SmartNIC Ransomware Protection via Secure Snapshots
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current technologies lack an effective and centralized method for adding ransomware protection to workloads running on servers, due to diverse OS environments, virtualization trends, and restricted data visibility in confidential computing setups.
Innovation Solution
Implementing ransomware protection using Smart Network Interface Controllers (SmartNICs), which provide a centralized security domain within the SmartNIC, enabling coordinated data protection, real-time ransomware detection, and intelligent operational controls through secure snapshots, delta set analysis, and AI/ML algorithms.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If ransomware protection is implemented using traditional methods in diverse OS environments, then protection coverage is limited, but system complexity and deployment difficulty increase
Solution Approach 1:
The patent introduces a SmartNIC as an intermediary device between the host system and storage devices. The SmartNIC contains a security domain with ransomware protection functionality, acting as a mediator that provides centralized protection without requiring modifications to diverse OS environments. This resolves the contradiction by delivering reliable protection through a hardware intermediary while avoiding the complexity of software deployment across different operating systems.
2Reliability
If centralized ransomware protection is implemented, then protection consistency improves, but additional hardware requirements increase
Solution Approach 1:
The patent makes the SmartNIC multi-functional by integrating both network interface functionality and ransomware protection security domain within a single hardware device. This allows the SmartNIC to serve dual purposes: network communication and centralized security enforcement. The resolution achieves protection consistency through centralized control while avoiding additional dedicated hardware by utilizing the existing SmartNIC infrastructure.
3Measurement precision
If real-time ransomware detection is implemented using AI/ML algorithms, then detection accuracy improves, but compute resource consumption increases
Solution Approach 1:
The patent extracts the computationally intensive AI/ML-based ransomware detection functionality from the host CPU and relocates it to the SmartNIC's security domain. By taking out the heavy computational workload from the main system and placing it in the isolated SmartNIC environment, the solution achieves high detection accuracy while preventing excessive compute resource consumption from impacting host system performance.
4Reliability
If secure snapshots with retention timers are implemented, then data recovery capability improves, but storage space requirements increase
Solution Approach 1:
The patent implements periodic secure snapshots with automated retention timer management. Instead of continuous or excessive snapshotting, the system creates snapshots at defined intervals and automatically manages their retention based on configured time periods. This periodic approach maintains adequate data recovery capability while controlling storage space consumption through automated snapshot lifecycle management.
Data Source
AI summary
A ransomware protection smart network interface controller (SmartNIC) is configured to implement data protection in a domain of the SmartNIC by taking a secure snapshot, a point in time image of a storage object, and retaining the point in time image of the storage object until a retention timer has expired, and implementing vault semantics and operational controls. The ransomware protection SmartNIC is also configured to implement ransomware detection in the domain of the SmartNIC by implementing inline ransomware attack detection and/or near-line ransomware attack detection, using periodic snapshots, by evaluating probability of a ransomware attack based, at least in part, on a delta change set in consecutive snapshots. The ransomware protection SmartNIC is further configured to implement ransomware protection policies in the domain of the SmartNIC by implementing policies of when the secure snapshots are taken.