Storage Device Restricted Area Access via File System Smuggling
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current methods for accessing restricted storage areas, such as the boot partition, are complex and costly due to the need for device-specific, host-specific, and OS-specific applications that bypass security restrictions, and existing systems cannot read data from different logical addresses.
Innovation Solution
A method using FSAPI to access restricted areas by storing files with a smuggling indication, allowing the storage device to internally relocate data from non-restricted to restricted areas, utilizing techniques like Copy, Map-Out, and Map-In modes to enable authorized applications to read and write data in restricted areas.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If device-specific, host-specific, and OS-specific applications are used to access restricted areas, then access to restricted storage areas is enabled, but system complexity and cost increase significantly
Solution Approach 1:
The patent introduces a file system driver as an intermediary layer between the file system and storage device. This driver contains a smuggling detection scheme that intercepts file system requests and redirects them to appropriate storage locations. The driver acts as a mediator that enables restricted area access through standard file system operations without requiring device-specific applications, thereby reducing system complexity while maintaining security.
2Ease of operation
If standard FSAPI is used to access restricted areas, then ease of operation improves, but the ability to access privileged areas is lost
Solution Approach 1:
The patent segments the storage device into restricted and non-restricted areas, and segments the file system operations into standard FSAPI calls and smuggling detection responses. By dividing the system into these functional segments, standard file system operations can access restricted areas through the smuggling mechanism without compromising the security boundaries. The segmentation allows versatility in access methods while maintaining operational simplicity.
Solution Approach 2:
The smuggling detection scheme in the file system driver provides universal access to restricted areas through standard file system operations. Instead of requiring different access methods for different areas, the system uses a single unified approach where the driver detects smuggling attempts and redirects them appropriately. This multi-functional mechanism enables both standard file operations and restricted area access through the same interface.
3Productivity
If data is stored in restricted areas directly, then access efficiency improves, but security restrictions prevent standard file system access
Solution Approach 1:
The file system driver serves as an intermediary that maintains security restrictions while enabling efficient access to restricted areas. When the driver detects a smuggling attempt (a file system request targeting a restricted area), it redirects the request to the appropriate location and returns data through the normal file system interface. This intermediary mechanism preserves security boundaries while maintaining access efficiency, as the redirection happens transparently without requiring additional operations from the application.
4Adaptability or versatility
If special code from boot partition is loaded to access boot partition, then access to restricted areas is enabled, but system reboot and non-uniformity are required
Solution Approach 1:
The system implements self-service through the smuggling detection scheme in the file system driver. Instead of requiring external special code or reboot procedures to access restricted areas, the driver automatically detects smuggling attempts and handles the redirection internally. The system serves itself by maintaining security restrictions while enabling access through standard operations, eliminating the need for complex update procedures, reboots, or non-uniform components.
Data Source
AI summary
The present invention discloses methods for an application, running on a host system, to access a restricted area of a storage device, the method including the steps of: providing a file system for running on the host system; restricting access, by the file system, to the restricted area; sending an indication, from the application to the storage device, that data being sent by the application to the storage device via the file system is intended for the restricted area; detecting the indication in the storage device; and making the data, residing in the restricted area, available for reading by the application upon receiving an application request. Preferably, the method further includes the step of: releasing wasted areas, of the storage device, for use by the file system. Preferably, the method further includes the step of: copying non-restricted data from a non-restricted area into the restricted area.