Stackable file systems and methods thereof

• US 20050273858A1
• Filed: 06/07/2004
• Published: 12/08/2005
• Est. Priority Date: 06/07/2004
• Status: Abandoned Application

• Current Assignee: The Research Foundation for The State University of New York (State University of New York), The Felters Group
• Original Assignee: The Research Foundation for The State University of New York (State University of New York)
• Inventors: Wright, Charles P., Muniswamy-Reddy, Kiran-Kumar, Zadok, Erez, Aranya, Akshat, Das, Abhijith Damodara, Himmer, Andrew Paul, Miretskiy, Yevgeniy Y.
• Application Number:
  US10/862,212
• Publication Number:
  US 20050273858A1
• Time in Patent Office: Days
• US Class Current: 726/24
• CPC Class Codes: G06F 21/50 Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
• CPC Class Codes: G06F 21/56 Computer malware detection or handling, e.g. anti-virus arrangements
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: G06F 21/78 to assure secure storage of data address-based protection against unauthorised use of memory G06F12/14; record carriers for use with machines and with at least a part designed to carry digital markings G06K19/00
• CPC Class Codes: H04L 67/06 specially adapted for file transfer, e.g. file transfer protocol [FTP]
• CPC Class Codes: H04L 67/1097 for distributed storage of data in networks, e.g. transport arrangements for network file system [NFS], storage area networks [SAN] or network attached storage [NAS]

Abstract

An operating system kernel, including a protocol stack, includes a network layer for receiving a message from a data network, a stackable file system layer coupled to the network layer for inspecting the message, wherein the stackable file system layer is coupled to a storage device, the stackable file system determining and storing file system level information determined from the message, and a wrapped file system comprising a file targeted by the message coupled to the stackable file system layer for receiving the message inspected by the stackable file system.

Claims

1. An operating system kernel comprising a protocol stack comprising:

a network layer for receiving a message from a data network;

a stackable file system layer coupled to the network layer for inspecting the message, wherein the stackable file system layer is coupled to a storage device, the stackable file system determining and storing file system level information determined from the message; and

a wrapped file system comprising a file targeted by the message coupled to the stackable file system layer for receiving the message inspected by the stackable file system.

2. The protocol stack of claim 1, wherein the stackable file system layer comprises a filter, wherein the message is compared to the filter, the filter being one of a virus signature, and an expression specifying an object and an operation.

3. The protocol stack of claim 1, wherein the stackable file system layer comprises a filter, wherein the message is compared to the filter, the filter specifying file system operations triggering a version save to the storage device.

4. The protocol stack of claim 1, further comprising a virus scanning engine coupled between the stackable file system and the storage device, wherein the storage device includes a virus database of virus signatures accessed by the virus scanning engine.

5. The protocol stack of claim 4, wherein the message is scanned by the virus-scanning engine before data from a read is delivered to a user and before data from a write propagates to a data storage device.

6. The protocol stack of claim 1, wherein the stackable file system layer stores a version of the file targeted by the message upon determining a change in the file.

7. The protocol stack of claim 2, wherein the filter performs an operation trace, wherein the filter comprises:

an input filter for determining an operation to trace;

an assembly driver for converting the operation into a stream;

an output filter for performing a stream transformation; and

an output driver for writing the stream out from the kernel to the storage device.

8. A stackable file system method comprising:

mounting a stackable file system on top of a target file system, wherein a stackable file system is loaded in a kernel below a system call level and above a network layer;

exporting a mount point of the stackable file system to a client;

monitoring a message targeting a file in the target file system, through the stackable file system; and

storing information about the message upon determining that the message satisfies a filter.

9. The method of claim 8, wherein the stackable file system is mounted on a server comprising the target file system.

10. The method of claim 9, further comprising exporting the target file system to a proxy, wherein the proxy performs the exporting of the mount point of the stackable file system to a client.

11. The method of claim 8, wherein monitoring further comprises:

determining an operation in the message to trace;

converting the operation in a stream;

transformating the stream; and

writing the stream to a trace storage device.

12. The method of claim 11, wherein the transformation is one of a compression, an encryption, and a checksum.

13. The method of claim 8, wherein monitoring comprises:

comparing the message to the filter on-access, wherein the filter is a virus signature is a virus database; and

determining the message to include a virus upon determining a match; and

storing a version of the message including the virus.

14. The method of claim 13, wherein the on-access comparison is performed when a file is created, when the file is read for a first time, and when the file in modified.

15. The method of claim 8, wherein monitoring comprises:

determining the message to include an operation to change the target file system upon comparing the message to the filter, wherein the filter is a policy set; and

storing a version of the target file system upon making the change.

16. The method of claim 15, wherein the version is stored as a sparse file.

17. The method of claim 15, wherein the version is stored as a full or compressed file.

18. An operating system kernel having a protocol stack comprising:

a network layer for receiving a message from a data communications network;

a stackable file system layer coupled to the network layer adapted to encrypt or decrypt the message received the network layer, wherein the stackable file system layer is kernel mount providing an attachment point for one or more directories, each directory being added to an encrypted name-space of the stackable file system layer.

19. The operating system kernel of claim 18, wherein an owner of each directory provides a directory key to the stackable file system layer, wherein the stackable file system layer stores the key in a kernel space of the operating system kernel.

20. The operating system kernel of claim 19, wherein the owner is authenticated and bound to at least one of a user, a group, a session, a process, a process group, a time-of-day range, a client host MAC address or IP address.

21. The operating system kernel of claim 18, comprising a long-lived key used by the stackable file system layer to encrypt or decrypt data and meta-data, wherein the stackable file system layer uses the network layer to store ciphertext data, and a pinned core memory to store an encryption key.

22. The operating system kernel of claim 18, further comprising a cipher module for performing data encryption or data decryption.

23. The operating system kernel of claim 18, comprising variable length buffers for receiving encrypted data, the variable length buffer having a length equal to the length of the encrypted data.

24. The operating system kernel of claim 18, wherein encryption is performed in a cipher feedback mode.

25. The operating system kernel of claim 18, wherein the stackable file system layer associates each attached directory with an individual encryption key.

26. The operating system kernel of claim 18, the stackable file system layer maintains a separate name space for each set of encrypted files, wherein the separate name-space comprises an encryption key, one or more authorizations, and one or more active sessions.

27. The operating system kernel of claim 26, wherein the encryption key is specific to a cipher for the attached directory.

28. The operating system kernel of claim 26, each authorization and active session comprises a bitmask of permissions.

29. The operating system kernel of claim 18, wherein the stackable file system layer associates timeouts with at least one of a key, an authorization, and an active session.