Decoy Filesystem for Cyber Deception and Integrity
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current cybersecurity measures are inadequate in preventing data theft and modification, as they rely on reactive approaches that fail to effectively deter attackers and protect sensitive information, especially in shared systems where distinguishing decoys from legitimate files is challenging.
Innovation Solution
A decoy filesystem paradigm is introduced, where a decoy filesystem is created atop a base filesystem, using filesystem overlays deployed on a per-process basis within mount namespaces, monitoring access to determine trust levels and adjusting content to hide or modify files, thereby protecting the base filesystem from untrusted processes.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If deceptive files are used to detect attackers, then attacker detection capability is improved, but legitimate users may be confused and attackers can identify decoys
Solution Approach 1:
The system segments the filesystem into multiple namespaces, each with its own view of files. Trusted users see the real filesystem, while untrusted processes see a decoy namespace with fake files. This segmentation allows deceptive files to be presented to attackers without confusing legitimate users, as each user group operates in its own isolated namespace context.
Solution Approach 2:
The patent introduces an intermediary layer (the namespace mechanism) between users and the actual filesystem. This intermediary translates file access requests differently based on trust levels: legitimate requests access real files, while suspicious requests access decoy files. The intermediary prevents direct exposure of decoys to trusted users and blocks attackers from accessing real sensitive data.
2Reliability
If reactive protection measures are used (ransomware protection, backups), then some data protection is achieved, but nearly two-thirds of companies still have files successfully encrypted
Solution Approach 1:
Instead of reacting to attacks after they occur, the system performs preliminary action by deploying decoy files and namespaces before any attack happens. When an attacker accesses the system, they immediately encounter the pre-prepared decoy environment, which prevents them from reaching real sensitive data in the first place. This proactive approach stops encryption attacks before they can affect actual data.
Solution Approach 2:
The system converts the attacker's harmful action (file access attempts) into a beneficial detection opportunity. By placing decoy files that trigger alerts when accessed, the system turns every attempted breach into a detected event. The attacker's actions to steal or encrypt files actually reveal their presence, allowing defenders to respond before real damage occurs.
3Device complexity
If a single filesystem view is provided to all users, then system simplicity is maintained, but untrusted processes can access and steal sensitive data
Solution Approach 1:
The system applies local quality by giving different filesystem views to different processes based on their trust level. Trusted processes receive the standard filesystem view with all files accessible, while untrusted processes receive a modified view with decoy files in place of sensitive data. This localized differentiation maintains simplicity for legitimate users while providing protection where needed.
Solution Approach 2:
The patent adds another dimension to the filesystem model by introducing namespaces as a fourth dimension of file access control. Instead of a single flat filesystem hierarchy, the system creates multiple layered views where each namespace adds a dimension of abstraction. This allows the same physical file to appear differently across different namespace dimensions, enabling security without complicating the base filesystem structure.
Data Source
AI summary
A decoy filesystem that curtails data theft and ensures file integrity protection through deception is described. To protect a base filesystem, the approach herein involves transparently creating multiple levels of stacking to enable various protection features, namely, monitoring file accesses, hiding and redacting sensitive files with baits, and injecting decoys onto fake system views that are purveyed to untrusted subjects, all while maintaining a pristine state to legitimate processes. In one implementation, a kernel hot-patch is used to seamlessly integrate the new filesystem module into live and existing environments.