Storage Array Access Bitmaps for Dataset Integrity Protection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Storage arrays are vulnerable to cyber-attacks such as data theft, destruction, or encryption, with current host-based detection techniques only identifying attacks after they occur, failing to prevent them.
Innovation Solution
Implementing a system that restricts access to datasets based on logical device or track, using access bitmaps and protection bitmaps to monitor and control access patterns, and employing a two-actor security mechanism to modify protection settings.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If access to storage arrays is freely permitted, then productivity and ease of operation are improved, but security and reliability deteriorate due to vulnerability to cyber-attacks
Solution Approach 1:
The patent segments storage arrays into multiple logical devices and further divides them into individual tracks. Access control is applied at the track level within logical devices, allowing fine-grained security policies to be enforced without restricting access to entire storage arrays. This segmentation enables selective protection of sensitive data while maintaining operational accessibility for non-sensitive portions.
Solution Approach 2:
The patent implements differential access control where different security policies are applied to different tracks within the same logical device. The protection bitmap enables specific tracks to be marked as protected or unprotected, allowing local quality control where only sensitive portions of data require restricted access while other portions remain freely accessible.
2Reliability
If access control policies are established to protect data, then security is improved, but device complexity increases due to monitoring and enforcement mechanisms
Solution Approach 1:
The patent implements partial action by applying access control only to specific tracks within logical devices rather than to all data. The protection bitmap selectively marks only those tracks containing sensitive information that require protection. This partial approach reduces the complexity of the access control system compared to comprehensive array-wide control while maintaining adequate security for critical data.
Solution Approach 2:
The patent introduces a protection bitmap as an intermediary data structure that mediates between access requests and stored data. This bitmap serves as a simplified interface that translates high-level security policies into low-level access control decisions, reducing the complexity of direct monitoring and enforcement mechanisms by providing an intermediate layer of abstraction.
3Difficulty of detecting and measuring
If comprehensive monitoring of access requests is implemented, then detection capability is improved, but processing time and system overhead increase
Solution Approach 1:
The patent performs preliminary action by pre-establishing the protection bitmap that identifies which tracks require protection before access requests are processed. This pre-computation of security policies allows the system to quickly determine whether an access request should be permitted without performing complex real-time analysis, thereby reducing access processing time while maintaining detection capability for abnormal access patterns.
Solution Approach 2:
The patent extracts the security policy determination from the access control enforcement process. By separating the identification of protected tracks (via the protection bitmap) from the actual access control decisions, the system can efficiently handle access requests by simply checking the bitmap state rather than performing comprehensive monitoring and analysis for each request, thus reducing processing overhead.
Data Source
AI summary
One or more aspects of the present disclosure relate to protecting the integrity of datasets stored by a storage array. In embodiments, an input/output (IO) workload is received at a storage array. A restricted access policy is also established for at least one target of one or more IO requests corresponding to the IO workload. Further, access to the at least one target is restricted based on the restricted access policy.