Isolated Backup Recovery Environment for Ransomware Network Failure
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing systems are inadequate in quickly and safely recovering data from ransomware attacks or power failures, often leading to significant financial and operational disruptions due to the inability to access encrypted data and the risk of lateral network infections.
Innovation Solution
A computer-implemented system utilizing a backup server with predefined data in a sandboxed environment, isolated from the customer's network, which builds a new digital working environment upon activation of an emergency switch, allowing rapid access to safe backup data through a fallback tenant.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional backup systems are used to store backup data, then data can be recovered after failure, but the recovery process is slow and may be compromised by ransomware-encrypted data overwriting clean backup data
Solution Approach 1:
The system divides backup data into separate containers: a primary backup container and a secondary backup container. This segmentation ensures that ransomware cannot overwrite all backup data simultaneously, and recovery can proceed from the clean container while the other is being restored or secured.
Solution Approach 2:
The system pre-configures multiple backup containers and establishes recovery procedures before a ransomware attack occurs. This preliminary preparation enables immediate switching to a clean backup container when an attack is detected, eliminating the need to search for or verify backup data during the emergency recovery process.
2Ease of operation
If backup data is stored on the same network infrastructure, then recovery is simpler, but lateral movement of infections can compromise the backup data
Solution Approach 1:
The system introduces an intermediary isolation layer between the primary and secondary backup containers. This intermediary mechanism prevents direct network communication between the containers, blocking lateral movement of ransomware while still allowing controlled data transfer and recovery operations through verified channels.
Solution Approach 2:
The system creates isolated copies of backup data in separate containers with restricted network connectivity. These copied backup environments maintain data integrity by preventing direct access from the compromised network, while still enabling recovery operations through controlled interfaces.
3Reliability
If the entire contents of a hard drive are replaced to recover from ransomware, then clean data can be restored, but the process is slow and disrupts business continuity
Solution Approach 1:
The system segments backup data into multiple containers, allowing selective restoration from clean containers without requiring complete drive replacement. This enables partial system recovery while maintaining business operations, rather than forcing a complete system shutdown for full drive replacement.
Solution Approach 2:
The system pre-configures multiple ready-to-use backup containers with recovery instructions before an attack occurs. When ransomware is detected, the system can immediately activate a clean container and begin recovery processes without delay, maintaining business continuity while restoring clean data.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
The invention relates to a computer-implemented system for recovering data in case of a computer network failure. The invention also relates to a computer-implemented method for recovering data in case of a computer network failure, preferably by making use of the computer-implemented system according to the invention. The invention further relates to a non-transitory computer-readable program storage device, comprising computer readable instructions executable by one or more processors to perform the computer-implemented method according to the invention.