Storage Controller Read-Only Policy for Secure Data Updates
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing data storage systems struggle to securely update protected data while preventing malware from modifying critical system files, as storage controllers enforcing a read-only policy hinder legitimate patching utilities from making necessary modifications.
Innovation Solution
The system divides secondary storage into protected, writable, and quarantined regions, using filter instructions for file system and registry virtualization to redirect changes made by patch utilities to a quarantined area, allowing verification and validation before updating protected data, ensuring secure and safe updates.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If storage controllers enforce a read-only policy on protected data regions, then system security is improved and malware cannot modify critical files, but legitimate patching utilities cannot make necessary modifications to protected data
Solution Approach 1:
The patent segments the storage system into protected regions (enforcing read-only policy) and unprotected regions (allowing writes). Patching utilities write to unprotected regions, and the system manages the coordination between these segments to enable secure updating without compromising security or patching capability
Solution Approach 2:
The patent introduces an intermediary mechanism (the storage controller's read-only policy enforcement layer) that mediates between patching utilities and protected data. The intermediary allows the utility to write to unprotected regions while preventing direct writes to protected regions, enabling indirect updating through coordinated operations
2Object-affected harmful factors
If storage controllers prevent write operations to protected disk blocks, then malware cannot persist on the system, but software updates and patching operations fail
Solution Approach 1:
The storage space is segmented into protected and unprotected regions. Malware attempting to write to protected regions is blocked by the read-only policy, while update operations write to unprotected regions and use coordination mechanisms to apply changes, thus segmenting the protection and update pathways
Solution Approach 2:
The system performs preliminary actions by having patching utilities write to unprotected regions before committing to protected regions. The read-only policy is enforced in advance on protected regions, and updates are prepared in advance in unprotected regions where writes are permitted
Data Source
AI summary
Described herein are articles, systems, and methods for using a storage controller to protect secure data blocks through the enforcement of a read only policy. In some embodiments, the articles use a combination of hardware protections and software protections (e.g., virtualization) to protect a system against attack from malware while such secure data is updated. Also described are systems and methods for securely updating data blocks secured in this fashion, and detecting and preventing the corruption of data stored on secondary storage media using a disk eventing mechanism.