JP2002084270A - Computer system for remote copy - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide a remote copy function which is compatibile with high data transfer performance and high encryption strength. SOLUTION: A primary disk sub system group 3 in a main center 9 repeats temporary stop and temporary stop release of a remote copy on a preset opportunity and the primary disk sub system group 3 transfers an encryption key to a secondary disk sub system group 7 of a remote center 10 in interlocking with the repetition to update the encryption key of the main center 9 and the remote center 10. Furthermore, the primary disk sub system group 3 encryption key update timing and release of encryption key update timing on a preset opportunity and the primary disk sub system group 3 transfers the encryption key to the secondary disk sub system group 7 of the remote center 10 in interlocking with the repetition to update the encryption key of the main center 9 and the remote center 10.

Description

DETAILED DESCRIPTION OF THE INVENTION

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to an external storage device for storing data of a computer system and an integrated system thereof, and in particular, to a plurality of external storage devices (subsystems) and a plurality of other remote storage devices. The present invention relates to a technology for encrypting and transferring data in a remote copy technology for interconnecting an external storage device (subsystem group) and duplicating data between external storage devices (subsystem groups) existing at remote locations.

[0002]

2. Description of the Related Art In consideration of data backup in the event of a natural disaster such as an earthquake, in a center composed of a host computer (upper device) and subsystems, a main center and a remote center need to be separated by about several hundred km. There is. Here, the subsystem refers to a control unit that transmits and receives information to and from a higher-level device, and a storage device that incorporates a disk device or the like that stores information. ). For this reason, some external storage systems employing a so-called remote copy function, which duplicates and holds data between subsystems respectively installed in the main center and the remote center, have already been put into practical use.

The remote copy function is roughly classified into two types, a synchronous type and an asynchronous type. Synchronous type: When a host computer (upper device) in the main center issues a data update (write) instruction to a subsystem in the main center, if the instruction target is also the target of the remote copy function, This is a processing procedure for reporting the completion of the update process to the host device of the main center after the instructed update (write) is completed for the subsystem in the remote center which is the target of the remote copy function.
In this case, depending on the geographical distance between the main center and the remote center, a time delay (transmission time or the like) occurs due to the influence of the capacity of the data transmission line interposed therebetween.

[0004] On the other hand, the asynchronous type means that when an upper-level device in the main center issues an instruction to update (write) data to the subsystem, even if the instruction is directed to the remote copy function, As soon as the update processing of the subsystems in the main center is completed, the completion of the update processing is reported to the host device, and the data update (reflection) in the subsystems in the remote center is executed asynchronously with the processing in the main center. Refers to the procedure. For this reason, since the data update is completed in the processing time required in the main center, the transmission time due to the storage of the data in the remote center is not required.

In the asynchronous type, the contents of subsystems in the remote center do not always match those in the main center. Therefore, if the main center loses its function due to a disaster or the like, data that has not been completely reflected on the remote center will be lost. However, the access performance of the subsystem on the main center side can be set to the same level as when the remote copy function is not performed.

In order to realize these remote copy functions between remote locations with high performance and at low cost, an asynchronous type is used. In this case, since a public communication line is used as a transmission path for transferring (copying) data from the main side to the remote side, prevention of information leakage as described below is an important issue.

[Encrypted Data Transfer] When performing data transfer via a public communication line, encrypted data transfer is performed to prevent information leakage.
This may be applied to remote copy. In this case, encrypted data transfer is performed between the primary disk subsystem group at the main center and the secondary disk subsystem group at the remote center. In remote copying, since data is transferred over a long period of time, it is necessary to achieve both high data transfer performance and high encryption strength.

"Regarding encrypted data transfer in communication path" In a data communication system including two or more computers for communicating data via a network,
There is a method in which an application program of an own computer encrypts and transmits data to an application program of another computer. A specific disclosure of this method is, for example, “Encrypted data communication system”
This is described in detail in JP-A-9-139735. In the "encrypted data communication system", a relay service program is operated on each of two computers, and data is encrypted by the relay service and transmitted / received via a network, thereby encrypting data on a communication path. It realizes simplified data transfer.

[0009]

The prior art (encrypted data)
Data communication system), a function of transferring encrypted data in a communication path can be realized. However, in the prior art, when performing data transfer over a long period of time, the same encryption key is used without being updated for a long period of time, so that the encryption key may be maliciously decrypted and data may be stolen. Also, even when updating the encryption key, it was notified offline, so
The data transfer performance was getting worse. That is, the prior art does not consider compatibility between high data transfer performance and high encryption strength.

An object of the present invention is to realize a remote copy function that achieves both high data transfer performance and high encryption strength.

[0011]

In order to solve the above problems, the present invention mainly employs the following configuration.

A main center comprising a group of primary disk subsystems having control means connected to a higher-level device for transmitting and receiving data, and storage means for storing the data; a place separated from the group of primary disk subsystems; Control means for receiving encrypted data transferred from the primary disk subsystem group arranged in the storage means for storing the transferred data, a remote center comprising a secondary disk subsystem group having: The primary disk subsystem group updates the encryption key at predetermined or irregular intervals, interrupts the data transfer to the secondary disk subsystem group, and transmits the updated encryption key to the secondary disk subsystem. Remote transfer to systems Copy of the computer system.

A main center comprising a group of primary disk subsystems having a control means connected to a higher-level device for transmitting and receiving data and a storage means for storing the data, is provided separately from the group of primary disk subsystems. A remote center comprising a secondary disk subsystem group having a control means for receiving encrypted data transferred from the primary disk subsystem group and a storage means for storing the transferred data. The primary disk subsystem group determines whether or not it is time to update the encryption key of the encrypted data transfer during execution of the data writing process.
A remote copy computer system which updates the encryption key, adds a sequence number to the updated encryption key, transfers the updated encryption key to the secondary subsystem, and associates the updated encryption key with the transfer data to which the sequence number has been added.

A remote copy method for a storage system comprising a local storage system for storing data written from a host device and a remote storage system for storing a copy of the data, wherein the local storage system A system encrypting the data with an encryption key; transferring the encrypted data from the local storage system to the remote storage system; repeatedly updating the encryption key; Transferring the updated encryption key from the local storage system to the remote storage system, wherein the encrypting step uses the updated encryption key after the encryption key has been updated. Remote copy method of storage system.

[0015]

DESCRIPTION OF THE PREFERRED EMBODIMENTS A remote copy computer system according to an embodiment of the present invention will be described below with reference to the drawings. FIG. 1 is a diagram showing an overall configuration of a remote copy computer system according to an embodiment of the present invention, and FIG. 3 is a diagram showing a specific configuration of a primary disk subsystem of a main center according to the present embodiment.

FIG. 1 shows an example of a configuration when an embodiment of the present invention is applied in order to duplicate information (data) between any two centers in a plurality of data centers equipped with a computer system. .

One or more disk subsystems 3 (3-1, 3-2,..., 3-n) on the main center 9 side
And one or more disk subsystems 7 (7-1, 7-2, ..., 7-n) on the remote center 10 side
A remote copy system that is connected without going through the host devices (host computers) 1 and 8 and duplicates data between the two centers is realized. As a connection of the disk subsystem without the intervention of a host device, for example, a SAN
(Storage Area Network). FIG. 3 shows a configuration example of the disk subsystem 3 of the main center 9.

In the main center 9 of FIG. 1, the host device 1 having a central processing unit (CPU) for performing data processing.
Are connected to the primary disk subsystems 3-1, 3-2,
... Are connected to 3-n.

The primary disk subsystem 3-1,
3-2,..., 3-n include, as shown in FIG. 3, an interface control unit 21 that exchanges data (including information) from the higher-level device 1, data referred to or updated by the higher-level device 1, and Data buffer 22 for storing information about the storage location of update data during which the remote copy is temporarily stopped
And a magnetic disk drive 23 as a recording medium for recording this data, a microprocessor 24 for controlling the exchange of these data, and a disk array subsystem control unit 25 for controlling each of these elements. The interface control unit 21 is also an interface for exchanging data with the remote center 10.

The primary disk subsystem 3
In addition to the above-described constituent elements, -1 indicates a console 26 for the user to set the remote copy setting, and a control indicating the current remote copy status based on the control information set by the console 26. A remote copy control information storage unit 27 for storing bits.

The primary disk subsystem 3-1 of the main center 9 is connected to the secondary disk subsystem 7-1 of the remote center 10 via an interface cable 4-1. Similarly, the primary disk subsystem 3-2 has the interface cable 4
-2, the secondary disk subsystem 7-2
Connected to the primary disk subsystem 3-n
Is connected to the secondary disk subsystem 7-n of the remote center via the interface cable 4-n.

The interface cables 4-1, 4
... 4-n can be connected to a general public communication line using a line connection device or the like. In this configuration example, the interface cables 4-1 to 4
Described as -n.

When there are a plurality of disk subsystems 3, the disk subsystem 3-1 is a disk subsystem other than the disk subsystem 3-1 in which data to be remotely copied is stored in the main center 9. 3-2,..., 3-n via the interface cable 5. As described above, the main center 9 has a configuration in which the entire primary disk subsystem group 3 is connected by the interface cable 5 with respect to the disk subsystem 3-1 storing the data to be remotely copied.

The primary disk subsystem group 3 includes:
When the host device 1 issues a data write request to the primary disk subsystem group 3, the data is written to the data buffer 22 in its own subsystem in synchronization with the request, and the data buffer 22 in its own subsystem is further synchronized.
Asynchronously with the data being written to the secondary disk subsystem group 7 located in a remote location,
This is a group of disk subsystems that issue a data write instruction. The data written in the data buffer 22 in its own subsystem is recorded on the magnetic disk drive 23 synchronously or asynchronously.

As a remote copy method for asynchronously writing data to a remote location, the primary disk subsystem group 3 of the main center 9 connects its own subsystems in accordance with the order in which the volumes in their subsystems are updated. The update data is transferred to the secondary disk subsystem group 7 of the remote center 10 and the secondary disk subsystem group 7 of the remote center 10 is updated.
Is the mode in which the update data is reflected in the volume in its own subsystem in accordance with the order in which it was received, and the main center 9 side is optimal in the primary disk subsystem group 3 irrespective of the order in which the volumes in its own subsystem are updated. The data to be transferred is collectively transferred at the time of the scheduled schedule, and the secondary disk subsystem group 7 of the remote center 10 updates the update data to the volume in its own subsystem in the updated order regardless of the order in which the data was received. Mode to reflect, and possess.

The secondary disk subsystem group 7 includes:
From the primary disk subsystem group 3 connected by the interface cable 4 to the interface control unit 2
1 is stored in the data buffer 22 in the own subsystem.

That is, one or more disk subsystems 3-1, 3-2,..., 3-n
, 7-n, the same data is stored in one or more disk subsystems 7-1, 7-2,..., 7-n in the remote center 10. 1 shows the configuration. The arrow in FIG.
2 shows the flow of data for which a write instruction has been issued from the host device 1.

The primary disk subsystem group 3 has control bits indicating the encryption status in remote copy in the remote copy control information storage unit 27, and has a trigger or an irregular set in advance by the system operator. By changing the information of the control bits based on the timing of the interval or an instruction from the system operator at an arbitrary time, the remote copy can be temporarily stopped. In the embodiment of the present invention, the updated encryption key is notified from the primary side to the secondary side in this suspended state (details will be described later). When the remote copy is suspended, the primary disk subsystem group 3 becomes the secondary disk subsystem group 7
It does not issue the instruction to write the update data to the CPU and suspends it.

Here, the remote copy control information storage section of the primary disk subsystem 3-1 has a control defining whether or not to encrypt and transfer data when remotely copying data to the secondary disk subsystem group. Information may be stored. In the case where the control information specifies that data is to be encrypted and transferred, the data is encrypted and transferred, and the secondary disk subsystem group confirms the control information of the primary disk subsystem group. When the control information is to be transferred after being encrypted, the transferred data is subjected to a process adapted to the encryption (for example, it is necessary to decrypt the transferred data using an encryption key). ), The consistency of the data copied from the main center to the remote center can be obtained.

According to the present invention, the remote copy is temporarily stopped in this way, and the encryption key used for the data on the main center 9 and the data on the remote center 10 is notified by notifying the updated encryption key to the remote center during this time. Since the consistency of the key can be maintained, the encryption key of the remote copy can be updated without the intervention of the host device. Therefore, not only the mainframe but also an open system can realize the same function.

Further, the primary disk subsystem group 3 releases the suspension state based on a trigger set in advance by the system operator, a trigger at irregular intervals, or an instruction from the system operator at any time. Can be done.

When the suspended state is released, the primary disk subsystem group 3 synchronizes with the primary disk subsystem group 3 when a data write request is issued from the higher-level device 1 to the primary disk subsystem group 3. Is written to the data buffer 22 in the own subsystem. Further, asynchronously with the data being written to the data buffer 22 in the own subsystem, the An instruction to write data is issued. Then, the updated encryption key is used when data is actually transferred to the remote center.

With such a configuration, the volume of the primary disk subsystem group 3 to be remotely copied in the main center 9 and the remote center 1
The encryption key can be updated at the same timing with the volume of the secondary disk subsystem group 7 within 0. Further, while remote copy is suspended in the primary disk subsystem group 3,
The state of the data in the primary disk subsystem group 3 of the main center 9 at the time when the primary disk subsystem group 3 is
And the data state in the secondary disk subsystem group 7 of the secondary disk subsystem group 7 is the same. That is, at that time, the state of the data whose consistency is guaranteed between the two centers is guaranteed and maintained.

The suspension of the remote copy and the release of the suspension can be set for each volume pair of the remote copy. A plurality of volume pairs can be set in one volume group, and the status can be changed for each volume group. Then, the suspension or suspension cancellation is performed by any of the subsystems 3 and 7 and the higher-level devices 1 and 8
By displaying the information on the console or the monitor used to manage these systems, the user can recognize whether the remote copy is currently being performed and in what unit the remote copy is being performed. I can do things.

The interval between the suspension of the remote copy and the release of the suspension can be arbitrarily set by the user. Here, the time required to increase the risk of decryption due to interception of the remote copy transfer data is set as the cycle,
A cycle is described in which a remote copy is performed from the main center 9 to the remote center 10, where the temporary stop is performed, an updated encryption key is transmitted, the temporary stop is released, and the remote copy is performed again. deep. Of course, without being limited to this example, the intervals of the pause and the release of the pause may be set.

The host device 8 is a central processing unit that is connected to the secondary disk subsystem group 7 at the remote center 10 by the interface cable 6 and references and updates the secondary disk subsystem group 7. The host device 8 can perform processing as an alternative to the host device 1 when the host device 1 of the main center 9 cannot perform its original function due to a disaster or a failure. In addition, using data stored in the secondary disk subsystem group 7, processing different from that of the host device 1 of the main center 9 can be executed independently of the host device 1.

However, if the host device 8 does not perform processing on the secondary disk subsystem group 7 or does not have a substitute function for the host device 1, the host device 8 is unnecessary. Conversely, a host system 8 is provided, the disk subsystem 7-1 is connected to the other disk subsystems 7-2 to 7-n via the interface cable 11, and the same configuration as the primary disk subsystem group 3 of the main center 9 is provided. Thus, the main center 9 in FIG. 1 can function as a remote center and the remote center 10 can function as a main center.

As an embodiment of the present invention, a data duplication method and operation will be described with reference to FIG.

The file, volume, and disk subsystem 3 in which data to be duplicated is stored are selected by the operator in advance according to the need for duplexing, that is, remote copying. Then, it is necessary to always maintain the relationship between the target file, the target volume, and the disk subsystem 3 and the file, volume, and the disk subsystem 7 that store the copy of the selected data, and the consistency of the update order when duplexing. The operator determines in advance whether or not there is
Alternatively, it is set in the remote copy control information storage unit 27 in the primary disk subsystem 3-1 from the console 26 or the like.

The primary disk subsystem 3
For -1, an opportunity to suspend the remote copy and an opportunity to cancel the suspension are set. Since the setting of the trigger can be instructed from the higher-level device 1, it is possible to schedule in advance the trigger from the higher-level device 1 by a program of the higher-level device 1 that supports the automation of the operation.

In the above selection and setting, in the case of the disk subsystem 3 to which a dedicated console 26 can be connected or equipped, the host device 1 is not used and the console 26 is used.
Can be set through In this example, the operator does not use the higher-level device 1 but uses the time value held in the primary disk subsystem group 3 to allow the operator to perform remote copy temporary copy at irregular intervals in the primary disk subsystem 3-1 in advance. It is set so that the suspension and the release of the suspension are performed.

FIG. 2 shows a case where selection and setting are performed from a dedicated console. Initial setting of a remote copy path and a volume pair, that is, setting of a disk subsystem to which a remote copy request is to be issued is set in advance by the user in the upper-level device 1 (Step 1: S1 in FIG. (The same applies hereinafter.) Further, the initial setting of the suspension and the suspension release of the remote copy is set for each volume pair of the remote copy target (step 2). Normally, all volume pairs to be copied are defined as one volume group, and all volumes in the volume group are set to have the same status.

In this example, all the volumes of the disk subsystem 3 are set as remote copy targets. Therefore, hereinafter, the status of remote copy is described not as a volume pair or a volume group but as a disk subsystem.

As a method of setting a file or a volume to be remotely copied, a method of designating a specific address indicating a volume or a disk subsystem or a control program in the disk subsystem selects an address from an arbitrary range. You can also take the method. As an initial setting, an example is shown in which a path and a volume pair are set, and a temporary stop trigger and a temporary stop release trigger are set.

When the host device 1 issues a write command to the primary disk subsystems 3-1, 3-2,..., 3-n (step 3), the primary disk subsystem 3-1, 3-2, ..., 3-n
Executes the data storage process to the data buffer 22 in its own disk subsystem based on the write command (step 4). Here, the write command is a command for transferring an instruction for writing data and the write data itself.

When the write command is received, the primary disk subsystems 3-1, 3-2,..., 3-n
Obtains and refers to the control bit indicating the remote copy status stored in the remote copy control information storage unit 27 of the primary disk subsystem group 3,
It is confirmed whether or not the primary disk subsystem group 3 is in the remote copy suspension state (step 5).
Primary disk subsystems 3-1, 3-2, ...
.., 3-n indicates that when the primary disk subsystem group 3 is in the remote copy suspended state, the data buffer 2
When the writing of data to the second device is completed, the completion of the process for the write command is reported to the host device 1 (step 6). Thereafter, a write command is issued to the secondary disk subsystems 7-1, 7-2,..., 7-n, and the processing for the write command is completed.

When the storage location information of the data that has not been transferred to the remote center is held for the data that has been updated previously in the main center, all the data at the location are also stored in the secondary disk sub-unit of the remote center. It is determined that the data is to be transferred to the systems 7-1, 7-2,... 7-n, and a write command for writing the data is written to the secondary disk subsystems 7-1, 7-2,.
.. 7-n to complete the processing for the write command. At this time, the data is encrypted using the currently set encryption key and transferred from the primary disk subsystem to the secondary subsystem. That is,
The data by the write command and all untransferred update data (write data) are encrypted with the current encryption key and all are transferred to the remote center (step 7). Thereafter, the data transfer is suspended.

Next, an encryption key in the main center (an encryption key is used to encrypt / decrypt data using the key).
Is updated (step 8). Thereafter, the updated encryption key is transferred to the secondary disk subsystems 7-1, 7-2,.
... Transfer to 7-n (step 9). After transferring the encryption key, the primary disk subsystems 3-1, 3-2,
... 3-n releases the remote copy (data transfer) temporary suspension state of the primary disk subsystem group 3 (step 10). Therefore, after the remote copy suspension state, the updated new encryption key is used. That is, the data to be transferred to the remote is encrypted with the new encryption key (updated encryption key), and the encrypted data is transferred to the remote.

In steps 8 and 9, data having the same data length / data pattern as data generally transferred from the primary disk subsystem group 3 to the secondary disk subsystem group 7 is created. Alternatively, the updated encryption key may be embedded as a part thereof and the encryption key may be transferred to the remote. By doing so, there is no need to use a special packet for transferring the encryption key, and it is possible to conceal the timing of the temporary stop of the remote copy from the outside because it seems to be general data from the outside. As a result, the security when sending an encryption request is increased. Here, it is important that the data in which the encryption key is to be embedded is generally similar to the data being transferred, and it is not always necessary to completely match them.

On the other hand, if the primary disk subsystem group 3 is not in the remote copy suspended state in step 5, the primary disk subsystems 3-1 and 3-
2,..., 3-n report the completion of the process for the write command to the host device 1 when the data writing to the data buffer 22 is completed (step 11), and based on the processing capability of the own subsystem. With the opportunity decided,
Write command to secondary disk subsystem 7-
1, 7-2,..., 7-n. At this time, a write command may not be immediately issued to the remote center for the data updated (written) in the main center, but this is stored in its own subsystem as storage position information of data not yet transferred to the remote center. Keep it. Further, in the case where the storage location information of the data which has not been transferred to the remote center is held for the data which has been previously updated in the main center, the data at the location is also stored in the secondary disk subsystem 7-1 of the remote center. 7-2,..., 7-n, and issues a write command for writing the data. At this time, the data is encrypted using the currently used encryption key and transferred to the secondary (step 12). The storage location information of the data is deleted after the process of transferring the write command to the remote is completed.

That is, if the primary disk subsystem group 3 is in the remote copy temporary suspension state, the primary disk subsystem group 3 of the main center 9 updates the encryption key and sends the updated encryption key to the remote center 1.
0 is transferred to the secondary disk subsystem group 7.
If the primary disk subsystem group 3 is not in the remote copy suspension state, the primary disk subsystem group 3 of the main center 9 uses the current encryption key due to the issuance of a write command from the host device 1. Remote copy is performed.

The secondary disk subsystem 7-1,
7-2,..., 7-n confirms that they have received the write command issued from the primary disk subsystems 3-1, 3-2,. That is, a process of storing data in the data buffer 22 in its own subsystem is performed (step 13).

The secondary disk subsystem 7-1,
7-2,..., 7-n are processes for the write command, that is, the data buffer 22 in the own subsystem.
When the data storage processing is completed, the completion of the write command is reported to the primary disk subsystems 3-1, 3-2,..., 3-n (step 14).

According to the present invention, the data written from the host device 1 is transferred to the primary disk subsystems 3-1 and 3-3.
,..., 3-n, and are also copied and stored in the secondary disk subsystems 7-1, 7-2, 7-n. Also, the primary disk subsystems 3-1, 3-2,... At the time when the primary disk subsystem group 3 enters the remote copy suspended state.
... The state of the data of 3-n indicates the secondary disk subsystems 7-1 and 7-2 on the remote center 10 side.
.. 7-n. At this time, the primary disk subsystem group 3 transfers the updated encryption key to the secondary disk subsystem group 7.

The secondary disk subsystem group 7 includes:
When the encryption key updated by the primary disk subsystem group 3 is received, the data can be decrypted using the updated encryption key. When the main center 9 is damaged, the data of the secondary disk subsystems 7-1, 7-2,.
Perform recovery work such as re-executing the job, and resume the business. These are all realized only by the functions of the disk subsystem and do not impose a burden on the processing capability of the host device.

As described above, according to the first embodiment of the present invention, the temporary stop of the remote copy set at appropriate time intervals (meaning that the remote copy is temporarily stopped, This is a system in which the encryption key is updated between the suspension and the suspension release, and the updated encryption key is also notified to the remote center. The data is decrypted using the updated encryption key, and the correspondence between the data transferred to the remote center and the encryption key is clear.

After all, the first embodiment of the present invention has the following configuration, function and operation. The primary disk subsystems of the main center and the secondary disk subsystems of the remote center that are mutually remote are connected. Upon receiving the update data from the host device, the primary disk subsystem group of the main center starts storing data in its own subsystem.

Then, the primary disk subsystem group confirms whether or not its own subsystem is in a state of changing the encryption key. If the current state is not the timing for changing the encryption key, the primary disk subsystem group transfers the data to the remote center using the current encryption key. If it is time to change the encryption key, the primary disk subsystems transfer data to the remote center after sending the data received this time and the data that has not been transferred so far to the remote center. Is temporarily stopped, the encryption key is updated, the updated encryption key is transferred to the remote center, and the data transfer to the temporarily stopped remote center is resumed.

Data transfer to the remote center is not performed during the suspension. After the suspended state of data transfer to the remote center in the primary disk subsystems is released, the primary disk subsystems in the main center use the updated encryption key to update the secondary disk subsystems in the remote center. Resume the transfer.

In this way, data is duplicated by remote copy between the main center and the remote center while updating the encryption key.

Next, as a second embodiment of the present invention, an outline of a data duplication method and operation will be described with reference to FIG.

Steps 21 to 24 in the flow of FIG.
Are common to steps 1 to 4 in the flow of FIG. Here, the description starts from step 25.

When a write command is received from the host device 1, the primary disk subsystems 3-1, 3-2,
……… 3-n is the primary disk subsystem group 3
By obtaining and referring to the control bits indicating the remote copy status stored in the remote copy control information storage unit 27, it is confirmed whether or not it is time for the primary disk subsystem group 3 to update the encryption key ( Step 25). Primary disk subsystem 3-
1, 3-2,..., 3-n are timings at which the primary disk subsystem group 3 updates the encryption key.
The encryption key is updated (step 26).

Thereafter, a sequence number (corresponding to the data sequence number) is given to the updated encryption key, similarly to the data generally transferred from the primary disk subsystem group 3 to the secondary disk subsystem group 7. (Step 2
7), this encryption key is transferred to the secondary disk subsystem 7
-1, 7-2,..., 7-n (step 2
8) The information indicating the data update position (for example, the address of the data buffer) is stored in the subsystem (step 29), and when the writing is completed, the completion of the processing for the write command is reported to the host device 1 (step 29). Step 30). Further, the primary disk subsystem 3-
1, 3-2,..., 3-n cancel the timing for updating the encryption key of the primary disk subsystem group 3 (step 31).

The above will be specifically described. When a write request (write data) is sent from the host,
The primary disk subsystem assigns a sequence number to the data in the order in which the data was sent, and stores the data in the buffer. When appropriate, these data are encrypted using the current encryption key (old encryption key) and transferred to the secondary disk subsystem together with the sequence number. At this time, the order of the data transferred to the secondary disk subsystem does not necessarily have to be the order sent from the host. The reason is that the data can be rearranged in order based on the sequence number assigned to the data in the secondary disk subsystem.

When the encryption key is updated, the primary disk subsystem updates its own encryption key (new encryption key) and assigns the sequence number assigned to the write data from the host. Then, the encryption key with the updated sequence number is transmitted to the secondary disk subsystem. Specifically, assuming that a sequence number has been added to the data, the sequence number is given to the updated encryption key at the timing of updating the encryption key.

Then, the updated encryption key (new encryption key) and the sequence number are paired and transferred to the secondary disk subsystem. The secondary disk subsystem that has received this, thereafter uses the encryption key updated with the sequence number for the received data. In other words, the secondary disk subsystem decrypts the data having the following sequence numbers using the pre-update encryption key, and uses the updated encryption key for the above sequence numbers. Decrypt the data.

Thereafter, when receiving a new write request, the primary disk subsystem assigns a sequence number to the data of this write request because the sequence number has already been used to send the encryption key, and stores it in the buffer. Store.
Thereafter, the data is encrypted with the updated encryption key at an appropriate opportunity, and is transferred to the secondary disk subsystem together with the sequence number.

When the secondary disk subsystem receives the actual data, it arranges the received data according to the sequence numbers. Then, the secondary disk subsystem that knows that the encryption key has been updated at the sequence number associates the old encryption key with the data having the sequence number and the new encryption key with the data having the sequence number. And perform decryption as necessary.

If the primary disk subsystem group 3 is not at the timing for updating the encryption key, the primary disk subsystems 3-1, 3-2,.
-N reports the completion of the process for the write command to the host device 1 when the writing is completed (step 32),
The write command is issued to the secondary disk subsystems 7-1, 7-2,..., 7-n on the occasion determined based on the processing capacity of the own subsystem. Then, the data is encrypted with the current encryption key and transferred to the remote center.

At this time, a write command may not be immediately issued to the remote center with respect to the data updated in the main center, but this is held in the own subsystem together with the storage position information of the data not yet transferred to the remote center. Is done. Further, in the case where the storage location information of the data which has not been transferred to the remote center is held for the data which has been previously updated in the main center, the data at the location is also stored in the secondary disk subsystem 7-1 of the remote center. 7-2,..., 7-n, and issues a write command for writing the data (step 33). Then, the data is encrypted with the current encryption key and transferred to the remote center. The storage position information of the data is deleted after the processing for the write command is completed.

That is, if the primary disk subsystem group 3 is at the timing of updating the encryption key, the primary disk subsystem group 3 of the main center 9 sends the updated encryption key to the secondary disk subsystem group 7 of the remote center 10. Forward. If the primary disk subsystem group 3 is not at the timing of updating the encryption key, the primary disk subsystem group 3 of the main center 9 performs remote copy because a write command is issued from the host device 1. .

The secondary disk subsystem 7-1,
7-2,..., 7-n confirms that they have received the write command issued from the primary disk subsystems 3-1, 3-2,. That is, the data is stored in the data buffer 22 in the own subsystem (step 34).

The secondary disk subsystem 7-1,
7-2,..., 7-n are processes for the write command, that is, the data buffer 22 in the own subsystem.
Upon completion of the data storage process, a report of the completion of the write command is sent to the primary disk subsystems 3-1, 3-2,..., 3-n (step 35).

According to the present invention, data written from the host device 1 is transferred to the primary disk subsystems 3-1 and 3-1.
,..., 3-n, and are also copied and stored in the secondary disk subsystems 7-1, 7-2, 7-n. At the point in time when the primary disk subsystem group 3 updates the encryption key, the primary disk subsystem group 3 assigns a sequence number to the updated encryption key and transfers it to the secondary disk subsystem group 7. .

The secondary disk subsystem group 7 includes:
Using the data generally transferred by the primary disk subsystem group 3 and the sequence number assigned to the updated encryption key, it is possible to identify and decrypt data to which the updated encryption key is to be applied. I can do it. If the main center 9 is damaged, the secondary disk subsystem 7-
Using the data of 1, 7-2,..., 7-n, recovery work such as re-execution of a job is performed, and the business is resumed. These are all realized only by the functions of the disk subsystem and do not impose a burden on the processing capability of the host device.

Next, as a third embodiment of the present invention, an outline of a data duplication method and operation will be described with reference to FIG. Here, it is assumed that the secondary disk subsystem stores the encrypted data received from the primary disk subsystem as it is.

During the execution of the remote copy, the main center 9
This is the operation when a disaster has occurred (step 41).
The main center 9 notifies the remote center 10 that a disaster has occurred (step 42). On the contrary,
The remote center 10 starts disaster recovery such as system startup (step 43). Secondary disk subsystem group 7 of remote center 10 without decryption
In order to use the data stored in, the decryption of the encryption is started (step 44). At this time, if the encryption key is stored in the secondary disk subsystem group 7, decryption is performed using the encryption key. The encryption key can also be stored in a storage device at another location other than the remote center 10. In this case, the encryption key is transferred to the secondary disk subsystem group 7 of the remote center 10 and decrypted using this.

When there is access from the higher-level device 8 of the remote center 10 to the data of the secondary disk subsystem group 7 (step 45), the secondary disk subsystem group 7 checks whether or not the accessed data has been decrypted. (Step 46). If the accessed data has not been decrypted, the secondary disk subsystem group 7 performs decryption on the data (step 47) and responds to the access using the decrypted data (step 48). If the accessed data has been decrypted, the secondary disk subsystem group 7 responds to the access using the data (step 4).
8). These are all realized only by the functions of the disk subsystem and do not impose a burden on the processing capability of the host device.

As described above, when a disaster occurs in the main center, the copy data in the remote center can be used by the disk subsystem of the remote center instead of the main center instead of the main center. As a result, the data is decrypted for all of the copy data or the copy data which is appropriately accessed.

Next, as a fourth embodiment of the present invention, an outline of a data duplication method and operation will be described with reference to FIG.

The remote center 10 accesses the secondary disk subsystem group 7 in order to use the data stored in the secondary disk subsystem group 7 of the remote center 10 without being decrypted by remote copying (step 51). ) Operation. Generally, when accessing data, the ID field or key field related to the data is searched, and when the search condition is satisfied, the subsequent data is read / written.

At this time, it is checked whether a search condition for a specific field, for example, a key field is satisfied (step 52). If this condition is satisfied, the subsequent data is decoded (step 53) and read / written (step 54). If this condition is not satisfied, an error is reported without decoding the subsequent data (step 55). These are all realized only by the functions of the disk subsystem and do not impose a burden on the processing capability of the host device.

[0084]

According to the present invention, it is possible to guarantee the consistency of the update data within the range expected by the user only by changing the function of the subsystem without introducing new software to the host device, and to leak information by updating the encryption key. It is possible to realize a remote copy encryption system which can reduce the danger of the remote copy.

[Brief description of the drawings]

FIG. 1 is a diagram showing an overall configuration of a remote copy computer system according to an embodiment of the present invention.

FIG. 2 is a flowchart showing processing of the remote copy system.

FIG. 3 is a diagram showing a configuration of a primary disk subsystem of a main center according to the embodiment.

FIG. 4 is a flowchart showing processing of the remote copy system.

FIG. 5 is a flowchart showing processing of the remote copy system.

FIG. 6 is a flowchart showing processing of the remote copy system.

[Explanation of symbols]

 DESCRIPTION OF SYMBOLS 1 Upper apparatus 2 Interface cable 3 Primary disk subsystem 4 Interface cable 5 Interface cable 6 Interface cable 7 Secondary disk subsystem 8 Upper apparatus 9 Main center 10 Remote center 11 Interface cable 21 Interface control unit 22 Data buffer 23 Magnetic disk drive 24 Micro Processor 25 Disk array subsystem control unit 26 Console 27 Remote copy control information storage unit

Continued on the front page (72) Inventor Takashi Oeda 1099 Ozenji Temple, Aso-ku, Kawasaki City, Kanagawa Prefecture Inside the Hitachi, Ltd.System Development Laboratory (72) Inventor Noboru Morishita 1099 Ozenji Temple, Aso-ku, Kawasaki City, Kanagawa Prefecture Hitachi, Ltd. F term in the system development laboratory (reference) 5J104 AA01 AA16 AA34 AA37 EA04 EA17 JA03 NA02 PA07

Claims (11)

[Claims] 1. A main center comprising a primary disk subsystem group having control means connected to a host device for transmitting and receiving data, and storage means for storing the data, wherein the main center is separated from the primary disk subsystem group. Control means for receiving encrypted data that is located at a location that has been transferred from the primary disk subsystem group,
A remote center comprising a group of secondary disk subsystems having storage means for storing the transferred data, wherein the group of primary disk subsystems updates encryption keys at predetermined or irregular intervals. Remote copy computer system, wherein the data transfer to the secondary disk subsystem group is interrupted, and the updated encryption key is transferred to the secondary disk subsystem group. 2. The remote copy computer system according to claim 1, wherein the primary disk subsystem group has a data length and a data pattern similar to data transferred to the secondary disk subsystem group. And embedding the encryption key in the created data. 3. A control means connected to a host device for transmitting and receiving data, a storage means for storing the data,
A main center comprising a group of primary disk subsystems having: a control means for receiving encrypted data transferred from the group of primary disk subsystems, which is arranged at a location separated from the group of primary disk subsystems;
A remote center comprising a group of secondary disk subsystems having storage means for storing the transferred data, wherein the group of primary disk subsystems has an encryption of data transfer encrypted during execution of data write processing. It is determined whether or not it is time to update the key, and if it is the update time, the encryption key is updated and a sequence number is added to the updated encryption key and transferred to the secondary subsystem, and the sequence number is updated. A remote copy computer system, which is associated with the added transfer data. 4. The remote copy computer system according to claim 1, wherein the encrypted data transferred from the primary disk subsystem group to the secondary disk subsystem group is not decrypted. A remote copy computer system, wherein the remote copy computer system stores the data in a storage unit and decrypts the data at the time of disaster recovery. 5. The remote copy computer system according to claim 4, wherein when encrypting and transferring data from said primary disk subsystem group to said secondary disk subsystem group, said encryption key is transmitted to said remote center. Remote copy and save it to another remote center located at a different location, and decrypt the data at the time of disaster recovery using the encryption key stored at the other remote center. Computer system. 6. The remote copy computer system according to claim 4, wherein when decrypting data encrypted and transferred from said primary disk subsystem group to said secondary disk subsystem group, a record of said data is recorded. A remote copy encryption system wherein decryption is performed only when a specific part is searched. 7. The remote copy computer system according to claim 1, wherein the primary disk subsystem group and the secondary disk subsystem group are connected via a storage area network. A remote copy computer system. 8. The remote copy computer system according to claim 1, wherein data transfer between said primary disk subsystem group and said secondary disk subsystem group is performed by synchronous transfer or asynchronous transfer. A computer system for remote copying. 9. A main center comprising a group of primary disk subsystems connected to a host apparatus and receiving data transfer from the host apparatus, and connected to the primary disk subsystem group of the main center to receive data transfer. A remote center consisting of a group of secondary disk subsystems, wherein the primary disk subsystems are controlled to specify whether to encrypt and transfer data when remote copying data to the secondary disk subsystems. A remote copy control information storage unit storing information, and performs data encryption when the control information specifies that data is to be encrypted and transferred; and the secondary disk subsystem group includes the primary disk subsystem. The control information of the group And sure,
A computer system for remote copying, characterized in that when the control information is encrypted and data is to be transferred, a process adapted to encryption is performed on the transferred data. 10. A remote copy method for a storage system comprising a local storage system for storing data written from a higher-level device and a remote storage system for storing a copy of the data, wherein the local storage A system encrypting the data with an encryption key; transferring the encrypted data from the local storage system to the remote storage system; repeatedly updating the encryption key; Transferring the updated encryption key from the local storage system to the remote storage system;
The method according to claim 1, wherein the encrypting step uses the updated encryption key after the encryption key is updated. 11. The storage system remote copy method according to claim 10, wherein the frequency of repeating the step of updating the encryption key is determined from the time for decrypting the encryption key. Remote copy method.