Fast data protection using dual file systems

Patent metadata

Field	Value
Publication number	US-9697375-B2
Application number	US-201414401062-A
Country	US
Kind code	B2
Filing date	Jun 27, 2014
Priority date	Jun 27, 2014
Publication date	Jul 4, 2017
Grant date	Jul 4, 2017

Abstract

A computing device is described that utilizes two file systems to enable sensitive data stored thereon to be deleted automatically, quickly, and discretely when the computing device is in a risky environment or context or when data protection has otherwise been activated. A first file system on the computing device manages a first memory area that stores non-sensitive data while a second file system on the computing device manages a second memory area that stores sensitive data. Only the first file system operates to receive data requests from other processes executing on the computing device. In a first operating mode, the first file system interacts with the second file system to ensure that both non-sensitive and sensitive data is returned in response to data requests. In a second operating mode, communication between the two file systems is disabled and the second file system deletes the sensitive data.

First claim

What is claimed is:

1. A method for utilizing a first file system and a second file system executing on a computing device to protect sensitive data stored on the computing device, the first file system managing a first memory area that stores non-sensitive data and the second file system managing a second memory area that stores sensitive data, the first file system being configured to receive data requests generated by programs executing on the computing device, the method comprising:
in a first operating mode of the computing device, the first operating mode being a mode in which data protection has not been activated, servicing each data request received by the first file system by performing the following steps by the first file system:
when the data request specifies non-sensitive data, retrieving the non-sensitive data specified by the data request from the first memory area; and
when the data request specifies sensitive data, communicating with the second file system to cause the second file system to retrieve the sensitive data specified by the data request from the second memory area; and

in a second operating mode of the computing device, the second operating mode being a mode in which data protection has been activated, disabling communication between the first file system and the second file system such that data requests that specify sensitive data are not serviced, and servicing by the first file system only those data requests received by the first file system that specify non-sensitive data by retrieving the non-sensitive data specified by the data requests from the first memory area.

2. The method of claim 1 , further comprising:
in the second operating mode, deleting the sensitive data stored in the second memory area.

3. The method of claim 2 , wherein deleting the sensitive data stored in the second memory area comprises:
deleting one or more file pointers utilized by the second file system to manage interaction with one or more sensitive files stored in the second memory area.

4. The method of claim 3 , further comprising:
creating a secure backup copy of the one or more file pointers prior to deleting the one or more file pointers; and
in response to an initiation of a recovery operation, restoring the one or more file pointers from the secure backup copy.

5. The method of claim 2 , wherein deleting the sensitive data stored in the second memory area comprises one of:
overwriting sectors of a hard disk drive on which the sensitive data is stored; or
utilizing a secure deletion utility to erase the sensitive data from a solid state drive.

6. The method of claim 1 , wherein communicating with the second file system to cause the second file system to retrieve sensitive data specified by the data request from the second memory area and return the secure data specified by the data request to the first file system comprises:
communicating with the second file system to cause the second file system to retrieve encrypted data from the second memory area, decrypt the encrypted data to produce decrypted data, and return the decrypted data to the first file system.

7. The method of claim 1 , further comprising:
in response to determining that a user has changed a data type associated with first data from non-sensitive to sensitive, moving the first data from the first memory area to the second area; and
in response to determining that a user has changed a data type associated with second data from sensitive to non-sensitive, moving the second data from the second memory area to the first memory area.

8. The method of claim 1 , further comprising:
intermittently performing a defragmentation operation on the sensitive data stored in the second memory area.

9. The method of claim 1 , further comprising:
switching from the first operating mode to the second operating mode in response to detecting a context-based trigger.

10. A system, comprising:
at least one processor; and
one or more memory devices connected to the at least one processor, the one or more memory devices storing software components for execution by the at least one processor, the software components including:
a first file system configured to manage a first memory area that stores non-sensitive data and to receive data requests generated by programs during execution thereof; and
a second file system configured to manage a second memory area that stores sensitive data;
the first file system being further configured to service each data request received thereby by retrieving any non-sensitive data specified by the data request from the first memory area and by sending a request to the second file system to retrieve any sensitive data specified by the data request from the second memory area, and
the second file system being further configured to: (i) in a first operating mode of the computing device, the first operating mode being a mode in which data protection has not been activated, respond to requests from the first file system to retrieve sensitive data specified by data requests from the second memory area, and (ii) in a second operating mode of the computing device, the second operating mode being a mode in which data protection has been activated, ignore requests from the first file system to retrieve sensitive data specified by data requests from the second memory area.

11. The system of claim 10 , wherein the second file system is further configured to delete the sensitive data stored in the second memory area during the second operating mode.

12. The system of claim 11 , wherein the second file system is configured to delete the sensitive data stored in the second memory area by deleting one or more file pointers utilized by the second file system to manage interaction with one or more sensitive files stored in the second memory area.

13. The system of claim 12 , wherein the second file system is further configured to create a secure backup copy of the one or more file pointers prior to deleting the one or more file pointers and to restore the one or more file pointers from the secure backup copy in response to an initiation of a recovery operation.

14. The system of claim 11 , wherein the second file system is configured to delete the sensitive data stored in the second memory area by overwriting sectors of a hard disk drive on which the sensitive data is stored or by utilizing a secure deletion utility to erase the sensitive data from a solid state drive.

15. The system of claim 10 , wherein the second file system is configured to encrypt sensitive data to be stored to the second memory area and to decrypt sensitive data retrieved from the second memory area.

16. The system of claim 10 , wherein the software components further comprise a data protection management component that is configured to determine that a user has changed a data type associated with first data from non-sensitive to sensitive, and in response to the determination that the user has changed the data type associated with the first data from non-sensitive to sensitive, to interact with at least one of the first file system and the second file system to cause the first data to be moved from the first memory area to the second memory area; and
the data protection management component being further configured to determine that a user has changed a data type associated with second data from sensitive to non-sensitive, and in response to the determination that the user has changed the data type associated with the second data from sensitive to non-sensitive, to interact with at least one of the first file system and the se

Assignees

• Microsoft Technology Licensing Llc
• Liu Zhen
• Huang Jerry

Inventors

• Huang Jerry
• Liu Zhen

Classifications

• G06F21/6245

  Protecting personal data, e.g. for financial or medical purposes · CPC title

• G06F2221/2143

  Clearing memory, e.g. to prevent the data from being stolen · CPC title

• G06F21/50

  Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems · CPC title

• G06F2221/2107

  File encryption · CPC title

• G06F21/31

  User authentication · CPC title