JP2003330781A - Data multiple security method - Google Patents

Abstract

(57) [Summary] [PROBLEMS] To guarantee data retention with higher reliability than data duplication. SOLUTION: A host computer 20 as a host device
1 from the primary data storage device 202,
Further, the primary data storage device 202 copies data stored in its own device to the secondary data storage device 204, and further, the secondary data storage device 204 stores the data stored in its own device in tertiary data storage device 204. Copy to device 206. Storing the data in the primary data storage device 202, copying the data to the secondary data storage device 204,
The copying of data to the tertiary data storage device 206 is performed asynchronously with each other.

Description

Detailed Description of the Invention

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to a data multiplex storage technology, and in particular, realizes multiplex data security by distributing and holding the same data in each of at least three storage devices which are independently distributed. The present invention relates to a data multiple security method.

[0002]

2. Description of the Related Art In an information processing system consisting of a central processing unit and a peripheral storage device represented by a disk device, the amount of information is enormous, and as a measure for improving the reliability of storage of handled data, double holding of data is performed. Has been put to practical use. As a practical method, it is general to separately provide an external storage control device and a storage device, connect the storage control devices with an arbitrary information communication medium, and copy data between the storage devices. In this way, the same data is held in different storage devices in duplicate, so that when data is lost in the event of a failure, recovery from backup data is achieved and reliability is improved.

[0003]

As described above, in the conventional technique, the data is held in different storage devices in a double manner to improve the reliability and the maintainability of the data against a failure. By holding data in different storage devices twice, if one of the primary data storage system or the secondary data storage system goes down due to a failure, the remaining data storage system can continue to operate without trouble. It is possible.

However, there are many factors that cause the data storage system to be in a system down state for a long period of time such as a natural disaster such as an earthquake or a fatal hardware failure. Is down, only the other remaining data storage system will continue to operate for a long time. Therefore, if some failure occurs in the remaining data storage system within this period, it is obvious that the loss of data or the stoppage of business or the like will be caused.

The object of the present invention is, rather than data duplication,
Another object of the present invention is to provide a data multiplex guarantee method capable of guaranteeing data retention with high reliability.

[0006]

According to the data multiplex guarantee method of the present invention, data from a host device is stored in a primary storage device, and the primary storage device secondary stores the data stored in the primary storage device. The secondary storage device copies the data stored in the secondary storage device to the tertiary storage device.

[0007]

BEST MODE FOR CARRYING OUT THE INVENTION Embodiments of the present invention will be described below with reference to FIG.
It will be described with reference to FIG.

First, a data multiplex guarantee system according to the present invention in which a magnetic disk device is assumed as a storage device will be described. FIG. 1 shows a system configuration as an example. In the figure, 101 is a host computer that normally mainly processes data, 102 is connected to the host computer 101, and the host computer 101
Is a disk control device that writes data to the magnetic disk device 112 and reads data from the magnetic disk device 112 in accordance with a command from the.

Further, 103 is a host computer 10.
1 is a channel port for transmitting and receiving instructions and data, etc., 104 is a channel port control CPU that controls the transmission and reception of data in accordance with instructions from the host computer 101, and 107 is for transmitting and receiving data between each port and memory Common bus, 108 is a cache memory for temporarily storing data and the like transmitted from the host computer 101, and 109 is the disk controller 102
A common memory that can be commonly used by the internal CPUs,
111 is a disk port for exchanging data with the magnetic disk device 112, and 110 is the magnetic disk device 11
Disk port control CPU that issues a command to 2 to control the transmission and reception of data to and from the magnetic disk device 112.
Reference numerals 05 and 125 are copy ports that are connected to other storage devices and that send and receive commands and data in order to copy data to the other storage devices. 106 issues commands to the other storage devices to transfer data. Is a copy port control CPU that controls the sending and receiving of data.

Further, 122 is a host computer 12.
1, channel ports 123, 124, 126 for sending and receiving commands and data to and from 1 are channel ports 12 for sending and receiving data and information from other storage devices.
Reference numeral 7 denotes a disk controller which writes data to the magnetic disk device 129 and reads data from the magnetic disk device 129, and 128 writes data to the magnetic disk device 130 and reads data from the magnetic disk device 130. It is a disk control device. Furthermore, the disk controller 102 and the disk controller 127, the disk controller 127 and the disk controller 128, and the disk controller 102 and the disk controller 128 are the interface cable 13 respectively.
Connected with 1. As the interface cable, when the data multiple security system itself is constructed over a relatively remote place (for example, when magnetic disk devices are arranged in Sapporo, Tokyo, and Fukuoka, respectively), an optical fiber cable, etc. Is used.

Next, the magnetic disk devices 112, 129,
Assuming that 130 is a primary data storage device, a secondary data storage device, and a tertiary data storage device, a process of copying data to the secondary data storage device and the tertiary data storage device will be described below.

That is, regardless of whether the writing process to the secondary data storage device is a synchronous process or an asynchronous process, the consistency of the data must always be maintained. Therefore, the order of writing data to the secondary data storage device is The order of writing from the host computer 101 must be the same. Therefore, the writing order from the host computer 101 is stored, and writing is performed in the secondary storage device according to this information. As this information, an update data management table for managing the data write position and an update order management table for managing the write order are stored in the disk controller 102.
2 shows an update data management table and FIG. 3 shows an update order management table.

As shown in FIG. 2, the update data management table 300 includes a cylinder number indicating a writing position, a head number, and copy necessity information (whether data is to be written to each of the primary / secondary / tertiary data storage devices). 2) and time stamp information (indicating the time when the updated data is received from the host computer 101). Disk controller 1
In 02, when a write command is received from the host computer 101, the copy necessity information for the corresponding write position and each of the disk control devices 102, 127, 128 is turned on, and the time stamp information is updated. After that, the cylinder number and the head number are registered in the update order management table. Incidentally, as the time stamp information, the transmission time from the host computer 101 may be stored as it is, or may be stored after being converted into a unique (unique) value in the disk control device 102.

As shown in FIG. 3, the update order management table 400 manages the priority order of the data to be copied, and the data is copied to the copy destination data storage device in the same order as the write command from the host computer 101. It is for doing. Disk control device 127 in the order of registration
The copy data is transferred together with the above-mentioned update order management information, but the disk controller 127 writes to the secondary data storage device according to the update order management information. Similarly, the disk controller 127 also has an update data management table and an update order management table, and when a copy command is received from the disk controller 102, the corresponding write position and copy necessity information for each of the disk controllers 127 and 128 are turned on. And update the time stamp information. After that, the cylinder number and the head number are registered in the update order management table. The disk control device 127 refers to the update order management table,
By writing the data in the order of registration, the data is updated in the order written by the host computer 101.

Further, the disk controller 127 transfers the copy data together with the update order management information to the disk controller 128, and the disk controller 1 at an arbitrary timing.
Report completion of processing to 02. Disk controller 12
8 has an update data management table and an update order management table, and according to the information from the disk controller 127,
Data is written in the tertiary data storage device and a processing completion report is sent to the disk control device 127 at an arbitrary timing. In the disk controller 102, when the processing completion report is sent from the disk controller 127, the corresponding information on the update data management table is turned off. Specifically, the bits of only the secondary data storage device copy necessity information of the updated cylinder number and head number are turned off, and the bits of the corresponding cylinder number and head number are not turned off.
Further, the disk controller 127 is the disk controller 1
The completion of the data update to 28 is reported to the disk controller 102 at an arbitrary timing, and the disk controller 102 receives this report, and then the corresponding cylinder number and head number bit in the update data management table and The tertiary data storage device copy necessity information is turned off. Similarly, the disk controller 127 also turns off the corresponding cylinder number, head number bit, and tertiary data storage device copy necessity information on the update data management table. When such a difference management method is adopted, in order for the disk controller 102 to recognize the data update status in the disk controller 128, it is not necessary to inquire the disk controller 128 about the data update status.

Here, in the data multiplex guarantee system configured as described above, a method of realizing data duplication in the event of a failure will be described with reference to FIG. 4 as follows. .

That is, in FIG. 4, 201 is a host computer that normally mainly processes data, and 202.
Is a primary data storage device that stores data from the host computer 201, and 204 and 206 are primary data storage device 202 and data transfer paths 207 and 20, respectively.
A secondary data storage device and a tertiary data storage device which are connected via 8 and hold the same data as the primary data storage device 202. The secondary data storage device 204 and the tertiary data storage device 206 are also connected via a data transfer path 209, and the secondary data storage device 204 and the tertiary data storage device 206 respectively have corresponding host computers 203,
205 is prepared. Note that, in FIG. 4, a data storage control device for each data storage device is not shown for simplification of the drawing.

Normally, the data in the primary data storage device 202 is reflected in the secondary data storage device 204 and then in the tertiary data storage device 206. However, the secondary data may be reflected due to a failure or an earthquake. Storage device 204,
Alternatively, when data cannot be transmitted to the tertiary data storage device 206, the processing must be continued between the remaining host computer and the two data storage devices. Further, in order to improve the reliability after that, it is necessary to double manage the data between the remaining host computer and the two data storage devices.

For that purpose, first, it is necessary to determine two data storage devices for achieving the redundant operation. In the primary data storage device 202, the secondary data storage device 20
In order to recognize whether 4 is operating normally, for example, data / message transmission is periodically performed to the secondary data storage device 204. If there is no response to this data / message transmission, the primary data storage device 2
02 determines that a failure has occurred in the secondary data storage device 204, switches the copy destination of the data to the tertiary data storage device 206, and continues the processing. Further, the secondary data storage device 204 can recognize that the primary data storage device 202 is operating normally by receiving the data / message. If neither the copy data nor the data / message is transmitted even after a certain period of time, it is determined that a failure has occurred in the primary data storage device 202, and it is determined that the data storage device is the new main data storage device. The determination may be made and the processing with the tertiary data storage device 206 may be continued to achieve duplication.

By the way, the copying of data from the primary data storage device 202 to the secondary data storage device 204 and the copying of data from the secondary data storage device 204 to the tertiary data storage device 206 are performed at arbitrary timings. Therefore, the state of the data being copied at the time of the failure may differ. In the above case, between the data storage devices capable of redundant operation,
It is unknown how much data difference has occurred. Duplication is possible by copying all data, but in order to realize duplication in a short time, only the data difference needs to be copied. In order to enable this, the information on the update data management table and the information on the update order management table described above are used.

Now, a process when data is duplicated between the primary data storage device 202 and the tertiary data storage device 206 due to the occurrence of a failure in the secondary data storage device 204 will be described with reference to FIG. The flow of the process in the example is shown. As shown in FIG. 5, when the primary data storage controller determines that a failure has occurred in the secondary data storage device 204 because there is no response to data / message transmission, the primary data storage device In order to duplicate the data between 202 and the tertiary data storage device 206,
After that, control is performed (process 501). Similarly to the case described above, when the data write command is received from the host computer 201, the primary data storage control device stores the write position information and the data storage device information to be copied on the update data management table. Therefore, the primary data storage controller analyzes the management information,
Determine the copy data. As a determination method, first, data that has been reflected in the primary data storage device 202 and has not been reflected in the tertiary data storage device 206 is preferentially transferred to the tertiary data storage device 206 (process 502). When there are a plurality of such data, the time stamp information may be compared and the oldest data may be transferred.

The above copy data determination method will be described more specifically with reference to the update data management table shown in FIG. 2. The data (B) and the data (C) are the primary data storage device 202. Although it is already reflected in the third data storage device 206 and is not reflected in the third data storage device 206, first, the old data (C) is registered in the update order management table in order to be preferentially written in the third data storage device 206. By transferring the copy data and the update order management information to the tertiary data storage control device in the order described above, the tertiary data storage device 206 also updates the data in the order written by the host computer 201. After that, when the end report is received from the tertiary data storage control device, the bit of the relevant tertiary data storage device copy necessity information in the update data management table is turned off. At this time, the primary data storage device 2 has already been
Since the data has been copied to 02, the bit of the position information (cylinder number and header number) of the data is also turned off. By turning off the bit, the data is reflected in both data storage devices 202 and 206.

Returning to FIG. 5, if the explanation is continued, the process 50 is performed.
After step 2 is performed, data (difference data) that has not been reflected in both the primary data storage device 202 and the tertiary data storage device 206 is copied (process 503). here,
Referring again to FIG. 2, it can be seen that the data of (A) corresponds to that. As in the previous case, the primary data storage control device transfers the difference data and update order management information to the tertiary data storage control device in the order registered in the update order management table, but the tertiary data storage control device The copy process is executed with. After that, when the primary data storage controller receives the end report from the tertiary data storage controller, the primary data storage controller turns off the bit of the relevant tertiary data storage device copy necessity information on the update data management table. here,
The primary data storage control device refers to the copy status of the data related to the end report ((A) in FIG. 2, primary data storage device copy necessity information bit), and the data is also copied to the primary data storage device 202. If (bit off state),
Position information of the data (cylinder number and header number)
Turn off the bit. Further, if the primary data storage device 202 is in an uncopied state (bit on), the bit of the position information of the data is not turned off, and the bit is turned off as soon as the copying is completed. When the process 503 is completed, the process is returned to the process 502 again.

Even when the data is duplicated between the secondary data storage device 204 and the tertiary data storage device 206, the update data management information and the update order management information held in the secondary data storage control device are analyzed by the above procedure. In addition, the data transfer from the secondary data storage device 204 to the tertiary data storage device 206 is performed, so that both data storage devices 20
It is possible to duplicate data between 4,206.

As described above, it is possible to always duplicate the data. Moreover, even when a failure occurs in the data transfer path, the copy destination data storage device is switched,
By recognizing the data update status at the copy destination and transferring the difference data to the copy destination, it is possible to duplicate the data without losing the data.

In addition to the inventions described in the claims, the following inventions (1) to (8) are also conceivable. (1): Connected to a host device and connected to a primary data storage device for storing primary data accessed from the host device and the primary data storage device by an arbitrary communication medium or the like, and stored in the primary data storage device. A secondary data storage device that stores secondary data that is the same copy as the primary data,
Further, it comprises a tertiary data storage device which is connected to the secondary data storage device by an arbitrary communication medium or the like and stores tertiary data which is the same copy as the secondary data stored in the secondary data storage device. Copying the data written in the primary data storage device to a secondary data storage device, and further copying the data written in the secondary data storage device by the primary data storage device to a tertiary data storage device. Data multiple security method. (2): In the multiple data guarantee method described in (1),
A data multiplexing guarantee method, characterized in that primary data written in a primary data storage device by a host device is copied to a secondary data storage device asynchronously with the write processing of the host device. (3): In the multiple data guarantee method described in (1),
A data multi-guarantee method, characterized in that secondary data written by the primary data storage device to the secondary data storage device is copied to the tertiary data storage device asynchronously with the write processing of the primary data storage device. (4): In the data multiple security method described in (1),
A data multi-guarantee method characterized in that, when a failure occurs in a host device or a primary data storage device, the secondary data storage device is newly set as the primary data storage device and data is copied to the tertiary data storage device. (5): In the data multiple security method according to (1),
When the host device copies the data written in the primary data storage device to the secondary data storage device, it creates differential data information for each unit of data to be updated in the primary data storage device, and transmits it. Guarantee method. (6): In the data multiple security method according to (1),
A method for guaranteeing data multiplex characterized in that, when data written in the secondary data storage device is copied to the tertiary data storage device, difference data information is created and transmitted for each unit of data to be updated in the secondary data storage device. . (7): In the data multiple security method according to (1),
If a failure occurs in the secondary data storage device, analyze the differential data management information stored in the primary data storage device,
A method for ensuring data duplication, characterized by copying data to a tertiary data storage device. (8): In a multiple data storage system in which a primary data storage system and a secondary data storage system are connected, a means for connecting the tertiary data storage system to the secondary data storage system, and written data from the host device A data multiple security system comprising means for creating copy data management information in a primary data storage system, secondary data storage system, and tertiary data storage system, and means for automatically detecting a failure in a data transfer path.

Although the invention made by the present inventor has been specifically described based on the embodiments, the present invention is not limited to the above embodiments, and various modifications can be made without departing from the scope of the invention. It goes without saying that it is possible.

[0028]

The data retention can be ensured with higher reliability than the duplication of data.

Further, even when a failure occurs, data can be multiplexed between the two remaining storage devices.

[Brief description of drawings]

FIG. 1 is a diagram showing a system configuration of an example of a data multiplex protection system according to the present invention in which a magnetic disk device is assumed as a storage device.

FIG. 2 is a diagram showing a table for managing copy information of difference data.

FIG. 3 is a diagram showing a table for managing copy priority information of difference data.

FIG. 4 is a diagram showing a system configuration of a data multiplex guarantee system for explaining a method of realizing data duplication when a failure occurs.

FIG. 5 is a diagram showing a processing flow when data duplication is achieved between the primary data storage device and the tertiary data storage device due to the occurrence of a failure in the secondary data storage device.

[Explanation of symbols]

101, 121 ... Host computer, 102, 12
7, 128 ... Disk controller, 112, 122, 13
0 ... Magnetic disk device, 131 ... Interface cable, 201, 203, 205 ... Host computer, 2
Reference numeral 02 ... Primary data storage device, 204 ... Secondary data storage device, 206 ... Tertiary data storage device, 207 to 209 ... Data transfer path, 300 ... Update data management table, 400
… Update order management table.

   ─────────────────────────────────────────────────── ─── Continued front page    (72) Inventor Kazuhide Sano             Stock No.2 322 Nakazato, Odawara City, Kanagawa Prefecture             Hitachi, Ltd. RAID System Division F term (reference) 5B065 BA01 EA02 EA33 EA35                 5B082 DA02 GA04

Claims (5)

[Claims] 1. A primary storage device stores data from a host device, the primary storage device copies data stored in the primary storage device to a secondary storage device, and the secondary storage device stores the secondary storage device in the secondary storage device. A data multiplex guarantee method in which data stored in a secondary storage device is copied to a tertiary storage device. 2. Storage of data from the host device to a primary storage device, copying of data from the primary storage device to a secondary storage device, and copying of data from the secondary storage device to a tertiary storage device. The method for ensuring data multiplex according to claim 1, wherein the steps are performed asynchronously with each other. 3. When copying data to each of the secondary storage device and the tertiary storage device, difference data update order management information is created in each of the primary storage device and the secondary storage device, and the secondary storage device is also created. 3. The data multiplex guarantee method according to claim 1, wherein the data multiplex guarantee is transferred to each of the tertiary storage devices. 4. The data multiplexing guarantee method according to claim 1, wherein when a failure occurs in a host device or a primary storage device, the secondary storage device is set as a new primary storage device, and Data security method in which data is copied from a primary storage device to a tertiary storage device. 5. The data multiplexing guarantee method according to claim 1, wherein when a failure occurs in the secondary storage device, the primary storage device is based on the differential data management information stored in the primary storage device. A data multiplex guarantee method in which differential data is copied from a storage device to a tertiary storage device.