Encrypted File System Metadata Access via Secure Circuit
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing file systems are vulnerable to unauthorized access and manipulation due to unencrypted metadata, which can reveal sensitive information about file locations, creation dates, and user identities, making them susceptible to targeted attacks.
Innovation Solution
The metadata is encrypted using a metadata encryption key stored in an encrypted form and managed by a secure circuit, which decrypts the key using user and hardware entropy, ensuring only authorized access to the metadata.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If metadata is stored in unencrypted form for easy access, then ease of operation is improved, but security is worsened due to vulnerability to unauthorized access and manipulation
Solution Approach 1:
A secure circuit acts as an intermediary between the processor and encrypted metadata. The secure circuit decrypts metadata using a stored encryption key only when authorized access is requested, allowing easy access for legitimate operations while preventing unauthorized access. This mediator resolves the contradiction by enabling convenient access for authorized users while maintaining security against unauthorized users.
2Object-affected harmful factors
If metadata is encrypted to prevent unauthorized access, then security is improved, but device complexity is worsened due to need for secure circuits and key management
Solution Approach 1:
The encryption key is pre-stored in the secure circuit during device manufacturing or initialization. This preliminary action eliminates the need for complex key distribution and management mechanisms during operation. The key is already in place and ready to use, simplifying the overall system architecture while maintaining strong security protections for metadata.
3Speed
If encryption key is stored in plaintext for fast decryption, then processing speed is improved, but security is worsened due to key exposure risk
Solution Approach 1:
The encryption key is stored in a secure circuit that acts as a protective shell or container. This secure circuit isolates the key from the rest of the system, preventing exposure to malware or unauthorized access attempts. The key remains in plaintext within the secure circuit for fast decryption operations, while the secure circuit's protective boundary prevents external threats from accessing the key, thus resolving the speed-security contradiction.
Data Source
AI summary
Techniques are disclosed relating to securely storing file system metadata in a computing device. In one embodiment, a computing device includes a processor, memory, and a secure circuit. The memory has a file system stored therein that includes metadata for accessing a plurality of files in the memory. The metadata is encrypted with a metadata encryption key that is stored in an encrypted form. The secure circuit is configured to receive a request from the processor to access the file system. In response to the request, the secure circuit is configured to decrypt the encrypted form of the metadata encryption key. In some embodiments, the computing device includes a memory controller configured to receive the metadata encryption key from the secure circuit, retrieve the encrypted metadata from the memory, and decrypt the encrypted metadata prior to providing the metadata to the processor.