Network File Server Access Control for Ransomware Defense
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods for preventing phishing and ransomware attacks are inadequate, as they either fail to protect encrypted data or require cumbersome registration processes, and ransomware can encrypt entire disks or servers, necessitating a more comprehensive solution.
Innovation Solution
A system and method that uses a network file server and client to authenticate and authorize access to files, allowing only predetermined programs to write or modify data, while restricting others to read-only access, and enabling selective switching of files to edit mode to prevent unauthorized changes.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If data is periodically backed up to a safe storage area to prevent ransomware attacks, then data loss can be mitigated, but recent working files cannot be recovered and the process is cumbersome
Solution Approach 1:
The system performs preliminary actions by automatically backing up files to a network storage device before ransomware can encrypt them. The backup process runs continuously or at scheduled intervals without user intervention, ensuring that recent working files are already protected before any attack occurs.
Solution Approach 2:
The backup system operates autonomously without requiring user intervention. It automatically identifies working files, copies them to the network storage device, and manages the backup process itself, eliminating the need for users to manually perform backup operations.
2Reliability
If authorized processes are registered in advance to access files on a file server, then ransomware access can be blocked, but the registration process becomes cumbersome when programs are installed frequently
Solution Approach 1:
The file server automatically performs access control verification without requiring manual registration of each process. The server independently determines whether a requesting process is authorized to access files, eliminating the need for users to manually register processes before installation.
Solution Approach 2:
The system implements a feedback mechanism where the file server continuously monitors and verifies process identities and access rights in real-time. This automatic verification loop replaces manual registration processes, allowing the system to adapt to newly installed programs without user intervention.
3Adaptability or versatility
If all programs are allowed to access and modify files on a network drive, then program functionality is maintained, but ransomware can encrypt or delete data
Solution Approach 1:
The file server applies different access permissions to different processes based on their identity and authorization status. Authorized processes receive full read-write access to maintain functionality, while unauthorized processes (including ransomware) are restricted to read-only access or completely blocked, creating localized quality control for each access request.
4Reliability
If file access is restricted to read-only mode by default, then ransomware encryption is prevented, but legitimate write operations require additional authorization steps
Solution Approach 1:
The system performs preliminary authorization verification before granting write access. When a process requests to write a file, the file server proactively checks whether the process is authorized beforehand, and only then grants write permissions. This preliminary check prevents unauthorized writes while streamlining authorized operations.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
Provided is a system for blocking an external attack, which includes: a network file server; and a network file server (NFS) client installed in a user terminal or a service server and communication-connected with the network file server which is remotely positioned, and the network file server determines, when there is an access or opening request of a file stored in the network file server mounted in the user terminal or service server in a network drive format from the NFS client, whether at least one of the user information and the program information to request the access or opening is authorized and blocks the access to the file which is requested to be accessed or provides the file of which opening is requested to the NFS client only in a read only mode when the access or opening request is unauthorized according to a determination result.