SunNAS / Hella Storage Fabric
A hybrid SAN/NAS research platform built to study measurable cyber resilience on ordinary hardware. The design separates everyday data access from protected recovery state and research telemetry, so recovery can be evaluated independently from an affected endpoint.
What we designed
SunNAS is our own system architecture, assembled from standard technologies and organized around four roles: normal data access, protected recovery state, evidence/telemetry preservation, and independent control. We do not claim to have invented SAN, ZFS or snapshots. The contribution we are exploring is how these layers can work together as a small, reproducible resilience platform.
What is already proven
- A ZFS-backed storage pool is operational in our controlled lab.
- Authenticated block-storage access has been validated with a dedicated test LUN.
- Recovery authority is kept outside the ordinary client endpoint.
- The design supports separate operational and recovery roles.
Research contribution
We are developing a benchmark that focuses on the bounded damage window: how much test data changes between a credible incident signal and verified containment. We believe this is a useful complement to conventional detection-accuracy metrics because it directly measures the outcome defenders care about.
What we will measure
- time to credible detection;
- time to verified containment;
- amount of changed test data before containment;
- recovery time from a trusted historical state;
- false-positive behavior under benign workloads.
Originality boundary
Our public claim is deliberately narrow: the architecture and benchmark design are our work. We are not claiming that the underlying storage technologies are new, nor that prior art does not exist. Stronger novelty claims will only be made after systematic prior-art review and reproducible testing.
Responsible research
Testing is restricted to systems and data owned by Mikronik or explicitly authorized for analysis. Public materials omit operational credentials, private topology, internal rules and sensitive forensic artifacts.
Research roadmap
- Experiment 002: compare independent endpoint, storage and network signals and measure the trade-off between corroboration and response delay.
- Experiment 003: evaluate short-lived storage write authority and graceful read-only fallback on a disposable test target.
- Experiment 004: measure the full containment envelope: changed data, response latency, evidence preservation, false-positive cost and recovery time.
Each stage is intentionally gated. Live SAN validation is restricted to dedicated disposable test targets; production data and production LUNs are not used as experiment targets.
Experiment 002 · quorum + live witness calibration
A deterministic policy model first showed that weighted corroboration could reduce synthetic benign decisions to 0.51% while retaining a 100% decision rate on the modeled incident trace. We then calibrated real storage and network witnesses on a disposable iSCSI test filesystem. Synthetic high-fanout mutation reached a median 670 IOPS and 18.7 MiB/s network TX, but benign update-like activity also reached high fanout and overlapping I/O intensity.
Result: storage/network intensity alone is not a reliable discriminator. This supports the multi-witness design: lower layers corroborate, while endpoint semantics provide context.
Truth boundary: controlled calibration corpus only, not a production detector benchmark.
Experiment 003 · live SAN containment checkpoint
The write-lease state-machine dry run was followed by a real iSCSI-backed containment measurement on an existing empty 20 GiB test LUN. A direct live RW→RO remount failed because the filesystem was busy, which we retained as a negative result. A safer filesystem-freeze gate then completed across 10 runs with median canary-observation to completed freeze of 43.015 ms (28.748–91.488 ms). The median bounded post-trigger window was 2 × 4 KiB writes, with a maximum of 3 writes.
Every run returned the test filesystem to RW and passed a post-thaw write probe; the iSCSI session remained connected.
Truth boundary: real iSCSI data path, initiator-side filesystem freeze. This is not yet target-side ACL/session enforcement or a true expiring write lease.
Experiment 004 · self-measuring incident receipts
We converted the ten proven Experiment 003 containment runs into compact hash-chained research receipts. All 10/10 untouched receipts verified and all 10/10 deliberately altered copies failed integrity validation.
Truth boundary: software tamper evidence after receipt creation, not hardware attestation or digital signing.
Experiment 005 · recovery confidence
A 10,000-trial synthetic model compared “latest snapshot before alert” with evidence-aware recovery selection. Because alerts often arrive after compromise, the naive policy selected a pre-compromise snapshot in only 0.78% of trials. A conservative confidence threshold selected pre-compromise snapshots in 98.90% of trials, at the cost of rolling back a median 121.9 seconds.
Result: recovery-point selection is a safety/freshness trade-off, not simply “pick the newest snapshot”.
Experiment 006 · graceful degradation
A synthetic governor model compared binary blocking with staged write restriction. Staging reduced modeled median incident damage from 8.556 to 5.034 units, about 41%, while the modeled benign update workload experienced no hard blocks. The price was a small throughput penalty while suspicion was unresolved.
Truth boundary: policy simulation only; live rate-limiter validation remains future work.