File System Encryption Driver Management
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current file system encryption technologies face challenges in transitioning between encryption algorithms, requiring significant time and resources, often resulting in system downtime and double encryption issues that impact performance.
Innovation Solution
The implementation of automatic management techniques for file system encryption drivers, which involve a method to redirect data access requests between different encryption levels using shim modules and encryption indicators, ensuring that data is handled by the appropriate encryption driver without disrupting system operations.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If file system encryption transitions from an old algorithm to a new algorithm, then the encryption method is updated, but the transition requires significant time and system resources, resulting in system downtime and making the volume inaccessible to users
Solution Approach 1:
The patent segments the encryption driver functionality into multiple independent drivers (first encryption driver and second encryption driver) that can operate simultaneously. This allows the system to transition from an old encryption algorithm to a new one without requiring complete system downtime, as different segments of data can be handled by different drivers concurrently.
Solution Approach 2:
The patent implements preliminary action by setting up multiple encryption drivers in advance and using encryption indicators to mark data regions before transition is needed. The system prepares the infrastructure for algorithm switching by having both old and new encryption drivers ready, allowing seamless transition without forcing users to wait for the entire transition process.
2Adaptability or versatility
If file system encryption transitions from an old algorithm to a new algorithm, then the encryption method is updated, but the transition requires making a volume inaccessible to users while unencrypting, uninstalling old software, installing new software, and re-encrypting
Solution Approach 1:
The patent divides the volume into multiple regions, each associated with a different encryption driver through encryption indicators. This segmentation allows different parts of the volume to use different encryption algorithms simultaneously, enabling users to access data throughout the transition process without making the entire volume inaccessible.
Solution Approach 2:
The patent introduces encryption indicators as intermediary markers that associate data regions with specific encryption drivers. These indicators act as mediators between the data and the appropriate encryption driver, allowing the system to automatically route access requests to the correct driver without requiring user intervention or making the volume inaccessible during transitions.
3Reliability
If two types of encryption are used (file level encryption and disk level encryption), then comprehensive data protection is achieved, but a portion of data may be encrypted twice, impacting performance in writing and reading the data
Solution Approach 1:
The patent implements a feedback mechanism where the first encryption driver checks encryption indicators to determine whether data has already been encrypted by a second encryption driver. This feedback loop allows the system to detect double-encryption conditions and adjust its behavior accordingly, preventing redundant encryption operations that would degrade performance while maintaining comprehensive data protection.
Data Source
AI summary
Techniques for automatic management of file system encryption drivers are disclosed. In one particular exemplary embodiment, the techniques may be realized as a method for automatic management of file system encryption drivers comprising receiving a data access request at a first level encryption driver, checking an encryption indicator to identify an encryption method corresponding to the data access request, determining, using at least one computer processor, whether the data access request is to be handled at the first level encryption driver based at least in part on the identified encryption method; allowing the data access request to proceed to the first level encryption driver in the event the data access request is to be handled by the first level encryption driver; redirecting the data access request to a second level encryption driver in the event the data access request is to be handled by a second level encryption driver, and returning a result to the data access request to a requestor while ensuring that returned data is handled by an appropriate level encryption driver on a return path.