Method for storage system detection and alerting on potential malicious action
AssigneePure Storage, Inc.
InventorChristopher Golden
Life of this patent
Estimating the term…
Abstract
A method of storage system operation, and related computer-readable media and storage system are disclosed. One or more processors or storage system controllers monitor accesses of blocks of storage memory of the storage system. The monitoring is to detect one or more characteristics of the accesses of the blocks. From the characteristic(s), it is determined the one or more accesses of the blocks are indicative of a malicious action. In response to such determining, the storage system performs a reaction action.
Claims20
A method comprising:
- monitoring, by a storage system controller of a storage system that is external to storage memory of the storage system, accesses of blocks of the storage memory of the storage system to detect one or more characteristics of the accesses of the blocks, wherein the storage memory comprises one or more storage devices having erase blocks that are directly mapped by the storage system controller bypasssing an address modification by a storage device controller of the one or more storage devices;
- and
- performing a reaction action in response to the detecting, wherein the reaction action comprises sending an alert from the storage system upon determining, by the storage system controller, from the one or more characteristics that one or more of the accesses of the blocks are indicative of a malicious action.
A non-transitory, computer-readable media having instructions thereupon which, when executed by a storage system controller of a storage system, cause the storage system controller to:
- monitor, by the storage system controller that is external to storage memory of the storage system, accesses of blocks of the storage memory of the storage system to detect one or more characteristics of the accesses of the blocks, wherein the storage memory comprises one or more storage devices having erase blocks that are directly mapped by the storage system controller bypassing an address modification by a storage device controller of the one or more storage devices;
- and
- perform a proactive or recovery action in response to the detecting, wherein to perform the recovery action, the storage system controller to send an alert from the storage system upon determining from the one or more characteristics that one or more of the accesses of the blocks are indicative of a malicious action.
A storage system, comprising:
- storage memory;
- and
- one or more storage system controllers that are external to the storage memory, operatively coupled with the storage memory, to:
- monitor accesses of blocks of the storage memory, based on I/O (input/output) of the storage system, to detect one or more characteristics of the accesses of the blocks, wherein the storage memory comprises one or more storage devices having erase blocks that are directly mapped by the one or more storage system controllers bypassing an address modification by a storage device controller of the one or more storage devices;
- and
- perform a preventive action in response to the detecting, to prevent loss of data, wherein to perform the preventive action, the one or more storage system controllers to reject one or more writes to the blocks of the storage memory upon determining from the one or more characteristics that one or more of the accesses of the blocks are indicative of a malicious action.
Dependencies are inferred from the claim text.