Flash Memory Rollback Checkpoints for Ransomware Validation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing storage systems lack effective methods to detect and mitigate ransomware attacks in real-time, leading to potential data loss and increased computational overhead due to inefficient data validation and management.
Innovation Solution
Implement a method and system that utilizes a storage controller to perform ransomware detection and data validation directly on Flash memory, utilizing entropy checks and metadata analysis to manage data versions and pointers, allowing for efficient rollback and validation before committing new data to storage.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If data validation and ransomware detection are performed by external systems (IBM Storage Insights, IBM Spectrum Control), then data security is improved, but computational overhead and bandwidth usage increase
Solution Approach 1:
The patent introduces an intermediary verification structure and pointer system that enables local validation at the Flash memory level. Instead of relying solely on external systems to analyze and validate data, the verification structure stores metadata and pointers that allow the storage system to quickly verify data integrity locally, reducing the need for continuous external analysis and thereby reducing computational overhead and bandwidth usage while maintaining data security.
2Measurement precision
If Shannon Entropy computation is performed on all write data, then ransomware detection accuracy is improved, but processing speed decreases
Solution Approach 1:
The patent implements partial action by selectively applying Shannon Entropy computation only to new write data that needs validation, rather than processing all data continuously. The verification structure tracks which data has been validated and stores pointer information, allowing the system to skip re-validation of already verified data. This selective approach maintains high ransomware detection accuracy for new data while significantly improving overall processing speed by avoiding redundant computations.
3Reliability
If data is validated before committing to storage, then data integrity is improved, but write performance decreases
Solution Approach 1:
The patent applies preliminary action by performing validation computations during the data write process itself, before the data is committed to storage. The verification structure is updated concurrently with data writing, and pointer information is established in advance. This allows the system to validate data integrity proactively rather than reactively, ensuring data integrity is maintained while minimizing the performance impact by integrating validation into the write workflow rather than adding it as a separate post-processing step.
4Adaptability or versatility
If multiple data versions are maintained for rollback capability, then data recovery ability is improved, but storage space consumption increases
Solution Approach 1:
The patent uses copying by creating lightweight metadata copies and pointer references in the verification structure rather than maintaining full duplicate data versions. The verification structure stores compact pointer information that references original data locations, allowing the system to track multiple data versions efficiently. When rollback is needed, the system uses these pointer references to quickly restore previous versions without requiring substantial additional storage space, thus improving data recovery ability while minimizing storage space consumption.
Data Source
AI summary
A method, system, computer program product, and computer program for managing data in a storage system, the storage system comprising: a set of subsystems comprising: a structure comprising a set of mappings between logical and mapped addresses; and a storage device comprising a first data version at a first mapped address; the method comprising: for at least one substructure: providing, in the structure, for the first logical address, a verified pointer to the first mapped address; writing a second data version for a second mapped address, the second mapped address different from the first mapped address; providing, in the structure, for the first logical address a write-head pointer to the second mapped address; gathering the second data version to determine metadata for the second data version, the metadata associated with an indicator; in response to the indicator comprising a verify indicator; updating the verify pointer to the second mapped address.