Variable File System Sub-file Segmentation for Unauthorized Access Prevention
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing computer file systems are vulnerable to security breaches when an unauthorized user gains administrator access, as the security is managed by the operating system and can be bypassed by malicious programs or unauthorized users, leading to potential data leakage and loss.
Innovation Solution
A data storage apparatus with a variable computer file system that includes dedicated sub-file systems activated or deactivated based on user authentication, providing enhanced security by hiding and protecting file system objects from unauthorized access, using a separate management system independent of the host computer's OS.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If the file system is managed by the operating system with user authentication, then security is provided by different access rights for each user, but the security can be bypassed if an unauthorized user gains administrator access
Solution Approach 1:
The file system is segmented into multiple sub-file systems, each independently managed with its own authentication. This segmentation allows the system to isolate security-critical data into separate sub-file systems that require additional authentication beyond standard OS credentials, preventing unauthorized access even if administrator privileges are compromised.
Solution Approach 2:
An intermediary authentication layer is introduced between the OS and the file system. The storage device includes an authentication unit that verifies user credentials independently of the OS authentication mechanism. This intermediary layer acts as a mediator that can grant or deny access to sub-file systems based on its own authentication results, bypassing OS-level security vulnerabilities.
2Reliability
If multiple sub-file systems are introduced with independent authentication, then security against unauthorized access is enhanced, but the device complexity increases
Solution Approach 1:
Multiple sub-file systems are merged into a single storage device under unified management. The control unit coordinates authentication and mounting operations across all sub-file systems, while the authentication unit provides centralized credential verification. This merging approach maintains security benefits while reducing the complexity that would arise from completely separate storage devices.
Solution Approach 2:
The storage device is designed with multi-functionality to handle both standard OS-mounted file systems and authenticated sub-file systems. The authentication unit can verify multiple types of credentials (passwords, biometric data, security tokens), and the control unit can dynamically mount or unmount sub-file systems based on authentication results, providing universal access control across different security requirements.
3Reliability
If sub-file systems are activated only after authentication, then access control is improved, but the ease of operation decreases due to additional authentication steps
Solution Approach 1:
The file system activation is made dynamic based on authentication state. Sub-file systems are automatically mounted or unmounted by the control unit in response to authentication events. This dynamic behavior allows legitimate users to access protected data seamlessly after authentication, while maintaining strict access control without requiring manual intervention for each access request.
Solution Approach 2:
The authentication and mounting process is automated through self-service mechanisms. The authentication unit independently verifies user credentials and communicates authentication results to the control unit, which then automatically mounts or unmounts the appropriate sub-file systems. This self-service approach eliminates the need for manual configuration or intervention, simplifying the user experience while maintaining security.
Data Source
Figure 1~3
Figure 4
Figure 5~6
AI summary
The present invention relates to a data storage apparatus with a variable computer file system which adopts the concept of a dedicated sub-file system and is activated or deactivated according to whether authentication is granted. Each dedicated sub-file system is activated or deactivated according to whether authentication is granted, and is recognized by a host computer. Deactivated dedicated sub-file systems cannot be recognized or accessed by the host computer. Accordingly, since a third party accessing the host computer cannot access a dedicated sub-file system without possessing a means for activating the dedicated sub-file system, security is greatly strengthened.