Trusted OS Write Protection for Backup Data
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Ransomware can encrypt both primary and backup data due to its kernel-level access, making existing software-driven countermeasures ineffective, and hardware-based solutions like self-encrypting drives and Opal drives are needed to protect backup data from unauthorized encryption.
Innovation Solution
A trusted operating system is employed to control access to a write-protected portion of a hard disk, using a TPM to manage encryption keys and ensure that only the trusted OS can write to this protected area, thereby safeguarding backup data from ransomware encryption.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If software-driven countermeasures (anti-malware software, OS updates) are used to protect against ransomware, then ease of operation is improved, but reliability deteriorates because these measures are not 100% effective against kernel-level ransomware attacks
Solution Approach 1:
The system divides the operating system into two separate trusted OS instances: a primary trusted OS for normal operations and a secondary trusted OS specifically for managing backup data. This segmentation ensures that even if the primary OS is compromised by ransomware, the secondary trusted OS and its associated backup data remain protected, thereby improving reliability while maintaining ease of operation through automated backup management.
2Ease of operation
If local backups are stored in accessible locations for quick restoration, then ease of operation is improved, but object-generated harmful factors worsen because ransomware can encrypt both primary and backup data
Solution Approach 1:
The system implements different access control qualities for different portions of the storage system. The first portion (primary OS data) is accessible to the primary trusted OS for normal operations, while the second portion (backup data) is restricted to only the secondary trusted OS. This local quality differentiation allows quick restoration when needed while preventing ransomware from encrypting backup data, thus resolving the contradiction between ease of operation and harmful factors.
3Reliability
If hardware-based solutions (self-encrypting drives, Opal drives) are used to protect backup data, then reliability is improved, but device complexity worsens
Solution Approach 1:
The system introduces a secondary trusted OS as an intermediary layer between the hardware storage and the backup data. This intermediary manages access to the second portion of the storage device with restricted permissions, providing hardware-level protection without requiring specialized hardware components. This approach improves reliability by preventing ransomware encryption while avoiding the increased device complexity that would result from implementing self-encrypting drives or Opal drives.
Data Source
AI summary
A method for providing malware protection in connection with processing circuitry including hardware resources and software resources managed by a primary operating system may include providing a trusted operating system to control access to a portion of a local storage area of the hardware resources. In this context, only the trusted operating system is configured to enable writing to the portion of the local storage area. The method may further include storing backup files for the primary operating system in the portion of the local storage area responsive to the trusted operating system granting access to write to the portion of the local storage area.