Granted Patent B2

US 9,069,955 · App. 13/873,625 · Granted Jun 30, 2015

Inventors: Blaine H. Dolph (Western Springs, IL); Sandeep R. Patil (Pune, IN); Riyazahamad M. Shiraguppi (Maharashtra, IN); Gandhi Sivakumar (Victoria, AU); Matthew B. Trevathan (Roswell, GA)

Assignee: International Business Machines Corporation

G06F21/55G06F21/6218

Abstract

Claims (67)

1. A method for creating a data snapshot and executing file system protection-specific commands to protect data and limit access of the snapshotted data upon suspicion of a potential security breach, the method comprising:

in response to identifying a suspected breach to a file system, at a time of the identifying the suspected breach:

generating a read-only snapshot of at least one file set of data that is stored on a storage volume of the file system;

invoking at least one file system protection command that restricts access to the snapshot of the at least one file set of data;

detecting a user credential associated with the suspected breach;

extracting from an authentication server a user identification indicia and a group identification indicia for the user that is associated with the suspected breach;

referring to an access table of the file system to identify a first plurality of file sets stored within system storage resources to which the user identification indicia and the group identification indicia have write access and which comprises the at least one file set of the generated read-only snapshot; and

invoking a file system protection that restricts access, by any user with the user identification indicia and the group identification indicia, to the identified first plurality of file sets stored within the system storage resources.

2. The method of claim 1 , wherein the step of generating the read-only snapshot of the at least one file set of data that is stored on the storage volume of the file system further comprises:

opening an administrative shell for the file-system at the time of the identifying the suspected breach, in response to the identifying the suspected breach to the file system; and

executing an administrative shell snapshot command that invokes the creation of the generated snapshot of the file system; and

wherein the step of invoking the at least one file system protection command that restricts access to the snapshot of the at least one file set of data further comprises executing an administrative shell file system protection-specific command that limits access of the data of the snapshot of the at least one file set of data to an administrator, or to a super user that has a higher level of security access than a user of the file system.

3. The method of claim 1 , wherein the step of generating, at the time of the identifying the suspected breach, the read-only snapshot of the at least one file set of data that is stored on the storage volume of the file system, comprises:

generating a logical copy-on-write snapshot comprising a set of reference pointers to an original copy of data stored on the storage volume of the file system.

4. The method of claim 1 , wherein the step of generating, at the time of the identifying the suspected breach, the read-only snapshot of the at least one file set of data that is stored on the storage volume of the file system, comprises:

generating a logical redirect-on-write snapshot comprising a set of reference pointers to an original copy of data stored on the storage volume of the file system, wherein new writes to an original volume are redirected to another location set aside for the redirect-on-write snapshot.

5. The method of claim 1 , further comprising:

integrating computer-readable program code into a computer system comprising a processing unit, a computer readable memory and a computer readable tangible storage medium;

wherein the computer readable program code is embodied on the computer readable tangible storage medium and comprises instructions for execution by the processing unit via the computer readable memory that cause the processing unit to, in response to identifying the suspected breach to the file system, perform the steps of generating at the time of the identifying the suspected breach the read-only snapshot of the at least one file set of data that is stored on the file system storage volume, invoking the at least one file system protection command that restricts access to the snapshot of the at least one file set of data, detecting the user credential associated with the suspected breach, extracting from the authentication server the user identification indicia and the group identification indicia for the user that is associated with the suspected breach, referring to the access table of the file system to identify the first plurality of file sets stored within system storage resources, and invoking the file system protection that restricts access, by any user with the user identification indicia and the group identification indicia, to the identified first plurality of file sets stored within the system storage resources.

6. The method of claim 1 , further comprising:

using the snapshot to roll a current state of the file system data back to a previous data copy of the file set that belongs to the user identification indicia and the group identification indicia associated with the suspected breach.

7. The method of claim 6 , further comprising:

restoring data within the at least one file set of the snapshot by rewriting sectors that were modified since the snapshot was generated.

8. A system, comprising:

a processing unit;

a computer readable memory in communication with the processing unit; and

a tangible computer-readable storage medium in communication with the processing unit;

wherein the processing unit, in response to identifying a suspected breach to a file system, at a time of the identifying the suspected breach, executes program instructions comprising at least one file system protection command and stored on the tangible computer-readable storage medium via the computer readable memory and thereby:

generates a read-only snapshot of at least one file set of data that is stored on a storage volume of the file system;

restricts access to the snapshot of the at least one file set of data;

detects a user credential associated with the suspected breach;

extracts from an authentication server a user identification indicia and a group identification indicia for the user that is associated with the suspected breach;

refers to an access table of the file system to identify a first plurality of file sets stored within system storage resources to which the user identification indicia and the group identification indicia have write access and which comprises the at least one file set of the generated read-only snapshot; and

invokes a file system protection that restricts access, by any user with the user identification indicia and the group identification indicia, to the identified first plurality of file sets stored within the system storage resources.

9. The system of claim 8 , wherein the processing unit executes the program instructions stored on the computer-readable storage device via the computer readable memory and thereby:

generates the read-only snapshot of the at least one file set of data stored on the file system storage volume by:

opening an administrative shell for the file-system at the time of the identifying the suspected breach, in response to the identifying the suspected breach to the file system; and

executing an administrative shell snapshot command that invokes the creation of the generated snapshot of the file system; and

restricts access to the snapshot of the at least one file set of data by executing an administrative shell file system protection-specific command that limits access of the data of the snapshot of the at least one file set of data to an administrator, or to a super user that has a higher level of security access than a user of the file system.

10. The system of claim 8 , wherein the processing unit executes the program instructions stored on the computer-readable storage device via the computer readable memory and thereby generates the snapshot as a logical copy-on-write snapshot comprising a set of reference pointers to an original copy of data stored on the storage volume of the file system.

11. The system of claim 8 , wherein the processing unit executes the program instructions stored on the computer-readable storage device via the computer readable memory and thereby:

generates the snapshot as a logical redirect-on-write snapshot comprising a set of reference pointers to an original copy of data stored on the storage volume of the file system; and

redirects new writes to an original volume to another location set aside for the redirect-on-write snapshot.

12. The system of claim 8 , wherein the processing unit executes the program instructions stored on the computer-readable storage device via the computer readable memory, and thereby further:

uses the snapshot to roll a current state of the file system data back to a previous data copy of the file set that belongs to the user identification indicia and the group identification indicia associated with the suspected breach.

13. The system of claim 8 , wherein the processing unit executes the program instructions stored on the computer-readable storage device via the computer readable memory, and thereby further:

restores data within the file sets by rewriting sectors that were modified since the snapshot was generated.

14. A computer program product for generating a data snapshot and protecting the data snapshot upon a suspected breach of a file system, the computer program product comprising:

a computer readable tangible storage medium having computer readable program code embodied therewith, the computer readable program code comprising instructions comprising at least one file system protection command for execution by a computer processing unit that causes the computer processing unit to, in response to identifying a suspected breach to a file system, at a time of the identifying the suspected breach:

generate a read-only snapshot of at least one file set of data that is stored on a storage volume of the file system;

restrict access to the snapshot of the at least one file set of data;

detect a user credential associated with the suspected breach;

extract from an authentication server a user identification indicia and a group identification indicia for the user that is associated with the suspected breach;

refer to an access table of the file system to identify a first plurality of file sets stored within system storage resources to which the user identification indicia and the group identification indicia have write access and which comprises the at least one file set of the generated read-only snapshot; and

invoke a file system protection that restricts access, by any user with the user identification indicia and the group identification indicia, to the identified first plurality of file sets stored within the system storage resources.

15. The computer program product of claim 14 , wherein the computer readable program code instructions for execution by the computer processing unit further cause the computer processing unit to generate the read-only snapshot of the at least one file set of data stored on the file system storage volume by:

opening an administrative shell for the file-system at the time of the identifying the suspected breach, in response to the identifying the suspected breach to the file system; and

executing an administrative shell snapshot command that invokes the creation of the generated snapshot of the file system; and

restrict access to the snapshot of the at least one file set of data by executing an administrative shell file system protection-specific command that limits access of the data of the snapshot of the at least one file set of data to an administrator, or to a super user that has a higher level of security access than a user of the file system.

16. The computer program product of claim 14 , wherein the computer readable program code instructions for execution by the computer processing unit further cause the computer processing unit to generate the snapshot as a logical copy-on-write snapshot comprising a set of reference pointers to an original copy of data stored on the storage volume of the file system.

17. The computer program product of claim 14 , wherein the computer readable program code instructions for execution by the computer processing unit further cause the computer processing unit to:

generate the snapshot as a logical redirect-on-write snapshot comprising a set of reference pointers to an original copy of data stored on the storage volume of the file system; and

redirect new writes to an original volume to another location set aside for the redirect-on-write snapshot.

18. The computer program product of claim 14 , wherein the computer readable program code instructions for execution by the computer processing unit further cause the computer processing unit to:

use the snapshot to roll a current state of the file system data back to a previous data copy of the file set that belongs to the user identification indicia and the group identification indicia associated with the suspected breach.

19. The computer program product of claim 14 , wherein the computer readable program code instructions for execution by the computer processing unit further cause the computer processing unit to:

restore data within the file sets by rewriting sectors that were modified since the snapshot was generated.

Assignments (8)

Continuity (1)