Access Control List Key Ring for Encrypted File Systems
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Encrypted file systems in networked environments, particularly in cloud computing, lack adequate security as any process with the correct key can access encrypted files, and there are challenges in managing encryption keys between distributed computers, including secure storage and transmission over untrusted networks.
Innovation Solution
Implementing a system that stores an access control list in a key ring and provides restricted access by using a passphrase and salt to calculate an encryption key, allowing only authorized processes to access the file system by matching process names, IDs, and file checksums, and securely managing key storage and transmission using SSL certificates and authentication protocols.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If encryption keys are stored in non-volatile memory on cloud servers, then access speed and convenience are improved, but security is worsened because physical access to servers allows unauthorized key access
Solution Approach 1:
The patent extracts the encryption key from the cloud server environment and stores it externally in non-volatile memory on the client device. This separation ensures that even if the server is compromised or physically accessed, the encryption key remains secure on the client side, preventing unauthorized decryption of stored encrypted data.
Solution Approach 2:
The patent introduces an intermediary key management system that handles key generation, storage, and distribution. This intermediary layer manages the encryption keys securely, allowing fast access through local storage while maintaining security through controlled key distribution and authentication mechanisms.
2Adaptability or versatility
If encryption keys are transmitted over network connections, then key management between distributed computers is enabled, but security is worsened due to potential interception on untrusted networks
Solution Approach 1:
The patent applies preliminary anti-action by implementing authentication protocols and secure transmission mechanisms before key exchange occurs. The system pre-establishes trusted relationships and uses cryptographic authentication to prevent interception and unauthorized access during key transmission over network connections.
3Reliability
If access control lists are implemented with multiple verification parameters, then security is improved by preventing unauthorized access, but device complexity increases due to additional storage and verification requirements
Solution Approach 1:
The patent merges multiple access control parameters (process ID, process name, file checksum) into a unified access control list structure stored in the key ring. This consolidation allows the system to verify multiple security parameters simultaneously through a single integrated data structure, reducing the operational complexity despite the increased information density.
Data Source
AI summary
A method for accessing a protected file system includes receiving a request from a process to access the file system, the request including a requesting process identification and a requesting process name; decrypting an ACL to obtain ACL process names, ACL process identifications, and ACL process file checksums; allowing the process access to the file system if the requesting process name matches a corresponding ACL process name and the requesting process identification matches a corresponding ACL process identification; or allowing the process access to the file system if the requesting process identification does not match a corresponding ACL process identification but a calculated process file checksum matches a corresponding ACL process file checksum. In one embodiment, the ACL information can be stored in a key ring.