Moving target defenses for data storage devices
AssigneeNexiTech, Inc.
InventorDonald E. Matthews
Life of this patent
Estimating the term…
Abstract
Systems and methods for actively securing data storage devices utilize the technique of storage virtualization. In embodiments, would-be cyberattackers are presented with many possible “ports” or “channels” by which to communicate over a network with a data storage device. Unknown to the attacker, at any given time, only one of these ports or channels is the “correct,” or “active,” port; all of the other ports are dummies that do not permit communication with the storage device. The active port is dynamically, randomly, and/or continually reconfigured, seriously impeding the ability of the attacker to access the data storage device through the active port.
Claims21
A moving target defense method for securing at least one data storage device, comprising:
- changing, within a storage appliance, a device type of the at least one data storage device from “disk” to “unknown;”
- obfuscating a command set for the at least one data storage device inside the storage appliance;
- after a command is sent to the at least one data storage device from a host computer via the storage appliance, re-obfuscating the command set and reconfiguring a communications channel between the storage appliance and the at least one data storage device;
- and
- statically linking an interface library on the host computer to an authorized application on the host computer, wherein the storage appliance allows the authorized application to access the at least one data storage device and blocks any other applications on the host computer from accessing the at least one data storage device.
A moving target defense system for at least one data storage device, comprising:
- the at least one data storage device;
- a host computer, comprising a storage communications protocol initiator, an advanced storage programming interface (ASPI), a moving target defense framework (MTDF), and an authorized application, wherein the ASPI enables the MTDF and the authorized application to send read and/or write commands to the at least one data storage device, wherein the MTDF comprises an MTDF library that is utilized by the authorized application;
- and
- a storage appliance, comprising a storage communications protocol target, a device plug-in module, and MTDF extensions, wherein the device plug-in module emulates the at least one data storage device and provides the emulation to the storage communications protocol initiator, wherein the MTDF extensions mirror the MTDF library,
- wherein, during a session initiated by a user of the host computer and based on at least one algorithm embodied in the MTDF library, the storage communications protocol target presents a plurality of logical unit numbers (LUNs) to the storage communications protocol initiator, wherein the plurality of LUNs comprises an active LUN assigned to the at least one storage device by a storage communications protocol and at least one dummy LUN, wherein the active LUN is known to the ASPI, the MTDF, and the authorized application,
- wherein, after the user-initiated session terminates and based on the at least one algorithm, at least one of the device plug-in module and MTDF extensions randomly changes the LUN assigned to the at least one data storage device by the storage communications protocol target.
Dependencies are inferred from the claim text.