Patent Application
20080183734
The present invention relates to a computer file-systems, and particularly relates to a method and system of manipulating the original content of at least one original read-only computer file in a computer file-system in a computer system, where the computer system includes an operating system including a framework for in-line monitoring of accesses to the file-system.
A computer system typically includes a computer file-system. A computer system typically includes an operating system. The operating system may include a framework for in-line monitoring of accesses to the file-system. Such a framework could be a file-system filter driver.
Such a file-system filter driver would logically reside above the file-system stack and would have the ability to monitor and modify input/output requests that are sent to and completed from the underlying file-system. In addition, such a file-system filter driver could allow sophisticated file-data manipulation features, such as file data encryption and file data compression. Some modern operating systems support using file-system filter drivers to perform non-length preserving data transformations (e.g., file data encryption, file data compression). However, other operating systems do not provide such support. Thus, for those operating systems, there is a need to manipulate the original content of an original read-only computer file.
For example, an operating system based on Microsoft Corporation's Windows NT kernel (e.g., Windows 2000, Windows XP, Server 2003) does not support manipulating the original content of an original read-only computer file. Specifically, such an operating system does not support using file-system filter drivers to perform non-length preserving data transformations. Namely, in such an operating system, the underlying file-system discloses the on-disk length of the file to the operating system's cache manager directly, without giving any of the mounted filter drivers a chance to transform the length appropriately. For example, if a file were encrypted (using an algorithm that increases the file length)(i.e., transformed via a non-length preserving data transformation), the cache manager would see the encrypted file-length, which is larger than the decrypted length of the file. If the file were paged-in by the cache-manager for caching, the cache manager would attempt to stream in data past the decrypted end-of-file. Such an attempt would lead to incorrect computer system behavior or an application crash. Specifically, if the encrypted file were a kernel driver for the operating system, the computer system could display an operating system blue-screen and/or experience kernel panics.
As shown in prior art
Therefore, a method and system of manipulating the original content of at least one original read-only computer file in a computer file-system in a computer system, where the computer system includes an operating system including a framework for in-line monitoring of accesses to the file-system, is needed.
The present invention provides a method and system of manipulating the original content of at least one original read-only computer file in a computer file-system in a computer system, where the computer system includes an operating system including a framework for in-line monitoring of accesses to the file-system. In an exemplary embodiment, the method and system include (1) transforming the original content via a non-length-preserving data transformation algorithm, thereby resulting in transformed content, (2) storing the transformed content in a transformed computer file, (3) splitting the transformed computer file into a first file (F_1) and a second file (F_2), and (4) associating the first file (F_1) with the second file (F_2) in the file-system. In an exemplary embodiment, the non-length-preserving data transformation algorithm includes a length-increasing data transformation algorithm (i.e., encryption).
In an exemplary embodiment, the splitting includes (a) writing an amount of the transformed content to the first file (F_1) that equals the size of the original computer file and (b) saving the remainder of the transformed content to the second file (F_2). In an exemplary embodiment, the writing includes writing the first N bytes of the transformed computer file to the first file (F_1), where N equals the length of the original computer file. In an exemplary embodiment, the saving includes saving the bytes after the first N bytes of the transformed computer file to the second file (F_2). In an exemplary embodiment, the saving includes denying direct open requests for the second file (F_2).
In an exemplary embodiment, the associating includes, (a) if the file-system supports at least one alternate data stream, writing the second file (F_2) as an alternate data stream of the first file (F_1) and, (b) if the file-system does not support at least one alternate data stream, naming the second file (F_2) with a name derived from the name of the first file (F_1). In a further embodiment, the associating includes, if the file-system does not support at least one alternate data stream, removing the second file (F_2) from a directory listing of the file-system. In a further embodiment, the naming includes naming the second file (F_2) with a name derived from a cryptographic hash of at least the name of the first file (F_1). In a further embodiment, the naming includes naming the second file (F_2) with a name derived from a cryptographic hash of the name of the first file (F_1) and the data of the first file (F_1).
In a further embodiment, the present invention further includes, if a read request is received for the first file (F_1), retrieving the original content from the first file (F_1). In a further embodiment, the retrieving includes (a) recognizing that the first file (F_1) resulted from the transforming, (b) locating the second file (F_2) associated with the first file (F_1), (c) given the byte offset and byte length of the request and based on the non-length-preserving data transformation algorithm used in the transforming, determining whether to retrieve the transformed content from the first file (F_1), from the second file (F_2), or from the first file (F_1) and the second file (F_2), (d) retrieving the transformed content, based on the determining, from the first file (F_1), from the second file (F_2), or from the first file (F_1) and the second file (F_2), (e) performing the inverse transformation of the non-length-preserving data transformation algorithm on the retrieved transformed content, thereby resulting in the original content, and (f) returning the original content.
In a further embodiment, the present invention further includes, if a close request is received for the first file (F_1), closing the first file (F_1) and the second file (F_2).
The present invention also provides a computer program product usable with a programmable computer having readable program code embodied therein of manipulating the original content of at least one original read-only computer file in a computer file-system in a computer system, where the computer system includes an operating system including a framework for in-line monitoring of accesses to the file-system. In an exemplary embodiment, the computer program product includes (1) computer readable code for transforming the original content via a non-length-preserving data transformation algorithm, thereby resulting in transformed content, (2) computer readable code for storing the transformed content in a transformed computer file, (3) computer readable code for splitting the transformed computer file into a first file (F_1) and a second file (F_2), and (4) computer readable code for associating the first file (F_1) with the second file (F_2) in the file-system.
The present invention also provides a method of providing a service to manipulate the original content of at least one original read-only computer file in a computer file-system in a computer system, where the computer system includes an operating system including a framework for in-line monitoring of accesses to the file-system. In an exemplary embodiment, the method includes (1) transforming the original content via a non-length-preserving data transformation algorithm, thereby resulting in transformed content, (2) storing the transformed content in a transformed computer file (3) splitting the transformed computer file into a first file (F_1) and a second file (F_2) and (4) associating the first file (F_1) with the second file (F_3) in the file-system.
The present invention provides a method and system of manipulating the original content of at least one original read-only computer file in a computer file-system in a computer system, where the computer system includes an operating system including a framework for in-line monitoring of accesses to the file-system. In an exemplary embodiment, the method and system include (1) transforming the original content via a non-length-preserving data transformation algorithm, thereby resulting in transformed content, (2) storing the transformed content in a transformed computer file, (3) splitting the transformed computer file into a first file (F_1) and a second file (F_2), and (4) associating the first file (F_1) with the second file (F_2) in the file-system. In an exemplary embodiment, the non-length-preserving data transformation algorithm includes a length-increasing data transformation algorithm (i.e., encryption).
Referring to
Referring to
Writing
Referring to
Saving
Referring to
Denying
Referring to
Referring to
Referring to
Naming
Referring to
Referring to
Referring to
In a specific embodiment, recognizing step 922 includes checking a special attribute to the first file (F_1) in order to determine if the first file (F_1) resulted from transforming step 212.
In an exemplary embodiment, if the non-length-preserving data transformation algorithm includes a length-decreasing data transformation algorithm (i.e., compression), the present invention includes padding the transformed file such that the length of the padded file (F_1) equals the length of the original file and such that the length of the second file (F_2) is 0 bytes.
Referring to
The present invention can take the form of an entirely hardware embodiment, an entirely software embodiment, or an embodiment containing both hardware and software elements. In an exemplary embodiment, the present invention is implemented in software, which includes but is not limited to firmware, resident software, and microcode.
Furthermore, the present invention can take the form of a computer program product accessible from a computer-usable or computer-readable medium providing program code for use by or in connection with a computer system or any instruction execution system. The computer program product includes the instructions that implement the method of the present invention. A computer-usable or computer readable medium can be any apparatus that can contain, store, communicate, propagate, or transport the program for use by or in connection with the instruction execution system, apparatus, or device. The medium can be an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system (or apparatus or device) or a propagation medium. Examples of a computer-readable medium include a semiconductor or solid-state memory, magnetic tape, a removable computer diskette, a random access memory (RAM), a read-only memory (ROM), a rigid magnetic disk, and an optical disk. Current examples of optical disks include compact disk—read only memory (CD-ROM), compact disk—read/write (CD-R/W), and DVD.
A computer system suitable for storing and/or executing program code includes at least one processor coupled directly or indirectly to memory elements through a system bus. The memory elements include local memory employed during actual execution of the program code, bulk storage, and cache memories that provide temporary storage of at least some program code to reduce the number of times code is retrieved from bulk storage during execution. Input/output (I/O) devices (including but not limited to keyboards, displays, pointing devices, etc.) can be coupled to the computer system either directly or through intervening I/O controllers. Network adapters may also be coupled to the computer system in order to enable the computer system to become coupled to other computer systems or remote printers or storage devices through intervening private or public networks. Modems, cable modems, and Ethernet cards are just a few of the currently available types of network adapters.
Having fully described a preferred embodiment of the invention and various alternatives, those skilled in the art will recognize, given the teachings herein, that numerous alternatives and equivalents exist which do not depart from the invention. It is therefore intended that the invention not be limited by the foregoing description, but only by the appended claims.
