IP Library Granted Patent US 10,394,492
Granted Patent B2
US 10,394,492 · App. 15/335,290 · Granted Aug 27, 2019

Securing a media storage device using write restriction mechanisms

Inventors: John Michael Petersen (Wake Forest, NC); Gary David Cudak (Wake Forest, NC); Shareef Fathi Alshinnawi (Apex, NC); Ajay Dholakia (Cary, NC)
Assignee: Lenovo Enterprise Solutions (Singapore) Pte. Ltd.
G06F3/0673G06F3/0619G06F3/0659G06F3/0683G06F12/14G06F2212/1052
View Patent ↗
Loading inventors, assignments & file history…
Monitor This Case
Get email alerts when status or documents change.
Order Certified Copies
Most orders are placed with the USPTO same day — all within 24 business hours.
Order via The Patent Place →
Pre-filled with this patent's details
Quick Facts
Patent No.
US 10,394,492
App. No.
15/335,290
Granted
Aug 27, 2019
Kind
B2
Abstract

According to one embodiment, a system includes a media storage device, a processor, and logic integrated with and/or executable by the processor. The logic is configured to cause the processor to determine a write rate for the media storage device or a portion thereof based on one or more factors, the write rate ranging from zero to a maximum possible write rate for the media storage device or the portion thereof. The logic is also configured to cause the processor to receive a write request to write data to the media storage device or the portion thereof and write the data to the media storage device using the determined write rate. Other systems, methods, and computer program products for defending against ransomware attacks are presented according to more embodiments.

Claims (44)

1. A system, comprising:

a media storage device;

a processor; and

logic integrated with and/or executable by the processor, the logic being configured to cause the processor to:

determine a write rate for the media storage device or a portion thereof based on one or more factors, the write rate ranging from zero to a maximum possible write rate for the media storage device or the portion thereof;

determine an overwrite rate for the media storage device or the portion thereof based on the one or more factors;

receive a write request to write data to the media storage device or the portion thereof; and

write the data to the media storage device, wherein portions of the data written to empty blocks of memory on the media storage device are written using the determined write rate, wherein portions of the data written to non-empty blocks of memory on the media storage device are written using the determined overwrite rate.

2. The system as recited in claim 1 , wherein the one or more factors comprise an identity of a source of the write request, a particular subset of storage space targeted by the write request, a media storage device that is targeted by the write request, an historical write rate for the particular subset of storage space on the media storage device, an amount of overwriting that has historically taken place due to write requests received from the source of the write request, a time at which the write request is received, and a pattern of write requests received from the source of the write request.

3. The system as recited in claim 1 , wherein the logic is further configured to cause the processor to restrict the write rate from an initial value in response to determining an action selected from a group consisting of: a frequency of write activity on the media storage device or the portion thereof that exceeds a predetermined write frequency threshold, a rate of change resulting from the write request being greater than an historical rate of change for the media storage device or the portion thereof, and the write request being received outside of a time period in which write requests are expected to be received for the media storage device or the portion thereof.

4. The system as recited in claim 1 , wherein the logic is further configured to cause the processor to track, over a period of time, a write frequency for non-empty blocks of data on the media storage device or the portion thereof.

5. The system as recited in claim 4 , wherein the logic is further configured to cause the processor to:

calculate an historical score for the media storage device or the portion thereof based on the write frequency tracked over the period of time;

calculate an instant score for the write request based on a write frequency resulting from performing the write request; and

restrict the write rate in response to the instant score exceeding the historical score.

6. The system as recited in claim 1 , wherein the write rate is determined based, at least in part, on a type of user who issued the write request or historical write rates to the media storage device or the portion thereof exploited by the user who issued the write request.

7. A computer program product comprising a computer readable medium having stored thereon computer readable program instructions executable by a processor to cause the processor to perform a method, the method comprising:

determining a write rate for a media storage device or a portion thereof based on one or more factors, the write rate ranging from zero to a maximum possible write rate for the media storage device or the portion thereof;

determine an overwrite rate for the media storage device or the portion thereof based on the one or more factors;

receiving a write request to write data to the media storage device or the portion thereof; and

writing the data to the media storage device, wherein portions of the data written to empty blocks of memory on the media storage device are written using the determined write rate, wherein portions of the data written to non-empty blocks of memory on the media storage device are written using the determined overwrite rate.

8. The computer program product as recited in claim 7 , wherein the one or more factors comprise an identity of a source of the write request, a particular subset of storage space targeted by the write request, a media storage device that is targeted by the write request, an historical write rate for the particular subset of storage space on the media storage device, an amount of overwriting that has historically taken place due to write requests received from the source of the write request, a time at which the write request is received, and a pattern of write requests received from the source of the write request.

9. The computer program product as recited in claim 7 , wherein the method further comprises restricting the write rate from an initial value in response to determining an action selected from a group consisting of: a frequency of write activity on the media storage device or the portion thereof that exceeds a predetermined write frequency threshold, a rate of change resulting from the write request being greater than an historical rate of change for the media storage device or the portion thereof, and the write request being received outside of a time period in which write requests are expected to be received for the media storage device or the portion thereof.

10. The computer program product as recited in claim 7 , wherein the method further comprises tracking, over a period of time, a write frequency for non-empty blocks of data on the media storage device or the portion thereof.

11. The computer program product as recited in claim 10 , wherein the method further comprises:

calculating an historical score for the media storage device or the portion thereof based on the write frequency tracked over the period of time;

calculating an instant score for the write request based on a write frequency resulting from performing the write request; and

restricting the write rate in response to the instant score exceeding the historical score.

12. The computer program product as recited in claim 7 , wherein the write rate is determined based, at least in part, on a type of user who issued the write request or historical write rates to the media storage device or the portion thereof exploited by the user who issued the write request.

13. A computer-implemented method, comprising:

determining a write rate for a media storage device or a portion thereof based on one or more factors, the write rate ranging from zero to a maximum possible write rate for the media storage device or the portion thereof;

determining an overwrite rate for the media storage device or the portion thereof based on the one or more factors;

receiving a write request to write data to the media storage device or the portion thereof; and

writing the data to the media storage device, wherein portions of the data written to empty blocks of memory on the media storage device are written using the determined write rate, wherein portions of the data written to non-empty blocks of memory on the media storage device are written using the determined overwrite rate.

14. The computer-implemented method as recited in claim 13 , further comprising:

returning an error indicating that the data cannot be stored in response to determining that the write rate is zero.

15. The computer-implemented method as recited in claim 13 , wherein the one or more factors comprise an identity of a source of the write request, a particular subset of storage space targeted by the write request, a media storage device that is targeted by the write request, an historical write rate for the particular subset of storage space on the media storage device, an amount of overwriting that has historically taken place due to write requests received from the source of the write request, a time at which the write request is received, and a pattern of write requests received from the source of the write request.

16. The computer-implemented method as recited in claim 13 , further comprising restricting the write rate from an initial value in response to determining an action selected from a group consisting of: a frequency of write activity on the media storage device or the portion thereof that exceeds a predetermined write frequency threshold, a rate of change resulting from the write request being greater than an historical rate of change for the media storage device or the portion thereof, and the write request being received outside of a time period in which write requests are expected to be received for the media storage device or the portion thereof.

17. The computer-implemented method as recited in claim 13 , further comprising:

tracking, over a period of time, a write frequency for non-empty blocks of memory on the media storage device or the portion thereof;

calculating an historical score for the media storage device or the portion thereof based on the write frequency tracked over the period of time;

calculating an instant score for the write request based on a write frequency resulting from performing the write request; and

restricting the write rate in response to the instant score exceeding the historical score.

18. The computer-implemented method as recited in claim 13 , wherein the write rate is determined based, at least in part, on a type of user who issued the write request or historical write rates to the media storage device or the portion thereof exploited by the user who issued the write request.

Assignments (3)
ASSIGNMENT OF ASSIGNOR'S INTEREST Recorded Jan 10, 2025
From: LENOVO GLOBAL TECHNOLOGIES INTERNATIONAL LIMITED
To: LENOVO GLOBAL TECHNOLOGIES SWITZERLAND INTERNATIONAL GMBH
Reel/Frame 069869/0614 →
ASSIGNMENT OF ASSIGNOR'S INTEREST Recorded Jun 16, 2020
From: LENOVO ENTERPRISE SOLUTIONS (SINGAPORE) PTE LTD
To: LENOVO GLOBAL TECHNOLOGIES INTERNATIONAL LTD
Reel/Frame 052952/0127 →
ASSIGNMENT OF ASSIGNOR'S INTEREST Recorded Dec 8, 2016
From: PETERSEN, JOHN MICHAEL; CUDAK, GARY DAVID; ALSHINNAWI, SHAREEF FATHI; DHOLAKIA, AJAY
To: LENOVO ENTERPRISE SOLUTIONS (SINGAPORE) PTE. LTD.
Reel/Frame 040860/0274 →
Continuity (1)
Related Publication 20180113638A1 · Apr 26, 2018