 | 公开日
    US20200348876A1|2020-11-05|
    EP3905046A4|2021-11-03|
    US11249791B2|2022-02-15|
    JP2021174495A|2021-11-01|
    EP3905046A1|2021-11-03|
    引用文献:
    公开号 | 申请日 | 公开日 | 申请人 | 专利标题
    US8065273B2|2006-05-10|2011-11-22|Emc Corporation|Automated priority restores|
    US8135748B2|2009-04-10|2012-03-13|PHD Virtual Technologies|Virtual machine data replication|
    EP3474138A1|2009-10-12|2019-04-24|Veeam Software Ag|Item-level restoration and verification of image level backups|
    US10783043B2|2018-03-16|2020-09-22|EMC IP Holding Company LLC|Automation and optimization of data recovery after a ransomware attack|US11086542B1|2020-02-24|2021-08-10|Amazon Technologies, Inc.|Network-configurable snapshot load order properties|
    法律状态:
    优先权:
    申请号 | 申请日 | 专利标题
    US201962840513P| true| 2019-04-30|2019-04-30|
    US16/863,233|US11249791B2|2019-04-30|2020-04-30|System and method of selectively restoring a computer system to an operational state|
    [返回顶部]