Append-Write Storage Data Restoration After Ransomware
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current methods for protecting against ransomware, such as snapshot rollback, result in data loss between snapshots and increase performance and storage overheads due to frequent snapshot management.
Innovation Solution
Implementing data restoration in append write mode, where data marked as invalid by ransomware is not deleted but marked as such, allowing recovery of this data during garbage collection without additional storage or computing overheads.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If snapshot rollback is used to protect against ransomware, then data can be restored to an earlier version, but data information between snapshots is lost and storage space overhead increases
Solution Approach 1:
The system performs preliminary actions by marking data as invalid before actual deletion occurs during garbage collection. This allows the system to detect ransomware-encrypted data early and restore it before the deletion process completes, preventing information loss that would occur with traditional snapshot methods.
Solution Approach 2:
The patent creates a copy of the invalid data mark status to track which data blocks are potentially ransomware-encrypted. By maintaining this metadata copy, the system can restore data without needing full snapshots, thus avoiding information loss while reducing storage overhead.
2Reliability
If high-density snapshots are used to better protect against ransomware, then data restoration capability improves, but performance overheads and storage space overheads increase
Solution Approach 1:
The patent extracts only the essential information needed for ransomware detection and restoration - specifically, the invalid data marks and their associations - rather than managing complete snapshots. This extraction approach significantly reduces snapshot management complexity while maintaining effective ransomware protection.
Solution Approach 2:
By performing preliminary marking of invalid data blocks before garbage collection, the system establishes a detection mechanism that simplifies subsequent restoration operations. This preliminary action eliminates the need for complex snapshot management while maintaining high-density protection capabilities.
3Quantity of substance
If data is physically deleted after being marked as invalid, then storage space is freed, but ransomware-encrypted data cannot be restored
Solution Approach 1:
The system implements feedback by continuously monitoring invalid data marks and their associations. Before garbage collection deletes physical data blocks, the feedback mechanism checks for ransomware encryption patterns and triggers restoration if detected, ensuring data can be recovered while still allowing normal garbage collection to free storage space.
Solution Approach 2:
The patent provides beforehand cushioning by maintaining the association information between invalid data marks and their original data blocks. This cushioning layer protects against permanent data loss during garbage collection, allowing the system to restore ransomware-encrypted data even after physical deletion would normally occur.
Data Source
AI summary
The present disclosure relates to the computer field, and provides data restoration methods and apparatuses for a storage device, to implement data restoration without losing data after an attack by ransomware. One example method is a data restoration method for a storage device, wherein the storage device stores data in append write mode. The method includes determining first data in response to inaccessibility to target data, wherein the first data is data marked as invalid, and is data associated with the target data. The first data is then restored.