Managed Run-Time Environment Ransomware Detection and Recovery

Resolve Bottlenecks,
Find Innovative Solutions
Generate Solutions

Solution Overview

Problem

Traditional storage systems face inefficiencies in data management and reliability due to redundant write operations and lack of centralized control over storage processes, leading to increased wear and reduced reliability of storage devices.

Innovation Solution

A direct-mapped flash storage system where the operating system directly addresses data blocks without translation by storage controllers, offloading device management tasks, and utilizing non-volatile RAM for quick data buffering, thereby reducing unnecessary write operations and enhancing reliability.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Ease of operation

If storage controllers translate and manage data blocks, then data management control is improved, but device complexity and redundant write operations increase

Engineering Contradiction:
Improvedata management controlVSAvoidstorage controller complexity
Core Design Contradiction:
Ease of operationVSDevice complexity

Solution Approach 1:

The patent extracts the data translation and management functions from the storage controller and relocates them to the operating system. The OS directly addresses flash memory data blocks without controller intervention, eliminating the need for complex translation logic in the storage controller while maintaining centralized data management control at the software level.

Inventive Principle:
Principle #2Taking out (Extraction)

Solution Approach 2:

The operating system serves itself by directly managing flash memory data blocks without requiring storage controller mediation. The OS performs address translation, data management, and wear leveling operations autonomously, reducing the storage controller to basic I/O handling and thereby reducing device complexity.

Inventive Principle:
Principle #25Self-service

2Reliability

If storage controllers manage write operations, then data reliability is improved, but redundant write operations increase causing device wear

Engineering Contradiction:
Improvedata reliabilityVSAvoidstorage device wear
Core Design Contradiction:
ReliabilityVSLoss of substance

Solution Approach 1:

The operating system performs preliminary wear leveling and data relocation operations before actual write operations occur. By pre-managing data block locations and maintaining a mapping of valid data blocks, the system minimizes redundant writes to the same physical locations, thereby reducing storage device wear while maintaining data reliability through OS-level error checking and recovery.

Inventive Principle:
Principle #10Preliminary action

3Adaptability or versatility

If storage controllers translate data blocks, then data management flexibility is improved, but write operation efficiency deteriorates

Engineering Contradiction:
Improvedata management flexibilityVSAvoidwrite operation efficiency
Core Design Contradiction:
Adaptability or versatilityVSProductivity

Solution Approach 1:

The operating system acts as an intermediary between the application layer and flash memory, directly translating logical data block addresses to physical addresses without storage controller intervention. This eliminates the dual translation overhead (OS to controller, controller to memory) and improves write operation efficiency while maintaining data management flexibility through software-based address mapping and management.

Inventive Principle:
Principle #24Intermediary (Mediator)

Data Source

PatentUS12411962B2Managed run-time environment-based detection of a ransomware attack
Publication Date: 2025.09.09 PURE STORAGE INC
  • US12411962B2 patent drawing
  • US12411962B2 patent drawing
  • US12411962B2 patent drawing

AI summary

An illustrative method includes a data protection system detecting an anomaly associated with a managed run-time environment; determining, based on the detecting the anomaly, that the managed run-time environment is possibly being targeted by a security threat; and performing, based on the determining that the managed run-time environment is possibly being targeted by the security threat, a remedial action associated with the managed run-time environment. The performing the remedial action may include identifying a recovery dataset generated prior to the detecting the anomaly, the recovery dataset for data associated with the managed run-time environment and stored by a storage system, and converting the recovery dataset into a protected recovery dataset that cannot be deleted without a specific instruction provided by an authorized entity.