Distributed Storage Lineage Graphs for Tainted-Data Tracking
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing systems fail to efficiently track and manage the spread of sensitive data across network-based computing resources, such as malware or mis-stored information, due to limited scanning capabilities and lack of insights into the distribution of infected snapshots and volumes, leading to inefficiencies in remediation and potential data leaks.
Innovation Solution
A storage unit lineage graph is created to represent relationships among storage units, allowing for efficient tracking and management of sensitive data by identifying tainted units and their relationships, reducing the need for exhaustive scanning and enabling targeted remediation actions.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If exhaustive scanning of all storage units is performed to detect sensitive data, then detection completeness is improved, but scanning time and computational resources increase significantly
Solution Approach 1:
The patent segments the storage units into a directed acyclic graph (DAG) structure, dividing the comprehensive scanning task into manageable components. By organizing storage units as nodes with parent-child relationships, the system can process only relevant segments (child nodes) when parent nodes are identified as tainted, rather than scanning the entire storage landscape exhaustively.
Solution Approach 2:
The patent performs preliminary actions by establishing the DAG structure and parent-child relationships between storage units before actual scanning occurs. This pre-organization of storage unit dependencies enables the system to quickly identify and scan only the necessary child nodes when sensitive data is detected in parent nodes, significantly reducing scanning time while maintaining detection completeness.
2Measurement precision
If comprehensive scanning of all storage units is performed to identify tainted units, then detection completeness is improved, but computational resources and scanning complexity increase
Solution Approach 1:
The patent segments the complex scanning task into a hierarchical DAG structure where storage units are organized as nodes with defined parent-child relationships. This segmentation allows the system to manage complexity by processing only relevant portions of the storage landscape, using the DAG structure to navigate and scan only the necessary child nodes when parent nodes are identified as tainted.
Solution Approach 2:
The patent introduces the DAG structure as an intermediary between the scanning system and the storage units. This intermediary layer provides a manageable representation of storage unit relationships, enabling the system to navigate complex storage landscapes efficiently by traversing the DAG rather than attempting to scan all storage units directly, thus reducing overall scanning complexity.
3Ease of operation
If storage units are scanned individually without relationship tracking, then scanning simplicity is maintained, but the ability to track spread of sensitive data is lost
Solution Approach 1:
The patent merges the scanning function with relationship tracking by integrating the DAG structure directly into the scanning process. Instead of scanning storage units individually and separately, the system combines scanning with relationship analysis, using the DAG to simultaneously identify storage units and track their parent-child relationships, thereby maintaining scanning simplicity while gaining comprehensive distribution insights.
Solution Approach 2:
The patent makes the DAG structure multi-functional, serving both as an organizational framework for storage units and as the scanning pathway itself. This universal structure enables the system to perform both simple scanning operations and complex relationship tracking simultaneously, eliminating the need for separate scanning and analysis processes while providing comprehensive data distribution information.
4Device complexity
If no lineage tracking is implemented, then system complexity is minimized, but remediation efficiency decreases due to lack of targeted actions
Solution Approach 1:
The patent performs preliminary action by pre-establishing the DAG structure and parent-child relationships between storage units before remediation is needed. This pre-organized lineage information enables rapid and targeted remediation actions, as the system already knows which child nodes are affected when parent nodes are identified as tainted, significantly improving remediation efficiency without requiring complex real-time analysis.
Data Source
AI summary
Systems and methods are provided for tracking sensitive data within a plurality of storage units, where storage units include block storage volume(s) and/or “snapshot(s)” representing values of every block of a block storage volume or device at a particular point in time. A computing device may be configured to receive a notification identifying a first tainted storage unit. Subsequently, a subset of the plurality of storage units may be identified. Additional tainted storage units can be identified as tainted within the subset. This identification may depend on whether the storage units contain data blocks in common with the first tainted storage unit. Remedial action may be taken for storage units identified as tainted.