Storage Device

Abstract

To provide a storage device, a falsification detection method, and a program, capable of accurately detecting data falsification.SOLUTION: A storage device includes: an I / O pattern collection section which collects I / O pattern information within a storage device as a collection of I / O pattern information representing information corresponding to operation when performing backup processing, and obtaining I / O pattern information obtained within a client device from the client device transmitting data to be backed up; and a data analysis section which functions as a detection section for detecting falsification to the data to be backed up based on the I / O pattern information collected by the I / O pattern collection section.SELECTED DRAWING: Figure 1

Description

[Technical field]

[0001] The present invention relates to a storage device, a tamper detection method, and a program. [Background technology]

[0002] Methods for detecting unauthorized access such as data tampering are known.

[0003] For example, Patent Document 1 describes an unauthorized access countermeasure control device that includes a kernel space and an AP space. According to Patent Document 1, in the kernel space, events executed by the OS are monitored based on a monitoring event definition table that defines events that are signs of unauthorized access, and when an event that is a sign of unauthorized access occurs, a notification is sent to the AP space. Also, in the AP space, there is provided an unauthorized access detection means that detects unauthorized access, and a software control unit that receives a notification from the kernel space and executes the unauthorized access detection means. This configuration makes it possible to detect unauthorized access in real time while suppressing performance degradation, etc. [Prior art documents] [Patent documents]

[0004] [Patent Document 1] JP 2006-65835 A [Patent Document 2] International Publication No. 2012 / 101983 Summary of the Invention [Problem to be solved by the invention]

[0005] As a means of protecting data from data tampering, in addition to detecting unauthorized access, there is also a method of periodically backing up data using backup software, etc., and retrieving and restoring data from past backup data when tampering is detected. However, when using such a method, if the backup data is tampered with at the same time as the original data, there is no way to restore the data. Another method is to replicate the backup data. However, even with this method, there is a risk that the tampered data will be replicated, making restoration impossible.

[0006] Thus, there has been a problem that it is difficult to accurately detect data tampering. Therefore, an object of the present disclosure is to provide a storage device, a tampering detection method, and a program that solve the problem that it is sometimes difficult to accurately detect data tampering. [Means for solving the problem]

[0007] In order to achieve this object, a storage device according to one embodiment of the present disclosure comprises: A collection unit that collects I / O pattern information, which is information corresponding to an operation when performing a backup process; a detection unit that detects tampering with data to be backed up based on the I / O pattern information collected by the collection unit; have The structure is as follows.

[0008] In addition, a tamper detection method according to another embodiment of the present disclosure includes: An information processing device, Collect I / O pattern information, which is information related to the operation when performing backup processing, Detects tampering with data to be backed up based on the collected I / O pattern information The structure is as follows.

[0009] In addition, a program according to another aspect of the present disclosure includes: In the information processing device, Collect I / O pattern information, which is information related to the operation when performing backup processing, Detects tampering with data to be backed up based on the collected I / O pattern information It is a program for implementing processing. Effect of the Invention

[0010] According to the above-mentioned configurations, data tampering can be accurately detected. [Brief description of the drawings]

[0011] [Figure 1] 2 is a diagram illustrating an example of the configuration of a storage device and a client device according to the first embodiment of the present disclosure. [Diagram 2] 13 is a diagram illustrating an example of I / O pattern information collected by an I / O pattern collection unit. FIG. [Diagram 3] FIG. 13 is a diagram illustrating an example of an algorithm for detecting tampering by a data analysis unit. [Figure 4] FIG. 13 is a diagram for explaining an example of tamper detection. [Diagram 5] 11 is a flowchart illustrating an example of an operation performed by the storage device when detecting tampering. [Figure 6] FIG. 11 is a diagram illustrating another example of processing by the storage device. [Figure 7] FIG. 11 is a diagram illustrating an example of a hardware configuration of a storage apparatus according to a second embodiment of the present disclosure. [Figure 8] FIG. 2 is a block diagram showing a configuration example of a storage device. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0012] [First embodiment] A first embodiment of the present disclosure will be described with reference to Figs. 1 to 6. Fig. 1 is a block diagram showing a configuration example of a storage device 100 and a client device 200. Fig. 2 is a diagram showing an example of I / O pattern information collected by the I / O pattern collection unit 110. Fig. 3 is a diagram showing an example of a tampering detection algorithm by the data analysis unit 120. Fig. 4 is a diagram for explaining an example of tampering detection. Fig. 5 is a flowchart showing an example of an operation when the storage device 100 detects tampering. Fig. 6 is a diagram for explaining another processing example of the storage device 100.

[0013] In the first embodiment of the present disclosure, a storage device 100 that performs a backup process of receiving and storing data to be backed up from a client device 200 will be described. As will be described later, the storage device 100 collects I / O pattern information, which is information according to operations when performing backup processing, in response to reception of data to be backed up from the client device 200, etc. Then, the storage device 100 detects tampering with the data to be backed up, etc., based on the collected I / O pattern information. I / O by the backup software 210 often follows a fixed pattern for each software. The storage device 100 can detect tampering by focusing on the above pattern.

[0014] As described later, the I / O pattern information may include information extracted (collected) in the storage device 100 and information collected by the collection unit 220 operating in the client device 200. The I / O pattern information may include only one of the information extracted in the storage device 100 and the information collected by the collection unit 220 operating in the client device 200.

[0015] Furthermore, the storage device 100 can create a snapshot of the file system before the update, triggered by receiving the data to be backed up, before performing the backup process. Then, when tampering is detected, the storage device 100 can notify the user, etc., that the tampering has been detected, without restricting the I / O by the backup. For example, when the data to be backed up is increased or decreased, or when the backup software 210 is updated, the I / O pattern may change. By detecting tampering while not causing the backup to fail, it is possible to deal with the above-mentioned cases. In particular, in a CAS (Contents Addressed Storage) device, by using a method such as that described in Patent Document 2, a snapshot can be created without affecting the I / O performance of the user. Therefore, a snapshot may be created using a method such as that described in Patent Document 2.

[0016] Fig. 1 shows an example of the overall configuration. As shown in Fig. 1, a storage device 100 is connected to a client device 200 so as to be able to communicate with each other. The storage device 100 receives data to be backed up, I / O pattern information collected by the client device 200, and the like from the client device 200.

[0017] Furthermore, referring to FIG. 1, the storage device 100 includes an I / O pattern collector 110, a data analyzer 120, a controller 130, a notifier 140, and a storage device 150, in addition to the components used during backup processing.

[0018] For example, the storage device 100 has a calculation device such as a CPU, and a storage device such as the storage device 150. For example, the storage device 100 can realize each of the above-mentioned processing units by causing the calculation device to execute a program stored in a storage device such as the storage device 150. The storage device 100 may realize each of the above-mentioned processing units by hardware or a combination of hardware and software.

[0019] The I / O pattern collection unit 110 collects I / O pattern information, which is information according to operations when performing backup processing. For example, when the I / O pattern collection unit 110 receives data to be backed up or I / O pattern information collected by the client device 200 from the client device 200, the I / O pattern collection unit 110 starts collecting I / O pattern information. Then, the I / O pattern collection unit 110 stores the collected I / O pattern information in the storage device 150.

[0020] The I / O pattern collection unit 110 collects I / O pattern information by receiving information from a collection unit 220 included in the client device 200, acquiring information from within the storage device 100, or the like. For example, referring to FIG. 2, the I / O pattern collection unit 110 collects I / O pattern information including at least some of the following examples. IP address of the client device 200, network routing information, memory and CPU usage Backup software 210 software logs, configuration parameters -Frequency and amount of file creation, writing to files, reading from files, etc., execution time, file name - Read and write performance, read and write start position, data size, data characteristics (compressibility rate, duplicate data inclusion rate, etc.) Memory and CPU usage and resource allocation ratios within the storage device 100 Among the above-mentioned information, at least some of the IP address of the client device 200, network routing information, memory and CPU usage, software log of the backup software 210, setting parameters, etc. can be collected, for example, by receiving information from the collection unit 220. Also, at least some of the file creation, frequency and amount of writing to and reading from a file, execution time, file name, execution performance of reading and writing, starting position of reading and writing, data size, data characteristics (compressibility rate, duplicate data inclusion rate, etc.), memory and CPU usage in the storage device, etc. can be collected, for example, by acquiring information from within the storage device 100.

[0021] The I / O pattern collection unit 110 may be configured to delete the I / O pattern information stored in the storage device 150 according to a predetermined condition. For example, the I / O pattern collection unit 110 may be configured to leave the I / O pattern information for a predetermined number of backups in the storage device 150 and delete the oldest information in order. The number of times that serves as the basis for deletion can be determined according to the amount of data required to detect tampering, such as the number of times required for calculating an average value or a deviation value, or as input data for machine learning. The I / O pattern collection unit 110 may be configured to perform the above deletion at any timing.

[0022] The I / O pattern collection unit 110 may be configured to start collection of I / O pattern information and to instruct the control unit 130 to create a snapshot of the file system. The I / O pattern collection unit 110 may be configured to instruct the control unit 130 to delete the snapshot created before the backup process if no tampering is detected at the time the backup process is completed.

[0023] The data analysis unit 120 detects tampering with the data to be backed up, based on the I / O pattern information collected by the I / O pattern collection unit 110. In other words, the data analysis unit 120 functions as a detection unit that detects tampering with the data to be backed up, based on the I / O pattern information.

[0024] For example, the data analysis unit 120 can detect tampering by comparing the past I / O pattern information stored by the I / O pattern collection unit 110 with the I / O pattern information to be the target of tampering detection, using the results of machine learning based on the past I / O pattern information, etc. In other words, for example, the data analysis unit 120 detects tampering when there is a difference between the past I / O pattern information and the I / O pattern information to be the target of tampering detection, when data indicated by the past I / O pattern information is quantified, and when an AI that has been trained to learn machine learning using the quantified data as input determines that there is a possibility of tampering, etc.

[0025] Fig. 3 shows an example of an algorithm used when the data analysis unit 120 detects tampering. For example, referring to Fig. 3, the algorithm used when detecting tampering includes detection based on a policy, detection of fraud that cannot be defined by a user using principal component analysis or k-nearest neighbor method, etc.

[0026] For example, the data analysis unit 120 can detect tampering based on predetermined characteristic information as an example of detection based on a policy. For example, characteristic information such as "unchanging due to backup" or "having a certain regularity" can be defined in advance for each piece of information included in the I / O pattern information. Then, the data analysis unit 120 can detect tampering when the I / O pattern information to be detected includes information that deviates from the predetermined characteristic information. Note that the characteristic information may be other than the above examples.

[0027] As an example, characteristic information such as "things that are immutable due to backups" and "things that follow a certain pattern" can be defined in advance for the following types of information among the I / O pattern information. Characteristic information may also be added to information other than the examples below. - Items that do not change due to backup (presence or absence of backup log, connected client IP, backup execution time, etc.) - Items with a certain regularity (file names, backup job identifiers, etc.)

[0028] For example, suppose that data to be backed up has been received, but the log of the backup software 210 has not arrived. In this case, the backup log that should have arrived has not arrived for a backup log that has the characteristic of being "unchanged by backup." Therefore, the data analysis unit 120 determines that the I / O pattern information to be detected includes information that deviates from the predetermined characteristic information, and detects tampering. In this way, the data analysis unit 120 can detect tampering by comparing with past information using the characteristic information.

[0029] In addition, for example, the data analysis unit 120 can detect tampering using principal component analysis as an example of detection of fraud that cannot be defined by the user. For example, the data analysis unit 120 can A principal component analysis is performed in advance using components that can be measured and calculated for the number or amount of past I / O pattern information during one backup. Then, the data analysis unit 120 performs an analysis using a method of anomaly detection using principal component analysis. For example, when the current write, which is the I / O pattern information to be detected, deviates from the normal subspace, the data analysis unit 120 can regard it as tampering. The I / O pattern information that can be measured and calculated for the number or amount of past I / O pattern information during one backup includes, for example, the number of file creations, the number of file attribute updates, and the amount of data. The data analysis unit 120 may perform principal component analysis using some of the above examples, or may perform principal component analysis using information included in I / O pattern information other than the above examples. The method of anomaly detection using principal component analysis may be a known method.

[0030] The backup process by the backup software 210 is performed repeatedly and periodically with a certain logic on the same original data (including partial updates). Generally, during backup process, the backup software 210 embeds management data (metadata) in addition to the original data according to a certain rule. Therefore, among the I / O pattern information, consistency occurs in the following information (components). Therefore, by applying principal component analysis to at least a part of the following information, it becomes possible to detect abnormal tampering. - The ratio of the number of files created to the number of times file attributes are changed -Limit on the number of files that can be written simultaneously File creation timing (e.g., offset time variance from the start of the backup) The ratio of the number of files created to the amount of data written The ratio of small files (metadata) to large files (data) Number of writes to a specific offset (e.g., the beginning of the file, 32KB, 64KB) Write offset transition (e.g. (write offset - previous write offset - previous write size) 2 (average of

[0031] For example, the backup software 210 is characterized by changing the attributes of one 2GB file three times and changing the attributes of a small management file eight times. In the above situation, it is assumed that only one attribute update is performed for each file in the I / O pattern information to be detected. For example, in such a case, the data analysis unit 120 can detect the tampering.

[0032] Furthermore, for example, the data analysis unit 120 can detect tampering using the results of classification using the k-nearest neighbor method or the like, as an example of detection of fraud that cannot be defined by the user. For example, the data analysis unit 120 performs machine learning (using the k-nearest neighbor method or the like) in advance to classify past I / O pattern information that is time-series (continuous) data (write performance, CPU utilization rate, deduplication rate, etc.) as feature values. Then, the data analysis unit 120 can determine that the I / O pattern information to be detected does not fall into any of the classifications as tampering. The I / O pattern information that is time-series (continuous) data is, for example, write performance, CPU utilization rate, deduplication rate, etc. The data analysis unit 120 may perform machine learning using some of the above examples, or may perform machine learning using information included in I / O pattern information other than the above examples.

[0033] For example, some CAS storage devices have a characteristic where performance fluctuates depending on whether or not write data overlaps with stored data. In such cases, the performance graph indirectly includes information about data duplication, and expresses the characteristics of where the updated part of the data to be backed up is located (when it is written). Therefore, by performing the classification described above, it is possible to detect tampering.

[0034] For example, as shown in Fig. 4, it is assumed that the write performance does not fit into any class classified by machine learning (for example, the k-nearest neighbor method) (for example, there is a distance greater than a predetermined distance). In such a case, the data analysis unit 120 can detect tampering.

[0035] For example, as described above, the data analysis unit 120 can detect tampering by performing various processes on the I / O pattern information. The data analysis unit 120 may detect tampering by combining the methods exemplified above, or may detect tampering by using some of the methods exemplified above.

[0036] The control unit 130 creates and deletes snapshots. Furthermore, when the data analysis unit 120 detects tampering, the control unit 130 instructs the reporting unit 140 to issue a predetermined report.

[0037] For example, the control unit 130 can create or delete a snapshot in response to an instruction from the I / O pattern collection unit 110. As described above, the control unit 130 may create a snapshot using a method such as that described in Patent Document 2.

[0038] The notification unit 140 notifies a pre-registered user in response to an instruction from the control unit 130. For example, in response to detection of tampering by the data analysis unit 120, the notification unit 140 notifies the user that the tampering has been detected.

[0039] The storage device 150 is a storage device that stores I / O pattern information. The storage device 150 may store data to be backed up, snapshots created by the control unit 130, and the like.

[0040] The above is an example of the configuration of the storage device 100.

[0041] The client device 200 is an information processing device that transmits data to be backed up and the like to the storage device 100. With reference to FIG.

[0042] The backup software 210 performs backup processing by, for example, transmitting the data to be backed up to the storage device 100. The backup software 210 may be a known software.

[0043] The collection unit 220 acquires I / O pattern information that can be acquired by the client device 200 and transmits the information to the storage device 100. For example, the collection unit 220 monitors the log of the backup software 210. Then, the collection unit 220 acquires I / O pattern information that can be acquired by the client device 200 upon the start of a backup. The collection unit 220 can transmit the acquired I / O pattern information to the storage device 100, for example, periodically.

[0044] For example, the collection unit 220 acquires IP addresses, network routing information, memory and CPU usage, etc. The collection unit 220 also acquires setting values ​​of the backup software 210 through the API of the backup software 210, etc. The setting values ​​to be acquired are, for example, predetermined. The collection unit 220 then periodically transmits the log of the backup software 210 and the acquired I / O pattern information to the storage device 100 through a network path or the like that has been set in advance.

[0045] The collection unit 220 may transmit the log of the backup software 210 without processing it, or may transmit a part of the log by using a preset parsing method or the like. When partially extracting the log, the collection unit 220 may set characteristic information, such as a value that should be different for each backup or a value that should be common, to the extracted value or the like. In other words, the collection unit 220 may acquire I / O pattern information and add characteristic information to the acquired I / O pattern information according to a preset criterion or the like.

[0046] The above is an example of the configuration of the client device 200. Next, an example of the operation of the storage device 100 when detecting tampering will be described with reference to FIG.

[0047] 5, the I / O pattern collection unit 110 starts collecting I / O pattern information and instructs the control unit 130 to create a snapshot of the file system. As a result, the control unit 130 creates a snapshot before the update (step S101).

[0048] The I / O pattern collection unit 110 collects I / O pattern information. For example, the I / O pattern collection unit 110 collects the I / O pattern information by receiving it from the collection unit 220 or by collecting it within the storage device 100 (step S102).

[0049] The data analysis unit 120 detects tampering with the data to be backed up based on the I / O pattern information collected by the I / O pattern collection unit 110 (step S103). For example, the data analysis unit 120 detects tampering using at least one of algorithms such as detection by policy, detection of fraud that cannot be defined by a user using principal component analysis, k-nearest neighbor method, etc.

[0050] When no tampering is detected even after the backup process is completed (No in step S103), the data analysis unit 120 notifies the I / O pattern collection unit 110 that no tampering was detected. In response to this, the I / O pattern collection unit 110 notifies the control unit 130 to delete the snapshot created before the update. As a result, the control unit 130 deletes the snapshot created before the update (step S104). In this way, when the data analysis unit 120 does not detect tampering even after the backup process is completed, the control unit 130 deletes the snapshot created before the update.

[0051] On the other hand, if the data analysis unit 120 detects tampering (step S103, Yes), the data analysis unit 120 notifies the control unit 130 that tampering has been detected. In response to this, the control unit 130 instructs the reporting unit 140 to make a predetermined report. As a result, the reporting unit 140 notifies the user that tampering has been detected (S105).

[0052] In this way, the storage device 100 has an I / O pattern collection unit 110 and a data analysis unit 120. With this configuration, the data analysis unit 120 can detect tampering based on the I / O pattern information collected by the I / O pattern collection unit 110. In other words, the storage device 100 can detect tampering that has been performed without going through the backup software 210 by detecting differences in operation based on client information, particularly I / O pattern information including the log of the backup software 210. This makes it possible to accurately detect data tampering.

[0053] Moreover, according to the storage device 100 described in this embodiment, tampering is detected by detecting differences in the data itself, including data size and data characteristics (compressibility rate, duplicate data inclusion rate, etc.) as I / O pattern information. Therefore, it is possible to detect that tampered original data has been backed up. For example, a type of malware called ransomware encrypts files to obstruct access to data and demands a ransom in exchange for a secret key for decryption, but the encrypted data has differences in the above-mentioned I / O pattern information compared to past data stored in the storage device 100. Therefore, according to the storage device 100 described in this embodiment, tampering can be detected without any problems in the above-mentioned cases.

[0054] Furthermore, according to the storage device 100 described in this embodiment, a snapshot is created before updating (before backup). Then, if tampering is detected, the storage device 100 notifies the user or the like that tampering has been detected without restricting I / O due to backup. For example, if the data to be backed up is increased or decreased, or if the backup software 210 is updated, the I / O pattern may change. By detecting tampering while not causing backup to fail, it is possible to handle such cases.

[0055] Some storage devices provide a WORM (Write Once Read Many) function that prevents files from being updated for a preset period of time. According to the method described in this embodiment, the WORM function that requires a unique protocol is not required, so tampering can be detected without placing restrictions on the selection of the backup software 210.

[0056] The storage device 100 may be configured to perform processing for tuning performance in addition to detecting tampering based on the I / O pattern information. In other words, the I / O pattern information can also be used to improve the performance of the storage device 100. With this configuration, it is possible to automatically tune to optimal I / O performance simply by performing a certain amount of backup testing (machine learning). As a result, it is possible to reduce the effort required, for example, when building a new system or when updating the backup software 210 or the OS of the client device 200.

[0057] For example, thresholds and corresponding parameter values ​​are set in advance for the number of files created, the amount of writing and reading to files, resource allocation ratios, and the like. Then, for example, when the value of each execution data indicated by the I / O pattern information exceeds a threshold, the data analysis unit 120 outputs the preset parameter value as a recommended value. Note that the parameter value may be, for example, a value calculated by an AI or the like that has been machine-learned using I / O pattern information for a certain period stored in the storage device 150 as input. In other words, the parameters output by the data analysis unit 120 may be calculated using a known technology such as deep learning.

[0058] Furthermore, when a parameter change is recommended by the data analysis unit 120, the control unit 130 can change the parameters of the storage device 100 itself to values ​​output by the data analysis unit 120, or can change or suggest parameter values ​​on the client device 200 side. For example, the control unit 130 can be configured to change or suggest parameter values ​​on the client device 200 side through an API, Webhook, email, or the like provided by the client device 200.

[0059] For example, there are physical limitations to resources such as memory, CPU, and storage capacity that software can use. For this reason, it is common for software to allocate resources in advance for different purposes. For example, as shown in Fig. 6, in the storage device 100, it is possible to allocate a memory amount to be used for a structure that represents a file, a memory amount to be used as a buffer for written data, and a memory amount to be used to cache read data.

[0060] Such internal resource allocation is considered to be built into the software as a default state optimized for common use cases. However, in individual cases, the resource allocation described above may become a bottleneck and cause a decrease in performance. In addition, it is often difficult for users to understand the specifications within such software and change them by setting parameters.

[0061] Therefore, the allocation is tuned based on I / O pattern information indicating actual I / O patterns performed in the past. For example, the data analysis unit 120 outputs a predetermined parameter (for example, increase the memory allocation of the file structure by 10% and reduce the memory allocation of the read cache by 10%) when the memory usage rate of the file structure included in the I / O pattern information exceeds a threshold value (for example, the average number of times it has reached 100% is 3, etc.). For example, as described above, the data analysis unit 120 and the control unit 130 may be configured to perform processing for tuning performance in addition to detecting tampering based on the I / O pattern information.

[0062] [Second embodiment] Next, a second embodiment of the present disclosure will be described with reference to Figures 7 and 8. In the second embodiment, a storage device 300 will be described.

[0063] Fig. 7 shows an example of the hardware configuration of the storage device 300. Referring to Fig. 7, the storage device 300 has, as an example, the following hardware configuration. ·CPU(Central Processing Unit)301(Arithmetic unit) ROM (Read Only Memory) 302 (storage device) RAM (Random Access Memory) 303 (storage device) Programs 304 loaded into RAM 303 A storage device 305 for storing the programs 304 A drive device 306 that reads and writes data from a recording medium 310 outside the storage device A communication interface 307 for connecting to a communication network 311 outside the storage device Input / output interface 308 for inputting and outputting data Bus 309 connecting each component

[0064] 8 by the CPU 301 acquiring the group of programs 304 and executing the group of programs 304. The group of programs 304 is stored in the storage device 305 or the ROM 302 in advance, for example, and the CPU 301 loads the group of programs 304 into the RAM 303 or the like and executes the programs as necessary. The group of programs 304 may be supplied to the CPU 301 via the communication network 311, or may be stored in the recording medium 310 in advance, and the drive device 306 may read out the programs and supply them to the CPU 301.

[0065] 7 shows an example of the hardware configuration of the storage device 300. The hardware configuration of the storage device 300 is not limited to the above. For example, the storage device 300 may be configured with a part of the above configuration, such as not including the drive device 306.

[0066] The collection unit 321 collects I / O pattern information, which is information according to the operation when performing backup processing.

[0067] The detection unit 322 detects tampering with the data to be backed up based on the I / O pattern information collected by the collection unit 321.

[0068] As described above, the storage device 300 has a collection unit 321 and a detection unit 322. With this configuration, the detection unit 322 can detect tampering with the data to be backed up based on the I / O pattern information collected by the collection unit 321. As a result, it becomes possible to accurately detect tampering.

[0069] The above-mentioned storage device 300 can be realized by installing a predetermined program in an information processing device such as the storage device 300. Specifically, a program according to another embodiment of the present invention is a program for causing an information processing device such as the storage device 300 to collect I / O pattern information, which is information corresponding to operations when performing backup processing, and to realize processing for detecting tampering with data to be backed up based on the collected I / O pattern information.

[0070] Furthermore, the tamper detection method realized by an information processing device such as the above-mentioned storage device 300 is a method in which the information processing device such as the storage device 300 collects I / O pattern information, which is information corresponding to the operation when performing backup processing, and detects tampering of the data to be backed up based on the collected I / O pattern information.

[0071] The invention of a program (or recording medium) or a tamper detection method having the above-mentioned configuration has the same action and effect as the above-mentioned storage device 300, and therefore can achieve the above-mentioned object of the present invention.

[0072] <Additional Notes> A part or all of the above-described embodiment can be described as follows: A storage device and the like according to the present invention will be outlined below. However, the present invention is not limited to the following configuration.

[0073] (Appendix 1) A collection unit that collects I / O pattern information, which is information corresponding to an operation when performing a backup process; a detection unit that detects tampering with data to be backed up based on the I / O pattern information collected by the collection unit; have Storage device. (Appendix 2) The collection unit collects the I / O pattern information in a storage device, and acquires the I / O pattern information acquired in a client device from a client device that transmits the data to be backed up. 2. The storage device of claim 1. (Appendix 3) The I / O pattern information includes the logs of the backup software. 3. The storage device according to claim 1 or 2. (Appendix 4) The detection unit detects tampering based on characteristic information previously assigned to each piece of information included in the I / O pattern information. 4. The storage device according to claim 1, (Appendix 5) The detection unit detects tampering using a result of machine learning using information included in the I / O pattern information collected in the past. Storage device according to any one of appendix 1 to appendix 4. (Appendix 6) The detection unit detects tampering by using principal component analysis using information included in the previously collected I / O pattern information as components. 6. The storage device according to claim 1, (Appendix 7) The detection unit detects tampering using the results of classification of information included in the previously collected I / O pattern information as features by machine learning. 7. The storage device according to claim 1, (Appendix 8) A control unit that creates a snapshot of a file system before updating the file system by a backup; The backup will not fail even if the detection unit detects tampering. 8. The storage device according to claim 1, (Appendix 9) The detection unit outputs a predetermined parameter value based on the I / O pattern information. 9. The storage device according to claim 1, (Appendix 10) An information processing device, Collect I / O pattern information, which is information related to the operation when performing backup processing, Detects tampering with data to be backed up based on the collected I / O pattern information Tamper detection methods. (Appendix 11) In the information processing device, Collect I / O pattern information, which is information related to the operation when performing backup processing, Detects tampering with data to be backed up based on the collected I / O pattern information A program to realize the processing.

[0074] The programs described in the above embodiments and appendices may be stored in a storage device or a computer-readable recording medium, such as a portable medium such as a flexible disk, an optical disk, a magneto-optical disk, or a semiconductor memory.

[0075] Although the present invention has been described with reference to the above-mentioned embodiments, the present invention is not limited to the above-mentioned embodiments. Various modifications that can be understood by a person skilled in the art can be made to the configuration and details of the present invention within the scope of the present invention. [Explanation of symbols]

[0076] 100 Storage Device 110 I / O Pattern Collection Unit 120 Data Analysis Department 130 Control section 140 Reporting Department 150 Storage device 200 Client Device 210 Backup Software 220 Collection Department 300 Storage Device 301 CPU 302 ROM 303 RAM 304 Programs 305 Storage device 306 Drive Unit 307 Communication Interface 308 Input / Output Interface 309 Bus 310 Recording media 311 Communication Network 321 Collection Department 322 Detection unit

Claims

1. A collection unit that collects I / O pattern information, which is information corresponding to an operation when performing a backup process; a detection unit that detects tampering with data to be backed up based on the I / O pattern information collected by the collection unit; having The detection unit detects tampering based on characteristic information previously assigned to each piece of information included in the I / O pattern information, The characteristic information may be indicated as being immutable by a backup; The detection unit detects tampering when the I / O pattern information to be detected includes information that deviates from the characteristic information. Storage device.

2. The collection unit collects the I / O pattern information within a storage device, and acquires, from a client device that transmits the data to be backed up, the I / O pattern information acquired within the client device that differs from I / O pattern information that can be collected within the storage device. The storage device according to claim 1.

3. The I / O pattern information includes the log of the backup software. The storage device according to claim 1 or 2.

4. The detection unit detects tampering using a result of machine learning using information included in the I / O pattern information collected in the past. A storage device according to any one of claims 1 to 3.

5. The detection unit detects tampering by using principal component analysis using information included in the I / O pattern information collected in the past as components. The storage device according to any one of claims 1 to 4.

6. The detection unit detects tampering using a result of classification performed in advance by machine learning of information included in the previously collected I / O pattern information as a feature. The storage device according to any one of claims 1 to 5.

7. A control unit that creates a snapshot of a file system before updating the file system by a backup; In response to detection of tampering by the detection unit, a backup process is performed without restricting I / O by the backup and a notification is issued in response to the detection. If the detection unit does not detect tampering, the control unit deletes the created snapshot. The storage device according to any one of claims 1 to 6.

8. The detection unit outputs a predetermined parameter value based on the I / O pattern information. The storage device according to any one of claims 1 to 7.

9. An information processing device, Collect I / O pattern information, which is information corresponding to the operation when performing backup processing; Detecting tampering with the data to be backed up based on the collected I / O pattern information; When detecting tampering, the tampering is detected based on characteristic information previously assigned to each piece of information included in the I / O pattern information; The characteristic information may be indicated as being immutable by a backup; When detecting tampering, if the I / O pattern information to be detected includes information that is different from the characteristic information, tampering is detected. Tamper detection methods.

10. In the information processing device, Collect I / O pattern information, which is information corresponding to the operation when performing backup processing; Detecting tampering with the data to be backed up based on the collected I / O pattern information; When detecting tampering, the tampering is detected based on characteristic information previously assigned to each piece of information included in the I / O pattern information; The characteristic information may be indicated as being immutable by a backup; When detecting tampering, if the I / O pattern information to be detected includes information that is different from the characteristic information, tampering is detected. A program to realize the processing.

Images