File System Driver for Secure Instant Backup Access
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing file-based backup systems face challenges in managing secure access and data integrity, particularly in preventing malicious activities during instant access to file-based backups, as unauthorized entities can gain access and modify data, leading to potential security breaches.
Innovation Solution
A method and system that utilize a FBB metadata file manager to enable secure access to file-based backups by authenticating entity contexts, providing access control, and employing a cyber sense device to monitor and detect security events, thereby ensuring secure access and immediate action in case of malicious activities, such as disabling access and reverting changes.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If instant access to file-based backups is enabled for applications, then productivity and data accessibility are improved, but security risks and data integrity threats worsen due to potential unauthorized modifications
Solution Approach 1:
The patent introduces a file system driver as an intermediary layer between the application and the backup data. This driver intercepts I/O requests, redirects them to the appropriate backup files, and manages the mapping between production file system paths and backup storage locations. The intermediary enables instant access while maintaining security controls and preventing direct unauthorized modifications to backup data.
Solution Approach 2:
The system implements feedback mechanisms where the file system driver monitors and tracks all access operations to backup files. By maintaining awareness of which applications access which backup data and what operations are performed, the system can detect anomalies, prevent unauthorized modifications, and ensure data integrity while still allowing legitimate instant access operations.
2Reliability
If traditional backup access methods are used, then data security is maintained, but access time and productivity deteriorate due to full restore requirements
Solution Approach 1:
The system performs preliminary actions by pre-processing and organizing backup data into a structure that enables direct access without full restoration. Backup files are prepared and indexed in advance with metadata that allows the file system driver to quickly locate and access specific data portions. This preliminary organization eliminates the need for time-consuming full restores while maintaining security through controlled access mechanisms.
Solution Approach 2:
The patent segments the backup access process into distinct components: the backup storage containing organized backup files, the file system driver that manages access requests, and the application that consumes data. This segmentation allows the system to provide direct access to specific data portions without restoring entire backup sets, significantly reducing access time while maintaining security through the driver's controlled interface.
3Ease of operation
If direct application access to backup files is permitted, then ease of operation is improved, but security control and monitoring capabilities worsen due to lack of intermediation
Solution Approach 1:
The file system driver serves as a security intermediary that all applications must pass through to access backup data. This intermediary maintains security control by intercepting and validating all access requests, preventing direct unmonitored access to backup files. The driver can implement authentication, authorization, and monitoring policies while still providing convenient access to authorized applications through standard file system interfaces.
Solution Approach 2:
The system implements continuous feedback monitoring where the file system driver tracks all access operations to backup files. By maintaining logs and awareness of access patterns, the system can detect suspicious activities, enforce security policies, and respond to potential threats while allowing normal authorized access to proceed smoothly. This feedback mechanism maintains security control without significantly impacting ease of operation for legitimate users.
Data Source
AI summary
Embodiments described herein relate to a method for managing file based backups (FBBs). The method may include obtaining a FBB mount request for a FBB mount of a FBB from an application, wherein the application is executing in a production host environment and the FBB is stored on backup storage; in response to the FBB mount request: enabling access to a portion of the FBB by the application; notifying a cyber sense device that the access is enabled; providing, to the cyber sense device, a storage location of the portion of the FBB for which access was enabled; receiving, from the cyber sense device, a security event notification; and performing, in response to the security event notification, a security action set.