File System Manager Using Segmented Virtual Views for Endpoint Visibility Control
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing file system managers lack effective mechanisms to protect directories and files from unauthorized access, allowing users with access rights to view and potentially exploit the presence or absence of other files and directories, which can be detrimental to security.
Innovation Solution
Implementing a system that uses a security appliance to manage community of interest (COI) keys, where only authorized users with matching COI credentials can access and decrypt files, making unauthorized users unaware of the existence of protected endpoints by using a hierarchical structure and encryption methods to obscure file and directory visibility.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional access control lists are used to control file access, then users with access rights can read and write files, but all users can see all directories and files in the directory structure
Solution Approach 1:
The patent segments the file system into multiple virtual file systems, each associated with a specific user or group. Each virtual file system contains only the endpoints (files and directories) that are relevant to that user, effectively dividing the complete file system view into separate, user-specific views. This segmentation prevents users from seeing endpoints not relevant to them while maintaining access control.
Solution Approach 2:
The patent introduces a file system manager as an intermediary between users and the actual file system endpoints. This manager intercepts all file system requests, determines the user's identity and relevant endpoints, and constructs virtual file system views accordingly. The intermediary filters and transforms requests before they reach the actual endpoints, enabling selective visibility without changing the underlying file system structure.
2Ease of operation
If all users can access directories they are permitted to, then ease of operation is maintained, but security is compromised by exposing presence information to unauthorized users
Solution Approach 1:
The patent makes the file system view dynamic rather than static. The virtual file system view is dynamically generated based on the user's identity, group memberships, and the current state of the actual file system. As users join or leave groups, or as files are created or deleted, the virtual views are automatically updated to reflect the current access rights and relevant endpoints, maintaining both convenience and security.
Solution Approach 2:
The patent applies local quality by creating user-specific virtual file system views that contain only the endpoints relevant to each user. Instead of providing a uniform view of the entire file system, each user receives a customized view tailored to their access rights and operational needs. This localizes the information presented to each user, preventing exposure of irrelevant or unauthorized endpoints.
Data Source
AI summary
Systems and methods for accessing data secured and encrypted using a file system manager are disclosed. One method includes determining whether a community of interest (COI) key obtained from a security appliance matches a COI key associated with a file structure managed by the file system manager that is the subject of a file system request issued by a caller. The method further includes identifying an entry included in a key bank associated with the COI key and the file structure that is the subject of the file system request, the key bank storing encrypted versions of a metadata key. The method also includes decrypting the metadata key using the COI key, decrypting at least one block encryption key using the metadata key, and decrypting a block of data associated with the at least one block encryption key.