Method and apparatus for providing access to files based on user identity

• US 8,166,067 B2
• Filed: 12/26/2008
• Issued: 04/24/2012
• Est. Priority Date: 12/26/2008
• Status: Active Grant

• Current Assignee: Western Digital Israel Limited (Western Digital Corporation)
• Original Assignee: SanDisk IL Ltd. (Western Digital Corporation)
• Inventors: Hahn, Judah Gamliel
• Primary Examiner(s): Nguyen, Phong
• Assistant Examiner(s): Ly, Anh
• Application Number:
  US12/344,407
• Publication Number:
  US 20100169394A1
• Time in Patent Office: 1,215 Days
• Field of Search: 707/781, 707/784, 707/785, 707/783, 707/828, 707/763, 715/741, 715/743, 715/719, 713/182, 713/161, 713/155, 726/2, 726/4, 726/17, 726/21, 726/27, 726/28
• US Class Current: 707/781
• CPC Class Codes: G06F 21/6227 where protection concerns the structure of data, e.g. records, types, queries
• CPC Class Codes: G06F 3/0622 in relation to access
• CPC Class Codes: G06F 3/0637 Permissions
• CPC Class Codes: G06F 3/0679 Non-volatile semiconductor memory device, e.g. flash memory, one time programmable memory [OTP]

Abstract

A storage device provides a file system to a host based on the access rights of a user determined during authentication. If the authentication does not succeed, the storage device provides to the user a file system restricted to files authorized by public access rights. If the authentication does succeed, and the user is a device owner, the storage device provides to the user the native file system. If the authentication succeeds, and the user is not a device owner, the storage device provides a file system that is restricted to files that the given user is authorized to access. Due to the internal nature of the mechanism for safeguarding files, this security measure cannot be circumvented by simply connecting the storage device to another host that does not respect the permission rules of the file system.

Claims

1. A method of providing a file system, the method comprising:

in a data storage device operatively coupled to a host device, performing;

commencing authentication of a user to determine access rights of the user to data stored at the data storage device;

in response to the user not being authenticated as having access rights other than public access rights to the data stored at the data storage device, providing to the host device a third file system, contents of the third file system being restricted to files authorized by the public access rights; and

in response to the user being authenticated as having access rights other than public access rights to the data stored at the data storage device, determining whether the user is authenticated as a device owner, wherein;

in response to the user being authenticated as the device owner, providing to the host device a first file system, the first file system being a native file system of the data storage device, and

in response to the user not being authenticated as the device owner, providing to the host device a second file system, the second file system being restricted to files that the user is authenticated as being authorized to access.

2. The method of claim 1, wherein the first file system includes instructions executable by a controller of the data storage device for determining access rights.

3. The method of claim 1, wherein, in response to the user not being authenticated as the device owner, the restricting of the contents of the second file system is begun before beginning the process of authenticating the user.

4. The method of claim 1, wherein the restricting of the contents of the second file system is performed after determining that the user is not authenticated as the device owner.

5. The method of claim 1, wherein authenticating whether the user is the device owner includes ascertaining ownership of a root directory of the first file system.

6. The method of claim 1, wherein authenticating whether the user is the device owner includes referencing access control rights stored in a non-volatile memory.

7. The method of claim 1, wherein the second file system is of a type that does not include an algorithm or a supporting data structure for determining access control rights.

8. The method of claim 1, wherein the first file system is a New Technology File System (NTFS), and the second file system is an NTFS.

9. The method of claim 1, wherein the first file system type is a Second Extended (ext2) file system, and the second file system is an ext2 file system.

10. The method of claim 1, wherein the first file system is a New Technology File System (NTFS), and the second file system appears as a File Allocation Table (FAT) file system.

11. A storage device, comprising:

a first memory module operative to store a first file system, the first file system being a native file system of the storage device and being of a first file system type;

a second memory module operative to store generated data;

an authentication module operative to authenticate a user; and

a controller operative to activate the authentication module and, in response to the user being authenticated as a device owner, to provide access to the first file system, and in response to the user not being authenticated as the device owner, to generate a second file system of the first file system type, wherein, depending on the authentication of the user as determined by the authentication module, a subset of files included in the first file system are included in the second file system and the second file system is stored in the second memory module.

12. The storage device of claim 11, wherein the first file system includes instructions for determining access control rights.

13. The storage device of claim 11, wherein the second file system does not include instructions for determining access control rights.

14. The storage device of claim 11, wherein the second memory module contains volatile memory.

15. The storage device of claim 11, wherein the first file system type is a New Technology File System (NTFS), and the second file system is an NTFS.

16. The storage device of claim 11, wherein the first file system is a Second Extended (ext2) file system, and the second file system is an ext2 file system.

17. A data storage device comprising:

a first memory module;

a second memory module;

an authentication module; and

a controller, wherein the controller includes;

a first interface operative to communicate with a host device while the data storage device is operatively coupled to the host device;

a second interface configured to communicate with the first memory module, the authentication module, and the second memory module, the first memory module being operative to store a first file system, the first file system being a native file system of the data storage device and having a first file system type, the authentication module being operative to determine the identity of a user, and the second memory module being operative to store generated data; and

logic operative to activate the authentication module and, in response to the user being authenticated as a device owner, to provide to the user access to the first file system, and in response to the user not being authenticated as the device owner, to generate a second file system having the first file system type and including a subset of files included in the first file system according to access rights of the user and to provide to the user access to the second file system.

18. The data storage device of claim 17, wherein the first file system includes instructions executable by the controller for determining access control rights.

19. The data storage device of claim 17, wherein the second file system does not include instructions executable by the controller for determining access control rights.

20. The data storage device of claim 17, wherein the first file system type is a New Technology File System (NTFS).

21. The data storage device of claim 17, wherein the first file system type is a Second Extended (ext2) file system.