File System Snapshot Data Protection During Security Breach
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing intrusion detection and prevention systems (IDPS) fail to immediately protect file system data from corruption upon detecting a potential breach, relying on administrative intervention that can lead to data loss due to the time delay in responding to and reverting undesirable changes.
Innovation Solution
The implementation of a method that generates a read-only snapshot of file system data and executes file system protection commands to restrict access upon suspicion of a breach, using snapshot mechanisms like copy-on-write to create a point-in-time copy of the data, thereby preventing further modifications and ensuring data integrity.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If administrative intervention is used to respond to potential breaches, then data protection can be achieved, but time delay occurs leading to data loss
Solution Approach 1:
The system creates read-only snapshots of file systems proactively before administrative intervention is needed. When a potential breach is detected, the snapshot mechanism is already in place to immediately preserve data state, eliminating the time delay associated with manual administrative responses. The snapshot creation is triggered automatically by the intrusion detection system, ensuring data protection occurs in real-time without waiting for human action.
2Reliability
If read-only snapshots are created immediately upon breach detection, then data integrity is protected, but system complexity increases
Solution Approach 1:
The patent introduces a file system snapshot mechanism as an intermediary layer between the intrusion detection system and the actual file system data. This snapshot intermediary automatically captures and preserves file system states without requiring complex custom development. By leveraging existing snapshot technology, the system achieves data integrity protection while minimizing the complexity that would arise from building a custom data protection mechanism from scratch.
3Reliability
If access to snapshotted data is restricted to administrative levels, then data corruption is prevented, but ease of operation decreases
Solution Approach 1:
The system dynamically adjusts data access permissions based on the security context. During an active intrusion response, the snapshotted data is restricted to administrative levels only, preventing corruption. Once the threat is mitigated and the system returns to normal operation, access permissions are dynamically relaxed to allow standard user operations. This dynamic permission adjustment maintains both data protection and operational ease at different times in the system lifecycle.
Data Source
AI summary
Immediately upon identifying a potential breach to a file system, a read-only snapshot of one or more file sets of data stored on a storage volume of the file system is created, and one or more file system protection commands are invoked that restrict access to the snapshot of the file set. Generating the snapshot and restricting access to the snapshot data may include immediately opening an administrative shell for the file-system in response to identifying a potential breach, and executing administrative shell commands that invoke creation of snapshot and limit access of the snapshot data to an administrator or super user.