Program Context Whitelisting for Ransomware-Resistant Storage Writes
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional methods fail to completely block ransomware attacks as new variants emerge, and whitelist techniques are ineffective against malicious code injected into allowed applications.
Innovation Solution
A data storage device and host device implement a whitelist system that uses program contexts to identify and allow only authorized input/output operations by storing and comparing program contexts against a whitelist, preventing unauthorized writes.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a whitelist method is used to allow only authorized applications access to protected files, then data protection against application-level threats is improved, but the system cannot prevent damage from malicious code injected into allowed applications
Solution Approach 1:
The patent segments the protection mechanism from application-level to code-level by introducing a program context verification layer. Instead of protecting entire applications, the system divides protection into individual code execution contexts, verifying each program context against a whitelist before allowing file access. This segmentation enables detection of injected malicious code within authorized applications.
Solution Approach 2:
The patent introduces a program context verification mechanism as an intermediary between the application and the file system. This intermediary layer captures program context information, verifies it against the whitelist, and mediates file access decisions. This intermediary prevents malicious code from directly accessing files even when injected into authorized applications.
2Reliability
If conventional detection and removal methods are used for ransomware, then some threats can be mitigated, but new ransomware variants cannot be completely blocked
Solution Approach 1:
The patent implements preliminary action by establishing a whitelist of authorized program contexts before ransomware attacks occur. The system proactively defines which code execution contexts are permitted to access protected files, creating a preventive barrier against unknown and emerging ransomware variants. This preliminary configuration enables the system to block new threats without requiring real-time detection capabilities.
3Reliability
If program context verification is implemented for every write request, then data integrity is improved, but I/O operation performance may deteriorate
Solution Approach 1:
The patent applies partial action by implementing program context verification selectively rather than for every single I/O operation. The verification is performed at critical write request boundaries where data integrity is most important, rather than continuously monitoring all file operations. This selective approach maintains data integrity while minimizing performance impact.
Data Source
AI summary
A data storage device includes a memory device including a whitelist storing one or more program contexts for identifying input/output (I/O) operation, and a control circuit including a whitelist managing circuit configured to determine whether a write request is allowable by comparing the whitelist with one or more program contexts transmitted with the write request from a host. The program contexts may be generated using program counter values corresponding to call operations performed by the I/O operation.