Data Storage Access Management for Ransomware Protection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods for operating data storage devices are vulnerable to malware, particularly ransomware, which can encrypt or damage files, leading to loss of information.
Innovation Solution
Implementing a computer-implemented method with access management that includes a file backup system, where access requests are blocked until a backup copy is created and saved, and a fingerprint determination to identify malicious requests, along with an access filter to skip backup for secure requests, and a block position transformation or encryption stage to secure the file system.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a backup copy is created for every access request to protect against malware, then file security against ransomware is improved, but system performance and access speed deteriorate due to the overhead of creating and managing backup copies for every access
Solution Approach 1:
The patent applies local quality by implementing selective backup strategies where different access requests receive different treatments based on their characteristics. The access filter analyzes fingerprints and metadata to determine which requests require backup creation, applying protection only where necessary rather than uniformly to all requests. This resolves the contradiction by maintaining high security for suspicious requests while allowing fast access for legitimate requests.
Solution Approach 2:
The system changes parameters by dynamically adjusting backup creation behavior based on fingerprint analysis results, access patterns, and system state. The access filter modifies the backup creation parameter from a constant true value (backup every request) to a conditional value based on security assessment, thereby optimizing both security and performance.
2Measurement precision
If fingerprint determination is implemented to identify malicious access requests, then accuracy in detecting ransomware is improved, but device complexity increases due to additional processing requirements
Solution Approach 1:
The patent applies preliminary action by computing fingerprints and performing security assessments before actual file access operations. The access filter evaluates access requests in advance, determining whether backup creation is necessary before the main access path is taken. This preliminary filtering reduces the complexity burden by handling security checks separately from the main access flow.
Solution Approach 2:
The fingerprint determination mechanism serves as an intermediary layer between the access request and the file system. Rather than directly complicating the core file access path, the fingerprint analysis acts as a mediating component that translates access requests into security-assessed decisions, isolating the complexity to a dedicated module.
3Productivity
If an access filter is implemented to skip backup for legitimate requests, then system performance is improved by reducing unnecessary backup operations, but reliability may worsen if legitimate requests are misidentified and skipped
Solution Approach 1:
The system implements feedback mechanisms where the outcomes of access filter decisions are monitored and used to refine future filtering accuracy. The access management system learns from access patterns and fingerprint analysis results, adjusting its assessment criteria to reduce false positives while maintaining high-performance access for legitimate requests. This feedback loop resolves the contradiction by progressively improving both performance and reliability.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
To improve a computer-implemented method for operating a data storage facility, comprising access management for a file system, in which, upon an access request for a file of the file system generated by a process in a data processing facility and transmitted to the data storage facility, this file is made available for file access, in such a way that it is protected against malware, in particular ransomware, it is proposed that the access management includes a file backup, from which, upon an access request for the file forwarded from this file backup, a file backup run is started, that the access request is blocked until a backup copy of the file has been created and saved, that subsequently the access request is forwarded to an access driver for the file system, and that the access is carried out by the access driver.