US 12,602,473 B1Granted

Using intermediate mappings to prevent data loss from ransomware

AssigneeAmazon Technologies, Inc.

InventorEknath Venkataramani

Life of this patent

Estimating the term…

Loading patent…

Abstract

A storage driver for a storage space (e.g., hard disk volume) may use intermediate mappings for write, create, and delete requests to prevent data loss from ransomware. The storage driver receives a request to overwrite a data item (e.g., file or object) at a first location of a storage space and in response, writes data to a second location of the storage space. The storage driver also generates a write mapping that associates the first location with the second location. At a later point in time, the storage driver may determine whether to commit the request to overwrite the data item. If the storage driver determines not to commit the request to overwrite the data item (due to the data being the result of a ransomware attack), then the storage driver deletes the write mapping, preventing the first location from being overwritten (preventing data loss from a ransomware attack).

Claims20

Dependent claims

A system, comprising:

one or more processors and one or more memories, wherein the one or more memories have stored thereon instructions, which when executed by the one or more processors, cause the one or more processors to implement a storage service for a plurality of clients of a provider network, wherein the storage service is configured to:
process an overwrite request to overwrite an existing data item located at a first location of a storage space with a new data item indicated by the overwrite request by:
writing the new data item to a second location of the storage space;
generating an intermediate write mapping that associates the first location of the existing data item with the second location that the new data item was written to based on the overwrite request to overwrite the existing data item;
storing the intermediate write mapping to enable the storage service to serve read requests for the existing data item with the new data item;
determining whether to commit the overwrite request to overwrite the existing data;
and
in response to determining to commit the overwrite request to overwrite the existing data item at the first location with the new data item indicated by the overwrite request:
overwriting the existing data item at the first location with the new data item that was previously stored at the second location based on reception of the overwrite request to overwrite the existing data item and delete the intermediate write mapping that indicates an association between the first location of the existing data item and the second location that the new data item was written to, or
updating data item location information of the existing data item to indicate the second location that the new data item was previously stored at based on reception of the overwrite request instead of the first location of the existing data item, deleting the existing data item at the first location, and deleting the intermediate write mapping that indicates the association between the first location of the existing data item and the second location that the new data item was previously stored at based on the reception of the overwrite request;
and
in response to determining not to commit the overwrite request:
deleting the new data item and the intermediate write mapping.

10 more elements

A method, comprising:

performing, by a storage driver implemented by one or more computing devices:
receiving an overwrite request to overwrite an existing data item at a first location of a storage space with a new data item indicated by the overwrite request;
in response to receiving the overwrite request:
writing the new data item to a second location of the storage space;
generating an intermediate write mapping that associates the first location of the existing data item with the second location that the new data item was written to based on the overwrite request to overwrite the existing data item;
and
storing the intermediate write mapping;
determining to commit the overwrite request;
and
in response to determining to commit the overwrite request to overwrite the existing data item at the first location with the new data item indicated by the overwrite request:
overwriting the existing data item at the first location with the new data item that was previously stored at the second location based on reception of the overwrite request to overwrite the existing data item and deleting the intermediate write mapping that indicates an association between the first location of the existing data item and the second location that the new data item was written to, or
updating data item location information of the existing data item to indicate the second location that the new data item was previously stored at based on reception of the overwrite request instead of the first location of the existing data item, deleting the existing data item at the first location, and deleting the intermediate write mapping that indicates the association between the first location of the existing data item and the second location that the new data item was previously stored at based on the reception of the overwrite request.

9 more elements

One or more non-transitory computer-accessible storage media storing program instructions that when executed on or across one or more processors cause the one or more processors to:

receive a delete request to delete an existing data item at a particular location of a storage space;
in response to reception of the delete request:
generate an intermediate delete mapping, wherein the intermediate delete mapping associates the particular location of the storage space indicated by the previously received delete request with the previously received delete request;
and
store the intermediate delete mapping;
determine to commit the delete request;
and
in response to the determination to commit the delete request to delete the existing data item at the particular location:
delete the existing data item at the particular location;
and
delete the intermediate delete mapping that indicates an association between the particular location of the data item indicated by the previously received delete request and the previously received delete request.

8 more elements

Dependencies are inferred from the claim text.