Backup Storage Ransomware Protection via Deferred Deletion
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Backup storage systems are vulnerable to ransomware attacks, which can delete or encrypt data, making it difficult to distinguish between legitimate and malicious requests, and existing solutions do not adequately protect or recover data from such attacks.
Innovation Solution
Implementing a deferred deletion policy in backup storage systems, where all deletion requests are delayed for a predetermined period, allowing for data recovery to a pre-attack state by storing deduplicated data as immutable objects, and preventing modification or deletion during this time, thereby protecting against ransomware attacks.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If deletion requests are processed immediately in backup storage systems, then operational efficiency is improved, but vulnerability to ransomware attacks increases
Solution Approach 1:
The system performs preliminary validation of deletion requests by checking digital signatures and certificates before processing deletions. This preliminary action allows the system to reject malicious requests while still processing legitimate deletions efficiently, thus maintaining productivity while improving reliability.
Solution Approach 2:
The system dynamically adjusts its response to deletion requests based on validation results. For validated requests, deletions are processed immediately; for unvalidated requests, deletions are deferred. This dynamic approach optimizes operational efficiency for legitimate operations while providing protection against ransomware attacks.
2Reliability
If all deletion requests are deferred for a predetermined period, then protection from ransomware attacks is improved, but operational efficiency deteriorates
Solution Approach 1:
The system applies different processing qualities to different deletion requests based on their validation status. Validated requests receive immediate processing (high efficiency), while unvalidated requests are deferred (high protection). This local differentiation resolves the contradiction by applying the appropriate action to each request individually.
Solution Approach 2:
The system changes the processing parameter (immediate vs. deferred deletion) based on the validation result of each request. This parameter change allows the system to optimize between efficiency and protection dynamically, processing validated requests immediately and deferring only suspicious ones.
3Stability of the object's composition
If deduplicated data is stored as immutable objects, then data integrity is improved, but storage flexibility deteriorates
Solution Approach 1:
The system performs preliminary validation of deletion requests before allowing any modifications to immutable objects. This preliminary check ensures that only authorized deletions are processed, maintaining data integrity while allowing necessary flexibility for legitimate operations.
Solution Approach 2:
The system introduces an intermediary validation layer between deletion requests and the immutable storage. This intermediary checks digital signatures and certificates, allowing the system to maintain immutability for protection while providing controlled flexibility for legitimate deletions through the validation mechanism.
Data Source
Figure 1
Figure 2a
Figure 2b
AI summary
A method, a system, and a computer program product for protection and recovery of backup storage systems from ransomware attacks. A request to modify data stored in a storage system is received. The storage system includes at least one component configured to store the deduplicated data. An acknowledgement of the received request is generated. The acknowledgement indicates that the data stored in the at least one component and identified in the received request was modified. Modification of the data stored in the at least one component and identified in the received request for a predetermined period of time is prevented.