Immutable Snapshot Retention for Ransomware Protection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing techniques for combating ransomware, such as isolated recovery environments with immutable data vaults, face challenges in ensuring the integrity and retention of snapshots during a ransomware attack, as snapshots can be easily compromised or deleted, hindering effective data recovery.
Innovation Solution
The implementation of a system that creates and retains immutable snapshots by assigning a defined retention period using snapshot schedule policies, locking the snapshots with a tamper-proof timer, thereby preventing deletion until the specified retention time has expired, ensuring data integrity and facilitating recovery.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If snapshots are retained for ransomware recovery, then data recovery capability is improved, but snapshots can be easily compromised or deleted by ransomware
Solution Approach 1:
The patent applies preliminary anti-action by pre-locking snapshots with immutable retention times before ransomware can compromise them. The system assigns retention times to snapshots in advance, creating a pre-established protective barrier that prevents ransomware from deleting or modifying the snapshots even after infection occurs. This proactive locking mechanism directly counteracts the harmful action of ransomware attempting to destroy backup data.
Solution Approach 2:
The system performs preliminary action by creating and locking immutable snapshots before any ransomware attack occurs. The snapshots are prepared with predetermined retention periods and stored in secure locations, ensuring they are ready for immediate recovery use. This advance preparation eliminates the vulnerability window where snapshots might be compromised during an attack.
2Stability of the object's composition
If snapshots are made immutable with retention locking, then snapshot integrity is improved, but deletion flexibility is reduced
Solution Approach 1:
The patent applies dynamics by making the snapshot retention policy time-dependent rather than static. Snapshots are locked with immutable retention times, but this locking mechanism automatically expires after a predetermined period. The system dynamically transitions snapshots from a locked immutable state to an unlockable state based on the elapsed time, providing both integrity during the retention period and flexibility after expiration.
Solution Approach 2:
The system implements periodic action through time-based retention policies where snapshots are retained for specific durations and then automatically become eligible for deletion. This periodic unlocking based on time intervals maintains snapshot integrity during critical recovery windows while restoring deletion flexibility after the retention period expires, balancing protection needs with operational flexibility.
Data Source
AI summary
Systems and methods for creation and retention of immutable snapshots to facilitate ransomware protection are provided. According to one embodiment, multiple use cases for retention of snapshots are supported, including (i) maintaining a locked snapshot on a source volume of a first storage system on which it was originally created for at least an associated immutable retention time; (ii) replicating the locked snapshot to a destination volume of a second storage system and also maintaining the replica of the locked snapshot on the destination volume for at least the associated immutable retention time; and (iii) maintaining an unlocked snapshot on the source volume, replicating the unlocked snapshot to the destination volume, locking the replicated snapshot on the destination volume when it has an associated non-zero immutable retention time, and thereafter maintaining the replica on the destination volume in accordance with the immutable retention time.