FILE SYSTEM LEVEL DATA PROTECTION DURING POTENTIAL SECURITY BREACH

• US 20140325616A1
• Filed: 04/30/2013
• Published: 10/30/2014
• Est. Priority Date: 04/30/2013
• Status: Active Grant

• Current Assignee: Globalfoundries US Incorporated (GlobalFoundries, Inc.)
• Original Assignee: International Business Machines Corporation
• Inventors: Dolph, Blaine H., Patil, Sandeep R., Shiraguppi, Riyazahamad M., Sivakumar, Gandhi, Trevathan, Matthew B.
• Granted Patent: US 9,069,955 B2
• Time in Patent Office: Days
• US Class Current: 726/5
• CPC Class Codes: G06F 16/128 Details of file system snapshots on the file-level, e.g. snapshot creation, administration, deletion use of snapshots for error detection or correction G06F11/14, G06F11/16
• CPC Class Codes: G06F 21/55 Detecting local intrusion or implementing counter-measures
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: G06F 21/64 Protecting data integrity, e.g. using checksums, certificates or signatures
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/14 for detecting or protecting against malicious traffic

Abstract

Immediately upon identifying a potential breach to a file system, a read-only snapshot of one or more file sets of data stored on a storage volume of the file system is created, and one or more file system protection commands are invoked that restrict access to the snapshot of the file set. Generating the snapshot and restricting access to the snapshot data may include immediately opening an administrative shell for the file-system in response to identifying a potential breach, and executing administrative shell commands that invoke creation of snapshot and limit access of the snapshot data to an administrator or super user.

Claims

1. A method for creating a data snapshot and executing file system protection-specific commands to protect data and limit access of the snapshotted data upon suspicion of a potential security breach, the method comprising:

in response to identifying a potential breach to a file system, immediately;

generating a read-only snapshot of at least one file set of data that is stored on a storage volume of the file system; and

invoking at least one file system protection command that restricts access to the snapshot of the at least one file set of data.

3. The method of claim 1, wherein the step of invoking the at least one file system protection command that restricts access to the protected snapshot of the at least one file set of data further comprises:

detecting a user credential associated with the suspected breach;

extracting from an authentication server a user identification indicia and a group identification indicia for the user that is associated with the suspected breach;

referring to an access table of the file system to identify a plurality of file sets stored within system storage resources to which the user identification indicia and the group identification indicia have write access and which comprises the at least one file set of snapshotted data; and

invoking a file system protection that restricts access to the identified file sets stored within system storage resources to which the user identification indicia and the group identification indicia have write access, by any user with the user identification indicia and the group identification indicia.

4. The method of claim 1, wherein the step of immediately generating the read-only snapshot of the at least one file set of data that is stored on the storage volume of the file system comprises:

generating a logical copy-on-write snapshot comprising a set of reference pointers to an original copy of data stored on the storage volume of the file system.

5. The method of claim 1, wherein the step of immediately generating the read-only snapshot of the at least one file set of data that is stored on the storage volume of the file system comprises:

generating a logical redirect-on-write snapshot comprising a set of reference pointers to an original copy of data stored on the storage volume of the file system, wherein new writes to an original volume are redirected to another location set aside for the redirect-on-write snapshot.

6. The method of claim 1, further comprising:

integrating computer-readable program code into a computer system comprising a processing unit, a computer readable memory and a computer readable tangible storage medium;

wherein the computer readable program code is embodied on the computer readable tangible storage medium and comprises instructions that, when executed by the processing unit via the computer readable memory, cause the processing unit to perform the steps of immediately generating the read-only snapshot of the at least one file set of data that is stored on the file system storage volume, and invoking the at least one file system protection command that restricts access to the snapshot of the at least one file set of data, in response to identifying the potential breach to the file system.

7. The method of claim 1, further comprising:

using the snapshot to roll a current state of the file system data back to a previous data copy of the file set that belongs to the user identification indicia and the group identification indicia associated with the potential breach.

8. The method of claim 7, further comprising:

restoring data within the at least one file set of the snapshot by rewriting sectors that were modified since the snapshot was generated.

2. The method of claim 2, wherein the steps of generating the read-only snapshot of at least one file set of data stored on the storage volume of the file system, and invoking the at least one file system protection command that restricts access to the snapshot of the at least one file set of data, further comprises:

opening an administrative shell for the file-system immediately in response to the identifying the potential breach to the file system;

executing an administrative shell snapshot command that invokes the creation of the generated snapshot of the file system; and

executing an administrative shell file system protection-specific command that limits access of the data of the snapshot of the at least one file set of data to an administrator, or to a super user that has a higher level of security access than a user of the file system.

9. A system, comprising:

a processing unit in communication with a computer readable memory and a tangible computer-readable storage medium;

wherein the processing unit, when executing program instructions comprising at least one file system protection command and stored on the tangible computer-readable storage medium via the computer readable memory, in response to identifying a potential breach to a file system, immediately;

generates a read-only snapshot of at least one file set of data that is stored on a storage volume of the file system; and

restricts access to the snapshot of the at least one file set of data.

10. The system of claim 9, wherein the processing unit, when executing the program instructions stored on the computer-readable storage device via the computer readable memory, generates the read-only snapshot of the at least one file set of data stored on the file system storage volume, and restricts access to the snapshot of the at least one file set of data, by:

opening an administrative shell for the file-system immediately in response to the identifying the potential breach to the file system;

executing an administrative shell snapshot command that invokes the creation of the generated snapshot of the file system; and

executing an administrative shell file system protection-specific command that limits access of the data of the snapshot of the at least one file set of data to an administrator, or to a super user that has a higher level of security access than a user of the file system.

11. The system of claim 9, wherein the processing unit, when executing the program instructions stored on the computer-readable storage device via the computer readable memory, restricts access to the snapshot of the at least one file set of data by:

detecting a user credential associated with the suspected breach;

extracting from an authentication server a user identification indicia and a group identification indicia for the user that is associated with the suspected breach;

referring to an access table of the file system to identify a plurality of file sets stored within system storage resources to which the user identification indicia and the group identification indicia have write access and which comprises the at least one file set of snapshotted data; and

restricting access to the identified file sets stored within system storage resources to which the user identification indicia and the group identification indicia have write access, by any user with the user identification indicia and the group identification indicia.

12. The system of claim 9, wherein the processing unit, when executing the program instructions stored on the computer-readable storage device via the computer readable memory, generates the snapshot as a logical copy-on-write snapshot comprising a set of reference pointers to an original copy of data stored on the storage volume of the file system.

13. The system of claim 9, wherein the processing unit, when executing the program instructions stored on the computer-readable storage device via the computer readable memory:

generates the snapshot as a logical redirect-on-write snapshot comprising a set of reference pointers to an original copy of data stored on the storage volume of the file system; and

redirects new writes to an original volume to another location set aside for the redirect-on-write snapshot.

14. The system of claim 9, wherein the processing unit, when executing the program instructions stored on the computer-readable storage device via the computer readable memory, further:

uses the snapshot to roll a current state of the file system data back to a previous data copy of the file set that belongs to the user identification indicia and the group identification indicia associated with the potential breach.

15. The system of claim 9, wherein the processing unit, when executing the program instructions stored on the computer-readable storage device via the computer readable memory, further:

restores data within the file sets by rewriting sectors that were modified since the snapshot was generated.

16. A computer program product for generating a data snapshot and protecting the data snapshot upon a potential, suspected breach of a file system, the computer program product comprising:

a computer readable tangible storage medium having computer readable program code embodied therewith, the computer readable program code comprising instructions comprising at least one file system protection command that, when executed by a computer processing unit, cause the computer processing unit to, in response to identifying a potential breach to a file system, immediately;

generate a read-only snapshot of at least one file set of data that is stored on a storage volume of the file system; and

restrict access to the snapshot of the at least one file set of data.

17. The computer program product of claim 16, wherein the computer readable program code instructions, when executed by the computer processing unit, further cause the computer processing unit to generate the read-only snapshot of the at least one file set of data stored on the file system storage volume, and restrict access to the snapshot of the at least one file set of data, by:

opening an administrative shell for the file-system immediately in response to the identifying the potential breach to the file system;

executing an administrative shell snapshot command that invokes the creation of the generated snapshot of the file system; and

executing an administrative shell file system protection-specific command that limits access of the data of the snapshot of the at least one file set of data to an administrator, or to a super user that has a higher level of security access than a user of the file system.

18. The computer program product of claim 16, wherein the computer readable program code instructions, when executed by the computer processing unit, further cause the computer processing unit to restrict access to the snapshot of the at least one file set of data by:

detecting a user credential associated with the suspected breach;

extracting from an authentication server a user identification indicia and a group identification indicia for the user that is associated with the suspected breach;

referring to an access table of the file system to identify a plurality of file sets stored within system storage resources to which the user identification indicia and the group identification indicia have write access and which comprises the at least one file set of snapshotted data; and

restricting access to the identified file sets stored within system storage resources to which the user identification indicia and the group identification indicia have write access, by any user with the user identification indicia and the group identification indicia.

19. The computer program product of claim 16, wherein the computer readable program code instructions, when executed by the computer processing unit, further cause the computer processing unit to generate the snapshot as a logical copy-on-write snapshot comprising a set of reference pointers to an original copy of data stored on the storage volume of the file system.

20. The computer program product of claim 16, wherein the computer readable program code instructions, when executed by the computer processing unit, further cause the computer processing unit to:

generate the snapshot as a logical redirect-on-write snapshot comprising a set of reference pointers to an original copy of data stored on the storage volume of the file system; and

redirect new writes to an original volume to another location set aside for the redirect-on-write snapshot.