Intrusion Detection Snapshot Control for Pre-Attack Data Protection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional intrusion detection systems (IDSs) fail to provide timely data protection for storage systems during network attacks, as they lack the ability to quickly perform data protection tasks, and storage subsystems often do not receive timely information about impending threats.
Innovation Solution
Utilizing low latency connections, such as PCIe, to transmit snapshot commands to storage systems, ensuring they arrive before malicious data, and implementing snapshot consistency groups to maintain data integrity by blocking I/O activity and creating a consistent point-in-time copy across volumes.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If conventional intrusion detection systems are used to monitor network traffic, then network attacks can be detected, but data protection is not provided in time to prevent malicious modifications
Solution Approach 1:
The system performs preliminary actions by creating snapshots of data volumes before a network attack can cause damage. When an intrusion is detected, the system immediately initiates snapshot creation and blocks I/O operations to preserve the pre-attack state of the data, ensuring protection is established before malicious modifications occur.
Solution Approach 2:
The system introduces an intermediary mechanism using low-latency communication links and snapshot technology to bridge the gap between intrusion detection and data protection. The snapshot system acts as a mediator that rapidly captures data state and isolates it from potential attack vectors, enabling timely protection without requiring direct real-time blocking of all network traffic.
2Reliability
If storage systems block I/O activity to create snapshots, then data integrity is preserved, but normal data access and operations are interrupted
Solution Approach 1:
The system applies partial action by selectively blocking I/O operations only for specific data volumes identified as being under attack, rather than blocking all I/O activity system-wide. This targeted approach preserves data integrity for affected volumes while maintaining normal access operations for other volumes, minimizing overall productivity impact.
Solution Approach 2:
The system creates snapshots as preliminary copies of data before blocking I/O operations. This allows the system to preserve data integrity through the snapshot while the blocking mechanism protects the live data, enabling potential recovery or migration without permanently interrupting all data access operations.
Data Source
AI summary
A determination is made of whether a network attack is suspected. In response to determining that the network attack is suspected, a generation of a snapshot of volumes of data is requested via a low latency link. The snapshot of the volumes of data is generated while the volumes of data are blocked from access and prior to an occurrence of an effect of the network attack on the volumes of data.