Secure Runtime File Integrity via Key-Based Check Function
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods for securing critical data on mobile devices, such as smartphones, are vulnerable to attacks where unauthorized access occurs due to the lack of unique file identifiers in cryptographic checks, allowing attackers to manipulate file names and compromise security.
Innovation Solution
A method that creates a key-based check function linking data to a unique file identifier, ensuring that only authorized access is granted by verifying the file identifier during access commands, and storing data with a hash value under a file name in a non-volatile memory, preventing unauthorized file access and manipulation.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If conventional cryptographic methods are used without unique file identifiers, then the implementation is simpler, but security is compromised allowing unauthorized file access and manipulation
Solution Approach 1:
The patent combines the file content hash with the file identifier (filename or inode number) into a single check function input. This merging ensures that both the content and the identity of the file are verified, preventing unauthorized access and manipulation while maintaining a relatively simple implementation approach.
Solution Approach 2:
The patent performs preliminary hashing of the file content and concatenation with the file identifier during the file writing phase, before any access operations occur. This preliminary action ensures that the check function is pre-computed and stored alongside the file data, enabling fast verification during access without adding significant overhead to subsequent operations.
2Reliability
If file content is hashed without including file identifier, then storage space is reduced, but security is weakened allowing file name manipulation attacks
Solution Approach 1:
The patent merges the file identifier (which is already stored in the file system metadata) with the file content hash. Since the file identifier is typically already available in the file system structure, combining it with the hash adds minimal storage overhead while significantly enhancing security by preventing file name manipulation attacks.
3Reliability
If independent security elements like SIM cards are used, then security-critical data is protected, but device complexity and cost increase
Solution Approach 1:
The patent makes the file system itself serve multiple functions: it stores both regular files and security-critical data, and performs both file management and security verification. By enhancing the existing file system with the improved check function that includes file identifiers, the system achieves security-critical data protection without requiring separate dedicated security storage hardware.
Solution Approach 2:
The patent enables the file system to verify its own integrity by incorporating file identifiers into the check function. The file system uses its existing metadata (filenames or inode numbers) to create and verify checks, making the system self-protecting without requiring external security hardware or additional verification infrastructure.
Data Source
Figure 1
AI summary
The invention relates to a method for operating a computer unit (20) with a processor (24), on which a normal runtime environment (30) and a secure runtime environment (40) are implemented, and with a storage unit (26) for storing data to be stored in a file. The method has the following steps: generating a key-based checking function of a link between the data to be stored and a file identifier; and storing the data to be stored together with the generated checking function under a file name in the storage unit (26).