File Object Cache for Audit Event Verification
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current data management systems face challenges in rapidly detecting unauthorized access and ransomware attacks, particularly in complex computer infrastructures, where traditional authentication methods are limited to creation events and do not effectively verify subsequent events like reads or writes, posing a risk to data security and compliance with regulations like GDPR.
Innovation Solution
A data management system that utilizes a mini-filter and file object cache to identify and verify audit events by associating user IDs and remote IP addresses with file objects, storing these associations in a cache for authorization and tracking subsequent events, and removing entries based on timestamps to ensure secure data access and compliance.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional authentication methods are used that only verify creation events, then device complexity is reduced, but data security and ability to detect unauthorized access deteriorates
Solution Approach 1:
The system performs preliminary actions by creating a file object cache entry at file creation time, storing the authentication information (user ID, remote IP address, file object ID) before any subsequent access events occur. This pre-established cache structure enables rapid verification of subsequent events without complex real-time analysis, thus improving security detection capability while maintaining manageable system complexity
Solution Approach 2:
The file object cache serves as an intermediary data structure that mediates between the mini-filter's audit event detection and the security verification process. By storing pre-resolved authentication information in this intermediate cache, the system enables efficient verification of subsequent events without requiring complex cross-referencing between multiple data sources, thereby improving reliability while controlling device complexity
2Speed
If a file object cache is implemented to track subsequent events, then detection speed of unauthorized access improves, but memory usage increases
Solution Approach 1:
The system extracts only the essential authentication information (user ID, remote IP address, file object ID) into the file object cache, rather than storing complete audit event records. This selective extraction of critical verification data enables fast detection of unauthorized access by comparing only key identifiers, while minimizing memory consumption by excluding redundant information
Solution Approach 2:
The file object cache implements local quality optimization by maintaining authentication information specifically at the file object level rather than globally. Each cache entry is tailored to verify access to a specific file object, storing only the locally relevant authentication data needed for that particular file's subsequent event verification, thus optimizing memory usage while maintaining high detection speed
3Measurement precision
If audit events are tracked for all user file accesses, then measurement precision of security events improves, but processing overhead increases
Solution Approach 1:
The system performs preliminary resolution of the pair value (user ID and remote IP address) at file creation time and stores it in the file object cache before subsequent events occur. This pre-computation eliminates the need for repeated complex queries to resolve user identity from file access events, thereby maintaining high measurement precision for event verification while significantly reducing processing overhead during actual security monitoring
Solution Approach 2:
The system creates a simplified copy of the authentication context (user ID, IP address, file object ID) in the file object cache, rather than maintaining and processing the complete original audit event data structure. This copied representation retains all necessary information for accurate event verification while requiring minimal processing power to compare and validate against subsequent events, thus achieving high measurement precision with low processing overhead
Data Source
AI summary
Some examples relate generally to computer architecture software for data classification and information security and, in some more particular aspects, to verifying audit events in a file system.