Moving target defenses for data storage devices

• US 10,552,607 B2
• Filed: 08/03/2017
• Issued: 02/04/2020
• Est. Priority Date: 08/03/2017
• Status: Active Grant

• Current Assignee: NexiTech, Inc.
• Original Assignee: NexiTech, Inc.
• Inventors: Matthews, Donald E.
• Primary Examiner(s): Tabor, Amare F
• Application Number:
  US15/668,127
• Publication Number:
  US 20190042742A1
• Time in Patent Office: 915 Days
• Field of Search: 726 23
• CPC Class Codes: G06F 21/53 by executing in a restricted environment, e.g. sandbox or secure virtual machine
• CPC Class Codes: G06F 21/552 involving long-term monitoring or reporting
• CPC Class Codes: G06F 21/556 involving covert channels, i.e. data leakage between processes inhibiting the analysis of circuitry or operation with measures against power attack G06F21/755
• CPC Class Codes: G06F 21/566 Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities
• CPC Class Codes: G06F 21/78 to assure secure storage of data address-based protection against unauthorised use of memory G06F12/14; record carriers for use with machines and with at least a part designed to carry digital markings G06K19/00
• CPC Class Codes: H04L 63/0236 Filtering by address, protocol, port number or service, e.g. IP-address or URL
• CPC Class Codes: H04L 63/0272 Virtual private networks
• CPC Class Codes: H04L 63/083 using passwords cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 63/162 at the data link layer
• CPC Class Codes: H04L 63/18 using different networks or channels, e.g. using out of band channels cryptographic mechanisms or cryptographic arrangements for key distribution involving distinctive intermediate devices or communication paths H04L9/0827; cryptographic mechanisms or cryptographic arrangements for authentication using a plurality of channels H04L9/3215
• CPC Class Codes: H04L 67/1097 for distributed storage of data in networks, e.g. transport arrangements for network file system [NFS], storage area networks [SAN] or network attached storage [NAS]

Abstract

Systems and methods for actively securing data storage devices utilize the technique of storage virtualization. In embodiments, would-be cyberattackers are presented with many possible “ports” or “channels” by which to communicate over a network with a data storage device. Unknown to the attacker, at any given time, only one of these ports or channels is the “correct,” or “active,” port; all of the other ports are dummies that do not permit communication with the storage device. The active port is dynamically, randomly, and/or continually reconfigured, seriously impeding the ability of the attacker to access the data storage device through the active port.

Claims

1. A moving target defense system for at least one data storage device, comprising:

the at least one data storage device;

a host computer, comprising a storage communications protocol initiator, an advanced storage programming interface (ASPI), a moving target defense framework (MTDF), and an authorized application, wherein the ASPI selectively enables the MTDF and the authorized application to send read and/or write commands to the at least one data storage device, wherein the MTDF comprises an MTDF library that is utilized by the authorized application; and

a storage appliance, comprising a storage communications protocol target, a device plug-in module, and MTDF extensions, wherein the device plug-in module emulates the at least one data storage device and provides the emulation to the storage communications protocol initiator, wherein the MTDF extensions mirror the MTDF library,

wherein, during a session initiated by a user of the host computer and based on at least one algorithm embodied in the MTDF library, the storage communications protocol target presents a plurality of logical unit numbers (LUNs) to the storage communications protocol initiator, wherein the plurality of LUNs comprises an active LUN assigned to the at least one storage device by a storage communications protocol and at least one dummy LUN, wherein the active LUN is known to the ASPI, the MTDF, and the authorized application,

wherein, after the user-initiated session terminates and based on the at least one algorithm, at least one of the device plug-in module and MTDF extensions randomly changes the LUN assigned to the at least one data storage device by the storage communications protocol target.

2. The moving target defense system of claim 1, wherein the storage communications protocol is selected from the group consisting of ATA, SATA, eSATA, NVMe, NVMe-oF, SCSI, iSCSI, SAS, USB, USB 3.0, IEEE 1394, Fibre Channel, ATA over Ethernet (AoE), and HyperSCSI.

3. The moving target defense system of claim 1, wherein the at least one data storage device is interconnected to the storage appliance in a direct-attached storage (DAS) arrangement.

4. The moving target defense system of claim 3, wherein the storage communications protocol is an SCSI protocol.

5. The moving target defense system of claim 1, wherein the at least one data storage device is interconnected to the storage appliance in a storage area network (SAN) arrangement.

6. The moving target defense system of claim 5, wherein the storage communications protocol is selected from the group consisting of a Fibre Channel protocol and an iSCSI protocol.

7. The moving target defense system of claim 1, wherein at least one of the device plug-in module and the MTDF extensions is configured to detect and log at least one attempt to access the at least one data storage device via a dummy LUN.

8. The moving target defense system of claim 7, wherein, after the at least one attempt, the device plug-in module and the MTDF extensions allow further commands to be sent to the at least one data storage device from the host computer via the storage appliance.

9. The moving target defense system of claim 7, wherein, after the at least one attempt, the device plug-in module and the MTDF extensions prevent further commands from being sent to the at least one data storage device from the host computer via the storage appliance.

10. The moving target defense system of claim 1, wherein the system implements at least one additional data storage security technique.

11. The moving target defense system of claim 10, wherein the at least one additional data storage security technique is selected from the group consisting of CHAP and IPsec.