OceanBase database anti-ransom data recovery method and system based on WORM storage

Abstract

The application discloses a ransom data recovery method and system of an OceanBase database based on WORM storage, relates to the field of data security backup, and comprises the following steps: a database backup directory is pointed to a mounting path configured with a WORM storage strategy, business data is first freely written, is automatically locked after a timeout, and is then unlocked and cleaned up. The metadata file is kept active and writable through periodic touching, and the metadata and business data are backed up regularly, and are locked after version numbers are prepared; the database is immediately locked after full backup, incremental backup and archiving log slices of the business data file. During recovery, a soft connection is established according to the version number, the backup file on the WORM storage is mapped to complete data recovery, and the expired data is automatically deleted to release space. Through WORM locking and soft connection recovery, the application can prevent ransomware from tampering with or deleting backups, supports safe backup of multi-version metadata and business data files, and realizes accurate and reliable recovery of historical data.

Description

Technical Field

[0001] This application relates to the field of data security backup, and in particular to a method and system for preventing ransomware data recovery from OceanBase databases based on WORM storage. Background Technology

[0002] Ransomware has become one of the major threats to the digital world. Having an uncontaminated database backup after a ransomware attack can effectively reduce losses. WORM storage locks data after it's written, making it readable but not modifiable or undeletable, thus preventing ransomware intrusion. However, currently, neither OceanBase's official backup nor third-party backup software supports WORM storage backups for database versions V2 and V3. The difficulty in backing up a database on WORM storage lies in the fact that each backup requires updating metadata information, and WORM storage locks files for a certain period. Once the metadata files are locked, they cannot be updated, leading to backup failure.

[0003] The existing technology has the following drawbacks: backup metadata needs to be modified at any time during the backup job, and if the file is locked by a worm, the database backup job cannot continue; there is a lack of a multi-version backup mechanism, making it difficult to accurately locate the required historical data version during recovery, resulting in low recovery reliability, and backup data is easily tampered with or deleted by ransomware, leading to data unrecoverability. Summary of the Invention

[0004] The purpose of this application is to provide a method and system for recovering OceanBase database data from ransomware based on WORM storage. It can recover data through WORM locking and soft links, prevent ransomware from tampering with or deleting backups, and support secure backup of multi-version metadata and business data files, so as to achieve accurate and reliable recovery of historical data.

[0005] To achieve the above objectives, this application provides the following solution: Firstly, this application provides a method for ransomware-resistant data recovery of OceanBase databases based on WORM storage. The method includes: pointing the backup directory output by the OceanBase database to a mount path configured with a WORM storage unit; the WORM storage unit is configured with a WORM storage policy; the WORM storage policy includes: guiding business data files into a free-write state within a first preset time period starting from the last write time; entering an automatic locking state if the free-write state exceeds the first preset time period; automatically entering an unlock and cleanup state if the automatic locking state exceeds a second preset time period; periodically touching metadata files at intervals of a third preset time period to update the modification timestamps of the metadata files; the metadata files are directory indexes for backing up business data files; the periodic touching is used to guide the metadata files to remain active and writable; the third preset time period is shorter than the first preset time period; periodically backing up metadata files and business data files at intervals of a fourth preset time period, while... A corresponding version number is assigned to the backup metadata file. The backup metadata file, backup business data file, and corresponding version number are stored in the WORM storage unit and locked using the worm command. The fourth preset time period is shorter than the first preset time period. The OceanBase database backup function is used to perform full backup, incremental backup, and archive log slicing on the business data file, and then the file is immediately locked using the worm command. When data recovery is required, a soft link is established in the corresponding full backup, incremental backup, and archive log directory in the backup directory according to the version number of the metadata to be recovered. The soft link is used to map the full backup, incremental backup, and archive log of the backup metadata to a directory structure that meets the OceanBase database recovery requirements. Data recovery is completed by reading the backup metadata in the soft link directory through the OceanBase database recovery command. When the WORM storage unit enters the unlock and cleanup state, the expired backup metadata file, backup business data file, and corresponding version number in the worm storage are deleted to free up space and prepare for the next stage of data backup.

[0006] Secondly, this application also provides a computer system, including: a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the computer program to implement the OceanBase database ransomware recovery method based on WORM storage described in the first aspect.

[0007] According to the specific embodiments provided in this application, the following technical effects are disclosed: This application points the database backup directory to the mount path configured with the WORM storage policy. Business data is initially freely written to, automatically locked after a timeout, and then unlocked and cleaned up. Metadata files are kept active and writable through periodic touches, and metadata and business data are backed up regularly, version numbers are assigned, and then locked. The database is locked immediately after full backups, incremental backups, and archive log slicing of business data files. During recovery, a symbolic link is created based on the version number, mapped to the backup file on the WORM storage to complete data recovery; expired links are automatically deleted to release space. This application, through WORM locking and symbolic link recovery, can prevent ransomware from tampering with or deleting backups, and supports secure backups of multiple versions of metadata and business data files, achieving accurate and reliable recovery of historical data. Attached Figure Description

[0008] To more clearly illustrate the technical solutions in the embodiments of this application or related technologies, the drawings used in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0009] Figure 1 This is a flowchart illustrating the OceanBase database ransomware recovery method based on WORM storage provided in this embodiment of the application.

[0010] Figure 2 This is a schematic diagram illustrating the mapping relationship between soft links and WORM storage provided in an embodiment of this application.

[0011] Figure 3 This is an internal structure diagram of a computer system provided in an embodiment of this application. Detailed Implementation

[0012] The technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0013] To make the above-mentioned objectives, features and advantages of this application more apparent and understandable, the application will be further described in detail below with reference to the accompanying drawings and specific embodiments.

[0014] Example 1, such as Figure 1 As shown, this embodiment provides a method for recovering OceanBase database data from ransomware based on WORM storage. The method includes: S1. Point the backup directory output by the OceanBase database to the mount path configured with the WORM storage unit; the WORM storage unit is configured with a WORM storage policy; the WORM storage policy includes: guiding the business data file to enter a free write state within a first preset time period starting from the last write time; entering an automatic lock state if the free write state exceeds the first preset time period; and automatically entering an unlock and cleanup state if the automatic lock state exceeds the second preset time period.

[0015] Furthermore, the free write state is a state in which data is allowed to be written, modified, or deleted normally.

[0016] Furthermore, the automatic locking state is a state in which data is only allowed to be read, and no user or process can modify, delete, or encrypt the file content.

[0017] Furthermore, the unlock and cleanup status refers to the status of releasing the data read-only lock, allowing the safe deletion of expired backup metadata files, backup business data files, and their corresponding version numbers.

[0018] Furthermore, the first preset time period is 2 hours.

[0019] Furthermore, the second preset time period is 7 days.

[0020] In practical applications, by pointing the OceanBase database backup directory to the WORM storage mount path and configuring a three-stage storage policy (free write → automatic locking → unlock and cleanup), automatic anti-tampering and lifecycle management of backup data can be achieved. Data can be freely updated within the first preset time after being written, thus ensuring normal backup operations; after the timeout, it is automatically locked to prevent ransomware from tampering with or deleting it; after the lock period expires, it is automatically cleaned up to release storage space, ensuring security while also improving resource utilization.

[0021] S2. Periodically touch the metadata file at intervals of a third preset time period to update the modification timestamp of the metadata file; the metadata file is a directory index of the backup business data file; the periodic touch is used to guide the metadata file to remain active and writable; the third preset time period is shorter than the first preset time period.

[0022] Furthermore, the third preset time period is 1 hour.

[0023] In practical applications, by periodically updating the modification timestamps of the metadata file (at intervals shorter than the free write period), the metadata file is kept active and writable, preventing accidental locking due to exceeding the first preset time period. This ensures continuous updates to the metadata file, guaranteeing the continuous backup capability of the OceanBase database and preventing backup interruptions or failures caused by metadata locking.

[0024] S3. Periodically back up metadata files and business data files at a fourth preset time interval, and assign a corresponding version number to the backed-up metadata files. Store the backup metadata files, backup business data files and corresponding version numbers in the WORM storage unit and lock them with the worm command; the fourth preset time interval is shorter than the first preset time interval.

[0025] Furthermore, the fourth preset time period is 1 hour.

[0026] In practical applications, by proactively creating versioned backups of metadata and business data at intervals shorter than the free write cycle and immediately locking them to WORM storage, multi-version secure storage is achieved. Backups can be pre-secured before data is automatically locked, preventing ransomware from tampering with or deleting it.

[0027] S4. Use OceanBase database backup function to perform full backup, incremental backup, and archive log slicing of business data files, and then immediately use the worm command to lock the files.

[0028] In practical applications, step S4 can resist ransomware attacks on generated files within the backup window, ensuring the integrity and security of backup data, while not interfering with the normal operation of subsequent backup tasks.

[0029] S5. For example Figure 2 As shown, when data recovery is required, soft links are established in the corresponding full backup, incremental backup, and archive log directories in the backup directory according to the version number of the metadata to be recovered. The soft links are used to map the backup metadata full backup, incremental backup, and archive logs to a directory structure that meets the recovery requirements of OceanBase database.

[0030] Optionally, the symbolic link is a Linux file symbolic link.

[0031] Furthermore, during the process of establishing symbolic links in the backup directory corresponding to the full backup, incremental backup, and archive log directories of the metadata version number to be recovered, if the business data file corresponding to the metadata version number to be recovered is unrecoverable due to ransomware damage, then it will be necessary to establish symbolic links using the metadata of the previous version number and its corresponding full backup, incremental backup, and archive log files for recovery.

[0032] In practical applications, symbolic links can quickly reconstruct the directory structure required by the OceanBase database without copying or moving large amounts of backup data, improving recovery efficiency while keeping the original backup files locked to ensure data security.

[0033] S6. Data recovery is completed by reading the backup metadata in the symbolic link directory using the OceanBase database recovery command.

[0034] In practical applications, after each metadata version backup is completed, the metadata and backup files of that version are used for recovery verification. If recovery is successful, it indicates that the metadata files, incremental backups, full backups, and archived log files of that version have not been contaminated by ransomware. If recovery is unsuccessful, virus detection technology is used to check whether all files have been contaminated by ransomware, so that ransomware can be detected in a timely manner. Because each backup version is verified after being locked, backups before the fourth preset time period are not contaminated by ransomware and can be used for recovery, thus enabling business recovery.

[0035] S7. When the WORM storage unit enters the unlock and cleanup state, delete the expired backup metadata files, backup business data files and corresponding version numbers in the worm storage, free up space and prepare for the next stage of data backup.

[0036] The technical effects of this application are as follows: This application points the database backup directory to the mount path configured with the WORM storage policy. Business data is initially freely written to, automatically locked after a timeout, and then unlocked and cleaned up. Metadata files are kept active and writable through periodic touches, and metadata and business data are backed up regularly, version numbers are assigned, and then locked. The database is locked immediately after full backups, incremental backups, and archive log slicing of business data files. During recovery, a symbolic link is created based on the version number, mapped to the backup file on the WORM storage to complete data recovery; expired links are automatically deleted to release space. This application, through WORM locking and symbolic link recovery, can prevent ransomware from tampering with or deleting backups, and supports secure backups of multiple versions of metadata and business data files, achieving accurate and reliable recovery of historical data.

[0037] Example 2: This example provides a computer system, which can be a server or a terminal, and its internal structure diagram can be as follows. Figure 3As shown, the computer system includes a processor, memory, input / output (I / O) interfaces, and a communication interface. The processor, memory, and I / O interfaces are connected via a system bus, and the communication interface is also connected to the system bus via the I / O interfaces. The processor provides computational and control capabilities. The memory includes non-volatile storage media and internal memory. The non-volatile storage media stores the operating system, computer programs, and databases. The internal memory provides the environment for the operating system and computer programs stored in the non-volatile storage media to run. The I / O interfaces are used for exchanging information between the processor and external devices. The communication interface is used for communicating with external terminals via a network connection. When the computer program is executed by the processor, it implements the methods described above.

[0038] Those skilled in the art will understand that Figure 3 The structure shown is merely a block diagram of a portion of the structure related to the present application and does not constitute a limitation on the computer system to which the present application is applied. A specific computer system may include more or fewer components than those shown in the figure, or combine certain components, or have different component arrangements.

[0039] Those skilled in the art will understand that all or part of the processes in the above embodiments can be implemented by a computer program instructing related hardware. The computer program can be stored in a non-volatile computer-readable storage medium. When executed, the computer program can include the processes of the embodiments described above. Any references to memory, databases, or other media used in the embodiments provided in this application can include at least one of non-volatile and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetic random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. By way of illustration and not limitation, RAM can take many forms, such as Static Random Access Memory (SRAM) or Dynamic Random Access Memory (DRAM).

[0040] The processors involved in the various embodiments provided in this application may be general-purpose processors, central processing units, graphics processors, digital signal processors, programmable logic devices, quantum computing-based data processing logic devices, etc., and are not limited thereto.

[0041] The various embodiments in this specification are described in a progressive manner, with each embodiment focusing on the differences from other embodiments. The same or similar parts between the various embodiments can be referred to each other.

[0042] This document uses specific examples to illustrate the principles and implementation methods of this application. The descriptions of the above embodiments are only for the purpose of helping to understand the methods and core ideas of this application. Furthermore, those skilled in the art will recognize that, based on the ideas of this application, there will be changes in the specific implementation methods and application scope. Therefore, the content of this specification should not be construed as a limitation of this application.

Claims

1. A method for recovering ransomware-protected data from OceanBase databases based on WORM storage, characterized in that, The method includes: The backup directory output by the OceanBase database is pointed to the mount path configured with the WORM storage unit; the WORM storage unit is configured with a WORM storage policy; the WORM storage policy includes: guiding the business data file to enter a free write state within a first preset time period starting from the last write time; if the free write state exceeds the first preset time period, it enters an automatic lock state; if the automatic lock state exceeds a second preset time period, it automatically enters an unlock and cleanup state. The metadata file is periodically touched at intervals of a third preset time period to update the modification timestamp of the metadata file; the metadata file is a directory index of the backup business data file; the periodic touching is used to keep the metadata file active and writable; the third preset time period is shorter than the first preset time period. Metadata files and business data files are periodically backed up at a fourth preset time interval. At the same time, a corresponding version number is assigned to the backed-up metadata file. The backed-up metadata file, the backed-up business data file, and the corresponding version number are stored in the WORM storage unit and locked using the worm command. The fourth preset time interval is shorter than the first preset time interval. Use OceanBase database backup function to perform full backup, incremental backup, archive log slices on business data files, and then immediately lock the files using the worm command. When data recovery is required, soft links are created in the corresponding full backup, incremental backup, and archive log directories in the backup directory according to the version number of the metadata to be recovered. The soft links are used to map the full backup, incremental backup, and archive logs of the backup metadata to a directory structure that meets the recovery requirements of the OceanBase database. Data recovery is completed by reading the backup metadata in the symbolic link directory using the OceanBase database recovery command; When a WORM storage unit enters the unlock and cleanup state, expired backup metadata files, backup business data files, and corresponding version numbers are deleted from the worm storage, freeing up space and preparing for the next stage of data backup.

2. The method for preventing ransomware attacks on OceanBase databases based on WORM storage as described in claim 1, characterized in that, The free write state is a state in which data is allowed to be written, modified, or deleted normally.

3. The method for preventing ransomware attacks on OceanBase databases based on WORM storage as described in claim 1, characterized in that, The automatic locking state is a state in which data can only be read, and no user or process can modify, delete or encrypt the file content.

4. The method for recovering OceanBase database data from ransomware based on WORM storage according to claim 1, characterized in that, The unlock and cleanup status refers to the state where the data read-only lock is released, allowing the safe deletion of expired backup metadata files, backup business data files, and their corresponding version numbers.

5. The method for recovering OceanBase database data from ransomware based on WORM storage according to claim 1, characterized in that, During the process of creating symbolic links in the backup directory for the version number of the metadata to be recovered, if the business data file corresponding to the version number of the metadata to be recovered is unrecoverable due to ransomware damage, then it will be necessary to create symbolic links using the metadata of the previous version number of the metadata and its corresponding full backup, additional backup, and archive log files for recovery.

6. The method for recovering OceanBase database data from ransomware based on WORM storage according to claim 1, characterized in that, The first preset time period is 2 hours.

7. The method for preventing ransomware attacks on OceanBase databases based on WORM storage as described in claim 1, characterized in that, The second preset time period is 7 days.

8. The method for recovering OceanBase database data from ransomware based on WORM storage according to claim 1, characterized in that, The third preset time period is 1 hour.

9. The method for recovering OceanBase database data from ransomware based on WORM storage according to claim 1, characterized in that, The fourth preset time period is 1 hour.

10. A computer system, comprising: A memory, a processor, and a computer program stored on the memory and executable on the processor, characterized in that the processor executes the computer program to implement the OceanBase database ransomware recovery method based on WORM storage as described in any one of claims 1-9.

Images