Firmlink File System Path Linking Security
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Modern computing devices with monolithic OS structures face security challenges due to commingled OS and user files, making them vulnerable to malware infiltration, and existing links like symlinks lack the ability to securely verify operation requests across volume boundaries.
Innovation Solution
Implementing 'firmlinks' that provide bi-directional references between system and data volumes within a container, allowing secure operation requests by storing attributes to identify approved source paths and maintaining references between source and target paths, enabling secure file operations while maintaining backward compatibility with legacy applications.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If traditional symlinks are used to create links between file paths, then flexibility in pointing to resources is improved, but security verification capability deteriorates
Solution Approach 1:
The patent segments the link structure into two distinct components: a source path stored in the file system and a target path stored in a database. This segmentation allows the system to maintain the flexibility of traditional symlinks while adding security verification capabilities through the database-stored target path, resolving the contradiction between link adaptability and security reliability.
Solution Approach 2:
The patent introduces a database as an intermediary layer between the source path and target path. This intermediary stores the target path information and provides verification mechanisms, enabling security checks without compromising the flexibility of path linking. The database acts as a mediator that bridges the gap between flexible file system operations and secure verification requirements.
2Device complexity
If OS and user files are commingled in a monolithic structure, then system simplicity is improved, but security vulnerability increases
Solution Approach 1:
The patent applies segmentation by separating OS files and user files into distinct file system paths and volumes. This structural segmentation allows the system to maintain simplicity through unified management while reducing security vulnerabilities by isolating critical OS components from user-accessible areas, thereby limiting malware infiltration risk.
Solution Approach 2:
The patent implements local quality by applying different security attributes and access controls to different file system regions. OS files in system volumes receive enhanced security protection while user files in data volumes have appropriate user-level access controls. This localized security approach maintains overall system simplicity while protecting critical areas from malware threats.
Data Source
AI summary
Representative embodiments set forth herein disclose techniques for implementing improved links between paths of one or more file systems. According to some embodiments, techniques are disclosed for establishing a system volume and a data volume within a container. According to other embodiments, techniques are disclosed for establishing a link from a source path of a system volume within a container to a target path of a data volume within the container. According to yet other embodiments, techniques are disclosed for determining whether to allow a file system operation on a data volume of a container based on at least determining whether a target path is associated with a reference to a source path.