Securing a media storage device using write restriction mechanisms

• US 10,394,492 B2
• Filed: 10/26/2016
• Issued: 08/27/2019
• Est. Priority Date: 10/26/2016
• Status: Active Grant

• Current Assignee: Lenovo Global Technologies International Ltd. (Lenovo Group Ltd.)
• Original Assignee: Lenovo Enterprise Solutions (Singapore) Pte., Ltd. (Lenovo Group Ltd.)
• Inventors: Petersen, John Michael, Cudak, Gary David, Alshinnawi, Shareef Fathi, Dholakia, Ajay
• Primary Examiner(s): Lane, John A
• Application Number:
  US15/335,290
• Publication Number:
  US 20180113638A1
• Time in Patent Office: 1,035 Days
• Field of Search: None
• CPC Class Codes: G06F 12/14 Protection against unauthorised use of memory or access to memory
• CPC Class Codes: G06F 21/554 involving event detection and direct action
• CPC Class Codes: G06F 21/79 in semiconductor storage media, e.g. directly-addressable memories
• CPC Class Codes: G06F 2212/1052 Security improvement
• CPC Class Codes: G06F 3/0619 in relation to data integrity, e.g. data losses, bit errors
• CPC Class Codes: G06F 3/0659 Command handling arrangements, e.g. command buffers, queues, command scheduling
• CPC Class Codes: G06F 3/0673 Single storage device
• CPC Class Codes: G06F 3/0683 Plurality of storage devices

Abstract

According to one embodiment, a system includes a media storage device, a processor, and logic integrated with and/or executable by the processor. The logic is configured to cause the processor to determine a write rate for the media storage device or a portion thereof based on one or more factors, the write rate ranging from zero to a maximum possible write rate for the media storage device or the portion thereof. The logic is also configured to cause the processor to receive a write request to write data to the media storage device or the portion thereof and write the data to the media storage device using the determined write rate. Other systems, methods, and computer program products for defending against ransomware attacks are presented according to more embodiments.

Claims

1. A system, comprising:

a media storage device;

a processor; and

logic integrated with and/or executable by the processor, the logic being configured to cause the processor to;

determine a write rate for the media storage device or a portion thereof based on one or more factors, the write rate ranging from zero to a maximum possible write rate for the media storage device or the portion thereof;

determine an overwrite rate for the media storage device or the portion thereof based on the one or more factors;

receive a write request to write data to the media storage device or the portion thereof; and

write the data to the media storage device, wherein portions of the data written to empty blocks of memory on the media storage device are written using the determined write rate, wherein portions of the data written to non-empty blocks of memory on the media storage device are written using the determined overwrite rate.

2. The system as recited in claim 1, wherein the one or more factors comprise an identity of a source of the write request, a particular subset of storage space targeted by the write request, a media storage device that is targeted by the write request, an historical write rate for the particular subset of storage space on the media storage device, an amount of overwriting that has historically taken place due to write requests received from the source of the write request, a time at which the write request is received, and a pattern of write requests received from the source of the write request.

3. The system as recited in claim 1, wherein the logic is further configured to cause the processor to restrict the write rate from an initial value in response to determining an action selected from a group consisting of:

a frequency of write activity on the media storage device or the portion thereof that exceeds a predetermined write frequency threshold, a rate of change resulting from the write request being greater than an historical rate of change for the media storage device or the portion thereof, and the write request being received outside of a time period in which write requests are expected to be received for the media storage device or the portion thereof.

4. The system as recited in claim 1, wherein the logic is further configured to cause the processor to track, over a period of time, a write frequency for non-empty blocks of data on the media storage device or the portion thereof.

5. The system as recited in claim 4, wherein the logic is further configured to cause the processor to:

calculate an historical score for the media storage device or the portion thereof based on the write frequency tracked over the period of time;

calculate an instant score for the write request based on a write frequency resulting from performing the write request; and

restrict the write rate in response to the instant score exceeding the historical score.

6. The system as recited in claim 1, wherein the write rate is determined based, at least in part, on a type of user who issued the write request or historical write rates to the media storage device or the portion thereof exploited by the user who issued the write request.

7. A computer program product comprising a computer readable medium having stored thereon computer readable program instructions executable by a processor to cause the processor to perform a method, the method comprising:

determining a write rate for a media storage device or a portion thereof based on one or more factors, the write rate ranging from zero to a maximum possible write rate for the media storage device or the portion thereof;

determine an overwrite rate for the media storage device or the portion thereof based on the one or more factors;

receiving a write request to write data to the media storage device or the portion thereof; and

writing the data to the media storage device, wherein portions of the data written to empty blocks of memory on the media storage device are written using the determined write rate, wherein portions of the data written to non-empty blocks of memory on the media storage device are written using the determined overwrite rate.

8. The computer program product as recited in claim 7, wherein the one or more factors comprise an identity of a source of the write request, a particular subset of storage space targeted by the write request, a media storage device that is targeted by the write request, an historical write rate for the particular subset of storage space on the media storage device, an amount of overwriting that has historically taken place due to write requests received from the source of the write request, a time at which the write request is received, and a pattern of write requests received from the source of the write request.

9. The computer program product as recited in claim 7, wherein the method further comprises restricting the write rate from an initial value in response to determining an action selected from a group consisting of:

a frequency of write activity on the media storage device or the portion thereof that exceeds a predetermined write frequency threshold, a rate of change resulting from the write request being greater than an historical rate of change for the media storage device or the portion thereof, and the write request being received outside of a time period in which write requests are expected to be received for the media storage device or the portion thereof.

10. The computer program product as recited in claim 7, wherein the method further comprises tracking, over a period of time, a write frequency for non-empty blocks of data on the media storage device or the portion thereof.

11. The computer program product as recited in claim 10, wherein the method further comprises:

calculating an historical score for the media storage device or the portion thereof based on the write frequency tracked over the period of time;

calculating an instant score for the write request based on a write frequency resulting from performing the write request; and

restricting the write rate in response to the instant score exceeding the historical score.

12. The computer program product as recited in claim 7, wherein the write rate is determined based, at least in part, on a type of user who issued the write request or historical write rates to the media storage device or the portion thereof exploited by the user who issued the write request.

13. A computer-implemented method, comprising:

determining a write rate for a media storage device or a portion thereof based on one or more factors, the write rate ranging from zero to a maximum possible write rate for the media storage device or the portion thereof;

determining an overwrite rate for the media storage device or the portion thereof based on the one or more factors;

receiving a write request to write data to the media storage device or the portion thereof; and

writing the data to the media storage device, wherein portions of the data written to empty blocks of memory on the media storage device are written using the determined write rate, wherein portions of the data written to non-empty blocks of memory on the media storage device are written using the determined overwrite rate.

14. The computer-implemented method as recited in claim 13, further comprising:

returning an error indicating that the data cannot be stored in response to determining that the write rate is zero.

15. The computer-implemented method as recited in claim 13, wherein the one or more factors comprise an identity of a source of the write request, a particular subset of storage space targeted by the write request, a media storage device that is targeted by the write request, an historical write rate for the particular subset of storage space on the media storage device, an amount of overwriting that has historically taken place due to write requests received from the source of the write request, a time at which the write request is received, and a pattern of write requests received from the source of the write request.

16. The computer-implemented method as recited in claim 13, further comprising restricting the write rate from an initial value in response to determining an action selected from a group consisting of:

a frequency of write activity on the media storage device or the portion thereof that exceeds a predetermined write frequency threshold, a rate of change resulting from the write request being greater than an historical rate of change for the media storage device or the portion thereof, and the write request being received outside of a time period in which write requests are expected to be received for the media storage device or the portion thereof.

17. The computer-implemented method as recited in claim 13, further comprising:

tracking, over a period of time, a write frequency for non-empty blocks of memory on the media storage device or the portion thereof;

calculating an historical score for the media storage device or the portion thereof based on the write frequency tracked over the period of time;

calculating an instant score for the write request based on a write frequency resulting from performing the write request; and

restricting the write rate in response to the instant score exceeding the historical score.

18. The computer-implemented method as recited in claim 13, wherein the write rate is determined based, at least in part, on a type of user who issued the write request or historical write rates to the media storage device or the portion thereof exploited by the user who issued the write request.