An intrusion detection system (IDS) is usually located and operated at the host, where it captures local suspicious events, or at an appliance that listens to the network activity. Providing an online IDS to the storage controller is essential for dealing with compromised hosts or coordinated attacks by multiple hosts. SAN block storage controllers are connected to the world via block-level protocols, such as iSCSI and Fibre Channel. Usually, block-level storage systems do not maintain information specific to the file-system using them. The range of threats that can be handled at the block level is limited. A file system view at the controller, together with the knowledge of which arriving block belongs to which file or inode, will enable the detection of file-level threats. In this paper, we present IDStor, an IDS for block-based storage. IDStor acts as a listener to storage traffic, out of the controller's I/O path, and is therefore attractive for integration into existing SAN-based storage solutions. IDStor maintains a block-to-file mapping that is updated online. Using this mapping, IDStor infers the semantics of file-level commands from the intercepted block-level operations, thereby detecting file-level intrusions by merely observing the block read and write commands passing between the hosts and the controller.

We consider a communication protocol where the sender breaks a message, comprised of an information block and a corresponding CRC, into small segments and transmits these segments separately, possibly via different routes, to the receiver. Traditionally, reversing the sender operations, the receiver first assembles all the segments that make up the message, then computes a CRC based on the information part of the message and verifies it against the arriving CRC, and, finally, delivers the information part on to the upper layer protocol (ULP). We present an incremental CRC computation whereby each arriving segment contributes its share to the message's CRC upon arrival, independently of other segment arrivals, and can thus proceed immediately to the ULP. We impose no constraint on the order of segment arrivals nor on their sizes. Yet, in its time complexity, our scheme does not exceed the traditional computation, which assembles all the segments first, and it uses only a fixed and very small amount of extra memory. Our scheme is beneficial when the ULP can process the individual segments without reading the entire message first and can revert, if needed, to the state it had prior to the processing of any segment of that message. One practical example application is the evolving protocol for remote direct memory access (RDMA) over TCP, where an overall CRC is added to a concatenation of data segments.