Over the last several years there has been an increasing requirement to protect data from logical corruption or malicious access from bad actors. Dell Technologies responded with Data Protector for z Systems (zDP), which provided automation for making up to 1024 space efficient snapshots per volume at frequencies as low as every five minutes in a VMAX or PowerMax array. zDP utilizes capacity in a production array, often at the disaster recovery site, to provide immutable snapshots that can be used for recovery from a cyber attack.

In addition to these ‘virtual vaults’, requirements have emerged for mainframes to utilize an isolated physical vault for DASD. This can be achieved by using an array dedicated to this purpose with either minimal connectivity (SRDF connections only) or no connectivity (physically air-gapped) in the production data center or at a separate site.

GDDR 6.0.0 introduced  automation to provide for the ongoing population of a physical vault array on a continuous basis. This feature is called Cyber Protection Automation (zCPA) and can be deployed in any GDDR topology. An example of zCPA in a SQAR topology is shown below with one Cyber Recovery (CR) site. There can be as many Cyber recovery sites as there are sites in the GDDR topology.

Figure 10.              Four site SQAR with a physical cyber recovery vault

GDDR zCPA works with zDP to provide three different methods for populating a physical cyber vault array, one that utilizes an air gap between the production site and the cyber vault site and two that do not utilize an airgap. In all methods, zCPA monitors and controls zDP snapset automation to achieve the differential resynchronization of zDP snapsets in a production site array (DC4 in Figure 10Figure 8) with the cyber vault array in the cyber recovery site CR1. The three methods are:

1. zCPA Type 1 (not air gapped): Triggered by GDDR’s detection of a new snapset created by zDP in DC(x). GDDR automation drives differential resynchronization of the data to the cyber vault and resumes the zDP automation to create a snapset in the cyber vault. There is no enabling/disabling of an air gap connection. This is the default type.
2. zCPA Type 2 (air gapped): Triggered by the ENABLE (closure) of the DC(x)-CR(y) air gap connection by a cyber recovery server that resides in the vault site. zDP Snapset creation is initiated and controlled by GDDR resuming and pausing zDP, controlling snapset creation in the DC(x) and CR(y) sites. When data is propagated to the CR site, GDDR DISABLES (opens) the airgap connection by setting the SRDF links offline in the CR site PowerMax.
3. zCPA Type 3 (not air gapped): Triggered by a SCHEDULE or INTERVAL parameter in GDDR. There is no enabling/disabling of an air gap connection. Data resynchronization is initiated and controlled by GDDR resuming and pausing zDP, controlling snapset creation in the DC(x) and CR(y) sites.