Application Authority Assignment for Ransomware Isolation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Ransomware attacks exploit conventional file systems' access control based on user accounts, allowing malicious applications to access and encrypt entire file systems, causing significant data security breaches and recovery challenges.
Innovation Solution
A system that associates specific subsets of storage space on media devices with authorized applications, preventing any application outside this group from accessing those spaces, thereby isolating sensitive data and restricting unauthorized access.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If conventional file systems use user account-based access control, then ease of operation is improved, but data security deteriorates because ransomware can access entire file systems when it gains account access
Solution Approach 1:
The patent segments the file system into multiple independent storage spaces (e.g., space1, space2, space3) and assigns each space to specific applications. This segmentation prevents ransomware from accessing the entire file system even if it compromises one application, as each storage space is isolated and protected by its own access control list (ACL) that specifies which applications can access it.
2Ease of operation
If administrator accounts have full file system access, then ease of operation is improved, but data security deteriorates because ransomware gaining admin access can encrypt all data
Solution Approach 1:
The patent applies local quality by giving administrator accounts different levels of access to different storage spaces based on their specific needs. Instead of providing blanket full access to the entire file system, each administrator account is granted access only to the specific storage spaces required for their role, as defined in ACLs. This limits the potential damage if an administrator account is compromised by ransomware.
3Adaptability or versatility
If applications can access any storage space, then adaptability is improved, but data security deteriorates because malicious applications can encrypt data in any space
Solution Approach 1:
The patent implements preliminary action by pre-configuring access control lists (ACLs) that define which applications can access which storage spaces before any data access occurs. These ACLs are established in advance and enforce access policies automatically. When an application attempts to access a storage space, the system checks the ACL to verify authorization, preventing malicious applications from accessing unauthorized spaces even if they attempt to do so.
Data Source
AI summary
In one embodiment, a system includes a media storage device, a processor, and logic integrated with and/or executable by the processor. The logic is configured to cause the processor to associate a first subset of storage space on the media storage device with a first group of applications executing on a hardware processor. The logic is also configured to cause the processor to receive a request from an application to access the first subset of storage space on the media storage device. Moreover, the logic is configured to cause the processor to prevent any application other than an application from the first group of applications from accessing the first subset of storage space on the media storage device. Other systems, methods, and computer program products for defending against ransomware attacks on devices and systems using application authority assignment are described according to more embodiments.