Back to results
US 12,596,792 B2Granted
Data encryption detection
AssigneeHewlett Packard Enterprise Development LP
InventorsAlex Veprinsky, Charles F. Clark, John Blumenthal, Ayman Abouelwafa
Life of this patent
Estimating the term…
Abstract
In some examples, a system applies an inline detection of a write of data in a storage, the inline detection to detect potential data encryption of the data. In response to an indication of the potential data encryption, the system creates a first object that represents a first version of the data, and applies a further analysis to determine whether the potential data encryption constitutes unauthorized data encryption, the further analysis based on the first object and a second object that represents a second version of the data that is prior to the first version of the data.
Claims20
A non-transitory machine-readable storage medium comprising instructions that upon execution cause a system to:
- apply an inline detection of a write of replicated data to a journal that logs writes in a storage system, the inline detection to detect potential data encryption of the replicated data, wherein the replicated data is a copy of data of a write request;
- in response to an indication of the potential data encryption, create a first object that represents a first version of the data of the write request;
- and
- apply a further analysis to determine whether the potential data encryption constitutes unauthorized data encryption, the further analysis comprising:
- calculating a first relative entropy representing a first divergence between the first object and a second object that represents a second version of the data of the write request, the second version created prior to the first version, wherein the first divergence represents a statistical distance between a probability distribution created for the first object and a probability distribution created for the second object;
- determining a write input/output (I/O) pattern from write metadata for the writes, the write I/O pattern comprising one or more of a spatial I/O pattern based on locations of the writes in storage volumes, or a temporal pattern based on timestamps of the writes;
- calculating a second relative entropy representing a second divergence between the determined write I/O pattern and a baseline write I/O pattern, wherein the second divergence represents a statistical distance between a probability distribution created for the determined write I/O pattern and a probability distribution created for the baseline write I/O pattern;
- and
- indicate that the potential data encryption constitutes the unauthorized data encryption responsive to the first relative entropy exceeding a first threshold and the second relative entropy exceeding a second threshold;
- and
- initiate a remediation action to counter the unauthorized data encryption.
8 more elements
A system comprising:
- a hardware processor;
- and
- a non-transitory storage medium storing instructions executable on the hardware processor to:
- apply, using an inline detector, an inline detection of replicated data in a data path to a journal that logs writes to a storage, the inline detection to detect potential data encryption, wherein the replicated data is a copy of data of a write request;
- send, from the inline detector to an object analyzer, an indication of the potential data encryption;
- and
- in response to the indication of the potential data encryption, apply, using the object analyzer, a further analysis to determine whether the potential data encryption constitutes unauthorized data encryption, the further analysis comprising:
- calculating a first relative entropy representing a first divergence between a first object and a second object, the first object representing a first version of the data of the write request created after occurrence of the potential data encryption, and the second object representing a second version of the data of the write request, the second version created prior to the occurrence of the potential data encryption, wherein the first divergence represents a statistical distance between a probability distribution created for the first object and a probability distribution created for the second object,
- determining a write input/output (I/O) pattern from write metadata for the writes, the write I/O pattern comprising one or more of a spatial I/O pattern based on locations of the writes in storage volumes, or a temporal pattern based on timestamps of the writes,
- calculating a second relative entropy representing a second divergence between the determined write I/O pattern and a baseline write I/O pattern, wherein the second divergence represents a statistical distance between a probability distribution created for the determined write I/O pattern and a probability distribution created for the baseline write I/O pattern, and
- indicating that the potential data encryption constitutes the unauthorized data encryption responsive to the first relative entropy exceeding a first threshold and the second relative entropy exceeding a second threshold;
- and
- initiate a remediation action to counter the unauthorized data encryption.
10 more elements
A method executed by a system comprising a hardware processor, the method comprising:
- applying, using an inline detector, an inline detection of replicated data in a first data path to a journal that logs writes to a storage, the inline detection to detect potential data encryption, wherein the replicated data is a copy of data of a write request being written over a separate second data path to the storage;
- sending, from the inline detector to an object analyzer, an indication of the potential data encryption;
- and
- based on the indication of the potential data encryption, applying, using the object analyzer, a further analysis to determine whether the potential data encryption constitutes unauthorized data encryption, the further analysis comprising:
- calculating a first relative entropy representing a first divergence between a first object and a second object, the first object representing a first version of the data of the write request created after occurrence of the potential data encryption, and the second object representing a second version of the data of the write request, the second version created prior to the occurrence of the potential data encryption, wherein the first divergence represents a statistical distance between a probability distribution created for the first object and a probability distribution created for the second object,
- determining a write input/output (I/O) pattern from write metadata for the writes, the write I/O pattern comprising one or more of a spatial I/O pattern based on locations of the writes in storage volumes, or a temporal pattern based on timestamps of the writes,
- calculating a second relative entropy representing a second divergence between the determined write I/O pattern and a baseline write I/O pattern, wherein the second divergence represents a statistical distance between a probability distribution created for the determined write I/O pattern and a probability distribution created for the baseline write I/O pattern, and
- indicating that the potential data encryption constitutes the unauthorized data encryption responsive to the first relative entropy exceeding a first threshold and the second relative entropy exceeding a second threshold;
- and
- initiating a remediation action to counter the unauthorized data encryption.
7 more elements
Dependencies are inferred from the claim text.