Storage Controller Ransomware Recovery via Tenant Status Tables
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In a multi-tenancy storage environment, existing technologies lack effective measures to recover data from ransomware attacks, which pose significant financial and social risks by encrypting data and demanding decryption keys.
Innovation Solution
A storage device with a non-volatile memory and a storage controller that detects ransomware attacks, updates a tenant status table, writes recovery information, and performs data recovery based on a warning status, using recovery information to restore original data.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If a multi-tenancy storage system allows multiple tenants to share storage resources, then storage resource utilization is improved, but data security and isolation between tenants deteriorates when ransomware attacks occur
Solution Approach 1:
The storage system is segmented into multiple isolated tenant storage spaces with individual status tables. Each tenant's data is managed separately with independent ransomware status tracking, allowing secure isolation while sharing the underlying storage infrastructure. This enables multiple tenants to coexist securely with dedicated protection mechanisms for each tenant's data.
Solution Approach 2:
A storage controller acts as an intermediary between tenants and storage resources, implementing ransomware detection, status management, and recovery coordination. The controller monitors write operations, updates tenant status tables, and coordinates recovery processes, providing security mediation that protects tenant data while enabling resource sharing.
2Reliability
If ransomware detection and recovery mechanisms are implemented, then data security is improved, but device complexity and operational overhead increase
Solution Approach 1:
The system performs preliminary ransomware detection by monitoring write operations before data is permanently encrypted. A tenant status table is pre-established to track ransomware infection states, enabling early intervention and recovery preparation without requiring complex real-time analysis during active attacks.
Solution Approach 2:
The storage controller autonomously detects ransomware attacks, updates tenant status tables, and initiates recovery processes without requiring external intervention. The system self-manages the complexity of security monitoring and recovery coordination, reducing operational overhead while maintaining robust data protection.
3Reliability
If recovery information is written for each tenant in warning status, then data recoverability is improved, but storage space consumption increases
Solution Approach 1:
Recovery information is selectively written only for tenants in warning status rather than all tenants. Each tenant's recovery status is locally tracked in individual status table entries, allowing recovery space allocation to be proportional to actual risk exposure rather than uniformly applied across all storage resources.
Data Source
AI summary
Disclosed is an operation method of a storage device, which includes detecting a ransomware attack on one or more tenants executed in a host, updating a tenant status table including a status of each of the one or more tenants based on a result of the detection, writing recovery information for data recovery in a non-volatile memory depending on whether a status value of a tenant corresponding to the write request from among the one or more tenants is a status value corresponding to a warning status from among a plurality of status values, when a write request is received from the host, and performing the data recovery depending on the recovery information, when a recovery signal is received from the host.