Storage drive protection using file system level encryption
Systems, devices and automated processes provide robust, computationally-efficient and secure protection of media content or other electronic data stored on a user-supplied storage device through the use of efficient file system encryption. Only certain portions of the content are encrypted by the host device, thereby reducing the computational demand in comparison to encrypting all of the content. By selecting the particular portions to encrypt, the formatting and structure of the stored data can be concealed, thereby making the use of the unencrypted content very difficult, if not impossible. In implementations based upon the XFS file system, for example, the superblocks that store header information about the files stored on the drive can be encrypted, thereby rendering the unencrypted content
1. An automated process performed by a host device comprising a processor, a memory and an interface configured to physically and electrically couple to a user-provided storage device, the automated process comprising:
formatting a data file by the host device for storing the data file within a file system of the user-provided storage device, wherein the data file spans a plurality of blocks of the file system of the user-provided storage device;
encrypting only a portion of the data file prior to storage within the file system of the user-provided storage device by the host device, wherein the encrypted portion of the data file comprises information that describes the remaining portions of the data file, and wherein the information that describes the remaining portions of the data file comprises header information that is stored within superblocks of the file system; and
writing the data file from the host device for storage within the file system of the user-supplied storage device.
2. The automated process of claim 1 wherein the information that describes the remaining portions of the data file comprises header information.
3. The automated process of claim 1 wherein the file system is an XFS file system, and wherein the information that describes the remaining portions of the data file comprises the superblocks of the XFS file system.
4. The automated process of claim 3 wherein the encrypted portion comprises only the superblocks of the file system.
5. The automated process of claim 4 wherein the encrypted portions are encrypted with AES- 128 encryption.
6. The automated process of claim 1 wherein the encrypted portions are encrypted using a cryptographic key that comprises the output of a hash function applied to a unique user identifier.
7. The automated process of claim 6 wherein the cryptographic key further comprises a global key known to the host device.
8. The automated process of claim 6 wherein the cryptographic key further comprises a value determined from an initialization vector (IV) known to the host device.
9. The automated process of claim 6 wherein the cryptographic key is stored in memory associated with the host device.
10. A host device to store media content on a user-supplied storage device, the host device comprising:
an interface to physically and electrically couple with the user-supplied storage device;
a memory configured to store computer-executable instructions; and
a processor configured to execute the computer-executable instructions to perform an automated process that comprises:
formatting a data file for storing the data file within a file system of the user-provided storage device, wherein the data file spans a plurality of blocks of the file system of the user-provided storage device;
encrypting only a portion of the data file prior to storage within the file system of the user-provided storage device by the host device, wherein the encrypted portion of the data file comprises header information that describes the remaining portions of the data file, and wherein the encrypted portions are encrypted using a cryptographic key that comprises the output of a hash function applied to a unique user identifier; and
writing the data file from the host device for storage within the file system of the user-supplied storage device.
11. The host device of claim 10 wherein the header information that describes the remaining portions of the data file comprises header information that is stored within superblocks of the file system.
12. The host device of claim 10 wherein the file system is an XFS file system, and wherein the information that describes the remaining portions of the data file comprises the superblocks of the XFS file system.
13. The host device of claim 10 wherein the cryptographic key further comprises a global key known to the host device and a value determined from an initialization vector (IV) known to the host device.
14. The host device of claim 13 wherein the cryptographic key is stored in the memory of the host device.
15. The host device of claim 10 wherein the interface is a universal serial bus (USB) interface.
16. The host device of claim 10 wherein the host device initially pairs with the user-supplied storage device by evaluating a device key and a user key previously stored on the user-supplied storage device.
17. The host device of claim 16 wherein the host device is a media encoder device that receives broadcast television signals via an antenna, that demodulates the received broadcast television signals, and that stores the demodulated broadcast television signals on the user-supplied storage device, and that produces a media stream transmitted to a remotely-located client device from the demodulated broadcast television signals stored on the user-supplied storage device.
18. A media encoder device to store media content on a user-supplied storage device, the media encoder device comprising:
a television receiver configured to receive the media content as broadcast television signals via an antenna and to demodulate the received broadcast television signals;
an interface to physically and electrically couple with the user-supplied storage device;
a memory configured to store computer-executable instructions; and
a processor configured to execute the computer-executable instructions to perform an automated process that comprises:
formatting a data file to store the demodulated broadcast television signals within a file system of the user-provided storage device, wherein the data file spans a plurality of blocks of the file system of the user-provided storage device;
encrypting only a portion of the data file prior to storage within the file system of the user-provided storage device by the host device, wherein the encrypted portion of the data file comprises information that describes the remaining portions of the data file; and
writing the data file from the host device for storage within the file system of the user-supplied storage device.
19. The media encoder device of claim 18 wherein the host device initially pairs with the user-supplied storage device by evaluating a device key and a user key previously stored on the user-supplied storage device.
20. The media encoder device of claim 19 wherein the processor is further configured to produce a media stream transmitted via a network to a remotely-located client device from the demodulated broadcast television signals stored on the user-supplied storage device.