Apparatus and method for protecting data in linux-based operating system
AssigneeREALSECU Co., Ltd.
InventorMyeong Won SEO
Life of this patent
Estimating the term…
Abstract
Provided is an apparatus for protecting data in a Linux-based operating system, the apparatus including: a physical storage device; and a processor provided with a user application, a user library, a virtual file system (VFS), a kernel-based file system, a Filesystem in Userspace (FUSE) kernel driver, and a FUSE user daemon as software modules. A file containing protection target data may be safely protected by being stored in a FUSE storage area that is accessible only in a FUSE mount state.
Claims13
An apparatus for protecting data, comprising:
- a physical storage device;
- and
- a processor provided with a user application, a user library, a virtual file system (VFS), a kernel-based file system, a Filesystem in Userspace (FUSE) kernel driver, and a FUSE user daemon as software modules,
- wherein, when the user application provides request information requesting access to a FUSE file path to the user library, the user library provides the request information to the VFS,
- when a handler for the FUSE file path included in the request information is registered in advance, the VFS determines that a state is a FUSE mounted state and provides the request information to the FUSE kernel driver that is registered in advance,
- the FUSE kernel driver provides the request information to the FUSE user daemon,
- the FUSE user daemon directly accesses a file at a file address of the physical storage device predetermined to correspond to the FUSE file path through the kernel-based file system,
- the FUSE user daemon returns access result information for the file of the file address of the physical storage device to the FUSE kernel driver,
- the FUSE kernel driver returns the access result information for the file to the VFS,
- the VFS returns the access result information for the file to the user library,
- the user library returns the access result information for the file to the user application, and
- the file for the FUSE file path includes protection target data.
A method of protecting data performed by an apparatus including a physical storage device and a processor provided with a user application, a user library, a virtual file system (VFS), a kernel-based file system, a Filesystem in Userspace (FUSE) kernel driver, and a FUSE user daemon as software modules, the method comprising:
- providing, by the user application, request information requesting access to a FUSE file path to the user library;
- providing, by the user library, the request information to the VFS;
- when a handler for the FUSE file path included in the request information is registered in advance, determining, by the VFS, that a state is a FUSE mounted state and providing the request information to the FUSE kernel driver that is registered in advance;
- providing, by the FUSE kernel driver, the request information to the FUSE user daemon;
- directly accessing, by the FUSE user daemon, a file at a file address of the physical storage device predetermined to correspond to the FUSE file path through the kernel-based file system;
- returning, by the FUSE user daemon, access result information for the file of the file address of the physical storage device to the FUSE kernel driver;
- returning, by the FUSE kernel driver, the access result information for the file to the VFS;
- returning, by the VFS, the access result information for the file to the user library;
- and
- returning, by the user library, the access result information for the file to the user application,
- wherein the file for the FUSE file path includes protection target data.
A method of safely protecting an encryption key used to protect data communication in a network, the method comprising:
- implementing a Filesystem in Userspace (FUSE) mount to access a FUSE partition in which key data for the encryption key is stored;
- after the FUSE mount, writing or reading, by a FUSE user daemon, the key data in the FUSE partition;
- and
- performing FUSE unmount,
- wherein a virtual file system (VFS) processes mount of a file system.
Dependencies are inferred from the claim text.