# US 2020/0401473 A1 · Proactive disaster recovery based on external event monitoring > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2020/0401473 A1 - Document ID: US20200401473A1 - Status: Published application - Kind: A1 - Application number: 17/008,727 - Filed: 2020-09-01 - Published: 2020-12-24 - Earliest claimed: 2018-11-20 - Assignees: Acronis International GmbH - Applicants: Acronis International GmbH - Inventors: Kirill Korotaev; Serguei Beloussov; Alexander Tormasov; Oleg Melnikov; Oleg Shaikhatarov; Stanistav Protasov - Web page: https://patentgrep.com/patent/US20200401473A1 ## CPC - G06F 11/0793: {Remedial or corrective actions (recovery from an exception in an instruction pipeline G06F9/3861; by retry G06F11/1402; for recovering from a failure of a protocol instance or entity H04L69/40)} - G06F 11/0709: {in a distributed system consisting of a plurality of standalone computer nodes, e.g. clusters, client-server systems} - G06F 11/0751: {Error or fault detection not based on redundancy (power supply failures G06F1/30; network fault management H04L41/06)} - G06F 11/076: {by exceeding a count or rate limit, e.g. word- or bit count limit} - G06F 11/079: {Root cause analysis, i.e. error or fault diagnosis (in a hardware test environment G06F11/22; in a software test environment G06F11/36)} - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract Disclosed are systems and methods for proactive disaster recovery. The described technique monitors for events raised by a system of interconnected external sensors and other devices for obtaining data on the external environment of servers. The system uses these events as a chain of triggers according to which preventative or preparatory actions for disaster recovery are performed. ## Claims ### Claim 1 A method for proactive disaster recovery preparation, the method comprising: detecting, based on sensor data received from a sensor in a first area of a data center, a first event that is a potential threat in data loss or breach at a server in the first area, wherein the sensor data captures an attribute of an environment proximate to the server; identifying, from a plurality of event escalation trees, an event escalation tree comprising the first event, wherein each respective event escalation tree defines a unique sequence of events and a respective action of a disaster recovery preparation process to execute for each respective event, and wherein events of the identified event escalation tree indicate a progression of the potential threat to additional areas in the data center and corresponding actions to the events indicate transferring data from servers in areas where the potential threat is detected to servers in other areas within the data center where the potential threat is not detected; and responsive to detecting the events at the data center sequentially ordered in accordance with the identified event escalation tree, sequentially executing the corresponding actions of the disaster recovery preparation process. ### Claim 2 (depends on 1) The method of claim 1, wherein the server is a first server, and wherein sequentially executing the corresponding actions comprises: transferring, at a first time, at least one portion of data stored on the first server in the first area of the data center to a second server in a second area of the data center where the potential threat is not detected; detecting, at a subsequent time, that the potential threat is progressing towards the second area; and in response to detecting that the potential threat is progressing towards the second area, transferring the at least one portion of data from the second server in the second area to a third server in a third area of the data center where the potential threat is not detected. ### Claim 3 (depends on 2) The method of claim 2, wherein the potential threat progressing towards the second area is indicated in a second event of the identified event escalation tree. ### Claim 4 (depends on 3) The method of claim 3, wherein the first event is associated with a first severity grade indicative of a likelihood of the first event triggering the data loss or breach at the server, the second event is associated with a second severity grade that is greater than the first severity grade, and wherein an amount of server resources utilized for each respective action is correlated with a respective severity grade of the respective event. ### Claim 5 (depends on 2) The method of claim 2, wherein the potential threat is an unauthorized person that has infiltrated the data center to potentially steal the at least one portion of data and the sensor comprises one or more of a motion detector and a surveillance video camera. ### Claim 6 (depends on 2) The method of claim 2, wherein the potential threat can cause physical damage to the first server in the first area, leading to the data loss or breach, and wherein the sensor comprises one or more of a temperature sensor, a carbon dioxide sensor, a humidity sensor, and a smoke detector. ### Claim 7 (depends on 2) The method of claim 2, further comprising: detecting that the potential threat has caused the data loss or breach at the first server in the first area; uploading data stored in the servers in the other areas within the data center where the potential threat is not detected to servers in a different data center; and shutting down the servers in the other areas. ### Claim 8 (depends on 1) The method of claim 1, wherein sequentially executing corresponding actions comprises: executing a first action corresponding to the first event in the event escalation tree; monitoring subsequent sensor data for a next event directly after the first event in the event escalation tree; and responsive to detecting the next event, executing a next action corresponding to the next event. ### Claim 9 (depends on 8) The method of claim 8, wherein the first action comprises removing all secure passwords and keys from the server, the next action comprises breaking all client and user connections to the server, and a subsequent action corresponding to a subsequent event comprises deleting data classified as critical on the server. ### Claim 10 (depends on 8) The method of claim 8, wherein the identified event escalation tree further defines a maximum time period between the first event and the next event, further comprising: monitoring the subsequent sensor data for the next event within the maximum time period; and in response to determining that the next event has not occurred within the maximum time period, identifying a different event escalation tree from the plurality of event escalation trees that comprises the first event. ### Claim 11 A system for proactive disaster recovery preparation, the system comprising: a plurality of sensors including a sensor in a first area of a data center, the sensor configured to provide sensor data that captures an attribute of an environment proximate to a server in the first area; a hardware processor configured to: detect, based on the sensor data received from the sensor, a first event that is a potential threat in data loss or breach at a server in the first area; identify, from a plurality of event escalation trees, an event escalation tree comprising the first event, wherein each respective event escalation tree defines a unique sequence of events and a respective action of a disaster recovery preparation process to execute for each respective event, and wherein events of the identified event escalation tree indicate a progression of the potential threat to additional areas in the data center and corresponding actions to the events indicate transferring data from servers in areas where the potential threat is detected to servers in other areas within the data center where the potential threat is not detected; and responsive to detecting the events at the data center sequentially ordered in accordance with the identified event escalation tree, sequentially execute the corresponding actions of the disaster recovery preparation process. ### Claim 12 (depends on 11) The system of claim 11, wherein the server is a first server, and wherein the hardware processor is configured to sequentially execute the corresponding actions by: transferring, at a first time, at least one portion of data stored on the first server in the first area of the data center to a second server in a second area of the data center where the potential threat is not detected; detecting, at a subsequent time, that the potential threat is progressing towards the second area; and in response to detecting that the potential threat is progressing towards the second area, transferring the at least one portion of data from the second server in the second area to a third server in a third area of the data center where the potential threat is not detected. ### Claim 13 (depends on 12) The system of claim 12, wherein the potential threat progressing towards the second area is indicated in a second event of the identified event escalation tree. ### Claim 14 (depends on 13) The system of claim 13, wherein the first event is associated with a first severity grade indicative of a likelihood of the first event triggering the data loss or breach at the server, the second event is associated with a second severity grade that is greater than the first severity grade, and wherein an amount of server resources utilized for each respective action is correlated with a respective severity grade of the respective event. ### Claim 15 (depends on 12) The system of claim 12, wherein the potential threat is an unauthorized person that has infiltrated the data center to potentially steal the at least one portion of data and the sensor comprises one or more of a motion detector and a surveillance video camera. ### Claim 16 (depends on 12) The system of claim 12, wherein the potential threat can cause physical damage to the first server in the first area, leading to the data loss or breach, and wherein the sensor comprises one or more of a temperature sensor, a carbon dioxide sensor, a humidity sensor, and a smoke detector. ### Claim 17 (depends on 12) The system of claim 12, wherein the hardware processor is further configured to: detect that the potential threat has caused the data loss or breach at the first server in the first area; upload data stored in the servers in the other areas within the data center where the potential threat is not detected to servers in a different data center; and shut down the servers in the other areas. ### Claim 18 (depends on 11) The system of claim 11, wherein the hardware processor is further configured to sequentially execute the corresponding actions by: executing a first action corresponding to the first event in the event escalation tree; monitoring subsequent sensor data for a next event directly after the first event in the event escalation tree; and responsive to detecting the next event, executing a next action corresponding to the next event. ### Claim 19 (depends on 18) The system of claim 18, wherein the first action comprises removing all secure passwords and keys from the server, the next action comprises breaking all client and user connections to the server, and a subsequent action corresponding to a subsequent event comprises deleting data classified as critical on the server. ### Claim 20 A non-transitory computer readable medium comprising computer executable instructions for proactive disaster recovery preparation, including instructions for: detecting, based on sensor data received from a sensor in a first area of a data center, a first event that is a potential threat in data loss or breach at a server in the first area, wherein the sensor data captures an attribute of an environment proximate to the server; identifying, from a plurality of event escalation trees, an event escalation tree comprising the first event, wherein each respective event escalation tree defines a unique sequence of events and a respective action of a disaster recovery preparation process to execute for each respective event, and wherein events of the identified event escalation tree indicate a progression of the potential threat to additional areas in the data center and corresponding actions to the events indicate transferring data from servers in areas where the potential threat is detected to servers in other areas within the data center where the potential threat is not detected; and responsive to detecting the events at the data center sequentially ordered in accordance with the identified event escalation tree, sequentially executing the corresponding actions of the disaster recovery preparation process.