Block-Level Backup Change Detection Without Timestamp Reliance
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods for identifying file and block-level modifications in a filesystem are susceptible to timestamp manipulation by malware, making them unreliable for detecting changes at the data block level.
Innovation Solution
A filesystem scanner and a block filter driver are used to identify modified files and data blocks by employing a special signature in read buffers, which intercept read calls to perform block change detection using a changed-block data structure, providing block change information that is not subject to timestamp manipulation.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If timestamp-based methods are used to identify file modifications, then the implementation is simple, but the reliability is compromised due to timestamp manipulation by malware
Solution Approach 1:
A block filter driver is introduced as an intermediary component between the filesystem scanner and the storage system. This driver intercepts read calls and performs block-level change detection by comparing data blocks against a changed-block data structure, thereby eliminating reliance on timestamps while maintaining system simplicity through standardized driver interfaces
Solution Approach 2:
The patent replaces the timestamp-based metadata mechanism with a block-level data comparison mechanism. Instead of relying on temporal information (mechanical system), the system directly compares data block contents using cryptographic hashes and changed-block data structures, providing malware-resistant modification detection
2Measurement precision
If block-level change detection is implemented, then the measurement precision of modifications is improved, but the device complexity increases due to additional drivers and data structures
Solution Approach 1:
The filesystem is segmented into individual data blocks that can be independently tracked and compared. The block filter driver processes read calls at the block level, maintaining a changed-block data structure that tracks modifications at this granular level, enabling precise identification of modified blocks without requiring complex whole-file analysis
Solution Approach 2:
A changed-block data structure is pre-established and maintained before backup operations. This data structure pre-identifies which blocks have changed by comparing cryptographic hashes, allowing the filesystem scanner to efficiently determine modification status without performing complex real-time analysis during backup operations
3Productivity
If traditional file scanning methods are used, then the ease of operation is maintained, but the productivity is reduced due to inability to efficiently identify only modified blocks
Solution Approach 1:
The block filter driver implements a feedback mechanism where read calls are intercepted and their results are immediately compared against the changed-block data structure. This real-time feedback loop identifies modified blocks on-the-fly during the scanning process, enabling efficient incremental backup operations without requiring separate analysis passes
Solution Approach 2:
The filesystem scanner is enhanced with self-service capabilities through the integrated block filter driver, which automatically performs block-level change detection during normal read operations. This eliminates the need for separate, complex modification detection processes, maintaining ease of operation while significantly improving backup productivity
Data Source
AI summary
Example implementations relate to computer data storage. In some examples, a filesystem scanner identifies files in a filesystem, where each file comprises logical blocks, and where the filesystem is included in a backup. The filesystem scanner generates a read buffer to store a logical block of a file. A block filter driver determines that the read buffer includes a predefined signature, and in response determines whether the logical block was modified in the backup. In response to a determination that the logical block was modified in the backup, the block filter driver sets a modification flag in the read buffer to a value indicating that the logical block was modified.