# Patent

## Title
Method and apparatus for determining whether a private data area is safe to preserve

## Abstract

One embodiment of the present invention provides a system that configures a safety-tag that indicates whether a private data area is safe to preserve. During operation, the system receives a file with a private data area. Specifically, in one embodiment of the present invention, the private data area is contained within an Exchangeable Image File (EXIF) MakerNote tag, which allows makers of EXIF writers to record any desired information. Next, the system determines whether the private data area is safe to preserve. If the private data area is safe to preserve, the system configures a safety-tag to indicate that the private data area is safe to preserve. Otherwise, if the private data area is not safe to preserve, the system configures the safety-tag to indicate that the private data is not safe to preserve. Specifically, in one embodiment of the present invention, the safety-tag is a Digital Negative (DNG) MakerNoteSafety tag.

## Background
FIELD OF THE INVENTION
The present invention is related to data storage. More specifically, the present invention is related to determining whether a private data area in a file is safe to preserve to storage.
BACKGROUND
Related Art
As digital cameras and associated software applications proliferate, a dizzying number of file formats are emerging. Supporting all of them in every application has become impractical. As a result, a number of file format standards have been proposed.
Typically, file formats allow a user to store “private data” in a file. This is usually achieved by specifying a “private data area” in the file which can be utilized by users, such as camera manufacturers, to store desired data. For example, Extensible Image Format (EXIF) uses a MakerNote tag to store private data.
Note that a file is typically handled by a variety of applications (or systems). But, the private data area is usually understood only by the application (or system) that wrote the private data. As a result, an application (or a system) that does not understand the private data can corrupt the private data area while trying to preserve it. This can cause subsequent applications or systems that use the file to malfunction which can potentially have disastrous consequences.
Hence there is a need for a method and apparatus for determining whether a private data area in a file is safe to preserve.
SUMMARY
One embodiment of the present invention provides a system that configures a safety-tag that indicates whether a private data area is safe to preserve. During operation, the system receives a file with a private data area. Specifically, in one embodiment of the present invention, the private data area is contained within an Exchangeable Image File (EXIF) MakerNote tag, which allows makers of EXIF writers to record any desired information. Next, the system determines whether the private data area is safe to preserve. If the private data area is safe to preserve, the system configures a safety-tag to indicate that the private data area is safe to preserve. Otherwise, if the private data area is not safe to preserve, the system configures the safety-tag to indicate that the private data is not safe to preserve. Specifically, in one embodiment of the present invention, the safety-tag is a Digital Negative (DNG) MakerNoteSafety tag.
In a variation on this embodiment, if the private data area is safe to preserve, the system can perform a variety of operations. For example, the system can translate the file into another format; the system can modify the file; the system can move the private data area to another location within the file; or the system can move the private data area to another file. Note that the system preserves the private data area during all of these operations.
In a variation on this embodiment, if the private data area is not safe to preserve, the system can perform a variety of operations. For example, the system can decide not to preserve the private data area; the system can warn the user that the private data area is not safe to preserve; or the system can decide to preserve the private data area in spite of it being not safe to preserve.
In a variation on this embodiment, while determining whether the private data area is safe to preserve, the system determines whether all offsets within the private data area are relative-offsets that are relative to a location within the private data area, and which do not point to locations outside of the private data area.
In a variation on this embodiment, while determining whether the private data area is safe to preserve, the system determines whether all of the data within the private data area is byte-order independent.
Another embodiment of the present invention provides a system that determines whether a private data area is safe to preserve. During operation, the system receives a file containing a private data area and a safety-tag which indicates whether the private data area is safe to preserve. The system then reads the safety-tag to determine whether the private data area is safe to preserve. Note that in one embodiment of the present invention, the private data area is contained within an Exchangeable Image File (EXIF) MakerNote tag, which allows makers of EXIF writers to record any desired information. Furthermore, in one embodiment of the present invention, the safety-tag is a Digital Negative (DNG) MakerNoteSafety tag.



BRIEF DESCRIPTION OF THE FIGURES
FIG. 1 illustrates how a corrupted private data area can cause an application (or a system) to malfunction in accordance with an embodiment of the present invention.
FIG. 2 illustrates how a safety-tag, which indicates whether the private data area is safe to preserve, can be used by an application (or a system) in accordance with an embodiment of the present invention.
FIG. 3 presents a flowchart that illustrates the process of configuring a safety-tag in accordance with an embodiment of the present invention.
FIG. 4 presents a flowchart that illustrates the process of reading a safety-tag to determine whether a private data area is safe to preserve in accordance with an embodiment of the present invention.



DETAILED DESCRIPTION
The following description is presented to enable any person skilled in the art to make and use the invention, and is provided in the context of a particular application and its requirements. Various modifications to the disclosed embodiments will be readily apparent to those skilled in the art, and the general principles defined herein may be applied to other embodiments and applications without departing from the spirit and scope of the present invention. Thus, the present invention is not limited to the embodiments shown, but is to be accorded the widest scope consistent with the principles and features disclosed herein.
The data structures and code described in this detailed description are typically stored on a computer-readable storage medium, which may be any device or medium that can store code and/or data for use by a computer system. This includes, but is not limited to, magnetic and optical storage devices such as disk drives, magnetic tape, CDs (compact discs) and DVDs (digital versatile discs or digital video discs), and computer instruction signals embodied in a transmission medium (with or without a carrier wave upon which the signals are modulated). For example, the transmission medium may include a communications network, such as the Internet.
File Formats
As digital cameras and associated software applications proliferate, a dizzying number of file formats are emerging. Supporting all of them in every application has become impractical. As a result, a number of file format standards have been proposed.
Digital Negative (DNG) is one such standard. DNG is designed for storing “raw image data”. Digital cameras usually do not directly capture color images that can be read by a computer. Instead, an imaging device behind the lens typically captures grayscale images, with color filters over some of the grayscale images so that they only record light of a particular color. The digital camera then takes this “raw image data”, assigns color to the pixels based on the filters in place, combines it with user provided settings, and creates a color image. Then it compresses the image (e.g., using JPEG compression) and sends it to a computer.
An increasing number of photographers want to use the raw image data instead of using the processed file (e.g., JPEG file). This is because the raw image data offers them increased flexibility, quality, and control over the final color image. Before DNG, there was no accepted standard for storing raw image data. Not only did different camera manufacturers have their own file formats, but often a single manufacturer had multiple file formats. As a result, photographers were unable to easily use raw image data. DNG allows photographers to conveniently use raw image data because DNG-compatible devices and applications interoperate seamlessly.
Note that a file is simply a stream of data. Consequently, a standardized file format, such as DNG, usually specifies some form of metadata that enables an application (or a system) to interpret the data. Specifically, the metadata specified in DNG contains all of the information that an application (or a system) needs to convert an image file, even if the application was not designed for the specific imaging device. This metadata is what makes DNG so powerful and is the reason why DNG-compatible devices and applications can interoperate seamlessly.
Typically, file formats allow a user to store “private data” in a file. This is usually achieved by specifying a private data area in the file which users can utilize to store desired data. For example, Extensible Image Format (EXIF) uses a MakerNote tag to store private data.
Unfortunately, an application (or a system) that does not understand the private data can corrupt the private data area while trying to preserve it. This can cause subsequent applications to malfunction while using the file, which can potentially have disastrous consequences.
Private Data Areas and Safety-Tags
FIG. 1 illustrates how a corrupted private data area can cause an application (or a system) to malfunction in accordance with an embodiment of the present invention.
A file writer, such as digital camera 102, can write private data to a file, such as image file 104, which contains a private data area. Next, the file 104 can be used by an application (or a system), such as image editor 106, which does not understand the private data. This application (image editor 106) may corrupt the private data area while trying to preserve it in a file, such as image file 108, which now contains a corrupted private data area. This can subsequently cause image reader 110 to malfunction when it uses corrupted data from the private data area in image file 108.
Note that a private data area can be corrupted by an application (or a system) for various reasons. For example, absolute offsets in the private data can get corrupted when an application or a system moves the private data area to a new location within the file, or when the application moves the private data area to another file. Similarly, an application (or a system) can save the private data area in a different byte order or file format.
In one embodiment of the present invention, the system uses a safety-tag to indicate whether the private data area is safe to preserve or not. Specifically, in one embodiment of the present invention, the safety-tag is a DNG MakerNoteSafety tag.
FIG. 2 illustrates how a safety-tag, which indicates whether the private data area is safe to preserve, can be used by an application (or a system) in accordance with an embodiment of the present invention.
A file writer, such as digital camera 202, configures a safety-tag and stores it with the private data in a file, such as image file 204. Next, the file 204 is used by an application (or a system), such as image editor 206, which does not understand the private data. Image editor 206 then reads the safety-tag to determine whether the private data area is safe to preserve.
If the private data is safe to preserve, image editor 206 can preserve the private data area in a file, such as image file 208, without corrupting the private data area. Note that the image editor 206 can also store the safety-tag along with the image file 208. Subsequently, image reader 210 can safely use image file 208, which contains the uncorrupted private data area.
On the other hand, if the private data area is not safe to preserve, image editor 206 can decide not to preserve the private data area in a file, such as image file 212. Subsequently, image reader 214 can safely use image file 212, which does not contain the private data area.
Note that, in the absence of the safety-tag, image editor 206 could have erroneously preserved the private data area because it would not have known whether the private data area was safe to preserve. As a result, image editor 206 could have corrupted the private data area while preserving it to a file, which could have caused a subsequent image reader to malfunction. Hence, a safety-tag is very useful because it can prevent an application (or a system) from malfunctioning due to a corrupted private data area.
Process of Configuring a Safety-Tag
FIG. 3 presents a flowchart that illustrates the process of configuring a safety-tag in accordance with an embodiment of the present invention.
The process starts by receiving a file with a private data area (step 302). It will be obvious to one skilled in the art that a file can contain a variety of private data areas. Moreover, it will be evident to one skilled in the art that a private data area can be specified in a variety of ways. In one embodiment of the present invention, the private data area can be contained within an Exchangeable Image File (EXIF) MakerNote tag, which allows makers of EXIF writers to record any desired information.
Next, the system determines whether the private data area is safe to preserve. Specifically, the system can first check whether all offsets within the private data area are relative-offsets that are relative to a location within the private data area, and which do not point to locations outside of the private data area (step 304).
If all offsets within the private data area are relative-offsets that are relative to a location within the private data area, and which do not point to locations outside of the private data area, the system then determines whether all of the data within the private data area is byte-order independent (step 306). If so, the system configures a safety-tag to indicate that the private data area is safe to preserve (step 308).
Otherwise, if the private data contains an offset that is not a relative-offset, or if it contains an offset that is relative to a location outside the private data area, or if it contains an offset which points to a location outside of the private data area, or if it contains data that is not byte-order independent, the system configures a safety-tag to indicate that the private data area is not safe to preserve (step 310).
It will be evident to one skilled in the art that a safety-tag can be specified in a variety of ways. In one embodiment of the present invention, the safety-tag is a Digital Negative (DNG) MakerNoteSafety tag.
Note that if the system determines that a private data in a file is safe to preserve, it can preserve the private data area while performing a variety of operations. For example, the system can preserve the private data area while translating the file into another format, or while modifying the file. Moreover, the system can move the private data area to another location within the file, or it can move the private data area to another file.
On the other hand, if the system determines that a private data in a file is not safe to preserve, it can take a variety of counter-measures. For example, the system can decide not to preserve the private data area while translating or modifying the file. Similarly, the system can warn the user that the private data area is not safe to preserve. Furthermore, in one embodiment of the present invention, the system can decide to preserve the private data area in spite of it being not safe to preserve.
Process of Reading a Safety-Tag
FIG. 4 presents a flowchart that illustrates the process of reading a safety-tag to determine whether a private data area is safe to preserve or not in accordance with an embodiment of the present invention.
The process starts by receiving a file with a private data area and a safety-tag (step 402).
Next, the system reads the safety-tag (step 404).
The system then uses the safety-tag to determine whether the private data are is safe to preserve or not (step 406).
If the private data area is safe to preserve, the system then preserves the private data area (step 408). It will be readily apparent to one skilled in the art that the private data area can be preserved during a variety of operations. For example, the system can preserve the private data area while translating the file into another format, or while modifying the file. Moreover, the system can move the private data area to another location within the file, or it can move the private data area to another file.
On the other hand, if the private data is not safe to preserve, the system does not preserve the private data area (step 410). Specifically, the system can decide not to preserve the private data area while translating or modifying the file. Similarly, the system can warn the user that the private data area is not safe to preserve. Moreover, the system can decide not to move the private data area to another location within the file or to another file. Furthermore, in another embodiment of the present invention, the system can decide to preserve the private data area in spite of it being not safe to preserve.
The foregoing descriptions of embodiments of the present invention have been presented only for purposes of illustration and description. They are not intended to be exhaustive or to limit the present invention to the forms disclosed. Accordingly, many modifications and variations will be apparent to practitioners skilled in the art. Additionally, the above disclosure is not intended to limit the present invention. The scope of the present invention is defined by the appended claims.

## Claims

1. A method for configuring a safety-tag that indicates whether a private data area is safe to preserve, the method comprising:
determining whether a private data area of an electronic file is safe to preserve, wherein the same electronic file includes another data area in addition to the private data area, wherein the private data area includes private data written by an application or system, and wherein the electronic file is manipulatable by another application or system that understands data in said another data area and does not understand the private data;
wherein said determining whether the private data area is safe to preserve comprises determining whether the private data area could be corrupted when preserved; and
if the private data area is safe to preserve, configuring a safety-tag to indicate that the private data area is safe to preserve;
otherwise, if the private data area is not safe to preserve, configuring the safety-tag to indicate that the private data is not safe to preserve;
wherein the safety-tag is specific to said private data area and not to said another data area of the same electronic file.

2. The method of claim 1, wherein in response to said determining the private data area is safe to preserve, the method further comprises:
in the another application or system that does not understand the private data:
translating the file that contains the private data area into another format;
modifying the file that contains the private data area;
moving the private data area to another location within the file that contains the private data area; or
moving the private data area to another file.

3. The method of claim 1, wherein in response to determining the private data area is not safe to preserve, the method further comprises:
manipulating the file in the another application or system that does not understand the private data without preserving the private data area;
manipulating the file in the another application or system that does not understand the private data and preserving the private data area in spite of it being not safe to preserve; or
manipulating the file in the another application or system that does not understand the private data and warning a user that the private data area is not safe to preserve.

4. The method of claim 1, wherein said determining whether the private data area is safe to preserve comprises determining whether all offsets within the private data area are relative-offsets that are relative to a location within the private data area, and which do not point to locations outside of the private data area.

5. The method of claim 1, wherein said determining whether the private data area is safe to preserve comprises determining whether all of the data within the private data area is byte-order independent.

6. The method of claim 1, wherein the private data area is contained within an Exchangeable Image File (EXIF) MakerNote tag, which allows makers of EXIF writers to record any desired information.

7. The method of claim 1, wherein the safety-tag is a Digital Negative (DNG) MakerNoteSafety tag.

8. A method for determining whether a private data area is safe to preserve, the method comprising:
receiving an electronic file containing a private data area and a safety-tag which indicates whether the private data area is safe to preserve, wherein the same electronic file includes another data area in addition to the private data area, wherein the private data area includes private data written by an application or system, and wherein the electronic file is manipulatable by another application or system that understands data in said another data area and does not understand the private data; and
reading the safety-tag to determine whether the private data area is safe to preserve so as to not be corrupted when preserved, wherein the safety-tag is specific to said private data area and not to said another data area of the same electronic file.

9. The method of claim 8, wherein in response to determining the private data area is safe to preserve, the method further comprises:
in the another application or system that does not understand the private data:
translating the file into another format;
modifying the file;
moving the private data area to another location within the file; or
moving the private data area to another file.

10. The method of claim 8, wherein in response to determining the private data area is not safe to preserve, the method further comprises:
manipulating the file in the another application or system that does not understand the private data without preserving the private data area;
manipulating the file in the another application or system that does not understand the private data and preserving the private data area in spite of it being not safe to preserve; or
manipulating the file in the another application or system that does not understand the private data and warning a user that the private data area is not safe to preserve.

11. The method of claim 8, wherein the private data area is safe to preserve if all offsets within the private data area are relative-offsets that are relative to a location within the private data area, and which do not point to locations outside of the private data area.

12. The method of claim 8, wherein the private data area is safe to preserve if all of the data within the private data area is byte-order independent.

13. The method of claim 8, wherein the private data area is contained within an Exchangeable Image File (EXIF) MakerNote tag, which allows makers of EXIF writers to record any desired information.

14. The method of claim 8, wherein the safety-tag is a Digital Negative (DNG) MakerNote Safety tag.

15. A computer-readable storage medium, wherein the computer-readable storage medium is a storage device storing instructions that when executed by a computer cause the computer to perform a method for configuring a safety-tag that indicates whether a private data area is safe to preserve, the method comprising:
determining whether a private data area of an electronic file is safe to preserve, wherein the same electronic file includes another data area in addition to the private data area, wherein the private data area includes private data written by an application or system, and wherein the electronic file is manipulatable by another application or system that understands data in said another data area and does not understand the private data;
wherein said determining whether the private data area is safe to preserve comprises determining whether the private data area could be corrupted when preserved; and
if the private data area is safe to preserve, configuring a safety-tag to indicate that the private data area is safe to preserve;
otherwise, if the private data area is not safe to preserve, configuring the safety-tag to indicate that the private data is not safe to preserve;
wherein the safety-tag is specific to said private data area and not to said another data area of the same electronic file.

16. The computer-readable storage medium of claim 15, wherein in response to determining the private data area is safe to preserve, the method further comprises:
in the another application or system that does not understand the private data:
translating the file that contains the private data area into another format;
modifying the file that contains the private data area;
moving the private data area to another location within the file that contains the private data area; or
moving the private data area to another file.

17. The computer-readable storage medium of claim 15, wherein in response to determining the private data area is not safe to preserve, the method further comprises:
manipulating the file in the another application or system that does not understand the private data without preserving the private data area;
manipulating the file in the another application or system that does not understand the private data and preserving the private data area in spite of it being not safe to preserve; or
manipulating the file in the another application or system that does not understand the private data and warning a user that the private data area is not safe to preserve.

18. The computer-readable storage medium of claim 15, wherein said determining whether the private data area is safe to preserve comprises determining whether all offsets within the private data area are relative-offsets that are relative to a location within the private data area, and which do not point to locations outside of the private data area.

19. The computer-readable storage medium of claim 15, wherein said determining whether the private data area is safe to preserve comprises determining whether all of the data within the private data area is byte-order independent.

20. The computer-readable storage medium of claim 15, wherein the private data area is contained within an Exchangeable Image File (EXIF) MakerNote tag, which allows makers of EXIF writers to record any desired information.

21. The computer-readable storage medium of claim 15, wherein the safety-tag is a Digital Negative (DNG) MakerNoteSafety tag.

22. A computer-readable storage medium, wherein the computer-readable storage medium is a storage device storing instructions that when executed by a computer cause the computer to perform a method for determining whether a private data area is safe to preserve, the method comprising:
receiving an electronic file containing a private data area and a safety-tag which indicates whether the private data area is safe to preserve, wherein the same electronic file includes another data area in addition to the private data area, wherein the private data area includes private data written by an application or system, and wherein the electronic file is manipulatable by another application or system that understands data in said another data area and does not understand the private data; and
reading the safety-tag to determine whether the private data area is safe to preserve so as to not be corrupted when preserved, wherein the safety-tag is specific to said private data area and not to said another data area of the same electronic file.

23. The computer-readable storage medium of claim 22, wherein in response to determining the private data area is safe to preserve, the method further comprises:
in the another application or system that does not understand the private data:
translating the file into another format;
modifying the file;
moving the private data area to another location within the file; or
moving the private data area to another file.

24. The computer-readable storage medium of claim 22, wherein in response to determining the private data area is not safe to preserve, the method further comprises:
manipulating the file in the another application or system that does not understand the private data without preserving the private data area;
manipulating the file in the another application or system that does not understand the private data and preserving the private data area in spite of it being not safe to preserve; or
manipulating the file in the another application or system that does not understand the private data and warning a user that the private data area is not safe to preserve.

25. The computer-readable storage medium of claim 22, wherein the private data area is safe to preserve if all offsets within the private data area are relative-offsets that are relative to a location within the private data area, and which do not point to locations outside of the private data area.

26. The computer-readable storage medium of claim 22, wherein the private data area is safe to preserve if all of the data within the private data area is byte-order independent.

27. The computer-readable storage medium of claim 22, wherein the private data area is contained within an Exchangeable Image File (EXIF) MakerNote tag, which allows makers of EXIF writers to record any desired information.

28. The computer-readable storage medium of claim 22, wherein the safety-tag is a Digital Negative (DNG) MakerNoteSafety tag.

29. An apparatus for configuring a safety-tag that indicates whether a private data area is safe to preserve, the apparatus comprising: a storage device storing instructions executable to implement a method comprising:
determining whether a private data area of an electronic file is safe to preserve, wherein the same electronic file includes another data area in addition to the private data area, wherein the private data area includes private data written by an application or system, and wherein the electronic file is manipulatable by another application or system that understands data in said another data area and does not understand the private data;
wherein said determining whether the private data area is safe to preserve comprises determining whether the private data area could be corrupted when preserved; and
if the private data area is safe to preserve, configuring a safety-tag to indicate that the private data area is safe to preserve;
otherwise, if the private data area is not safe to preserve, the safety-tag to indicate that the private data is not safe to preserve;
wherein the safety-tag is specific to said private data area and not to said another data area of the same electronic file.

30. The apparatus of claim 29, wherein in response to determining the private data area is safe to preserve, the method further comprising:
in the another application or system that does not understand the private data:
translating the file that contains the private data area into another format;
modifying the file that contains the private data area;
moving the private data area to another location within the file that contains the private data area; or
moving the private data area to another file.

31. The apparatus of claim 29, wherein in response to determining the private data area is not safe to preserve, the method further comprising:
manipulating the file in the another application or system that does not understand the private data without preserving the private data area;
manipulating the file in the another application or system that does not understand the private data and preserving the private data area in spite of it being not safe to preserve; or
manipulating the file in the another application or system that does not understand the private data and warning a user that the private data area is not safe to preserve.

32. The apparatus of claim 29, wherein said determining comprises determining whether all offsets within the private data area are relative-offsets that are relative to a location within the private data area, and which do not point to locations outside of the private data area.

33. The apparatus of claim 29, wherein said determining comprises determining whether all of the data within the private data area is byte-order independent.

34. The apparatus of claim 29, wherein the private data area is contained within an Exchangeable Image File (EXIF) MakerNote tag, which allows makers of EXIF writers to record any desired information.

35. The apparatus of claim 29, wherein the safety-tag is a Digital Negative (DNG) MakerNoteSafety tag.

36. An apparatus for determining whether a private data area is safe to preserve, the apparatus comprising: a storage device storing instructions executable to implement a method comprising:
receiving an electronic file containing a private data area and a safety-tag which indicates whether the private data area is safe to preserve, wherein the same electronic file includes another data area in addition to the private data area, wherein the private data area includes private data written by an application or system, and wherein the electronic file is manipulatable by another application or system that understands data in said another data area and does not understand the private data; and
reading the safety-tag to determine whether the private data area is safe to preserve so as to not be corrupted when preserved, wherein the safety-tag is specific to said private data area and not to said another data area of the same electronic file.

37. The apparatus of claim 36, wherein in response to determining the private data area is safe to preserve, the method further comprising:
in the another application or system that does not understand the private data:
translating the file into another format;
modifying the file;
moving the private data area to another location within the file; or
moving the private data area to another file.

38. The apparatus of claim 36, wherein in response to determining the private data area is not safe to preserve, the method further comprising:
manipulating the file in the another application or system that does not understand the private data without preserving the private data area;
manipulating the file in the another application or system that does not understand the private data and preserving the private data area in spite of it being not safe to preserve; or
manipulating the file in the another application or system that does not understand the private data and warning a user that the private data area is not safe to preserve.

39. The apparatus of claim 36, wherein the private data area is safe to preserve if all offsets within the private data area are relative-offsets that are relative to a location within the private data area, and which do not point to locations outside of the private data area.

40. The apparatus of claim 36, wherein the private data area is safe to preserve if all of the data within the private data area is byte-order independent.

41. The apparatus of claim 36, wherein the private data area is contained within an Exchangeable Image File (EXIF) MakerNote tag, which allows makers of EXIF writers to record any desired information.

42. The apparatus of claim 36, wherein the safety-tag is a Digital Negative (DNG) MakerNoteSafety tag.