File System Label-Based Access Control for Backup Data Protection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing data protection methods fail to effectively prevent ransomware attacks and malware modifications on backup data, and they often compromise system performance or flexibility.
Innovation Solution
A file system data access control method that sets a unique label in the security context of a virtual inode for specified directories, allowing only processes with the label to modify the directory, thereby protecting backup data from unauthorized access and modifications.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional access control methods are used to protect backup data, then security protection is provided, but system performance is compromised and flexibility is reduced
Solution Approach 1:
The patent uses copy-on-write technology to create a copy of the backup data when modification is needed. The original backup data remains unchanged and protected, while the copy can be modified. This allows security protection without blocking legitimate modification operations, thus maintaining system performance while ensuring backup data integrity.
Solution Approach 2:
The patent introduces an access control module as an intermediary between processes and backup data. This module intercepts access requests, checks labels, and manages copy-on-write operations. By placing the control logic in this intermediary layer, the patent avoids modifying the core file system and maintains system performance while providing robust security protection.
2Reliability
If strict access control is implemented to prevent ransomware attacks, then backup data is protected, but system flexibility and ease of operation are reduced
Solution Approach 1:
The patent changes the parameter of access control from permission-based to label-based. Instead of setting complex permission bits, the system uses simple labels that can be easily attached to processes and directories. This simplifies the operation of access control while maintaining strong protection against ransomware attacks.
Solution Approach 2:
The patent implements dynamic label assignment where processes automatically inherit labels from their parent processes and can dynamically acquire labels by opening protected directories. This dynamic behavior maintains system flexibility and ease of operation while ensuring that protected directories remain secure against unauthorized modifications.
3Reliability
If label-based access control is implemented to identify authorized processes, then security is enhanced, but device complexity increases
Solution Approach 1:
The patent makes the label mechanism universal by using it for multiple purposes: process identification, directory protection, and access control decisions. The same label data structure serves all these functions, avoiding the need for separate complex mechanisms for each purpose. This reduces overall system complexity while maintaining strong security.
Solution Approach 2:
The patent implements self-service label inheritance where processes automatically inherit labels from their parent processes without requiring explicit assignment. The access control module automatically checks labels and makes access decisions. This automation reduces the complexity of label management while providing robust security control.
Data Source
AI summary
A file system data access control method, a corresponding computer-readable storage medium and a corresponding data storage device are provided. The method is used in a file system of the data storage device and includes: setting an access rule that specifies a directory in the file system; setting a label into a security context of a virtual inode of the directory, wherein, if a process of an application is going to modify the directory, checking whether the label is already set in a security context of a task structure of the process; if the label is already set in the security context of the task structure, allowing the process to modify the directory, otherwise disallowing the process from modifying the directory.