Data Integrity Verification With Quarantine and State Restoration
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods for securing web service data integrity are inadequate in detecting and isolating compromised data, particularly in insecure networks, and fail to allow for immediate restoration and analysis of the data state before and after manipulation.
Innovation Solution
A method involving generating an intended data state on a secure primary system, transferring it to secondary systems in an insecure network, checking integrity using agents, and restoring the original state upon detection of manipulation while isolating compromised data in quarantine.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If data is stored on secondary systems in an insecure network to provide web service, then service availability and accessibility are improved, but data integrity and security deteriorate due to potential manipulation by attackers
Solution Approach 1:
The system divides data into two distinct states: intended state (original, verified data) and actual state (data on secondary systems). By segmenting the data storage and verification processes, the patent enables continuous integrity checking without disrupting service availability. The primary system holds the intended state while secondary systems serve requests, allowing security verification to occur independently.
Solution Approach 2:
The patent introduces an intermediary integrity verification mechanism that acts as a mediator between the primary system (holding intended state) and secondary systems (serving requests). This intermediary layer continuously verifies data integrity by comparing actual state against intended state, preventing direct attacker access to compromise the entire system while maintaining service continuity.
2Difficulty of detecting and measuring
If continuous integrity checking is performed on secondary systems, then detection capability is improved, but system performance and response time deteriorate due to additional verification overhead
Solution Approach 1:
The system performs preliminary actions by maintaining the intended state of data on the primary system before any potential manipulation occurs on secondary systems. Integrity verification leverages this pre-established reference state, allowing agents to quickly compare current data against the known good state without performing complex analysis, thus improving detection capability while minimizing performance overhead.
Solution Approach 2:
The patent creates a copy of the intended data state and stores it on the primary system as a reference. Agents on secondary systems use this copied reference state for verification purposes rather than analyzing original data from scratch. This copying approach enables rapid integrity checking by simple comparison operations, significantly reducing the computational overhead of continuous monitoring.
3Reliability
If manipulated data is immediately isolated upon detection, then security is improved, but loss of time occurs in restoring the original data state
Solution Approach 1:
The system performs preliminary action by maintaining the intended state of data on the primary system before any manipulation occurs. This pre-prepared reference state enables immediate restoration upon detection of manipulation, as the original state is already available and verified. The intended state acts as a pre-stored backup that can be quickly deployed without time-consuming recovery processes.
Solution Approach 2:
The patent implements a discard and recover mechanism where manipulated data on secondary systems is immediately discarded (isolated) upon detection. The system then recovers by retrieving the intended state from the primary system, which serves as a verified backup. This approach eliminates complex restoration procedures by simply replacing compromised data with the pre-maintained intended state, minimizing restoration time while maximizing security.
Data Source
AI summary
The present invention relates generally to a method and corresponding computer-based devices for securing the integrity of the data for operating a service (8). In particular, the invention relates to a method for generating an intended state (3) of data that can be stored or secured in a medium or system (1), for transferring the intended state of the data to a further system (7), for securing the integrity of the data on the further system and for enabling subsequent analysis after undesired tampering with the data. The invention also relates to computer-based devices, a computer system and a computer network which execute or enable the execution of this method or the individual steps therein, as well as a computer-readable medium with computer-executable instructions.