Flash Storage Snapshot Safeguards Against Ransomware Writes

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Existing storage systems are vulnerable to ransomware attacks, which can compromise data integrity and availability, and existing solutions do not adequately protect against such threats.

Innovation Solution

Implementing a safeguarded snapshot generation mechanism within a flash-based storage system that includes direct-mapped flash storage, where data operations are managed by the operating system rather than individual flash drives, and utilizing non-volatile RAM (NVRAM) to buffer writes, ensuring data integrity and availability even in power failures.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If traditional storage systems are used, then data storage capacity is provided, but data integrity and availability are compromised by ransomware attacks

Engineering Contradiction:

Improvedata integrity and availabilityVSAvoidransomware attacks

Core Design Contradiction:

ReliabilityVSObject-affected harmful factors

Solution Approach 1:

The system creates snapshots of data before potential ransomware attacks occur. These snapshots serve as pre-prepared restore points that enable rapid recovery without requiring real-time protection during the attack, thus resolving the contradiction between maintaining data availability and protecting against ransomware.

Inventive Principle:

Principle #10Preliminary action

Solution Approach 2:

The invention creates copies of data in the form of snapshots stored in non-volatile memory. These copies remain intact even when the primary data is compromised by ransomware, enabling restoration of data integrity and availability from these independent copies.

Inventive Principle:

Principle #26Copying

2Productivity

If flash-based storage systems are used, then write performance is improved, but redundant write operations increase and data protection is insufficient

Engineering Contradiction:

Improvewrite performanceVSAvoiddata protection against ransomware

Core Design Contradiction:

ProductivityVSReliability

Solution Approach 1:

The invention extracts the snapshot creation function from the traditional write path and implements it through a separate safeguarded snapshot generation mechanism. This allows the flash storage to maintain its high write performance while the snapshot system independently handles data protection, preventing ransomware propagation without degrading write performance.

Inventive Principle:

Principle #2Taking out (Extraction)

Solution Approach 2:

Non-volatile memory acts as an intermediary between the flash storage and the snapshot system. It buffers write operations and preserves data during power failures, enabling the system to achieve both high write performance from flash storage and reliable data protection through snapshots.

Inventive Principle:

Principle #24Intermediary (Mediator)

3Loss of time

If snapshots are created frequently for rapid recovery, then recovery time is reduced, but storage space consumption increases

Engineering Contradiction:

Improverecovery timeVSAvoidstorage space consumption

Core Design Contradiction:

Loss of timeVSQuantity of substance

Solution Approach 1:

The system creates snapshots only at critical points in time rather than continuously. By selectively creating snapshots based on significant data changes or before important operations, the system reduces storage space consumption while still providing rapid recovery capability when needed, thus resolving the contradiction between recovery speed and storage usage.

Inventive Principle:

Principle #3Local quality

Data Source

PatentUS20260057069A1Safeguarded Snapshot Generation within a Flash-based Storage System to Protect Against Ransomware

Publication Date: 2026.02.26 PURE STORAGE INC

AI summary

An illustrative method includes collecting I/O operation (IOP) data for each virtual disk included in a flash-based storage system; transmitting IOP data to an AI-powered detection module, detecting, using the AI-powered detection module, unusual activity associated with the IOP data, and performing, based on the detecting the unusual activity, a remedial action, the remedial action comprising automatically creating a snapshot of data included in the flash-based storage system.