METHOD AND APPARATUS FOR PROVIDING ACCESS TO FILES BASED ON USER IDENTITY

• US 20100169394A1
• Filed: 12/26/2008
• Published: 07/01/2010
• Est. Priority Date: 12/26/2008
• Status: Active Grant

• Current Assignee: Western Digital Israel Limited (Western Digital Corporation)
• Original Assignee: SanDisk IL Ltd. (Western Digital Corporation)
• Inventors: HAHN, Judah Gamliel
• Granted Patent: US 8,166,067 B2
• Time in Patent Office: Days
• US Class Current: 707/828
• CPC Class Codes: G06F 21/6227 where protection concerns the structure of data, e.g. records, types, queries
• CPC Class Codes: G06F 3/0622 in relation to access
• CPC Class Codes: G06F 3/0637 Permissions
• CPC Class Codes: G06F 3/0679 Non-volatile semiconductor memory device, e.g. flash memory, one time programmable memory [OTP]

Abstract

A storage device provides a file system to a host based on the access rights of a user determined during authentication. If the authentication does not succeed, the storage device provides to the user a file system restricted to files authorized by public access rights. If the authentication does succeed, and the user is a device owner, the storage device provides to the user the native file system. If the authentication succeeds, and the user is not a device owner, the storage device provides a file system that is restricted to files that the given user is authorized to access. Due to the internal nature of the mechanism for safeguarding files, this security measure cannot be circumvented by simply connecting the storage device to another host that does not respect the permission rules of the file system.

Claims

1. A method of providing a file system in a storage device, the method comprising:

commencing authentication of a user to at least a portion of a storage device;

if the authentication does not succeed, providing to the user a second file system, the contents of the second file system being restricted to files authorized by public access rights; and

if the authentication does succeed, determining whether the user is a device owner, and

if the user is a device owner, providing to the user a first file system, the first file system being a native file system of the storage device, and

if the user is not a device owner, providing to the user a second file system, the second file system being restricted to files that the user is authorized to access.

2. The method of claim 1, wherein the first file system includes an algorithm and a supporting data structure for determining access control rights.

3. The method of claim 1, wherein, for an authenticated user who is not a device owner, the restricting of the contents of the second file system is begun before beginning the process of authenticating the user.

4. The method of claim 1, wherein, for an authenticated user who is not a device owner, the restricting of the contents of the second file system is performed after determining that the user is not a device owner.

5. The method of claim 1, wherein the determining of whether the user is a device owner includes ascertaining ownership of a root directory of the first file system.

6. The method of claim 1, wherein the determining of whether the user is a device owner includes referencing access control rights stored in a non-volatile memory, the non-volatile memory being either within or outside of the first file system.

7. The method of claim 1, wherein the second file system is of a type that does not include an algorithm or a supporting data structure for determining access control rights.

8. The method of claim 1, wherein the first file system is an NTFS, and the second file system is an NTFS.

9. The method of claim 1, wherein the first file system is an ext2 file system, and the second file system is an ext2 file system.

10. The method of claim 1, wherein the first file system is an NTFS, and the second file system appears as a FAT file system.

11. A storage device, comprising:

a first memory module operative to store a first file system, the first file system being a native file system of the storage device;

a second memory module operative to store generated data;

an authentication module operative to determine an identity of a user; and

a controller operative to activate the authentication module and to provide to the user either the first file system or a second file system, depending on the identity of the user as determined by the authentication module,

wherein the providing of the second file system includes generating data based on file system structures of the first file system, according to the identity of the user and access control rights of the user, and

wherein the generated data is stored in the second memory module.

12. The storage device of claim 11, wherein the first file system includes an algorithm and a supporting structure for determining access control rights.

13. The storage device of claim 11, wherein the second file system is of a type that does not include an algorithm or a supporting data structure for determining access control rights.

14. The storage device of claim 11, wherein the second memory module contains volatile memory.

15. The storage device of claim 11, wherein the controller is operative to provide the second file system in the same format as that of the first file system.

16. The storage device of claim 11, wherein the first file system is an NTFS, and the second file system is an NTFS.

17. The storage device of claim 11, wherein the first file system is an ext2 file system, and the second file system is an ext2 file system.

18. The storage device of claim 11, wherein the first file system is an NTFS, and the second file system appears as a FAT file system.

19. A controller for a storage device, the controller comprising:

a first interface for communication with a host;

a second interface for communication with a first memory module, an authentication module, and a second memory module, the first memory module being operative to store a first file system, the first file system being a native file system of the storage device, the authentication module being operative to determine the identity of a user, and the second memory module being operative to store generated data; and

logic operative to activate the authentication module and to provide to the user either the first file system or a second file system, depending on the identity of the user as determined by the authentication module,

wherein the providing of the second file system includes generating data based on file system structures of the first file system, according to the identity of the user and access control rights of the user, and

wherein the generated data is stored in a second memory module.

20. The controller of claim 19, wherein the first file system includes an algorithm and a supporting data structure for determining access control rights.

21. The controller of claim 19, wherein the second file system is of a type that does not include an algorithm or a supporting data structure for determining access control rights.

22. The controller of claim 19, wherein the logic is operative to provide the second system in the same format as that of the first file system.

23. The controller of claim 19, wherein the first file system is an NTFS, and the second file system is an NTFS.

24. The controller of claim 19, wherein the first file system is an ext2 file system, and the second file system is an ext2 file system.

25. The controller of claim 19, wherein the first file system is an NTFS, and the second file system appears as a FAT file system.