File System Directory Encryption with Compliant Name Encoding
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
File encryption technologies face performance overheads due to stacking and lack of integrity protection for file names, leading to user-space application failures and violations of file name length rules.
Innovation Solution
An electronic device method that encrypts directory entries, determines user access to directory encryption keys, and encodes file names to comply with naming rules, using cryptographic hashes and concatenation to generate access hash values for indexed directory structures, ensuring POSIX compliance and secure access control.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If file encryption technology stacks a file system on top of an underlying file system, then file system level encryption is achieved, but performance overhead increases
Solution Approach 1:
The patent extracts the encryption functionality from a separate stacked file system layer and integrates it directly into the file system core. By removing the stacking architecture and embedding encryption operations within the file system itself, the solution eliminates the performance overhead associated with layered encryption while maintaining security functionality.
Solution Approach 2:
The patent merges the encryption module with the file system directory entry structures. By combining encryption operations with existing file system metadata handling, the solution eliminates the need for separate encryption layers and reduces the performance impact of file operations while maintaining security.
2Reliability
If encrypted file names are stored directly in directory entries, then encryption is provided, but file name length rules are violated causing user-space application failures
Solution Approach 1:
The patent applies parameter changes by transforming encrypted file names through encoding schemes that adapt them to fit within standard file name length constraints. By modifying the representation parameters of encrypted data (such as using compact encoding formats or truncated representations with hashing), the solution maintains encryption security while ensuring compliance with file system naming rules.
3Ease of operation
If encrypted file names are displayed to users, then access information is provided, but integrity protection for file names is not ensured
Solution Approach 1:
The patent introduces hash values as intermediary representations of encrypted file names. Instead of displaying raw encrypted data or plain file names, the system computes and displays hash values that serve as integrity-protected representations. This intermediary layer ensures that file name integrity is verified while still providing useful display information to users and applications.
Data Source
AI summary
An electronic device implements a method of encrypting directories of a file system. A processor receives a request to access a directory entry of a file system, and identifies a user who is logged into the electronic device. The processor determines whether the user has access to a directory encryption key associated with the directory entry and, if not, identifies an encrypted file name stored in the directory entry, and determines whether the encrypted file name complies with one or more naming rules. If the encrypted file name does not comply with one or more naming rules, the processor applies one or more functions to a file name associated with the encrypted file name to generate an encoded encrypted file name that complies with the one or more naming rules, and causes the encoded encrypted file name to be displayed as a representation of the directory entry.