Selective Storage Encryption via File-System Layer Segmentation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional disk encryption methods encrypt the entire disk, leading to lengthy initial encryption times and system unavailability during the process, and are unable to selectively encrypt specific data regions due to operating at a lower level than the file system.
Innovation Solution
A data conversion module operates at a higher level than the file system to selectively encrypt specific regions of a storage medium by decomposing data access requests into sector-level requests, using a data conversion auxiliary module to specify and manage encryption regions, and a data conversion module to encrypt and decrypt data at the sector level.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If the entire disk is encrypted using conventional disk encryption, then security is improved, but initial encryption time becomes excessively long and the system becomes unavailable during the process
Solution Approach 1:
The patent divides the disk encryption process into two levels: file-level encryption for selective regions and sector-level encryption for the entire disk. This segmentation allows encryption to be performed only on necessary regions rather than the entire disk, significantly reducing initial encryption time while maintaining security for protected files
Solution Approach 2:
The patent implements partial encryption by encrypting only the regions containing files that meet specific target conditions rather than encrypting the entire disk. This partial action approach reduces the scope of encryption operations, thereby reducing initial encryption time and allowing the system to remain available during encryption processes
2Reliability
If the entire disk is encrypted using conventional disk encryption, then security is improved, but the system becomes unavailable for work during the initial encryption process
Solution Approach 1:
The patent segments encryption operations into file-level and sector-level processes, allowing selective encryption of only necessary regions. This enables the system to maintain availability for non-encrypted regions while encryption is performed on specific files or folders, thus resolving the contradiction between security and system availability
Solution Approach 2:
The patent implements dynamic encryption where the encryption scope and priority can be adjusted based on system conditions and user needs. The file-level encryption allows flexible scheduling and priority assignment, enabling the system to dynamically balance security requirements with operational availability
3Productivity
If disk encryption is executed at a lower level than the file system, then encryption speed is improved, but the ability to selectively encrypt specific data regions is lost
Solution Approach 1:
The patent creates a dual-layer encryption architecture where file-level encryption provides selective region encryption capability and sector-level encryption provides fast encryption speed. This segmentation allows each layer to operate at its optimal level, combining the advantages of both approaches
Solution Approach 2:
The patent implements nested encryption where file-level encryption operates within the file system layer and sector-level encryption operates at the lower disk layer. The file-level encryption results are then encrypted at the sector level, creating a nested structure that provides both selectivity and speed
Data Source
Figure 1
Figure 2
Figure 3
AI summary
In a data conversion auxiliary module which is at a higher level than a file system in a disk management hierarchy, data stored in a storage medium, which becomes an object, is successively accessed. Then, a data conversion module captures a sector-unit access request to a device driver from the file system, converts data of a sector which is returned from the device driver, and writes the conversion data in the sector. Thereby, data conversion can be executed on a specific region of the storage medium, which is associated with the data in the storage medium.