Hardware File Protection via Split Tables
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Transient storage devices like USB flash drives lack effective hardware-based file level protection, as current solutions are either software-dependent or unable to provide per-file protection across various host file systems, leading to security vulnerabilities.
Innovation Solution
Implementing a mechanism that integrates hardware protection attributes with existing file systems, allowing for per-file protection by using attribute bits or alternate streams to indicate protection levels, and splitting file tables to manage different protection levels, enabling user interface control over protection settings.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If software-based encryption is used to protect data on transient storage devices, then data security is improved, but the device portability is limited and processing power is overwhelmed
Solution Approach 1:
The patent replaces software-based encryption with hardware-based encryption. The storage device includes a processor that performs encryption operations in hardware, eliminating the need for platform-specific software encryption. This hardware implementation maintains data security while improving device portability across different platforms.
Solution Approach 2:
The patent introduces a file attribute mechanism as an intermediary layer between the file system and hardware encryption. File attributes store protection level information that mediates between user access requests and hardware encryption/decryption operations, enabling seamless integration with existing file systems without requiring platform-specific software.
2Reliability
If hardware-based protection is implemented, then data security is improved, but the ability to provide per-file protection across various host file systems is lost
Solution Approach 1:
The patent creates a universal file attribute structure that can represent protection levels in a platform-independent manner. The file attribute mechanism can be integrated with various host file systems (NTFS, FAT32, exFAT, etc.), enabling hardware-based per-file protection across different file systems and platforms without requiring file system-specific modifications.
Solution Approach 2:
The patent uses file attributes to store protection level parameters that indicate the hardware protection state of files. By changing the parameter representation in file attributes, the system can communicate protection requirements between the file system, user interface, and hardware encryption module without being tied to any specific file system implementation.
3Reliability
If per-file protection is implemented, then security granularity is improved, but device complexity increases
Solution Approach 1:
The patent enables users to manage file protection settings through standard file attribute operations that are self-service in nature. Users can set, modify, and remove protection attributes on files through familiar file system operations, eliminating the need for complex dedicated management interfaces or procedures.
Solution Approach 2:
The patent merges the protection management functionality with the existing file system attribute structure. By integrating protection level information into standard file attributes, the system combines security management with file metadata management, reducing overall system complexity while maintaining fine-grained per-file protection control.
Data Source
AI summary
Described is a technology by which files that are hardware protected on a storage device, such as a USB flash drive, are managed on a host, including by integration with an existing file system. Each file maintained on a storage device is associated with a protection attribute that corresponds to that file's device hardware protection level. Requests directed towards accessing metadata or actual file data are processed based upon the protection attribute and a state of authentication, e.g., to allow or deny access, show file icons along with their level of protection, change levels, and so forth. Also described is splitting a file system file table into multiple file tables, one file table for each level of protection. Entries in the split file tables are maintained based on each file's current level; space allocation tracking entries are also maintained to track the space used by other split tables.