Air-Gapped Backup Recovery for Ransomware-Resilient Data Storage
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current data security techniques, such as data replication and snapshots, are ineffective in dealing with ransomware attacks, leading to significant disruptions and costly recovery efforts, as they either reproduce the ransomware or require extensive storage resources.
Innovation Solution
Implementing disconnected, isolated data storage nodes and monitoring API calls to detect ransomware attacks, preventing storage of corrupted data and enabling retrieval of non-compromised snapshots from air-gapped storage for system recovery.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If data replication and snapshots are used for backup, then data availability is improved, but the system becomes vulnerable to ransomware attacks that can corrupt both primary and backup data
Solution Approach 1:
The backup system is segmented into multiple isolated storage nodes that are air-gapped from the primary network. Each storage node operates independently, preventing ransomware from propagating across the entire backup infrastructure. This segmentation ensures that even if one node is compromised, others remain secure and available for recovery.
Solution Approach 2:
An API gateway acts as an intermediary between the primary data system and the disconnected storage nodes. The gateway monitors API calls for ransomware indicators and controls access to backup data, preventing direct network access that could allow ransomware to corrupt backup copies while still enabling legitimate backup operations.
2Object-affected harmful factors
If disconnected storage nodes are implemented for secure backup, then security against ransomware is improved, but system complexity increases
Solution Approach 1:
The API gateway serves multiple functions: it monitors for ransomware indicators, manages authentication and authorization, controls access to disconnected storage nodes, and enables backup operations. This multi-functionality reduces the need for separate specialized components, thereby managing system complexity while maintaining strong security.
Solution Approach 2:
The system automatically monitors API calls for ransomware indicators and responds by blocking suspicious access attempts without requiring manual intervention. The disconnected storage nodes self-manage their isolation status, automatically connecting only when needed for authorized backup or recovery operations, reducing the complexity of manual security management.
3Difficulty of detecting and measuring
If API monitoring is implemented to detect ransomware, then detection capability is improved, but processing overhead increases
Solution Approach 1:
The system monitors API calls for specific ransomware indicators rather than analyzing all possible attack vectors. By focusing on known ransomware behaviors and patterns, the system achieves effective detection while minimizing processing overhead compared to comprehensive security scanning of all data traffic.
Data Source
AI summary
Aspects of the present disclosure provide systems, methods, and computer-readable storage media that support providing secure backup and recovery of files from edge devices during ransomware attacks or other cyberattacks. Secure data, such as medical records, may be stored at one or more networked storage nodes and backup images (e.g., snapshots) may be stored at a disconnected storage node (e.g., an air-gapped storage node) that is isolated from the networked storage nodes. Application programming interface (API) calls may be managed and monitored to detect an alarm state (e.g., a ransomware attack), and based on the alarm state, storage and retrieval from the networked storage nodes may be stopped. Additionally, a recent backup image from the disconnected storage node may be retrieved for use in performing system recovery operations.