Fast data protection using dual file systems

• US 9,697,375 B2
• Filed: 06/27/2014
• Issued: 07/04/2017
• Est. Priority Date: 06/27/2014
• Status: Active Grant

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Inventors: Huang, Jerry, Liu, Zhen
• Primary Examiner(s): DOAN, TRANG T
• Application Number:
  US14/401,062
• Publication Number:
  US 20160371500A1
• Time in Patent Office: 1,103 Days
• Field of Search: None
• CPC Class Codes: G06F 21/31 User authentication
• CPC Class Codes: G06F 21/50 Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
• CPC Class Codes: G06F 21/604 Tools and structures for managing or administering access control systems
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: G06F 21/6245 Protecting personal data, e.g. for financial or medical purposes
• CPC Class Codes: G06F 21/74 operating in dual or compartmented mode, i.e. at least one secure mode
• CPC Class Codes: G06F 21/78 to assure secure storage of data address-based protection against unauthorised use of memory G06F12/14; record carriers for use with machines and with at least a part designed to carry digital markings G06K19/00
• CPC Class Codes: G06F 2221/2107 File encryption
• CPC Class Codes: G06F 2221/2143 Clearing memory, e.g. to prevent the data from being stolen

Abstract

A computing device is described that utilizes two file systems to enable sensitive data stored thereon to be deleted automatically, quickly, and discretely when the computing device is in a risky environment or context or when data protection has otherwise been activated. A first file system on the computing device manages a first memory area that stores non-sensitive data while a second file system on the computing device manages a second memory area that stores sensitive data. Only the first file system operates to receive data requests from other processes executing on the computing device. In a first operating mode, the first file system interacts with the second file system to ensure that both non-sensitive and sensitive data is returned in response to data requests. In a second operating mode, communication between the two file systems is disabled and the second file system deletes the sensitive data.

Claims

1. A method for utilizing a first file system and a second file system executing on a computing device to protect sensitive data stored on the computing device, the first file system managing a first memory area that stores non-sensitive data and the second file system managing a second memory area that stores sensitive data, the first file system being configured to receive data requests generated by programs executing on the computing device, the method comprising:

in a first operating mode of the computing device, the first operating mode being a mode in which data protection has not been activated, servicing each data request received by the first file system by performing the following steps by the first file system;

when the data request specifies non-sensitive data, retrieving the non-sensitive data specified by the data request from the first memory area; and

when the data request specifies sensitive data, communicating with the second file system to cause the second file system to retrieve the sensitive data specified by the data request from the second memory area; and

in a second operating mode of the computing device, the second operating mode being a mode in which data protection has been activated, disabling communication between the first file system and the second file system such that data requests that specify sensitive data are not serviced, and servicing by the first file system only those data requests received by the first file system that specify non-sensitive data by retrieving the non-sensitive data specified by the data requests from the first memory area.

2. The method of claim 1, further comprising:

in the second operating mode, deleting the sensitive data stored in the second memory area.

3. The method of claim 2, wherein deleting the sensitive data stored in the second memory area comprises:

deleting one or more file pointers utilized by the second file system to manage interaction with one or more sensitive files stored in the second memory area.

4. The method of claim 3, further comprising:

creating a secure backup copy of the one or more file pointers prior to deleting the one or more file pointers; and

in response to an initiation of a recovery operation, restoring the one or more file pointers from the secure backup copy.

5. The method of claim 2, wherein deleting the sensitive data stored in the second memory area comprises one of:

overwriting sectors of a hard disk drive on which the sensitive data is stored;

or

utilizing a secure deletion utility to erase the sensitive data from a solid state drive.

6. The method of claim 1, wherein communicating with the second file system to cause the second file system to retrieve sensitive data specified by the data request from the second memory area and return the secure data specified by the data request to the first file system comprises:

communicating with the second file system to cause the second file system to retrieve encrypted data from the second memory area, decrypt the encrypted data to produce decrypted data, and return the decrypted data to the first file system.

7. The method of claim 1, further comprising:

in response to determining that a user has changed a data type associated with first data from non-sensitive to sensitive, moving the first data from the first memory area to the second area; and

in response to determining that a user has changed a data type associated with second data from sensitive to non-sensitive, moving the second data from the second memory area to the first memory area.

8. The method of claim 1, further comprising:

intermittently performing a defragmentation operation on the sensitive data stored in the second memory area.

9. The method of claim 1, further comprising:

switching from the first operating mode to the second operating mode in response to detecting a context-based trigger.

10. A system, comprising:

at least one processor; and

one or more memory devices connected to the at least one processor, the one or more memory devices storing software components for execution by the at least one processor, the software components including;

a first file system configured to manage a first memory area that stores non-sensitive data and to receive data requests generated by programs during execution thereof; and

a second file system configured to manage a second memory area that stores sensitive data;

the first file system being further configured to service each data request received thereby by retrieving any non-sensitive data specified by the data request from the first memory area and by sending a request to the second file system to retrieve any sensitive data specified by the data request from the second memory area, and

the second file system being further configured to;

(i) in a first operating mode of the computing device, the first operating mode being a mode in which data protection has not been activated, respond to requests from the first file system to retrieve sensitive data specified by data requests from the second memory area, and (ii) in a second operating mode of the computing device, the second operating mode being a mode in which data protection has been activated, ignore requests from the first file system to retrieve sensitive data specified by data requests from the second memory area.

11. The system of claim 10, wherein the second file system is further configured to delete the sensitive data stored in the second memory area during the second operating mode.

12. The system of claim 11, wherein the second file system is configured to delete the sensitive data stored in the second memory area by deleting one or more file pointers utilized by the second file system to manage interaction with one or more sensitive files stored in the second memory area.

13. The system of claim 12, wherein the second file system is further configured to create a secure backup copy of the one or more file pointers prior to deleting the one or more file pointers and to restore the one or more file pointers from the secure backup copy in response to an initiation of a recovery operation.

14. The system of claim 11, wherein the second file system is configured to delete the sensitive data stored in the second memory area by overwriting sectors of a hard disk drive on which the sensitive data is stored or by utilizing a secure deletion utility to erase the sensitive data from a solid state drive.

15. The system of claim 10, wherein the second file system is configured to encrypt sensitive data to be stored to the second memory area and to decrypt sensitive data retrieved from the second memory area.

16. The system of claim 10, wherein the software components further comprise a data protection management component that is configured to determine that a user has changed a data type associated with first data from non-sensitive to sensitive, and in response to the determination that the user has changed the data type associated with the first data from non-sensitive to sensitive, to interact with at least one of the first file system and the second file system to cause the first data to be moved from the first memory area to the second memory area;

and

the data protection management component being further configured to determine that a user has changed a data type associated with second data from sensitive to non-sensitive, and in response to the determination that the user has changed the data type associated with the second data from sensitive to non-sensitive, to interact with at least one of the first file system and the second file system to cause the second data to be moved from the second memory area to the first memory area.

17. The system of claim 10, wherein the second file system is further configured to intermittently perform a defragmentation operation on the sensitive data stored in the second memory area.

18. The system of claim 10, wherein the software components further include a data protection management component that is configured to switch from the first operating mode to the second operating mode in response to detecting a context-based trigger.

19. A computer program product comprising a computer-readable memory having computer program logic recorded thereon that when executed by at least one processor causes the at least one processor to perform a method for utilizing a first file system and a second file system executing on a computing device to protect sensitive data stored on the computing device, the first file system managing a first memory area that stores non-sensitive data and the second file system managing a second memory area that stores sensitive data, the first file system being configured to receive data requests generated by programs executing on the computing device, the method comprising:

in a first operating mode of the computing device, the first operating mode being a mode in which data protection has not been activated, servicing each data request received by the first file system by performing the following steps by the first file system;

when the data request specifies non-sensitive data, retrieving the non-sensitive data specified by the data request from the first memory area; and

when the data request specifies sensitive data, communicating with the second file system to cause the second file system to retrieve the sensitive data specified by the data request from the second memory area;

in a second operating mode of the computing device, the second operating mode being a mode in which data protection has been activated, disabling communication between the first file system and the second file system such that data requests that specify sensitive data are not serviced, and servicing by the first file system only those data requests received by the first file system that specify non-sensitive data by retrieving the non-sensitive data specified by the data requests from the first memory area.

20. The computer program product comprising the computer-readable memory of claim 19, wherein the method further comprises:

in the second operating mode, deleting the sensitive data stored in the second memory area.