File Object Cache for Rapid Unauthorized Access Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current data management systems face challenges in rapidly detecting unauthorized access and ransomware attacks, which are critical for compliance with data security regulations like GDPR, due to the complexity of data systems and the lack of effective audit event tracking across file systems.
Innovation Solution
A data management system that includes a storage device for base and incremental files, processors to identify and track audit events such as create, read, write, and cleanup events, and a file object cache to associate user IDs and remote IP addresses with file objects, using these associations as authorization keys and managing cache entries based on timestamps.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Speed
If traditional data management systems are used without file object cache, then system complexity is reduced, but detection speed of unauthorized access and ransomware attacks is slow
Solution Approach 1:
The system pre-associates user IDs and remote IP addresses with file object IDs at file creation events, storing these mappings in a file object cache before any potential unauthorized access occurs. This preliminary action enables immediate detection and response to security threats without requiring complex real-time analysis during actual access events.
Solution Approach 2:
The file object cache acts as an intermediary data structure that stores mappings between file object IDs and authorization information (user IDs and remote IP addresses). This intermediary enables rapid verification of unauthorized access by providing pre-computed authorization data, eliminating the need for complex real-time authentication queries during security detection.
2Measurement precision
If comprehensive audit event tracking is implemented across all file operations, then detection accuracy of security threats is improved, but processing overhead increases
Solution Approach 1:
The system extracts and stores only the critical authorization information (user ID and remote IP address) associated with file object IDs in the file object cache during creation events. By extracting only these essential elements rather than tracking all possible file operation attributes, the system achieves accurate security detection while minimizing processing overhead during subsequent read, write, and cleanup events.
Solution Approach 2:
The system creates a simplified copy of authorization information (user ID and remote IP) linked to file object IDs and stores it in the file object cache. This copy enables rapid security verification without requiring access to the original complex authentication data or re-processing the full authentication logic during each file operation, thus reducing processing overhead while maintaining detection accuracy.
3Speed
If file object cache is maintained in memory, then access speed for authorization verification is improved, but memory usage increases
Solution Approach 1:
The file object cache stores authorization information (user ID and remote IP address) locally associated with each file object ID in memory, enabling rapid access speed for verification. By maintaining this critical security data in local memory rather than relying on slower disk-based or network-based storage, the system achieves fast authorization verification while using only the minimal memory required for the cache mappings.
Data Source
AI summary
Some examples relate generally to computer architecture software for data classification and information security and, in some more particular aspects, to verifying audit events in a file system.