Delete Restriction Workflow for Ransomware-Resilient Protection Storage
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing data protection systems are vulnerable to ransomware attacks that can bypass write-only settings and dual-party authentication, allowing unauthorized data deletion with low detection risk.
Innovation Solution
Implement a Write Only Restricted Delete (WORD) methodology that restricts data deletion based on a set of rules, requiring multiple confirmations and using a Well-Known Process Expiration List (WEL) and Data Delete Confirmed List (DDCL) to ensure data integrity, combined with a garbage collection process to verify deletion requests.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If retention lock is used to prevent data erasure, then data persistence is improved, but the system cannot completely prevent ransomware attacks that circumvent protection mechanisms
Solution Approach 1:
The patent segments the data protection system into multiple independent components: primary storage, secondary storage, tertiary storage, and a separate delete restriction system. Each layer operates independently with its own protection mechanisms, so that compromise of one layer does not automatically compromise the entire system. The delete restriction system specifically segments the deletion authorization process into multiple confirmation steps.
Solution Approach 2:
The system performs preliminary actions by pre-configuring delete restriction rules and obtaining advance authorization for deletion operations. The delete restriction system is set up beforehand with defined policies, and any deletion request must be pre-approved through multiple confirmation steps before actual deletion occurs, preventing ransomware from executing immediate deletions.
2Reliability
If dual-party authentication is implemented, then security protection is improved, but it can be bypassed if security office credentials are obtained
Solution Approach 1:
The patent introduces an intermediary delete restriction system that sits between the authentication mechanism and the actual deletion operation. This intermediary layer validates deletion requests against pre-configured rules and requires multiple confirmations, acting as a mediator that prevents direct bypass of authentication through stolen credentials.
Solution Approach 2:
The system implements feedback mechanisms where deletion requests trigger multiple confirmation steps and logging events. Each deletion attempt generates feedback signals that require verification against established policies, creating a feedback loop that prevents unauthorized deletions even when initial authentication is compromised.
3Reliability
If multiple confirmations are required for data removal, then protection against attacks is improved, but deletion process complexity increases
Solution Approach 1:
The delete restriction system dynamically adjusts the deletion process based on the request context. For authorized administrative operations, the system follows the multi-confirmation workflow. For recognized backup and restore operations that match pre-configured policies, the system can streamline or bypass certain confirmation steps, making the process adaptive rather than statically complex.
Solution Approach 2:
The system changes parameters of the deletion process based on the request type and user credentials. Different deletion scenarios have different confirmation requirements: critical data requires multiple confirmations, while routine backup operations may require fewer steps. The system dynamically modifies the deletion workflow parameters based on the specific context.
Data Source
AI summary
Embodiments are described for preventing undesired data deletion on protection storage by using delete restrictions and issuing user alerts if an excessive number of deletions are requested within a period of time. The number of deletions per time period is recorded and stored as hash counts. Deletion of data is delayed until confirmation by the user is received. One or more metrics are computed from the recorded count data and corresponding deleted data sizes. The computed metrics are compared to defined corresponding threshold values, and if any of the metrics exceeds the corresponding threshold value, an alert is sent to the user. The user can then choose to stop or investigate the deletions, or acknowledge the deletions to provide the confirmation.