System and method for maintaining server data integrity

• US 8,806,617 B1
• Filed: 08/09/2007
• Issued: 08/12/2014
• Est. Priority Date: 10/14/2002
• Status: Active Grant

• Current Assignee: Cimcor, Inc.
• Original Assignee: Cimcor, Inc.
• Inventors: Johnson, Robert E. III
• Primary Examiner(s): DADA, BEEMNET W
• Application Number:
  US11/836,446
• Time in Patent Office: 2,560 Days
• Field of Search: 713/193, 713/189, 726/32, 726/33, 726/22, 726/23, 726/24, 726/30, 707/634, 707/E17.001
• US Class Current: 726/22
• CPC Class Codes: G06F 11/00 Error detection; Error correction; Monitoring error detection, correction or monitoring in information storage based on relative movement between record carrier and transducer G11B20/18; monitoring, i.e. supervising the progress of recording or reproducing G11B27/36; in static stores G11C29/00
• CPC Class Codes: G06F 11/1456 Hardware arrangements for backup
• CPC Class Codes: G06F 11/1464 for networked environments
• CPC Class Codes: G06F 11/1469 Backup restoration techniques
• CPC Class Codes: G06F 11/3034 where the computing system component is a storage system, e.g. DASD based or network based digital input from or digital output to record carriers G06F3/06; digital recording or reproducing G11B20/18; for distributed storage of data in networks, e.g. transport arrangements for network file system [NFS], storage area networks [SAN] or network attached storage [NAS], H04L67/1097
• CPC Class Codes: G06F 11/3055 Monitoring arrangements for monitoring the status of the computing system or of the computing system component, e.g. monitoring if the computing system is on, off, available, not available error or fault processing without redundancy G06F11/0703; error detection or correction by redundancy in data representation G06F11/08; error detection or correction by redundancy in operation G06F11/14; error detection or correction by redundancy in hardware G06F11/16
• CPC Class Codes: G06F 11/3409 for performance assessment
• CPC Class Codes: G06F 21/00 Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
• CPC Class Codes: G06F 2201/82 Solving problems relating to consistency ensuring consistency in mirrored systems G06F11/2064
• CPC Class Codes: G06F 2201/84 Using snapshots, i.e. a logical point-in-time copy of the data

Abstract

The System Integrity Guardian can protect any type of object and repairs and restores the system back to its original state of integrity. The Client component is the user interface for administering the System Integrity Guardian environment. An administrator can determine which servers to protect, which objects to protect, and what actions will be taken when an event that breaches integrity occurs. The Monitor Agent component is the watchdog of the System Integrity Guardian that captures and addresses any event that occurs on any object being protected. The Server component includes the server and the Protected Object Central Repository. The authoritative copies are maintained, digital signatures are created and stored, objects are validated, and communication between the three units is performed.

Claims

1. A system comprising:

a repository interface operative to make a copy of an original object and to store the object copy in a safe object storage, wherein the original object resides on a first server and the safe object storage resides a second server remote from the first server;

a monitor agent interface operative to monitor the original object to detect a change in real time and send a notification to the repository interface when the change is detected; and

wherein said repository interface is further operative to receive the notification from the monitor agent interface, determine that the change to the original object was unauthorized, and restore the original object on the first server using the object copy from the safe object storage in response to the change;

wherein the repository interface is further operative to retain a copy of the changed object that can be reviewed after the object copy is restored from the safe object storage.

2. The system of claim 1, wherein said repository interface determines that the change to the original object was unauthorized at least in part-by comparing a digital signature of the object after the change with a digital signature of the object copy.

3. The system of claim 1, wherein the object copy includes a unique digital signature of the original object and a compressed snapshot of the original object.

4. The system of claim 1, wherein the monitor agent interface resides on a computer and the original object being monitored resides on a device.

5. The system of claim 4, wherein the device is a router.

6. The system of claim 4, wherein the device is a firewall.

7. The system of claim 1, wherein the monitor agent interface resides on a same computer as the original object.

8. The system of claim 1, wherein the monitor agent interface resides on a different computer than the original object.

9. The system of claim 1, wherein the original object is part of a web site that resides on a web server.

10. The system of claim 1, wherein the original object is a file residing on a file server.

11. The system of claim 1, wherein the original object is part of a DNS database.

12. The system of claim 1, wherein the original object is part of a database.

13. The system of claim 1, wherein the repository interface is further operative to send a notification to a user indicating that the unauthorized change to the object occurred and that the object copy was automatically restored from the safe object storage.

14. The system of claim 1, further comprising:

a client interface operative to allow a user to select the original object to indicate the object is to be protected.

15. The system of claim 14, wherein the client interface is a graphical user interface.

16. The system of claim 14, wherein the client interface is a command line utility.

17. The system of claim 1, wherein the original object is a directory containing of a plurality of files, and wherein the object copy includes a copy of the plurality of files.

18. The system of claim 1, wherein the repository interface is further operative to provide retrieval of the object copy from the safe object storage and to restore the object copy to a new location.

19. The system of claim 18, wherein the restoration to the new location is performed in a disaster recovery situation.

20. A method comprising:

receiving a selection of at least one object to be protected;

generating a baseline copy of the object and storing the baseline copy in a safe object storage, wherein the at least one object resides on a first server and the safe object storage resides a second server remote from the first server;

monitoring the object in real time;

detecting an unauthorized modification to the object in real time;

in response to detecting the unauthorized modification, retrieving the baseline copy of the object from the safe object storage; and

replacing the modified object on the first server with the baseline copy of the object.

21. The method of claim 20, wherein the baseline copy includes a digital signature of the object and a compressed snapshot of the object.

22. The method of claim 20, wherein said detecting the unauthorized modification is determined at least in part-by comparing a digital signature of the modified object with a digital signature of the baseline copy.

23. The method of claim 20, wherein the object to be protected is a file residing on the first server.

24. The method of claim 20, wherein the object to be protected is a directory containing a plurality of files.

25. The method of claim 20, wherein the object to be protected is a file residing on a device.

26. The method of claim 25, wherein the device is a firewall.

27. The method of claim 25, wherein the device is a router.

28. The method of claim 20, further comprising:

sending a notification to a user to indicate that the unauthorized modification occurred and that the baseline copy was automatically restored.

29. The method of claim 28, wherein the notification is sent by a communication mechanism selected from the group consisting of email, internal messaging, and web paging.

30. A method comprising:

storing remotely in a safe object storage a copy of a plurality of objects from at least one directory to be protected, wherein the directory resides on a first server and the safe object storage resides a second server remote from the first server;

detecting a modification to the directory in real time;

determining, in real time, if the modification was made to one of the objects from the directory and for which a copy is stored in the safe object storage, and if so, restoring the modified object on the first server using the copy of the corresponding object from the safe object storage; and

determining, in real time, if the modification included adding a new file to the directory that is not stored in the safe object storage, and if so, deleting the added file from the directory.

31. The method of claim 30, wherein the objects are files residing on a computer.

32. The method of claim 31, wherein the computer is a web server.

33. The method of claim 30, wherein the objects are entries in a database and wherein the directory to be protected is the database.

34. The method of claim 30, wherein the objects are configuration files on a network device.