Backup Operation Authentication and Risk Detection for SAN Controllers
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current Storage Area Network (SAN) security solutions lack measures to protect against unauthorized access during backup and restore operations, leaving the entire storage controller vulnerable once an unauthorized user gains access.
Innovation Solution
Implement a computer-implemented method that authenticates users and IP addresses originating backup requests, calculates risk based on employee information, and verifies compliance with legal and cybersecurity policies using historical data and advanced analytics to detect and prevent anomalies in backup and restore operations.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional SAN security solutions are used, then basic data protection is provided, but the storage controller remains vulnerable during backup and restore operations
Solution Approach 1:
The system performs preliminary authentication of users and IP addresses before allowing backup or restore operations to proceed. It calculates risk scores based on employee information and historical data in advance, and establishes allowlists of approved backup software signatures beforehand, so that when a backup operation is initiated, the system can quickly verify against pre-established security criteria rather than reacting to threats as they occur
Solution Approach 2:
The system continuously monitors backup operations and provides feedback by calculating risk scores based on user behavior, IP address reputation, and software signature verification. It compares actual operations against historical patterns and approved allowlists, then dynamically adjusts security responses by either permitting or blocking operations based on the calculated risk level, creating a closed-loop security system that learns from each interaction
2Reliability
If authentication and risk calculation measures are implemented, then security against unauthorized access is improved, but system complexity increases
Solution Approach 1:
The security system is divided into distinct modular components: user authentication module, IP address verification module, risk calculation module, software signature verification module, and policy enforcement module. Each component handles a specific aspect of security verification independently, allowing the system to implement comprehensive security checks without creating a monolithic complex system that is difficult to manage or maintain
Solution Approach 2:
The system introduces an intermediary security layer between the user/request and the storage controller that handles all complex verification logic. This intermediary component authenticates users, verifies IP addresses, calculates risk scores, and validates software signatures before permitting access to the storage controller, thereby isolating the complexity from the core storage operations and presenting a simplified interface to both users and the storage system
3Reliability
If comprehensive authentication and risk assessment are performed, then protection against vulnerabilities is enhanced, but processing time increases
Solution Approach 1:
The system performs authentication, IP verification, and software signature validation before the actual backup operation begins. By completing these security checks in advance and caching the results, the system ensures that when a backup operation is initiated, the heavy lifting of security verification has already been done, minimizing the time impact on actual backup throughput
Solution Approach 2:
The system implements risk-based verification where not every backup operation undergoes the full spectrum of security checks. For low-risk operations from authenticated users with approved software, the system may perform only essential verification steps. For higher-risk operations, more extensive authentication and analysis are performed, optimizing the balance between security and processing time based on the actual risk level of each request
Data Source
AI summary
Embodiments of the present invention provide computer-implemented methods, computer program product, and computer systems. One or more processors, in response to receiving a request to execute a backup operation, determine that backup software targeted to perform the request includes a signature associated with training data. The one or more processors, in response to determining that the backup software targeted to perform the received request has a signature in the associated training data, executing one or more actions, wherein the one or more actions comprise one or more processors to authenticate a user and an internet protocol (IP) address originating the request. The one or more processors calculate a risk, associated with the user, based on employee information associated with the user.