Attack mitigation at the file system level
AssigneeDell Products L.P.
InventorsPiers Changyong Yu, Philippe Armangau
Life of this patent
Estimating the term…
Abstract
Architectures and techniques are described that can provide file system level attack mitigation techniques for a data storage service system or other network service system. By operating at a file system level, the disclosed techniques can access information that is unavailable at the block volume level and which can be leveraged to accurately identify a source of a potential attack. By accurately identifying a source of the potential attack, additional options are available for mitigating the potential attack.
Claims20
A device, comprising:
- a processor;
- and
- a memory that stores executable instructions that, when executed by the processor, facilitate performance of operations, comprising:
- interfacing with a file system of a network attached storage device that is configured to serve client devices according to multiple different file system protocols, wherein the interfacing is via a common layer that provides different services shared access to the file system;
- receiving, from the file system, transaction data indicative of access to a file system resource, of the file system resources, by a client device of the client devices;
- and
- performing an attack mitigation procedure configured to mitigate, at a file system level, attacks against the network attached storage device, the attack mitigation procedure comprising:
- generating, from the transaction data, attack detection data that indicates the client device is associated with an attack against the network attached storage device;
- and
- blocking access by the client device to the network attached storage device according to a configurable policy.
A non-transitory computer-readable medium comprising instructions that, in response to execution, cause a system comprising a processor to perform operations, comprising:
- communicating, via a common layer that provides shared access with a zero trust architecture, with a file system of a network attached storage device that is configured to serve client devices, comprising a client device, with respect to file system resources, comprising a file system resource;
- receiving, from the file system, transaction data indicative of access to the file system resource by the client device;
- generating, from the transaction data, attack detection data that indicates the client device is associated with an attack against the network attached storage device;
- and
- blocking access by the client device to the network attached storage device according to a configurable policy.
A method, comprising:
- communicating, by a device comprising a processor, with a file system of a network attached storage device, via a common layer that provides shared access with a zero trust architecture, wherein the network storage device is configured to serve client devices according to multiple different file system protocols;
- receiving, by the device, transaction data from the file system, wherein the transaction data is indicative of access to a file system resource, of the file system resources, by a client device of the client devices;
- based on the transaction data, generating, by the device, attack detection data that indicates the client device is associated with an attack against the network attached storage device;
- and
- blocking, by the device, access by the client device to the network attached storage device according to a configurable policy.
Dependencies are inferred from the claim text.