Network File Storage Protection Without Client-Side Ransomware Agents
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional ransomware prevention technologies require a separate client program installation on each operating system and version, causing user and service provider burdens, and lack effective protection methods that are not easily managed or secure.
Innovation Solution
A data protection storage system that integrates with a standard network driver on the operating system, utilizing a data protection processing part to enforce policies on file access requests through a virtual or custom file system, providing secure file access events and fake files as needed, with a determination part outside the PC to enhance security.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a separate client program is installed on each operating system and version for ransomware prevention, then ransomware protection function is achieved, but user burden increases and service provider development complexity increases
Solution Approach 1:
The patent extracts the ransomware protection function from the client terminal and relocates it to the network storage system. The network storage system independently performs file access monitoring, malware detection, and protection actions without requiring client programs on terminals. This eliminates the need for separate client installations on each operating system while maintaining protection reliability.
Solution Approach 2:
The patent introduces a gateway server as an intermediary between the network storage system and client terminals. The gateway server handles communication protocols, file access requests, and coordination, allowing the network storage system to provide protection services without direct client program installations. This intermediary layer simplifies the system architecture and reduces development complexity across multiple operating systems.
2Reliability
If conventional ransomware prevention systems are implemented, then file protection is achieved, but storage space is consumed and management complexity increases
Solution Approach 1:
The patent implements a file copying mechanism where protected files are replicated within the network storage system. When a file is accessed, the system creates a copy for processing while the original remains intact in storage. This allows protection operations to be performed on copies rather than requiring additional dedicated storage space for protection mechanisms, efficiently utilizing available storage capacity.
3Reliability
If client programs are installed on each terminal for data protection, then protection coverage is achieved, but ease of operation deteriorates due to installation and maintenance burden
Solution Approach 1:
The patent implements a self-service protection model where the network storage system automatically performs file monitoring, malware detection, and protection actions without requiring client programs on terminals. The system autonomously manages protection policies, updates detection signatures, and executes protection measures, eliminating installation and maintenance burdens on users while maintaining comprehensive protection coverage.
Solution Approach 2:
The gateway server acts as an intermediary that handles all communication between client terminals and the network storage system. Terminals only need to mount the network storage drive without installing additional software. The gateway server manages authentication, file access coordination, and protection service delivery, greatly simplifying user operation while ensuring comprehensive protection coverage.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
According to exemplary embodiments of the present invention, data protection storage is provided, the storage comprising: a standard network file server receiving a file access request from a user by being communicatively linked with a standard network driver mounted on an operating system of a client terminal; and a data protection processing part allowing a data protection processed file to be provided to the client terminal by data protection processing of a file requested in response to data protection policy set in a policy part when the file access request is received from a file system mapped to storage of the standard network file server.