File System Access Control via Unique Encryption Keys
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current storage container security schemes, particularly full disk encryption, are inadequate as they provide insufficient access controls, allowing unauthorized access to sensitive data once the encryption key is compromised, and privileged users can accidentally access sensitive information.
Innovation Solution
Implementing an access control and encryption module that encrypts each file in a virtual file system with a unique file encryption key, restricting access based on user permissions and generating application containers with specific access rules to limit privileged user access.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Use of energy by moving object
If full disk encryption is used to encrypt all data in a storage container with a single encryption key, then encryption efficiency is improved, but security is worsened because once the key is compromised, all data becomes accessible
Solution Approach 1:
The patent divides the storage container into multiple segments or partitions, each encrypted with a different encryption key. This segmentation allows the system to maintain encryption efficiency while improving security, as compromising one key only exposes data in that specific segment rather than the entire storage container.
2Ease of operation
If privileged users are granted system administration permissions, then system management capability is improved, but security is worsened because privileged users can accidentally or maliciously access sensitive data
Solution Approach 1:
The patent implements different access control policies for different users and data segments. Privileged users are granted specific permissions to manage particular segments or functions while being restricted from accessing sensitive data in other segments. This local quality approach allows system management capability to be maintained while enhancing security through granular access control.
3Device complexity
If a single encryption key is used for the entire storage container, then device complexity is reduced, but security control capability is worsened because fine-grained access control cannot be implemented
Solution Approach 1:
The patent implements a dynamic access control system where encryption keys and access permissions can be dynamically assigned, modified, and revoked based on user roles and data sensitivity. This dynamic approach enables fine-grained access control while managing complexity through automated key management and policy enforcement mechanisms.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
A method and system provides access control encryption for a file system. A resource management module manages access to data on a storage container and hosts a virtual file system including files representing the data on the storage container. An access control and encryption module encrypts each of the files with a respective file encryption key. The access control module generates a plurality of application containers each associated with a respective user and that include respective lists of files that the respective user is authorized to access. The access control and encryption module generates decrypts the files and allows access to files based on the lists of files in the application containers.