File System Filter Driver for Protected Local Backup
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Consumer and small business data backup solutions are vulnerable to malware and ransomware threats, as backed-up data is accessible through standard network protocols and users often operate with administrator privileges, making protection via OS write-protect access control features ineffective.
Innovation Solution
Implementing a file system filter driver that rejects write requests from applications other than the backup application, even when issued by users with administrative privileges, and selectively allowing read requests, to create a secure environment for protected local backup by attaching the filter driver to specific devices rather than entire classes of devices.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If standard network protocols and OS write-protect access control features are used for backup, then ease of operation is improved, but security against malware and ransomware deteriorates
Solution Approach 1:
A kernel-mode filter driver is introduced as an intermediary layer between the file system and backup storage devices. This driver acts as a security gatekeeper that intercepts and filters write requests, allowing only authorized backup applications to write data while blocking malware and ransomware, thus resolving the contradiction between ease of operation and security vulnerability
Solution Approach 2:
The system segments access control by creating distinct permission levels: backup applications receive full write access through the filter driver, while all other applications including those run by users with administrator privileges are completely blocked from writing to backup devices. This segmentation isolates the backup storage from harmful factors while maintaining operational simplicity for authorized users
2Ease of operation
If users operate with administrator privileges for backup operations, then ease of operation is improved, but reliability against data corruption deteriorates
Solution Approach 1:
The kernel-mode filter driver serves as an intermediary that decouples user privilege levels from actual write access permissions. Even when users operate with administrator privileges, the filter driver mediates all write requests and only permits them from authorized backup applications, thereby maintaining both ease of operation and data integrity/reliability
3Ease of operation
If backup storage is made accessible through standard network protocols, then ease of operation is improved, but security against malware deteriorates
Solution Approach 1:
The system extracts and removes the ability of standard network protocols and other applications to access backup storage devices. The filter driver actively blocks all non-backup write requests, effectively taking out the harmful accessibility pathway while preserving ease of operation for authorized backup applications through direct file system access
Data Source
AI summary
Systems and methods for protected local backup. In an illustrative, non-limiting embodiment, an Information Handling System (IHS) may include one or more processors and a memory coupled to the one or more processors, the memory including program instructions stored thereon that, upon execution by the one or more processors, cause the IHS to: receive, via a file system filter driver, a request targeting a file system within a storage device, wherein the file system filter driver is owned by a backup application; and reject the request, via the file system filter driver, in response to the request having been issued by an application other than the backup application.