38 results about "Encrypting file system" patented technology

A method for restricting access to an encryption key of an encrypted file system (EFS), whereby access is provided only when a computer system is booted in a trusted state. The EFS encrypts the files within a TPM chip according to TCPA specifications and simultaneously creates the encryption key, which is also stored in the TPM. The key is sealed to one or more platform control register (PCR) states (i.e., the TPM will export the key only when the PCRs are in a pre-defined state.). The original PCR states are modified during boot up of the computer system via a secure hashing algorithm, which extends a value of one PCR to a next PCR at each stage of the boot process and then hashes the value with the remaining content of the next PCR. When the system boot process is completed and before control passes to the user, the values within the PCRs are compared to values stored in a PCR table within the TPM, and the encryption key is exported to the OS kernel only when the PCR values match the table values. The control code of the TPM chip decrypts and exports the key only if the value of each and every PCR matches its corresponding table value. A complete match indicates that the computer system has completed a trusted boot sequence.

A digital video recorder (DVR) is disclosed comprising a unique ID, a hard disk drive (HDD) for storing a plurality of encrypted video programs and an encrypted file system, the encrypted file system comprising a plurality of encrypted file system entries for decrypting the plurality of video programs. The DVR further comprises host circuitry for interfacing with the HDD, the host circuitry comprising a cryptography facility for encrypting plaintext file system entries into the encrypted file system entries stored on the HDD, and for decrypting the encrypted file system entries read from the HDD into plaintext file system entries. The cryptography facility comprises a pseudo-random sequence generator, responsive to the unique ID, for generating a pseudo-random sequence. The cryptography facility further comprises an encoder for combining the pseudo-random sequence with the plaintext file system entries to generate the encrypted file system entries stored on the HDD, and a decoder for combining the pseudo-random sequence with the encrypted file system entries read from the HDD to generate the plaintext file system entries.

An encryption apparatus and method for providing an encrypted file system are provided. The encryption apparatus and method of the illustrative embodiments uses a combination of encryption methodologies so as to reduce the amount of decryption and re-encryption that is necessary to a file in the Encrypted File System in the event that the file needs to be modified. The encryption methodologies are interleaved, or alternated, with regard to each block of plaintext. In one illustrative embodiment, Plaintext Block Chaining (PBC) and Cipher Block Chaining (CBC) encryption methodologies are alternated for encrypting a sequence of blocks of data. The encryption of a block of plaintext is dependent upon the plaintext or a cipher generated for the plaintext of a previous block of data in the sequence of blocks of data so that the encryption is more secure than known Electronic Code Book encryption methodologies.

Replay attacks in an encrypted file system are prevented by generating a session key and providing the session key to one or more drive managers and an encrypted file system process. When a drive request is received by the encrypted file system process the drive request is encrypted using the generated session key. The encrypted drive request is sent to a drive manager. The drive manager attempts to decrypt the drive request using the session key. If the encrypted drive request is successfully decrypted, then the drive manager performs the requested operation. On the other hand, if the request is not decrypted successfully, then the request is not performed by the drive manager. Drive managers can include both disk device drivers and a logical volume managers.

The invention relates to the field of file mounting and provides an encrypted file system mounting method and device. The method includes extracting pre-stored environment parameters from a stored configuration file after starting that system; judging whether an environmental parameter of the starting system matches with the pre-stored environmental parameter; decrypting the first key if it matches the pre-stored environment parameter; decrypting and mounting the encrypted file system according to the first key. The application can protect the data security of the encrypted file system, meanwhile ensure the normal operation of the encrypted file system without artificial interference, and reduce the operation cost.

One embodiment of the present invention provides a system for accessing an encrypted file through a file system. During operation, the system receives a request to access the encrypted file. In response to the request, the system sends an encrypted file key for the encrypted file from the file system to a tamper-resistant module. Next, the tamper-resistant module uses a master secret to decrypt the encrypted file key to restore the file key, wherein the master secret is obtained from an external source by the tamper-resistant module. The system then uses the file key to access the encrypted file.

The invention provides a mobile phone payment protection method. The method comprises the following steps of: providing an encrypted file system, and protecting all reading and writing of a program to be redirected into the file system; performing encrypted storage on any reading and writing of the file system; performing the attach on the protected program by utilizing a ptrace function, and capturing transfer of a system of the all reading and writing of the protected program; and modifying the transfer of a path of a practical file system to be a path of a safe file system, and continuing running the program.

The invention provides a data safety storage method of a mobile terminal based on a virtual disk, belonging to the information safety field. The invention firstly creates an independent disk partitionin a hard disk, and simulates a disk partition by creating a file with a fixed size, and then formats the file content into a user-defined file system, so as to simulate the file into a disk, namelya virtual disk. Finally, combining with the real-time encryption technology, the encryption and decryption methods can be added in the process of reading and writing the disk to ensure the security ofthe data. The invention customizes the encrypted file system for the independent disk partition, constructs the encryption and decryption pipeline of the plaintext in the memory and the ciphertext onthe disk, avoids the plaintext traces left by the disk, and provides transparent data protection. The invention has higher security and flexibility, provides powerful protection for data in mobile terminal, can customize encrypted file system and identity authentication mechanism, and also can provide multiple encryption algorithms and working modes.

A file server receives a request from a client to mount an encrypted file system. The file server informs the client that the requested file system is encrypted and, in turn, receives a session ticket from the client that includes a security protocol mounting selection. The file server decrypts the client's user's encrypted private key, and then decrypts the requested encrypted file system using the private key. In turn, the file server sends the decrypted file system to the client over a secure channel, which is based upon the security protocol mounting selection. In one embodiment, a key distribution center server receives a request from the client for the client's user to access the encrypted file system at the file server. The key distribution center server retrieves an intermediate key; includes the intermediate key in a session ticket; and sends the session ticket to the client.

The invention discloses a folder encryption method and device for a Unix-like operating system. An encrypted file system is created in a catalog where an encrypted folder is located, wherein the name of the encrypted folder is used as a parameter of the encrypted file system; files in the encrypted folder are copied to the encrypted file system, the encrypted folder is deleted, and a routine shortcut with the same name as the encrypted folder is created; when a user double clicks a shortcut icon to enable a start routine of the encrypted file system, a password input by the user is verified, a temporary catalogue is created after the verification succeeds, and the encrypted file system is mounted to the temporary catalogue. The folder encryption method and device for the Unix-like operating system can encrypt folders and achieve the effect that encrypted files can be in a protection state under both a dynamic condition and a static condition by loading and unloading the encrypted file system.

The invention relates to an encrypted file system based on multi-image files. Each file in the encrypted file system is provided with a plurality of file images, i.e. a primary image file, a plurality of A image files, and a B image file; when one of the primary image files is opened or created by an untrusted process, the file opening or creating operation is redirected to one of the corresponding A image files, and the file opening or creating operations of different untrusted processes for the same primary image file are redirected to the different A image files; when one of the primary image files is opened or created by a trusted process, the file opening or creating operation is redirected to the corresponding B image file; the encrypted file system converts I/O operations for the A image files and the B image file of each file into operations for the corresponding original file, and automatically carries out file encryption and decryption processing during the operations. The encrypted file system provided by the invention avoids not only the mixing of cached data between the trusted processes and the untrusted processes, but also clear data leakage among the untrusted processes which might be caused by data storage and writing operations.

The invention relates to a distributed code running and interactive security method and system thereof, comprising a client browser or an application (interface) and a web or other type of server, andan encrypted file system and a function call intercepting plug-in module and an encryption module, are arranged in the server. the client browser or the application (interface) issues a code dynamicsecurity execution request to the server, the file system requests the encryption module to encode and encrypt to generate the code ciphertext; the encryption module performs ciphertext encoding conversion and returns to the operating system; The cryptographic module is requested to perform a ciphertext encoding conversion request on the code running result by the server; the server merges the ciphertext of the unconverted code running result with the ciphertext of the code running result that can be displayed or applied (interface), and the fusion result is sent to browse Or application (interface). The method and system effectively protects the security of running code in a web server.

The invention relates to a single-device information security processing and interaction method and an interaction system thereof. The system comprises a display screen and an operating system, an encrypted file system, a function calling interception plug-in module and an encryption module are arranged in the operating system, a user or an application (interface) sends a dynamic ciphertext culture security information request to the operating system, and the file system requests the encryption module to perform encoding encryption or ciphertext conversion to generate a new information ciphertext. The operating system puts forward a ciphertext coding conversion request to the encryption module. The encryption module carries out ciphertext coding conversion and returns the ciphertext codingconversion to the operation system. The operation system intercepts the image and/or text information to be displayed. The encryption module carries out code conversion on the ciphertext of the information processing result and returns the ciphertext to the operation system. The operating system fuses the intercepted information with the ciphertext of the converted information processing result,and a display screen of single equipment displays or an application (interface) processes the information processing ciphertext result. According to the invention, the security of the processed and used information in the operating system is effectively protected.

The invention discloses a method and a system for processing contacts of a mobile terminal and a mobile terminal. The method comprises the steps that: the mobile terminal acquires the contacts thereof after startup; and the mobile terminal only stores the contacts acquired by the mobile terminal in a random access memory (RAM) and does not perform writing encrypt file system (EFS) file operation. The method, the system and the mobile terminal save EFS space, reduce the product cost of manufacturers and improve the product competitiveness of manufacturers.

The invention relates to a single-device code safe execution and interaction method and an interaction system thereof. The system comprises a display and an operating system, an encrypted file system.An encryption module and a function call interception plug-in module are arranged in the operating system, a user sends a code dynamic ciphertext culture security execution request to the operating system, and the file system requests the encryption module to perform code encryption to generate a code ciphertext. The file system proposes a ciphertext coding conversion request to the encryption module. The encryption module carries out ciphertext coding conversion and returns the ciphertext coding conversion to the operation system. The encryption module performs ciphertext coding conversion on the ciphertext of the code operation result and returns the ciphertext to the operation system. The operating system fuses the ciphertext of the unconverted code running result with the ciphertext of the displayable or interface-processable code running result, the fusion result is sent to a display or a processing interface, and the display or the processing interface processes the running result corresponding to the code request. The security of codes in the operating system is effectively protected.

The invention relates to an encrypted file system based on a double-image file. In the encrypted file system, each encrypted file is correspondingly equipped with a virtual image file, and the encrypted file corresponding to the virtual image file is called a real image file; when file I/O (Input/Output) operation is carried out on the virtual image files by a program progress, the I/O operation aiming at the virtual image files can be converted into operation aiming at the corresponding real image files in the encrypted file system; through file redirection, a trusted progress and an untrusted progress which aim at one file type are respectively allowed to directly carry out the file I/O operation on one kind of files and only one kind of files of the real image files and the virtual image files; when data reading or storing and writing operation is carried out on one real image file or one virtual image file by one trusted process, data can be automatically unencrypted or encrypted; the trusted process and the untrusted process are respectively used for operating different files, so that different file control blocks and data caches are obtained, and the problem of violently clearing the cache is avoided.