Technical Documentation
StateWarden is a disaster recovery platform built on a Zero-Trust and Zero-Knowledge architecture. The system is designed to operate securely even if the host environment or hypervisor is compromised. The infrastructure is hosted on OVHcloud bare-metal servers in EU data centers, avoiding dependencies on external hyperscale cloud providers. Core components are developed in Rust to optimize performance and security.
1. Architecture Overview
Traditional enterprise backup strategies often rely on centralized NAS servers and file-level backups. These approaches can encounter performance bottlenecks during large-scale operations and may be susceptible to ransomware if the central credentials or storage arrays are compromised.
StateWarden restructures the data protection process by operating at the block level. The agent bypasses high-level file system APIs and interacts directly with the logical volume manager or disk hardware. This approach captures a crash-consistent state image without relying on file-locking mechanisms. A Change Block Tracking (CBT) engine identifies and transmits only modified sectors, reducing I/O load and network overhead.
2. Memory Protection and Anti-Tampering
- Memory Zeroing and Key Obfuscation: Cryptographic keys in StateWarden are generated dynamically and held in volatile memory only during active encryption or decryption processes. Key material is obfuscated while held in memory, and sensitive buffers are explicitly overwritten after use (memory zeroization of key material) to reduce exposure to memory scraping.
- Anti-Debugging: The agent employs runtime self-protection with anti-debugging countermeasures. When a debugger is detected, the process terminates itself to hinder runtime memory inspection.
- Control Flow Flattening: The compiled binaries utilize control flow flattening to complicate decompilation and static analysis.
3. Cascaded Cryptography and Post-Quantum Algorithms
The PrimeKEM engine applies multiple cryptographic layers to provisioning traffic and data at rest:
- Key Provisioning (ML-KEM / Kyber): Device pairing uses the post-quantum ML-KEM algorithm as part of an ML-KEM-based hybrid key provisioning scheme. Network communication occurs over Mutual TLS (mTLS) with strict certificate pinning.
- Data Encryption (Cascade): Data at rest is protected by independent authenticated-encryption layers (AES-256-GCM, ChaCha20-Poly1305), so the compromise of a single cipher layer does not expose plaintext.
The system enforces a Zero-Knowledge model; the Master Secret is never transmitted from the client's environment in plaintext.
4. Recovery Vectors
StateWarden supports multiple recovery methods designed to minimize Recovery Time Objectives (RTO).
| Recovery Vector | StateWarden Implementation |
|---|---|
| Instant Mount | The agent creates an iSCSI target in memory. Encrypted blocks are streamed from the Data Plane, decrypted locally, and presented to the OS as a native physical disk for immediate file access. |
| Bare Metal Recovery (BMR) | Restores the system to raw hardware, including dynamic patching of EFI/MBR bootloaders to support varying storage controllers and hardware configurations. |
| File-Level Restore | Facilitates the download of specific byte ranges to extract individual files without retrieving the entire volume image. |
5. Data Plane Immutability
- Append-Only Operations: The storage agent communicates with the Data Plane in an append-only mode. Compromised endpoint credentials cannot be used to delete or modify historical archives.
- Active Defense (Ransomware Protection): The agent calculates the Shannon entropy of data chunks as they are processed during the backup to detect mass-encryption patterns. When the configured detection thresholds are exceeded, the agent autonomously executes the configured response action: Alert Only (abort the backup and raise an alert), Quarantine Backup (alert and flag the affected backup as possibly infected in the restore view), Network Lockdown (cut network traffic except the StateWarden management channel), or Power Off. Response policies are configurable per Realm and per device in the Dashboard under "Ransomware Protection".
- Data Verification: Driad storage nodes perform Read-After-Write (RAW) verification to ensure stored chunks accurately match the hashes generated by the client Agent.
6. Vigil Telemetry and Analytics
System telemetry is isolated from backup data transfers and is transmitted asynchronously to the Control Plane, where it is stored in PostgreSQL. The Vigil subsystem functions as a local security sensor, cross-referencing the endpoint's software inventory with local copies of global vulnerability databases (OSV, NVD) to identify unpatched software.