Data Protection System

Abstract

To provide a data protection storage to ensure that a data protection-processed file is provided to a client terminal.SOLUTION: A remote data storage device 200B that is a data protection storage includes a standard network file server that receives file access requests from users by communicating with a standard network driver installed in the operating regime of the client terminal and a data protection processing unit that applies data protection processing to requested files based on data protection policies configured in the policy section when file access requests are received from file systems mapped to repository of the standard network file server, ensuring the processed files are provided to a client terminal.SELECTED DRAWING: Figure 3

Description

[Technical Field]

[0001] The present invention relates to a data protection technology, and more particularly to a data protection storage that can prevent external attacks such as ransomware and data theft. [Background technology]

[0002] A conventional storage technology for preventing ransomware involves installing a client program in a Windows or Linux operating system and installing a ransomware prevention file server daemon on a separate file server. When a file event occurs on a PC or server where the client program is installed, related to a file in a network driver connected to the ransomware prevention file server daemon, the client program transmits the file event to the file server, and when the file server transmits the requested file according to the file event, it encrypts the file and provides it.

[0003] However, in the above-mentioned conventional technology, users have to install a separate client program as described above on their PCs or servers, and service providers have to bear the burden of developing a client program that performs the above-mentioned functions for each operating system, such as Windows, Mac, Linux, etc., and for each version of the operating system. Summary of the Invention [Problem to be solved by the invention]

[0004] The present invention has been developed to solve the above-mentioned problems, and aims to provide data protection storage that enables materials stored in a file server to be kept safe from malware attacks such as ransomware. [Means for solving the problem]

[0005] According to one aspect of the present invention, there is provided a data protection storage including a standard network file server that communicates with a standard network driver installed in an operating system of a client terminal to receive a file access request from a user, and a data protection processing unit that, when the file access request is received from a file system mapped to a repository of the standard network file server, performs data protection processing on the requested file according to a data protection policy set in a policy unit, and provides the data-protected file to the client terminal.

[0006] In one embodiment, the standard network file server transmits file access events (creation, reading, modification, deletion, movement, etc.) due to file access requests received via the standard network driver of the client terminal to the file system, and the file system calls a predetermined program function according to the received file access event to interface with the data protection processing unit, and when the data protection processing unit processes the file access event using the called function, data protection processing according to the data protection policy can be performed on the requested file.

[0007] In this case, the file system may be a virtual file system or a custom file system, which is not a data storage where actual files are stored.

[0008] In one embodiment, the file system may include a directory path of the requested file and call a program function determined in accordance with the file access event to interact with the data protection processor, in which the data protection processor processes the file access event according to a directory-specific file protection policy of the called file, so that data protection processing according to the directory-specific data protection policy can be performed on the requested file.

[0009] In one embodiment, the standard network file server acquires information that can identify the client terminal or user account that transmitted the file access event and transmits it to the policy unit, and the data protection processing unit confirms from the policy unit which client terminal or user account requested the file access event that currently occurred, so that data protection processing can be performed according to a data protection policy for each user.

[0010] In one embodiment, the data protection processor may be functionally implemented as an integral part of the file system in the kernel area, thereby forming the custom file system.

[0011] According to another aspect of the present invention, there is provided a data protection storage including a custom network file server communicating with a standard network driver installed in an operating system of a client terminal, wherein the custom network file server includes a file server corresponding unit communicating with the standard network driver and receiving a file access event requested by a user of the client terminal, and a data protection processing unit that, when a request based on the file access event is received, performs data protection processing on the requested file according to a data protection policy set in a policy unit, and provides the data-protected file to the client terminal. [Effects of the Invention]

[0012] According to an embodiment of the present invention, a data protection storage is provided that uses standard network driver technology installed in the operating system and enables data stored in a file server connected to the operating system to be safely protected from malware attacks such as ransomware, thereby eliminating the burden of having to develop a separate client program for preventing various malware such as ransomware for each operating system and its version.

[0013] According to an embodiment of the present invention, when a file open request is received, a fake file is generated in real time and transmitted only via communication, which has the effect of saving storage space compared to methods used in existing conventional technologies (e.g., methods of copying and replacing fake folders or files corresponding to real folders or files).

[0014] In the case of conventional technology, there is a management burden involved in setting up fake files for each file or folder, but according to an embodiment of the present invention, instead of providing fake files for each file or folder, all files included in the mounted driver are provided as fakes at once, which makes management easier for the user.

[0015] Furthermore, according to an embodiment of the present invention, fake files are provided via a network driver, which is more secure than a method of protecting files by operating a virtual file system within a local file system built into a PC. In other words, while malware running on a PC can easily disable a protection method installed on the PC, the network driver method provides higher security because the judgment unit is located on a file server outside the PC. This is because the judgment unit operates in a space separated from the PC and media, such as an IC chip card, providing high security. If malware directly attacks a network driver connected to a PC via a network, the network driver operates as part of the kernel, resulting in a blue screen or the PC's operating system crashing. When the OS crashes, the malware also crashes. [Brief explanation of the drawings]

[0016] [Figure 1] FIG. 1 is a diagram illustrating a typical remote data storage device that interfaces with a standard network driver installed in the operating system of a client terminal. [Figure 2]1 is a diagram illustrating a data protection storage according to a first embodiment of the present invention that works in conjunction with a standard network driver installed in the operating system of a client terminal. [Figure 3] FIG. 10 is a diagram illustrating a data protection storage according to a second embodiment of the present invention, which operates in conjunction with a standard network driver installed in the operating system of a client terminal. [Figure 4] FIG. 10 is a diagram illustrating a data protection storage according to a third embodiment of the present invention, which works in conjunction with a standard network driver installed in the operating system of a client terminal. Specific details for implementing the invention

[0017] The present invention can be modified in various ways and can have various embodiments, and specific embodiments are illustrated in the drawings and described in detail in the detailed description. However, it is not intended to limit the present invention to the specific embodiments, and it should be understood that the present invention includes all modifications, equivalents, and alternatives that fall within the spirit and technical scope of the present invention.

[0018] In describing the present invention, if it is determined that a detailed description of related prior art may unnecessarily obscure the gist of the present invention, the detailed description will be omitted. Furthermore, numbers (e.g., 1, 2, etc.) used in the description of this specification are merely identification symbols for distinguishing one component from another.

[0019] Furthermore, throughout the specification, when a component is referred to as being "coupled" or "connected" to another component, it should be understood that the component may be directly coupled or connected to the other component, but also may be coupled or connected via an intermediate component, unless otherwise specified. Furthermore, throughout the specification, when a part "comprises" a component, this does not exclude other components, but means that the part may further include other components, unless otherwise specified. Furthermore, the terms "module," "unit," and the like used in the specification refer to a unit that processes at least one function or operation, and mean that the unit may be implemented using one or more pieces of hardware, software, or a combination of hardware and software.

[0020] Hereinafter, a data protection storage according to each embodiment of the present invention will be described in detail with reference to the accompanying drawings.

[0021] Here, Figure 1 is a diagram for explaining a general remote data storage device that works in conjunction with a standard network driver installed in the operating system of a client terminal, Figure 2 is a diagram for explaining data protection storage according to a first embodiment of the present invention that works in conjunction with a standard network driver installed in the operating system of a client terminal, Figure 3 is a diagram for explaining data protection storage according to a second embodiment of the present invention that works in conjunction with a standard network driver installed in the operating system of a client terminal, and Figure 4 is a diagram for explaining data protection storage according to a third embodiment of the present invention that works in conjunction with a standard network driver installed in the operating system of a client terminal.

[0022] The following description will be based on Figures 1 to 4 and will take as an example a case where a folder stored in a remote data storage device is mounted in the form of a network driver on a client terminal 100 such as a PC or notebook computer. However, it goes without saying that the present invention can also be applied to a case where a folder stored in a remote data storage device is mounted in the form of a network driver on a server.

[0023] [Figure 1 - Normal network driver mounting method] 1, a built-in standard network driver (see "standard network driver client" in FIG. 1) operates in the client terminal 100 according to the operating system installed, and a standard network file server (see "standard network file server" in FIG. 1) that communicates with the standard network driver is installed in a remote data storage device. As a result, the network driver is mounted on the client terminal 100.

[0024] In this case, the standard network file server saves or reads files through a file system interface (see "File System Interface" in FIG. 1, commonly called a file system, which operates on a driver or directory mounted in an operating system) in the remote data storage device. The file system interface transmits disk I / O requests (e.g., file creation, file read (open), file write (modification), file copy, file move, etc.) from a user to a data storage (see "Data Storage" in FIG. 1) operating in a kernel space via a standard network file server operating in a user space. The standard network file server retrieves the file requested for file access from the data storage and returns the retrieved file to the standard network driver of the client terminal 100.

[0025] [Figure 2 - First Example] Referring to FIG. 2, a data protection storage 200A according to a first embodiment of the present invention may be implemented to include a standard network file server 210, a virtual file system 220, a data protection processing unit 230, and a policy unit 240.

[0026] As described above, the standard network file server 210 communicates with the standard network driver (see "standard network driver client" in Figure 2) installed in the operating system of the client terminal 100, and receives file access events requested by the user.

[0027] According to an embodiment of the present invention, the standard network file server 210 is not directly connected to the data storage 250, but is linked to the data storage 250 in which actual files are stored via the virtual file system 220. To this end, in an embodiment of the present invention, the repository used by the standard network file server 210 is mapped to the virtual file system 220 (recognized as a driver or directory in the operating system).

[0028] The virtual file system 220 described above is a technology that can implement a custom file system driver, and can be implemented using a file system in user space in UNIX or Linux operating systems, and can be implemented using a callback file system in Windows operating systems. This allows a user program to create its own file system (i.e., a virtual file system that does not provide a general file system by providing a bridge to the kernel interface) without modifying the kernel of the operating system.

[0029] In this case, the network driver that is actually mounted on the client terminal 100 is a folder or driver of the virtual file system 220. As a result, after the virtual file system 220, which is a custom file system, is mounted by the network driver, if a file I / O request such as read / write is received in the corresponding area, this can be processed by a program in the user space (i.e., the data protection processing unit 230, which will be described later).

[0030] The standard network file server 210 transmits file access events (create, read, write, delete, move, modify, etc.) according to file access requests received via a standard network driver of the client terminal 100 to the virtual file system 220. The virtual file system 220 only calls a user space function (see the virtual file system library in FIG. 2) defined according to the received file access event, and the actual processing of the file access event is performed by the data protection processor 230, which interacts with the virtual file system 200 through the function call.

[0031] At this time, the data protection processing unit 230 can process the file access event according to the data protection policy set in the policy unit 240.

[0032] As an example, if the data protection policy is read-only mode, the data protection processing unit 230 can receive the target file from the data storage 250, change the attribute of the target file to read-only, and then process the target file changed to read-only so that it can be returned by the standard network driver of the client terminal 100.

[0033] As another example, when the data protection policy is Fake Mode, the data protection processor 230 may generate a fake file that is not the requested file itself, and then process the generated fake file so that it is returned using a standard network driver of the client terminal 100. In this case, the fake file may be provided as read-only.

[0034] Prior art technologies exist that provide fake files for data protection (e.g., IBM's Decoy FS (file system)). However, providing fake files that are readable and writable can lead to malware encrypting and saving data in the fake files, making it impossible to prevent the falsification of existing files (i.e., original files) in the storage path of the fake files. To address this issue of falsification of original files, the Decoy FS system is configured to store the original files in a separate, independent storage space (i.e., separate files) from the fake files. In contrast, in embodiments of the present invention, when providing fake files that are not original files, fake files with read-only attributes are provided, thereby preventing falsification of original files within a single file system (i.e., without the need for the separate storage spaces).

[0035] The data protection policy can be set by turning on / off a predetermined hardware switch (not shown) provided in the data protection storage 200A. Of course, the user can also set the data protection policy of the policy unit 240 using a mobile terminal (see drawing number 10 in FIG. 2) or the like (software switch method). When the data protection policy is set by turning on / off a hardware switch, the same data protection policy is set collectively for all folders in the data storage 250, but when the software switch method is used, different data protection policies can be set for each individual or folder.

[0036] When the data protection storage 200A is shared by multiple users, the data protection policy can be set based on the directory of the requested file. In this case, the standard network file server 210 makes a file request including a file path in the virtual file system, and the data protection processing unit 240 refers to the policy set for the folder included in the corresponding file path, so that the corresponding file access request can be processed according to the data protection policy for each folder or directory.

[0037] Furthermore, when the data protection storage 200A is shared by multiple users, the data protection policy can be set for each user rather than for each folder. In this case, the standard network file server 210 can be designed to transmit information (e.g., a user ID, a device-specific value of a standard network driver, an IP address, a communication session value, etc.) that can identify the client terminal or user account that transmitted the file access event to the policy unit 240. As a result, the data protection processing unit 230 can confirm from the policy unit 240 which user's file access event is associated with the currently generated file access request and process the corresponding file access request according to the user-specific data protection policy. For example, the data protection policy can be set so that if the user ID is "Woo," files are provided only in read-only mode, and if the user ID is "Kim," files are provided only as fake read-only files.

[0038] [Figure 3 - Second Example] Referring to FIG. 3, the data protection storage 200B according to the second embodiment of the present invention can be implemented to include a standard network file server 210, a custom file system 220 (which also embodies the functions of the data protection processing unit 230), and a policy unit 240.

[0039] In the first embodiment of Fig. 2 described above, the virtual file system 220 is installed in the kernel area, and the data protection processor 230 is installed in the user area, so that they are configured separately, whereas in the second embodiment of Fig. 3, the virtual file system in the kernel area is configured as a custom file system 220 in which the functions of the data protection processor 230 are simultaneously implemented. The overall network file server policy (or a folder-specific policy or a user-specific policy in the case of multiple users) transmitted from the policy unit 240 can be configured to communicate with the custom file system, which is a kernel-level program, using Procfs, etc.

[0040] According to the second embodiment of Figure 3, service processing is performed directly at the kernel stage compared to the first embodiment of Figure 2, which has the advantage of reducing unnecessary file access requests and file input / output from kernel mode to user mode, thereby enabling faster processing.

[0041] [Figure 4 - Third embodiment] 4, a data protection storage 200C according to a third embodiment of the present invention is implemented as a custom network file server 210C including a file server corresponding unit 215, a data protection processing unit 230, and a policy unit 240. In this case, the file server corresponding unit 215 performs the function of the standard network file server in FIGS.

[0042] That is, in the case of the third embodiment of FIG. 4, by designing a custom network file server 210C that performs the functions of a standard network file server while also adding the functions of the data protection processing unit and policy unit described above, it has the advantage of reducing unnecessary file access requests and file input / output from kernel mode to user mode and enabling faster processing compared to the first embodiment of FIG. 2.

[0043] While the data protection storage may be configured as a user's data protection storage with the configuration shown in the figure, it can also be configured as a server-specific data protection storage by a server administrator with the same configuration. For example, when a server administrator protects a data file (which may be generated regularly at a specific time interval or aperiodically in response to a file upload event), the server administrator can connect the data protection storage to the service server using a standard network driver and then have the data file generated in the corresponding driver. In this case, the data protection storage can provide a read-only file so that the file cannot be further modified or a fake read-only file so that the file cannot be read, according to the file modification time setting or the access (viewing and modification) time setting set in the policy unit when the file is first created. To prevent changes from being made to the file after its initial creation, the data protection processor performs a time comparison based on the file request (the time requested to read, modify, delete, etc. the current file relative to the time of the initial file creation). If the modification time is within the allowable modification time, the request is accepted. If it is exceeded, the file is provided as a read-only file, preventing changes to the file after its creation. In addition, to prevent access from the time of the initial file creation, the data protection processing unit performs a time comparison based on the file request (the time of the request to read, modify, delete, etc. the file from the time of the initial file creation), and if it is within the allowable time for modification, it is allowed, but if it exceeds the allowable time, it is handled with a read-only fake file, preventing viewing and modification.

[0044] In addition to comparing the current access time with the file creation time, the policy unit of the server data protection storage can be set to provide a read-only file or a fake read-only file when an EOF (End of File) is received in a file event when a file is created, considering this to be the final file immutable state. To this end, when an EOF event is received in the data protection processing unit, in order to store the immutable state information of the corresponding file, the file immutable state information can be recorded in the file attribute value and compared with the time of subsequent file requests, and it is obvious that the immutable state information can be managed by configuring a separate DB.

[0045] When configuring the data protection storage for the server, the data can be configured to be deleted only when a one-time password is entered into the policy section, so that the stored information cannot be arbitrarily manipulated by the data protection storage administrator.

[0046] The data protection storage according to the above-mentioned embodiment of the present invention may be installed on a separate server and implemented in the form of a network storage so that the above-mentioned data protection method can be provided on a cloud basis, or may be manufactured in the form of a personal portable storage device (e.g., an external USB storage device, etc.) that maximizes portability and implements the above-mentioned data protection method.

[0047] Although the present invention has been described above with reference to an embodiment, it will be readily apparent to those skilled in the art that various modifications and variations of the present invention can be made without departing from the spirit and scope of the present invention as set forth in the claims below.

Claims

1. 1. A data protection storage comprising: a standard network file server that communicates with a standard network driver installed in a client terminal and receives a file access request from a user; a file system mapped to said standard network file server repository; a policy unit that stores predefined data protection policies; and a data protection processing unit configured to, when the file access request is received from the file system, perform data protection processing on the requested file according to the data protection policy stored in the policy unit, and provide the data-protected file to a client terminal; the standard network file server transmits a file access event to the file system in response to a file access request received through a standard network driver of the client terminal; the file system calls a predetermined program function according to the received file access event to cooperate with the data protection processing unit; The data protection storage is characterized in that, when the data protection processing unit processes the file access event by the called function, data protection processing according to the data protection policy can be performed on the requested file.

2. The file system is a virtual file system or a custom file system that is not a data storage where actual files are stored; The data protection storage of claim 1 , wherein the file system includes a directory path of the requested file and calls a program function defined according to the file access event to cooperate with the data protection processing unit.

3. 3. The data protection storage of claim 2, wherein the data protection processing unit processes the file access event according to a directory-based file protection policy of the called file, so that data protection processing according to the directory-based data protection policy can be performed on the requested file.

4. The standard network file server acquires information that can identify the client terminal or user account that transmitted the file access event and transmits the information to the policy unit; 2. The data protection storage of claim 1, wherein the data protection processing unit checks from the policy unit which client terminal or user account requested the currently occurring file access event, and enables data protection processing of the file access event according to the data protection policy.

5. The data protection storage of claim 1 , wherein the data protection processor is integrated into the file system of the kernel area to form a custom file system.

Images