FUSE-Mounted Linux Storage for Secure Data Access Control
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing Linux-based operating systems face challenges in securely protecting data, particularly encryption keys, due to the complexity of the kernel file system and licensing issues, making it difficult to implement effective data security functions.
Innovation Solution
The method and apparatus utilize a FUSE-mounted storage area to store protection target data, allowing access only in a mounted state and enabling encryption/decryption operations based on user authorization, while maintaining identical physical file addresses in both mounted and unmounted states to prevent data loss.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If data is stored in the Linux kernel file system, then data storage functionality is provided, but data security is compromised due to kernel complexity and root access vulnerabilities
Solution Approach 1:
The patent introduces FUSE (Filesystem in Userspace) as an intermediary layer between the user application and the kernel file system. This mediator allows secure data storage in user space while maintaining controlled access through the kernel, eliminating the need to modify the kernel itself and addressing both security concerns and kernel complexity issues.
Solution Approach 2:
The patent segments the file system functionality into separate user space and kernel space components. The FUSE user space daemon handles data storage and access control logic, while the kernel provides only the necessary interface for mounting and basic file operations, reducing kernel complexity and improving security.
2Reliability
If FUSE mounting is used for data protection, then data access control is improved, but system complexity increases due to mounted/unmounted state management
Solution Approach 1:
The patent performs preliminary actions by creating symbolic links before FUSE mounting occurs. The symbolic links are configured to point to the correct physical file addresses in advance, so when FUSE is mounted or unmounted, the symbolic links automatically redirect to the appropriate locations, eliminating the need for complex runtime state management.
Solution Approach 2:
The patent uses symbolic links as copies that reference the actual data files. These symbolic links provide a simplified interface that automatically adapts to FUSE mounting states without requiring the system to track or manage the complex mounted/unmounted states directly.
3Adaptability or versatility
If physical file addresses differ between mounted and unmounted states, then FUSE operation flexibility is improved, but data integrity is compromised due to potential data loss
Solution Approach 1:
The patent performs preliminary configuration of symbolic links to point to the same physical file address regardless of FUSE mounting state. This preliminary setup ensures that data integrity is maintained because the symbolic links consistently reference the correct data location, preventing data loss while still allowing FUSE operational flexibility.
Data Source
AI summary
Provided is an apparatus for protecting data in a Linux-based operating system, the apparatus including: a physical storage device; and a processor provided with a user application, a user library, a virtual file system (VFS), a kernel-based file system, a Filesystem in Userspace (FUSE) kernel driver, and a FUSE user daemon as software modules.A file containing protection target data may be safely protected by being stored in a FUSE storage area that is accessible only in a FUSE mount state.