SNAPSHOT TAMPERING PREVENTION AND EFFICIENT DATA RESTORE FROM AN UNBREAKABLE SNAPSHOT

Systems and Methods for creating an immutable snapshot of a data volume and restoring the data volume from the immutable snapshot. A snapshot is created. For each file, a checksum is calculated. A string is created by concatenating the checksums in ascending order. That string is input to a linear aggregation method to create an aggregation checksum signature. The aggregation checksum signature, and each checksum along with and its associated file are stored as metadata in the snapshot.

BACKGROUND

This invention relates generally to computer systems, and more particularly to data snapshot integrity.

Immutable snapshots are taken at regular intervals. Whenever data is compromised or a file is deleted or overwritten in error, snapshots are restored to ensure business continuity. In the Virtual Private Cloud (VPC) snapshots are read-only to the client. If an attacker is able to compromise the VPC the attacker may be able to delete a snapshot and continue, for example, by infecting the VPC with malware.

As ransomware attacks are increasing and evolving in sophistication of variants, vectors, and methodology, it would be advantageous to provide an unbreakable snapshot that is resistant to unauthorized alteration, thereby making an efficient recovery strategy possible.

SUMMARY

A system is provided for creating an immutable snapshot of a data volume and restoring the data volume from the immutable snapshot. A snapshot is created. For each file, a checksum is calculated. A string is created by concatenating the checksums in ascending order. That string is input to a linear aggregation method to create an aggregation checksum signature. The aggregation checksum signature, and each checksum along with and its associated file are stored as metadata in the snapshot.

Embodiments are further directed to computer systems and computer program products having substantially the same features as the above-described computer-implemented method.

DETAILED DESCRIPTION OF THE INVENTION

Immutable snapshots of critical data are taken at regular intervals. Whenever data is compromised or a file is deleted or overwritten in error, snapshots are restored to ensure business continuity. In the Virtual Private Cloud (VPC) snapshots are read-only to the client.

If an attacker is able to compromise the VPC the attacker may be able to delete or corrupt a snapshot and continue, for example, by infecting the VPC with malware.

In addition to regularly taking data snapshots, ensuring their integrity is a significant part of a comprehensive recovery strategy. For example, a snapshot can be stored as write-once-read-many times (WORM) media. As another example, time-based key encryption is a common form of two factor authentication, whereby an algorithm generates unique passwords. The password must be correctly entered before the password expires in order to gain access to the protected resource.

In a multi-vendor, multisite storage enterprise, there is a possibility that the data content within a snapshot could be vulnerable to cybersecurity threats. As the number of files in the snapshot increases, so may the snapshot's vulnerability to malicious tampering. Similarly, when snapshots are taken on a frequent schedule, many snapshots may be needed for recovery, thereby increasing the possibility of encountering a compromised snapshot during recovery. When a storage volume is compromised, for example, the snapshots are applied up to the point the storage volume is compromised. Activity that occurred beyond that point is lost.

The present invention protects the integrity of system recovery using snapshots by restoring the data volume from the immutable snapshot. During recovery, the checksums of each of the files are verified against the checksums from when the snapshot was created. If an infected file is identified, the recovery process will replace the infected file with a non-infected alternative file and the recovery is able to continue.

Beginning now withFIG.1, an illustration is presented of the operating environment of a networked computer, according to an embodiment of the present invention.

Computing environment100contains an example of an environment for the execution of at least some of the computer code involved in performing the inventive methods, such as the snapshot tampering prevention and efficient restore (system)200. In addition to block200, computing environment100includes, for example, computer101, wide area network (WAN)102, end user device (EUD)103, remote server104, public cloud105, and private cloud106. In this embodiment, computer101includes processor set110(including processing circuitry120and cache121), communication fabric111, volatile memory112, persistent storage113(including operating system122and block200, as identified above), peripheral device set114(including user interface (UI), device set123, storage124, and Internet of Things (IoT) sensor set125), and network module115. Remote server104includes remote database130. Public cloud105includes gateway140, cloud orchestration module141, host physical machine set142, virtual machine set143, and container set144.

END USER DEVICE (EUD)103is any computer system that is used and controlled by an end user (for example, an administrator that operates computer101), and may take any of the forms discussed above in connection with computer101. For example, EUD103can be the external application by which an end user connects to the control node through WAN102. In some embodiments, EUD103may be a client device, such as thin client, heavy client, mainframe computer, desktop computer and so on.

Turning now toFIG.2, embodiments of the present invention include a cloud storage (primary storage) that is connected to cloud object storage (secondary storage), where the snapshots are stored. Cloud storage comprises non-volatile memory disks, such as flash memory. Each cloud object includes the data, its associated metadata, and an identifier.

The following is an example of syntax that may be used to create, make immutable, and store a snapshot in the cloud object storage:

During the snapshot creation (305), the system200calculates a checksum for each file being backed up. Each of the checksums is stored as metadata along with the file name of the associated file. Following the checksum creation process at the file level, the system200concatenates the created checksums, in ascending order, into a string.

The string is input to the linear aggregation method (310) to calculate an aggregation checksum signature, which is also stored with the individual checksums. The aggregation checksum signature is stored with the snapshot metadata. The aggregation checksum is evidence that the snapshot is immutable and cannot be deleted or further infected (315).

In an example, assume an attacker had injected malware on the original data volume, and recovery from snapshots is required (320). However, when the snapshot required for recovery, snapshot “n, was created, one or more files were already compromised by malware but were included in the snapshot (325,330). After snapshot “n” is restored (325), the data volume is scanned again for infected files (335). If there are no infected files on the data volume, the restore is complete (365). However, if infected files are on the data volume, the system (200) deletes the infected files and replaces each one with a marker (345). All previous snapshots are checked for different versions of the infected file(s) (350). This ensures that all infected versions are removed from the backup data all the way back to the point of the original malware introduction. If any of the snapshots “n-1” back to the parent have a version of the file that is not infected, the system200restores that version of the file (355). After all the required files are restored, the system200performs another consistency scan (360) to ensure that all the infected files have been identified and removed.