Selective control of a data synchronization setting of a storage system based on a possible ransomware attack against the storage system

Patent metadata

Field	Value
Publication number	US-12050683-B2
Application number	US-202117506501-A
Country	US
Kind code	B2
Filing date	Oct 20, 2021
Priority date	Nov 22, 2019
Publication date	Jul 30, 2024
Grant date	Jul 30, 2024

Abstract

An illustrative method includes determining, by a data protection system, that a dataset stored by a first storage system is possibly being targeted by a security threat while a data synchronization setting for the first storage system is enabled such that the dataset stored by the first storage system is synchronously replicated to a second storage system; and disabling, by the data protection system based on the determining that the dataset stored by the first storage system is possibly being targeted by the security threat, the data synchronization setting to prevent the dataset stored by the first storage system from being synchronously replicated to the second storage system.

First claim

What is claimed is:

1. A method comprising:
determining, by a data protection system, that a dataset stored by a first storage system is possibly being targeted by a security threat while a data synchronization setting for the first storage system is enabled such that the dataset stored by the first storage system is synchronously replicated to a second storage system;
detecting, by the data protection system, a request to perform a write operation with respect to the first storage system while the data synchronization setting is enabled;
directing, by the data protection system, the first storage system to abstain from performing the write operation for a predetermined time period;
determining, by the data protection system prior to completion of the predetermined time period, that the request is associated with the security threat;
preventing, by the data protection system, the first storage system from performing the write operation; and
disabling, by the data protection system based on the determining that the dataset stored by the first storage system is possibly being targeted by the security threat, the data synchronization setting to prevent the dataset stored by the first storage system from being synchronously replicated to the second storage system.

2. The method of claim 1 , further comprising performing, by the data protection system based on the determining that the dataset stored by the first storage system is possibly being targeted by the security threat, one or more additional remedial actions with respect to the dataset stored by the first storage system.

3. The method of claim 2 , wherein the one or more additional remedial actions comprise one or more of:
directing the first storage system to generate a first recovery dataset for the dataset stored by the first storage system; or
directing the second storage system to generate a second recovery dataset for dataset stored by the second storage system.

4. The method of claim 3 , further comprising using one or more of the first recovery dataset or the second recovery dataset to perform a data recovery operation with respect to the dataset stored by the first storage system.

5. The method of claim 1 , further comprising using data stored by the second storage system to perform a data recovery operation with respect to the dataset stored by the first storage system.

6. The method of claim 1 , further comprising:
determining, by the data protection system, that the dataset stored by the first storage system is no longer possibly being targeted by the security threat; and
enabling, by the data protection system based on the determining that the dataset stored by the first storage system is no longer possibly being targeted by the security threat, the data synchronization setting.

7. The method of claim 1 , wherein the determining that the dataset stored by the first storage system is possibly being targeted by a security threat is performed using a machine learning model.

8. A system comprising:
a memory storing instructions; and
a processor communicatively coupled to the memory and configured to execute the instructions to:
determine that a dataset stored by a first storage system is possibly being targeted by a security threat while a data synchronization setting for the first storage system is enabled such that the dataset stored by the first storage system is synchronously replicated to a second storage system;
detect a request to perform a write operation with respect to the first storage system while the data synchronization setting is enabled;
direct the first storage system to abstain from performing the write operation for a predetermined time period;
determine, prior to completion of the predetermined time period, that the request is associated with the security threat;
prevent the first storage system from performing the write operation; and
disable, based on the determining that the dataset stored by the first storage system is possibly being targeted by the security threat, the data synchronization setting to prevent the dataset stored by the first storage system from being synchronously replicated to the second storage system.

9. The system of claim 8 , wherein the processor is further configured to execute the instructions to perform, based on the determining that the dataset stored by the first storage system is possibly being targeted by the security threat, one or more additional remedial actions with respect to the dataset stored by the first storage system.

10. The system of claim 9 , wherein the one or more additional remedial actions comprise one or more of:
directing the first storage system to generate a first recovery dataset for the dataset stored by the first storage system; or
directing the second storage system to generate a second recovery dataset for dataset stored by the second storage system.

11. The system of claim 10 , wherein the processor is further configured to execute the instructions to use one or more of the first recovery dataset or the second recovery dataset to perform a data recovery operation with respect to the dataset stored by the first storage system.

12. The system of claim 8 , wherein the processor is further configured to execute the instructions to use data stored by the second storage system to perform a data recovery operation with respect to the dataset stored by the first storage system.

13. The system of claim 8 , wherein the processor is further configured to execute the instructions to:
determine that the dataset stored by the first storage system is no longer possibly being targeted by the security threat; and
enable, based on the determining that the dataset stored by the first storage system is no longer possibly being targeted by the security threat, the data synchronization setting.

14. A non-transitory computer-readable medium storing instructions that, when executed, direct a processor of a computing device to:
determine that a dataset stored by a first storage system is possibly being targeted by a security threat while a data synchronization setting for the first storage system is enabled such that the dataset stored by the first storage system is synchronously replicated to a second storage system;
detect a request to perform a write operation with respect to the first storage system while the data synchronization setting is enabled;
direct the first storage system to abstain from performing the write operation for a predetermined time period;
determine, prior to completion of the predetermined time period, that the request is associated with the security threat;
prevent the first storage system from performing the write operation; and
disable, based on the determining that the dataset stored by the first storage system is possibly being targeted by the security threat, the data synchronization setting to prevent the dataset stored by the first storage system from being synchronously replicated to the second storage system.

15. The non-transitory computer-readable medium of claim 14 , wherein the instructions further direct the processor to perform, based on the determining that the dataset stored by the first storage system is possibly being targeted by the security threat, one or more additional remedial actions with respect to the dataset stored by the first storage system.

16. The non-transitory computer-readable medium of claim 15 , wherein the one or more additional remedial actions comprise one or more of:
directing the first storage system to generate a first recovery dataset for the dataset stored by the first storage s

Assignees

• Pure Storage Inc

Inventors

• Rokade Arun
• Karr Ronald

Classifications

• G06F21/566

  Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities · CPC title

• G06F21/568

  eliminating virus, restoring damaged files · CPC title

• G06F21/52

  during program execution, e.g. stack integrity {; Preventing unwanted data erasure; Buffer overflow} · CPC title

• G06F3/0622

  in relation to access · CPC title

• G06F3/065

  Replication mechanisms · CPC title