Delete Restriction Mechanism for Ransomware Protection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing data protection systems are vulnerable to ransomware attacks, as they can be bypassed by hackers obtaining security credentials, and current measures such as retention locks and dual-party authentication do not completely prevent rogue data deletion requests from erasing data from persistent storage.
Innovation Solution
Implementing a Write Only Restricted Delete (WORD) methodology that restricts data deletion based on a set of rules, where data is only removed from storage after multiple confirmations and verification through a Well-Known Process Expiration List (WEL) and Data Delete Confirmed List (DDCL), ensuring that data is not staged for deletion unless intended and authenticated.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If retention lock is used to prevent data deletion by setting a timestamp, then data persistence is improved until the timestamp is reached, but the system remains vulnerable to ransomware attacks that can bypass singular point-in-time protection
Solution Approach 1:
The deletion protection mechanism is segmented into multiple independent verification layers: retention lock timestamp verification, dual-party authentication credentials verification, and cryptographic hash verification. Each layer independently checks a different aspect of deletion legitimacy, so that bypassing one layer does not compromise overall protection. This segmentation transforms a single point of failure into multiple defense layers.
Solution Approach 2:
The system performs preliminary actions by pre-registering authorized deletion requests with the storage system before actual deletion occurs. The storage system maintains a list of pre-approved deletion operations with their authentication credentials and timestamps. When a deletion request arrives, the system verifies it against the pre-registered list, ensuring that only previously authorized deletions can proceed. This preliminary authorization prevents rogue deletion requests from succeeding.
2Reliability
If dual-party authentication is implemented to require multiple confirmations for data removal, then protection against unauthorized deletion is improved, but the system can still be bypassed if security office credentials are obtained
Solution Approach 1:
The system introduces an intermediary cryptographic verification layer between the authentication credentials and the actual deletion operation. Instead of directly trusting authentication credentials, the system uses cryptographic hash functions to verify deletion requests against pre-registered authorized operations. This intermediary verification mechanism ensures that even if credentials are compromised, the cryptographic hash verification will detect the unauthorized nature of the deletion request and block it.
Solution Approach 2:
The system creates cryptographic copies (hashes) of authorized deletion requests and stores them in the storage system. These cryptographic copies serve as immutable references that verify the authenticity of deletion operations without exposing the original authentication credentials. The verification process compares incoming deletion requests against these cryptographic copies, ensuring that only exactly-matching authorized requests can proceed, preventing credential-based attacks.
3Ease of operation
If data deletion is allowed with low detection risk to maintain system flexibility, then operational ease is improved, but the system becomes vulnerable to rogue attacks that can alter and delete data
Solution Approach 1:
The system implements feedback mechanisms that continuously monitor and verify deletion operations against pre-registered authorized requests. Each deletion attempt triggers a verification process that checks the request against the list of pre-approved operations. This feedback loop ensures that only legitimate deletion requests proceed while blocking rogue attacks, maintaining system flexibility for authorized operations while providing robust protection against unauthorized deletions.
Data Source
AI summary
Embodiments are described for preventing undesired data deletion on protection storage by using delete restrictions. A delete restriction component prevents data from being staged for permanent erasure, such as by preventing files from being moved to a trash folder. A well-known process (WKP), such as a backup or migration operation that is known to request data expiration, is used to validate data deletions. The WKP identifies data that is no longer to be retained. The WKP uses a well-known process expiration list (WEL) that holds hashes of the data. A bucket confirmation count indicates candidates for data deletion. Separately, Garbage Collection maintains another list of hashes that are deletion candidates. A separate process finds common hashes between the WKP and GC hashes, and then removes the data pointed to by the common hashes.