USB Storage Access Control via Segmented Entities
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current USB storage devices lack file-level access control, leading to inadequate protection of sensitive data, as they either lack access control mechanisms or apply uniform disk-level access control, which is not flexible enough to protect specific data while allowing access to other storage spaces.
Innovation Solution
Implementing an access control module on the USB storage device that divides storage space into data storage entities, sets user access rights for each entity, and stores these rights as an access right list, allowing the module to determine and enforce access permissions based on user authentication, thereby providing finer granularity of access control.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If disk level access control is applied to USB storage devices, then data protection is improved, but access flexibility deteriorates as it cannot protect specific files while allowing access to other storage spaces
Solution Approach 1:
The patent segments the storage space into multiple data storage entities (files or folders) and applies access control to each entity independently through an access control list. This allows different access permissions for different files/folders while maintaining uniform disk-level structure, resolving the contradiction between comprehensive protection and access flexibility.
Solution Approach 2:
The patent implements local quality by assigning different access rights to different data storage entities within the same storage device. Each file or folder can have its own access control settings, allowing sensitive files to be protected while other files remain accessible, thus achieving both strong protection and flexible access.
2Adaptability or versatility
If file level access control is implemented on USB storage devices, then access flexibility is improved, but device complexity increases due to required extensions and key components
Solution Approach 1:
The patent achieves universality by making the access control module an integral part of the USB storage device that works with existing file systems without requiring separate extensions or key components. The access control list is stored within the device itself, allowing the system to provide file-level access control using existing infrastructure, thus reducing implementation complexity.
3Ease of operation
If USB storage devices use mass storage device standard, then ease of operation is improved, but data security deteriorates as devices can be accessed by any host without access control
Solution Approach 1:
The patent implements self-service by embedding the access control module directly in the USB storage device, allowing it to autonomously manage its own security without requiring external control systems. The device independently evaluates access requests against stored access control lists and enforces permissions, maintaining compatibility while providing built-in security.
Data Source
Figure 1~3
Figure 4~6
AI summary
The invention provides a USB storage device and an access control method thereof. An access control module is provided on the USB storage device. The storage space is divided into at least one data storage entity. Each user's access right to each data storage entity is set and stored in the USB storage device as an access control list. The process between the USB storage device's being connected with a USB host and its being disconnected from the USB host is one session. When a session is established, the user provides authentication information for the USB device to authenticate him/her, and saves the user information used in the current session. In the current session, when the host of the user issues an access request for the data storage entity on the USB storage device, the access control module queries the access right list based on the user information in the current session to determine whether the user has an access right to the requested data storage entity. When the user does not have the access right to the data storage entity, the access control module denies the user's access request for the data storage entity.