Back to results
US 12,585,766 B2Granted
Intermittent encryption attack
AssigneeHewlett Packard Enterprise Development LP
InventorsOmer Uretzky, Gil Barash
Life of this patent
Estimating the term…
Abstract
In some examples, a system identifies, from among a plurality of input/output (I/O) operations with a storage system, a subset of I/O operations involving encrypted data segments of a given data size. The system computes a measure based on a quantity of the I/O operations in the subset of I/O operations involving the encrypted data segments of the given data size. Based on the measure, the system determines whether an intermittent encryption attack is occurring with respect to the storage system.
Claims18
A non-transitory machine-readable storage medium comprising instructions that upon execution cause a system to:
- identify, from among a plurality of input/output (I/O) operations with a storage system, a collection of I/O operations involving data segments of a first data size;
- determine whether a quantity of I/O operations in the collection of I/O operations involving the data segments of the first data size exceeds a quantity of I/O operations involving data segments of a second data size by greater than a specified margin;
- and
- responsive to determining that the quantity of I/O operations in the collection of I/O operations involving the data segments of the first data size exceeds the quantity of I/O operations involving the data segments of the second data size by greater than the specified margin:
- identify, in the collection of I/O operations, a subset of I/O operations involving encrypted data segments of the first data size, wherein the collection of I/O operations involving the data segments of the first data size comprises the subset of I/O operations involving the encrypted data segments of the first data size, and I/O operations involving unencrypted data segments of the first data size;
- compute a measure based on a ratio between a quantity of the I/O operations in the subset of I/O operations involving the encrypted data segments of the first data size and a total quantity of I/O operations in the collection of I/O operations;
- and
- determine, based on the measure, whether an intermittent encryption attack is occurring with respect to the storage system.
5 more elements
A system comprising:
- a hardware processor;
- and
- a non-transitory storage medium storing instructions executable on the hardware processor to:
- identify, from among a plurality of input/output (I/O) operations with a storage system, a first collection of I/O operations involving data segments of a first data size;
- determine whether a quantity of I/O operations in the first collection of I/O operations involving the data segments of the first data size exceeds a quantity of I/O operations involving data segments of a second data size by greater than a specified margin;
- and
- responsive to determining that the quantity of I/O operations in the first collection of I/O operations involving the data segments of the first data size exceeds the quantity of I/O operations involving the data segments of the second data size by greater than the specified margin:
- identify, from the first collection of I/O operations, a first subset of I/O operations involving encrypted data segments of the first data size, wherein the first collection of I/O operations comprises the first subset of I/O operations involving the encrypted data segments of the first data size, and a second subset of I/O operations involving unencrypted data segments of the first data size;
- compute a measure based on a ratio between a first quantity of the I/O operations in the first subset of I/O operations involving the encrypted data segments of the first data size, and a total quantity of the I/O operations in the first collection of I/O operations;
- and
- determine, based on the measure, whether an intermittent encryption attack is occurring with respect to the storage system.
8 more elements
A method comprising:
- monitoring, by a system comprising a hardware processor, a plurality of input/output (I/O) operations that involve writes of data segments to a storage system;
- identifying, by the system from among the plurality of I/O operations, a collection of I/O operations involving data segments of a first data size;
- determining, by the system, whether a quantity of I/O operations in the collection of I/O operations involving the data segments of the first data size exceeds a quantity of I/O operations involving data segments of a second data size by greater than a specified margin;
- and
- based on determining that the quantity of I/O operations in the collection of I/O operations involving the data segments of the first data size exceeds the quantity of I/O operations involving the data segments of the second data size by greater than the specified margin:
- identifying, by the system from the collection of I/O operations, a first subset of I/O operations involving encrypted data segments of the first data size, wherein the collection of I/O operations comprises the first subset of I/O operations involving the encrypted data segments of the first data size, and a second subset of I/O operations involving unencrypted data segments of the first data size;
- computing, by the system, a measure based on a ratio between a first quantity of the I/O operations in the first subset of I/O operations involving the encrypted data segments of the first data size, and a total quantity of the I/O operations in the collection of I/O operations;
- and
- determining, by the system based on the measure, whether an intermittent encryption attack is occurring with respect to the storage system.
6 more elements
Dependencies are inferred from the claim text.