Method and system for data self-protection

Abstract

A system and method for data self-protection are provided. The system and method may include: installing a sentry on a computer system, the sentry including a file system filter installed on a kernel of the computer system; providing a central sentry platform in communication with the sentry; operating the central sentry platform to send a data self-protection policy to the sentry, the data self-protection policy being encrypted so that it can only be modified by the central sentry platform; operating the file system filter to control access to encrypted data stored on the computer system by: for each process making a file access request to the encrypted data, the file system filter receiving and processing the file access request according to the data self-protection policy; and operating the central sentry platform to monitor the sentry and receive information related to access to the encrypted data from the sentry.

Description

[0001] Related applications

[0002] This application claims priority to co-pending U.S. Patent Application No. 62 / 897,482, filed September 9, 2019, which is incorporated herein by reference in its entirety. Technical Field

[0003] The embodiments described herein relate generally to protecting data, and more particularly to systems and methods for self-protecting data. Background Art

[0004] The following is not an admission that anything discussed below is part of the prior art or part of the common general knowledge of a person skilled in the art.

[0005] Cybersecurity is the foundation of the digital society, and data is the foundation of the internet-based economy. At the core of cybersecurity is data security in complex cyberspace. As the world becomes increasingly digital, activities are increasingly reliant on data technologies. The compromise of critical data, such as core intellectual property, can jeopardize national and economic security. Alterations and / or loss of critical data can alter business processes, resulting in severe consequences, shutting down production lines, and negatively impacting people's lives. Therefore, protecting data against breaches and any known or unknown attacks at all times is a pressing need across many industries. Summary of the Invention

[0006] This summary is intended to introduce the reader to the more detailed description that follows and is not intended to limit or qualify any claimed or unclaimed inventions. One or more inventions may reside in any combination or subcombination of the elements or process steps disclosed in any portion of this document, including its claims and drawings.

[0007] According to one aspect of the present disclosure, a method for enabling data self-protection on at least one computer system is provided. The method may include: installing a sentry on a computer system of the at least one computer system, the sentry comprising a file system filter installed on the kernel of the computer system, the file system filter integrating mandatory access control with encryption; providing a central sentry platform in electronic communication with the sentry installed on the computer system, the central sentry platform being separate from the kernel of the computer system; operating the central sentry platform to send a data self-protection policy to the sentry, the data self-protection policy being encrypted so that the data self-protection policy can only be modified by the central sentry platform; operating the file system filter to control access to encrypted data stored on the computer system by: for each process making a file access request to the encrypted data, the file system filter receiving and processing the file access request to grant or deny the file access request according to the data self-protection policy; and operating the central sentry platform to monitor the sentry and receive information related to access to the encrypted data stored on the computer system from the sentry.

[0008] In some embodiments, the at least one computer system may include a plurality of computers; installing a sentry may include installing a plurality of sentries, including: for each computer in the plurality of computers, installing a corresponding sentry on the computer, installing the corresponding sentry on the computer may include installing a file system filter of the corresponding sentry on the kernel of the computer; providing a central sentry platform may include providing a central sentry platform on the computer system that is in electronic communication with the plurality of sentries; operating the central sentry platform to send a data self-protection policy may include operating the central sentry platform to send a plurality of data self-protection policies, including: for each sentry in the plurality of sentries, sending to the sentry a data self-protection policy. Corresponding data self-protection policy; operating the file system filter to control access to encrypted data stored on the computer system may include: for each of a plurality of computers, operating the file system filter of the corresponding sentry installed on the computer to control access to the encrypted data stored on the computer according to the corresponding data self-protection policy sent to the corresponding sentry; and operating the central sentry platform to monitor the sentry may include: for each of a plurality of computers, operating the central sentry platform to monitor the corresponding sentry on the computer, thereby receiving information related to access to encrypted data stored on the computer from the sentry.

[0009] In some embodiments, for each computer among multiple computers, operating the file system filter of the corresponding sentry installed on the computer may also include: operating the file system filter to check each access request made by each process to access encrypted data stored on the computer according to the corresponding data self-protection policy sent to the sentry, and the checking is performed in the following manner: if the corresponding data self-protection policy allows plaintext access, the access request is granted and the encrypted data is decrypted; if the corresponding data self-protection policy allows ciphertext access, the access request is granted without decrypting the encrypted data; or if the corresponding data self-protection policy allows neither plaintext access nor ciphertext access, the access request is denied; and operating the central sentry platform to monitor each sentry among multiple sentries and thereby receive information from the sentry may also include: monitoring each sentry to receive information about all checked access requests from the sentry.

[0010] In some embodiments, for each access request made by each process on each of the multiple computers, information about all checked access requests may include: for each access request made by each process on each of the multiple computers, information about the computer, information about the process including its application, file information of the encrypted data, the time of the access attempt associated with the access request, and the inspection result made by the corresponding sentry on the computer.

[0011] In some embodiments, the method may further include: for each of the plurality of computers, in addition to checking all access requests to encrypted data stored on the computer, operating a corresponding sentry installed on the computer to monitor the operation of the computer; for each of the plurality of computers, operating the central sentry platform to monitor each sentry may also include operating the central sentry platform to receive information related to the operation of the computer from the sentry.

[0012] In some embodiments, for each of a plurality of computers, the operating status of the computer may include, for a plurality of resources of the computer, a current usage level of each of the plurality of resources relative to a total capacity of the resources on the computer; the plurality of resources may include memory, processor, and disk space of the computer.

[0013] In some embodiments, for each of a plurality of computers, the data self-protection policy sent to the corresponding sentry installed on the computer may include: a plaintext authorization list having all legitimate applications of the process authorized to access the plaintext content of the encrypted data; and a ciphertext authorization list having all legitimate applications of the process authorized to access the ciphertext content of the encrypted data; for each access request to access the encrypted data, the file system filter of the sentry may make the following decision: when the process making the access request is authenticated by the sentry as a process of a legitimate application listed on the plaintext authorization list, allow plaintext access; when the process making the access request is authenticated by the sentry as a process of a legitimate application listed on the ciphertext authorization list, allow ciphertext access; otherwise, neither plaintext access nor ciphertext access is allowed.

[0014] In some embodiments, for each of a plurality of computers, installing a corresponding sentry on the computer may further include: installing a sentry application of the sentry on a user space of the computer, the user space being separate from a kernel space of the computer, the sentry application of the sentry being linked to communicate with a file system filter of the sentry; and providing a plurality of communication channels, which, for each of a plurality of computers, may include the following communication channels: the communication channels link the central sentry platform to the file system filter of the sentry for the computer via the sentry application for the computer.

[0015] In some embodiments, the method may further include: defining a heartbeat frequency for each of the plurality of sentries; operating the sentry to send a time sequence of heartbeats at the heartbeat frequency to the central sentry platform via a communication channel linking the central sentry platform to the file system filter of the sentry, the time sequence of heartbeats being encrypted such that the time sequence of heartbeats can only be modified by the sentry; monitoring the time sequence of heartbeats; and, based at least in part on monitoring the time sequence of heartbeats, operating the central sentry platform to evaluate a status of the sentry.

[0016] In some embodiments, the method may further include providing a visual display associated with the central sentry platform to display a plurality of access status indicators for indicating and displaying information regarding all inspected access requests received from the plurality of sentries.

[0017] In some embodiments, providing a visual display may include: providing multiple computer representations on the visual display, the multiple computer representations including, for each computer in the multiple computers, a corresponding computer representation for representing the computer; and, for each computer representation provided on the visual display, providing at least one access status indicator from a plurality of access status indicators in association with the computer representation to display and indicate at least part of the following information: the information is related to all checked access requests received from the corresponding sentry on the computer represented by the computer representation.

[0018] In some embodiments, the method may further include providing a visual display associated with the central sentry platform to display a plurality of operational status indicators for indicating and displaying operational conditions received from the plurality of sentries.

[0019] In some embodiments, providing a visual display may include: providing a plurality of computer representations on the visual display, the plurality of computer representations including, for each computer in the plurality of computers, a corresponding computer representation for representing the computer; and providing, for each computer representation provided on the visual display, at least one operating status indicator from a plurality of operating status indicators in association with the computer representation to display and indicate at least one operating condition received from a corresponding sentry on the computer represented by the computer representation.

[0020] In some embodiments, the method may further include providing a dynamic search function at the central sentry platform for searching for items contained in the information about all inspected access requests received from the plurality of sentries.

[0021] According to one aspect of the present disclosure, a system for enabling data self-protection is provided. The system may include at least one computer system, one of the at least one computer systems having a sentry installed on it, the sentry including a file system filter installed on the kernel of the computer system, the file system filter integrating mandatory access control with encryption; and a central sentry platform in electronic communication with the sentry installed on the computer system, the central sentry platform being separate from the kernel of the computer system. During operation, the central sentry platform may send a data self-protection policy to the sentry, the data self-protection policy being encrypted so that the data self-protection policy can only be modified by the central sentry platform; the file system filter may control access to encrypted data stored on the computer system in the following manner: for each process that makes a file access request to the encrypted data, the file system filter receives and processes the file access request according to the data self-protection policy to grant or deny the file access request; the central sentry platform may monitor the sentry and receive information from the sentry related to access to the encrypted data stored on the computer system.

[0022] In some embodiments, the at least one computer system may include multiple computers; a corresponding sentinel may be installed on each of the multiple computers, and the file system filter of the corresponding sentinel may be installed on the kernel of the computer; the central sentry platform may be set on a computer system that electronically communicates with the multiple sentries; the central sentry platform may be capable of operating to send multiple data self-protection policies, and for each of the multiple sentries, the multiple data self-protection policies include a corresponding data self-protection policy for the sentry; for each of the multiple computers, the file system filter of the corresponding sentry installed on the computer may be capable of operating to control access to encrypted data stored on the computer according to the corresponding data self-protection policy sent to the corresponding sentry; and, for each of the multiple computers, the central sentry platform may be capable of operating to monitor the corresponding sentry on the computer to receive information about access to encrypted data stored on the computer from the sentry.

[0023] In some embodiments, for each computer among multiple computers, the file system filter of the corresponding sentry installed on the computer can be operated to check each access request made by each process to access encrypted data stored on the computer according to the corresponding data self-protection policy sent to the sentry, and the checking is performed in the following manner: if the corresponding data self-protection policy allows plaintext access, the access request is granted and the encrypted data is decrypted; if the corresponding data self-protection policy allows ciphertext access, the access request is granted without decrypting the encrypted data; if the corresponding data self-protection policy allows neither plaintext access nor ciphertext access, the access request is denied; and the central sentry platform can be operated to monitor each sentry to receive information about all checked access requests from the sentry.

[0024] In some embodiments, for each access request made by each process on each of the multiple computers, information about all checked access requests may include: information about the computer, information about the process including its application, file information of the encrypted data, the time of the access attempt associated with the access request, and the inspection results made by the corresponding sentry on the computer.

[0025] In some embodiments, for each of the plurality of computers, in addition to checking all access requests to encrypted data stored on the computer, a corresponding sentry installed on the computer may also be operable to monitor the operation of the computer; and for each of the plurality of computers, the central sentry platform may be operable to receive information related to the operation of the computer from the corresponding sentry.

[0026] In some embodiments, for each of a plurality of computers, the operating status of the computer may include: for a plurality of resources of the computer, a current usage level of each of the plurality of resources relative to a total capacity of the resource on the computer; the plurality of resources may include the computer's memory, processor, and disk space.

[0027] In some embodiments, for each of a plurality of computers, the data self-protection policy sent to the corresponding sentry installed on the computer may include: a plaintext authorization list having all legitimate applications of the process authorized to access the plaintext content of the encrypted data; and a ciphertext authorization list having all legitimate applications of the process authorized to access the ciphertext content of the encrypted data; for each access request to access the encrypted data, the file system filter of the sentry may determine: when the process making the access request is authenticated by the sentry as a process of a legitimate application listed on the plaintext authorization list, plaintext access is allowed; when the process making the access request is authenticated by the sentry as a process of a legitimate application listed on the ciphertext authorization list, ciphertext access is allowed; otherwise, neither plaintext access nor ciphertext access is allowed.

[0028] In some embodiments, for each of the plurality of computers, a sentry application of the sentry may be installed on a user space of the computer, the user space being separate from a kernel space of the computer, the sentry application of the sentry being linked to communicate with a file system filter of the sentry; and, the system may further comprise a plurality of communication channels, which for each of the plurality of computers may comprise: a communication channel linking the central sentry platform to the file system filter of the sentry for the computer via the sentry application of the sentry for the computer.

[0029] In some embodiments, for each of the plurality of sentries, the sentry may be operable to send a time sequence of heartbeats at a heartbeat frequency to the central sentry platform via a communication channel linking the central sentry platform to the sentry's file system filter, the time sequence of heartbeats being encrypted such that the time sequence of heartbeats can only be modified by the sentry; the central sentry platform may be operable to monitor the time sequence of heartbeats; and, based at least in part on monitoring the time sequence of heartbeats, the central sentry platform may be operable to evaluate a status of the sentry.

[0030] In some embodiments, the central sentry platform may be operable to provide a visual display to display a plurality of access status indicators for indicating and displaying information regarding all inspected access requests received from a plurality of sentries.

[0031] In some embodiments, providing a visual display may include: providing multiple computer representations on the visual display, the multiple computer representations including, for each computer in the multiple computers, a corresponding computer representation for representing the computer; and, for each computer representation provided on the visual display, providing at least one access status indicator from a plurality of access status indicators in association with the computer representation to display and indicate at least part of the following information: the information is related to all checked access requests received from the corresponding sentry on the computer represented by the computer representation.

[0032] In some embodiments, the central sentry platform may be operable to provide a visual display to display a plurality of operational status indicators for indicating and displaying operational conditions received from a plurality of sentries.

[0033] In some embodiments, providing a visual display may include: for each computer in a plurality of computers, providing a plurality of computer representations on the visual display, the plurality of computer representations including a corresponding computer representation for representing the computer; and, for each computer representation provided on the visual display, providing at least one operating status indicator from a plurality of operating status indicators in association with the computer representation to display and indicate at least one operating condition received from a corresponding sentry on the computer represented by the computer representation.

[0034] In some embodiments, the central sentry platform may be operable to provide a dynamic search function for searching for items contained in information about all inspected access requests received from multiple sentries. BRIEF DESCRIPTION OF THE DRAWINGS

[0035] For a better understanding of the described embodiments and to show more clearly how they may be effectively carried into effect, reference will now be made, by way of example, to the accompanying drawings, in which:

[0036] Figure 1 is a block diagram of an example computer system according to an embodiment;

[0037] Figure 2 is a block diagram of an example system for enabling data self-protection, according to an embodiment; and

[0038] Figure 3 is a flow chart of an example method for enabling data self-protection, according to an embodiment.

[0039] The drawings described below are provided for the purpose of illustrating, but not limiting, the aspects and features of the various examples of the embodiments described herein. To simplify and clarify the description, the elements shown in the drawings are not necessarily drawn to scale. For clarity, the dimensions of some of these elements may be exaggerated relative to other elements. It should be understood that, to simplify and clarify the description, reference numerals may be repeated in the drawings to indicate corresponding or similar elements or steps, where deemed appropriate. DETAILED DESCRIPTION

[0040] Various systems or methods are described below to provide examples of implementations of the claimed subject matter. The implementations described below do not limit any claimed subject matter, and any claimed subject matter may encompass methods or systems that are different from the methods or systems described below. The claimed subject matter is not limited to systems or methods having all of the features of any one of the systems or methods described below, or to features common to multiple or all of the devices or methods described below. The systems or methods described below may not be implementations recited in any claimed subject matter. Any subject matter disclosed in the systems or methods described below that is not claimed in this document may be the subject of another claimed document, such as a continuation patent application, and the applicants, inventors, or owners do not intend to abandon, relinquish, or make available to the public any such subject matter by disclosure herein.

[0041] In addition, it should be understood that in order to make the description simple and clear, reference numerals may be repeated in the drawings to indicate corresponding or similar elements where deemed appropriate. In addition, many specific details are set forth to provide a thorough understanding of the embodiments described herein. However, those of ordinary skill in the art will understand that the embodiments described herein can be implemented without these specific details. In other cases, well-known methods, procedures, and components are not described in detail so as not to confuse the embodiments described herein. In addition, the drawings and description are not to be considered as limiting the scope of the embodiments described herein.

[0042] It should also be noted that, as used herein, the term "and / or" is intended to mean an inclusive or. That is, for example, "X and / or Y" is intended to mean X or Y or both. As a further example, "X, Y and / or Z" is intended to mean X or Y or Z or any combination thereof.

[0043] Unless expressly stated otherwise, the terms "include," "comprising," and variations thereof mean "including but not limited to." A listing of items does not imply that any or all of those items are mutually exclusive, unless expressly stated otherwise. The terms "a," "an," and "the" mean "one or more," unless expressly stated otherwise.

[0044] As used herein and in the claims, two or more elements are said to be "coupled," "connected," "attached," or "fastened" when they are joined or operated together, either directly or indirectly (i.e., through one or more intermediate components), as long as there is a link. As used herein and in the claims, two or more elements are said to be "directly coupled," "directly connected," "directly attached," or "directly fastened" when they are connected to each other in physical contact. The terms "coupled," "connected," "attached," and "fastened" do not distinguish the manner in which two or more elements are joined together.

[0045] Unless expressly stated otherwise, the terms "one embodiment," "an embodiment," "multiple embodiments," "the embodiment," "the multiple embodiments," "one or more embodiments," "some embodiments," and "an embodiment" mean "one or more (but not all) embodiments of the invention."

[0046] It should be noted that when used herein, terms of degree such as "substantially", "about" and "approximately" refer to a reasonable amount of deviation of the modified term such that the end result is not significantly changed. These terms of degree should be construed as including the deviation of the modified term if such deviation would not negate the meaning of the modified term.

[0047] Various aspects of the embodiments of the systems and methods described herein can be implemented in hardware or software, or a combination of both. Various aspects of these embodiments can be implemented in a computer program executed on a programmable computer, each computer comprising: at least one processor, a data storage system (including volatile memory or non-volatile memory or other data storage elements or a combination thereof), and at least one communication interface. For example, but not limited to, the programmable computer can be a server, a network appliance, an embedded device, a computer expansion module, a personal computer, a laptop computer, a personal data assistant, a cellular phone, a smartphone device, a tablet computer, a wireless device, or any other computing device that can be configured to perform various aspects of the methods described herein.

[0048] In some embodiments, the communication interface can be a network communication interface. In an embodiment in which elements are combined, the communication interface can be a software communication interface, such as an interface for inter-process communication (IPC). In other embodiments, there can be a combination of communication interfaces implemented as hardware, software, and combinations thereof.

[0049] Program code can be applied to input data to perform the functions described herein and generate output information. The output information can be applied to one or more output devices in a known manner. Each program can be implemented in high-level processes or object-oriented programming and / or scripting languages or both to communicate with a computer system. However, if necessary, the program can be implemented in assembly language or machine language. In any case, the language can be a compiled language or an interpreted language. Each such computer program can be stored on a storage medium or device (e.g., ROM, disk, CD), which can be read by a general or special programmable computer for configuring and operating the computer to perform the processes described herein when the storage medium or device is read by the computer. Aspects of the embodiments of the system can also be considered to be implemented as a non-transitory computer-readable storage medium, which is configured with a computer program, wherein the storage medium is so configured that the computer operates in a specific and predefined manner to perform the functions described herein.

[0050] Furthermore, aspects of the systems, processes, and methods of the described embodiments can be distributed in a computer program product comprising a computer-readable medium carrying computer-usable instructions for one or more processors. The medium can be provided in various forms, including one or more floppy disks, high-density magnetic disks, magnetic tapes, chips, wired transmissions, satellite transmissions, Internet transmissions or downloads, magnetic and electronic storage media, digital and analog signals, and the like. The computer-usable instructions can also be in various forms, including compiled and non-compiled code.

[0051] It's important to note that the term "application" is an abbreviation for "application program," which refers to a computer program designed to perform specific functions for an end user. Therefore, from the end user's perspective, programs in a computer system are often called applications. For example, end users often refer to Microsoft Windows Word as a word processing application, while within the operating system, the program is winword.exe.

[0052] Numerous computer security technologies have been proposed, including firewalls, role-based access control, data backup services, and data encryption. In addition, best practices and enforcement of regulations and policies are recommended. Firewall technology aims to prevent malware from invading computer systems. Role-based access control restricts system access to authorized users based on their roles and permissions. Data backup archives data on a predetermined schedule to prevent data loss. Encryption encodes plaintext files into an unrecognizable form unless decrypted using the corresponding decryption key.

[0053] While the aforementioned computer security technologies can be effective to a certain extent, they are all vulnerable to sophisticated attacks, as evidenced by the fact that 90% of all large organizations experienced data breaches and / or ransomware attacks in the past 12 months. In today's interconnected cyber-physical-human network, computer security depends on the strength of the weakest link at its weakest moment. Since it's difficult for humans to maintain 24 / 7 vigilance, malware can exploit the weakest links and moments to enter computer networks through sophisticated known or unknown attacks. Once malware is within a computer network, all network technologies can become ineffective.

[0054] Malware scanning and detection technologies face the challenge of uncertainty from unknown attacks and also place a huge computational burden on the protected system. The inventors have developed a method and system that can protect data from a data-centric perspective to proactively and effectively defend data.

[0055] Described herein are various embodiments of systems, methods, computer program products, and apparatus for providing edge security, data self-protection, and central monitoring and management. Generally speaking, the embodiments described herein provide data self-protection with encryption and process-based access supervision via kernel file system filters that act as data security sentries. Sentry builds on process-based access supervision, where authorized processes are granted desired access rights to encrypted data, while unauthorized processes (such as malware) are denied any access to the encrypted data. Sentry can be connected to a central Sentry platform for data analysis and visualization, as well as central monitoring and management. The embodiments described herein can protect data from data breaches and known and unknown attacks, including ransomware and phishing attacks.

[0056] The embodiments described herein may provide a process-based encrypted data access supervision system. The system may include a data storage device for storing encrypted data, a file system filter, and a sentry application. The file system filter may operate as an interface between the data stored in the data storage device and various applications attempting to access the data. The file system filter may encrypt data, decrypt data, supervise application processes attempting to access the data, authenticate processes, and authorize them accordingly. The embodiments described herein may also include kernel-level process authentication and authorization in a process-based encrypted data access supervision system. In particular, the embodiments described herein may be used to: supervise processes attempting to access encrypted data, authenticate processes, grant plaintext content access only to processes authorized to access plaintext, grant ciphertext content access only to processes authorized to access ciphertext, and deny access requests to all unauthorized processes.

[0057] The process authentication and authorization steps may include three stages:

[0058] 1. Configuration: First, the access permissions for each of the allowed legal processes can be determined. Then, the data self-protection policy between the allowed legal processes and their corresponding access permissions can be provided to the kernel-level file system filter.

[0059] 2. Process authentication: The real identity of the calling process can be checked and compared with the real identity in the data self-protection policy.

[0060] 3. Process authorization: The access permissions granted to the authenticated calling process can be checked according to the data self-protection policy and authorized accordingly.

[0061] Now refer to Figure 1 , shows an example computer system 10 according to an embodiment. Computer system 10 may include hardware components 40, such as a processor 42, a data storage device 44, and a communication interface 46. Computer system 10 may execute various software, such as kernel 30 and applications 20, using hardware components 40. In some embodiments, computer system 10 may be a server configured to provide services to other computer systems.

[0062] Processor 42 may be implemented using any suitable processor, controller, digital signal processor, graphics processing unit, application specific integrated circuit (ASIC), and / or field programmable gate array (FPGA) that can provide sufficient processing power for the configuration, purpose, and requirements of computer system 10. Processor 42 may include more than one processor, each configured to perform a different dedicated task. Processor 42 may execute instructions to run various software stored in data storage device 44, such as application programs 20 and kernel 30.

[0063] Data storage 44 may include RAM, ROM, one or more hard drives, one or more flash drives, or some other suitable data storage element, such as a disk drive, direct-attached storage, network-attached storage, and a storage area network. Data storage 44 may be used to store various computer programs, such as kernel 30 and applications 20. Data storage 44 may include volatile and non-volatile memory. During operation, computer programs stored in non-volatile memory may be loaded into volatile memory for rapid access by processor 42.

[0064] The communication interface 46 may include any interface that enables the computer system 10 to communicate with various devices and other systems. For example, in some embodiments, the communication interface 46 may include at least one of a serial port, a parallel port, or a USB port. The communication interface 46 may also include an interface established with a component through one or more of the Internet, a local area network (LAN), Ethernet, FireWire, a modem, optical fiber, a digital subscriber line connection, or other networks. Various combinations of these elements may be included in the communication interface 46. For example, the communication interface 46 may receive input from various input devices, such as a mouse, keyboard, touch screen, thumb wheel, trackpad, trackball, card reader, voice recognition software, etc., depending on the requirements and implementation of the computer system 10.

[0065] Application 20 can be any computer program that can be executed by computer system 10. Users can use application 20 to interact with computer system 10. For example, application 20 can include a word processor, a spreadsheet program, a web browser, a media player, a file viewer, a photo editor, etc. Application 20 generally cannot directly access hardware components 40. Instead, access to hardware components 40 is typically provided through kernel 30. That is, kernel 30 can control the interaction between application 20 and hardware components 40. Kernel 30 is generally responsible for managing hardware components 40 and is typically a subcomponent of the operating system of computer system 10. In other words, kernel 30 can allocate hardware resources 40 to execute application 20. For example, kernel 30 can perform memory, CPU and device management, file management, and system call management. Application 20 must generally issue system calls to kernel 30 to access hardware resources 40, such as file read / write.

[0066] During operation, the kernel 30 and applications 20 may be loaded from the data storage 44 for access and execution by the processor 42. The kernel 30 may be loaded from the applications 20 onto a separate, protected portion of the data storage 44. The portion of the data storage 44 where the kernel 30 is loaded may be protected from access by the applications 20 and, in some cases, from access by other components of the operating system. Accordingly, the data storage 44 may be segregated into a kernel space for loading the kernel 30 and a user space for loading the applications 20. The user space may include all portions of the data storage 44 except the kernel 30.

[0067] Now refer to Figure 2, which shows an example system 100 for data self-protection according to some embodiments. The data self-protection system 100 can provide process-based encrypted data access supervision. In some embodiments, the data self-protection system 100 can provide a data protection solution that protects the security of data stored on a computer system from data leakage and any known attacks and unknown attacks (including phishing and ransomware attacks), while seamlessly supporting various types of services (such as SharePoint, Exchange, SQL, Perforce, Web servers, etc.) to transparently access encrypted and protected data. In some embodiments, the system 100 can provide a data self-protection solution at the file system level on an endpoint computer system to protect from data leakage and any known attacks and unknown attacks (including phishing and ransomware attacks), while allowing legitimate end users to access protected data in a transparent manner.

[0068] The data self-protection system 100 includes a central sentry platform 140 and at least one sentry 110. Although only two sentries 110a and 110b are shown in the illustrated example, it should be understood that the data self-protection system 100 may include any number of sentries 110. The central sentry platform 140 and at least one sentry 110 are installed on one or more computer systems 10. Each sentry 110 is generally installed on a separate computer system 10 and is operable to protect data stored on that computer system 10 using an integrated combination of encryption and process-based access control. For example, the data self-protection system 100 may include multiple computer systems 10, each having a sentry 110 installed thereon. In the illustrated example, a first sentry 110a is installed on the first computer system 10a, and a second sentry 110b is installed on the second computer system 10b. The central sentry platform 140 is generally in electronic communication with each sentry 110 and is operable to monitor and manage each sentry 110. The central sentry platform 140 may be installed on the same computer system 10 as the sentry 110, or may be installed on a separate computer system 10. In some embodiments, the data self-protection system 100 may include only one computer system 10 on which both the central sentry platform 140 and the sentry 110 are installed.

[0069] In various embodiments, the data self-protection system 100 can be provided by multiple computer systems 10 connected via one or more networks. The network(s) can include any network capable of carrying data, including the Internet, Ethernet, plain old telephone service (POTS) lines, public switched telephone network (PSTN), integrated services digital network (ISDN), digital subscriber line (DSL), coaxial cable, fiber optic, satellite, mobile, wireless (e.g., Wi-Fi, WiMAX), SS7 signaling network, fixed line, local area network, wide area network, and other networks, including any combination of these capable of establishing an interface with and enabling communication between the computer systems 10. The network(s) can be local, private, public (e.g., the Internet), or a combination thereof. In some embodiments, the central sentry platform 140 and sentries 110 can be installed on multiple computer systems 10 that are all on the same private network. In other embodiments, the central sentry platform 140 can be installed on a cloud computer, while the sentries 110 are installed on computer systems 10 within the private network.

[0070] Each computer system 10 can store data that can be protected by a sentry 110 installed on the computer system 10. For example, each computer system 10 can include a first data storage device 104 for storing data that can be access-controlled and encrypted by the corresponding sentry 110. In various embodiments, the first data storage device 104 can be a non-volatile storage device, such as a hard disk, a network drive, a USB drive, a CD drive, an SD card, a direct-attached storage, a network-attached storage, a storage area network, or the like.

[0071] Each computer system 10 may also run various computer programs, such as applications 101. For example, each computer system 10 may include a second data storage device 109 for loading applications 101. In various embodiments, the second data storage device 109 may be a volatile storage device, such as a random access memory (RAM). The second data storage device 109 may include a user space 120 and a kernel 130 that is separate from the user space 120. As described above, the kernel 130 may be a protected portion of the second data storage device 109 that is separate from the user space 120 (and the applications 101). At least a portion of the sentry 110 may be installed within the kernel 130. However, it should be understood that the central sentry platform 140 is separate from the kernel 130.

[0072] Each sentry 110 may include a file system filter 103 and a sentry application 102. The file system filter 103 may be installed on the kernel 130 of the computer system 10. The file system filter 103 may integrate mandatory access control with encryption to protect protected data stored on the computer system 10. That is, the file system filter 103 may encrypt and control access to protected data stored on the computer system 10. The sentry application 102 may be installed in the user space 120 of the computer system. The sentry application 102 may facilitate communication between the central sentry platform 140 and the file system filter 103. For example, multiple communication channels may link the central sentry platform 140 to the file system filter 103 of each sentry 110 via the corresponding sentry application 102.

[0073] During operation, each computer system 10 on which Sentry 110 is installed can run various applications 101 as one or more processes. These processes are the actual execution of the applications 101. The applications 101 can be stored as files on the computer system 10 and loaded into user space 120 through a system call to the kernel 130 to generate a process. The process can be associated with a process ID that can be used to identify the process in the kernel 130.

[0074] When application 101 is executed, a process can request access to encrypted data protected by sentry 110. Typically, when a process wants to access a file, the process sends a request to the file system to obtain a reference to the file (called a file handle). Depending on the attributes of the request and whether the file to be accessed exists, a new file can be created or an existing file can be opened. After the process obtains the file handle for the file, the process can write data to the file by passing the file handle and the data to be written to the file system, and can read data from the file by passing the file handle and the location where the data to be read is stored to the file system. When the process no longer needs to access the file, the process sends a request to the file system to close the file handle. The file system filter 103 can intercept requests issued by the process to obtain file handles, write and read data, and close file handles.

[0075] The file system filter 103 can receive access requests and process the requests according to the data self-protection policy to grant or deny the requests. For example, the file system filter 103 can check each access request made by each process and, if the data self-protection policy allows plaintext access, grant the access request and decrypt the encrypted data; if the data self-protection policy allows ciphertext access, grant the access request without decrypting the encrypted data; or, if the data self-protection policy allows neither plaintext access nor ciphertext access, deny the access request. The file system filter 103 can also send information associated with each checked access request to the central sentry platform 140 via the sentry application 102.

[0076] The data self-protection policy can define a specific access level for each process. In various embodiments, the access level can be defined based on the application 101 associated with the process. Accordingly, all processes executing a particular application 101 can have the same access permissions. For example, the data self-protection policy can include a plaintext authorization list containing all legitimate applications of the process authorized to access the plaintext content of encrypted data, and a ciphertext authorization list containing all legitimate programs of the process authorized to access the ciphertext content of encrypted data. The file system filter 103 can determine whether the process making the access request is a legitimate application listed on the plaintext authorization list or the ciphertext authorization list to determine whether to grant the request and whether to decrypt the encrypted data. Example processes authorized to access plaintext content include Windows Word for .doc files, Acrobat Reader / Writer for .pdf files, Notepad for text files, Virtual Studio for C / C++ files, and so on. Processes authorized to access ciphertext content can include file synchronization applications such as Dropbox, OneDrive, and Google Drive. Sync applications can be granted access to ciphertext so that they only synchronize the ciphertext of encrypted data files (and the plaintext of encrypted data) to the cloud. Processes that are authorized to access neither plaintext content nor ciphertext content may include processes that are not inspected by the end user. In various embodiments, processes associated with the sentry application 102 may not have any type of access permissions to protected data because the sentry application 102 may not need to access encrypted data files. In some embodiments, the list may be a linked list data structure.

[0077] The data self-protection policy is typically provided to each sentry 110 by the central sentry platform 140. The data self-protection policy can be the same for each sentry 110, or can be different based on the specific sentry 110. The data self-protection policy can be encrypted so that it can only be modified by the central sentry platform 140. The encryption can prevent local users with root, administrative, or supervisor level access to the computer system 10 from modifying the data self-protection policy. In some embodiments, the central sentry platform 140 can send an initial data self-protection policy to the sentry 110 and then subsequently send modifications to the data self-protection policy. In some embodiments, the data self-protection policy can be referred to as a configuration map.

[0078] In some embodiments, the file system filter 103 can use a directory tree to determine whether a specific file stored in the computer system 10 is encrypted. A fast string search algorithm can be used to quickly search the directory tree based on the tree structure of the file system path string. In some embodiments, the search tree can be started when the file system filter 103 is loaded, and the search tree can be constructed by detecting whether each file is encrypted and when the file is first accessed by the file system filter 103 (such as when it is called by any process or application). The data self-protection system 100 can detect whether a file is encrypted in various ways. In some embodiments, detecting whether a file is encrypted can include appending a special extension to an encrypted data file stored on the data storage device 104. Then, detecting whether the file is encrypted can be performed by checking for the presence of the special extension. In some embodiments, detecting whether a file is encrypted can include embedding an encryption token into the file header of the encrypted data file to indicate that the file is encrypted, and then using the token information to detect. In some embodiments, detecting whether a file is encrypted can include using a file attribute field in the file system to record the symbol used to encrypt the encrypted data file and using the symbol to detect.

[0079] In some embodiments, an encryption key or a decryption key may be generated so that the file system filter 103 can encrypt or decrypt data stored on the computer system 10. The generated key may be used to encrypt / decrypt data in the buffer for file reading / writing. If symmetric encryption is used, the encryption key and the corresponding decryption key may be the same.

[0080] In some embodiments, generating an encryption key may include generating an encryption key based on input data in a deterministic manner, i.e., as long as the input data is the same, the output (encryption key) is the same. The input data may include two parts: a unique identifier for a keystore seed and auxiliary information called key material. Given the unique identifier for the keystore seed and the key material, a method for key generation may use the identifier to determine the keystore seed and then combine the keystore seed with the key material to generate an encryption key. An example of a method for key generation is described in more detail in U.S. Patent No. 9,703,979, filed by the applicant on June 10, 2016, entitled "METHODS AND COMPUTER PROGRAM PRODUCTS FOR ENCRYPTION KEY GENERATION AND MANAGEMENT," the entire contents of which are incorporated herein by reference.

[0081] In some embodiments, a hash map between file identifiers and encryption keys (hereinafter referred to as an encryption key cache) can be maintained in the memory of the computer system 10, thereby allowing the file system filter 103 to efficiently record or retrieve the encryption key of a file. The hash map can be started when the file system filter 103 is loaded and is constructed by recording a pair of the file identifier and the encryption key when an encryption key is generated for a particular file.

[0082] In some embodiments, encryption key generation and caching can include a user-mode sentry application 102 and a file system filter 103. Upon receiving a request to obtain a file handle for a file that results in the creation of a new encrypted data file, the file system filter 103 can retrieve certain attributes of the encrypted data file (e.g., the location where the file will be created in the file system) and transmit these attributes to the user-mode sentry application 102. Based on these attributes, the user-mode sentry application 102 can determine a keystore seed with a unique identifier, randomly generate key material, and then generate an encryption key using the selected keystore seed and key material. The user-mode sentry application 102 can then transmit the selected keystore seed's unique identifier, key material, and encryption key to the file system filter 103. The filter 103 can then record the key material in the encrypted data file along with the selected keystore seed's unique identifier. The filter 103 can also record the paired file's unique identifier and encryption key in an encryption key cache.

[0083] In some embodiments, upon receiving a request to obtain a file handle for an existing encrypted data file, the file system filter 103 may retrieve a unique identifier from the file and attempt to retrieve the corresponding encryption key from the encryption key cache using the unique identifier. If the encryption key cache does not contain the encryption key for the file, the filter 103 may retrieve the unique identifier and key material from the keystore seed stored in the encrypted data file, and then transmit the unique identifier and key material of the keystore seed to the user-mode sentry application 102. The user-mode sentry application 102 may then retrieve the keystore seed using the unique identifier, generate an encryption key for encrypting the data file using the keystore seed and key material, and transmit the encryption key to the filter 103. The filter 103 may also record the file's unique identifier and encryption key pair in the encryption key cache.

[0084] In some embodiments, encryption key generation and caching may involve only the file system filter 103 (and not the sentry application 102). For example, upon receiving a request to obtain a file handle for a file that results in the creation of a new encrypted data file, the file system filter 103 may determine a keystore seed having a unique identifier. The filter 103 may also randomly generate key material, generate an encryption key using the keystore seed and the key material, and then record the key material along with the unique identifier of the keystore seed in the encrypted data file. The filter 103 may also record the paired unique identifier and encryption key for the file in the encryption key cache.

[0085] In some embodiments, upon receiving a request to obtain a file handle for an existing encrypted data file, file system filter 103 may retrieve a unique identifier from the file and attempt to retrieve the corresponding encryption key from the encryption cache using the unique identifier. If the encryption key cache does not contain the encryption key for the file, filter 103 may retrieve the unique identifier and key material of a keystore seed stored in the encrypted data file, retrieve the keystore seed using the unique identifier, and generate the encryption key using the keystore seed and key material. Filter 103 may also record the paired unique identifier and encryption key for the file in the encryption key cache.

[0086] In some embodiments, when the file system filter 103 is loaded, a single keystore seed with an identifier can be loaded into memory. The filter 103 can use this keystore seed along with random key material to generate encryption keys for files to be created or opened. However, the key material randomly generated for a file to be created or read from a file to be opened may vary from file to file.

[0087] In some embodiments, when a request is received to write data to a file or to read data from an encrypted data file, the file system filter 103 may retrieve the unique identifier of the file, obtain the encryption key from the encryption key cache using the identifier, and use the encryption key to encrypt or decrypt the data before the data is written to the file system or read by the authorized process that issued the read request.

[0088] In some implementations, after all file handles to a file are closed, the encryption key for the file may be cleared from the encryption key cache.

[0089] In some embodiments, an encryption key can be loaded into memory when the file system filter 103 is loaded. For all encrypted data files, the file system filter 103 can use the encryption key to encrypt or decrypt the data before the data is written to the file system or read by an authorized process that issues a read request. An example is encrypting files accessed by Microsoft SQL Server. Typically, Microsoft SQL Server creates and / or accesses a limited number of files, each of which is very large. In this case, a single encryption key can be secure enough to encrypt all files accessed by Microsoft SQL Servers. Whenever Microsoft SQL Servers writes data to a file, the filter 103 can use a single encryption key in the encryption key cache to encrypt the data before the data is written to the file system; whenever Microsoft SQL Servers reads data from a file, the filter 103 can use a single encryption key in the encryption key cache to decrypt the data before the data is read by Microsoft SQL Server.

[0090] The central sentry platform 140 can be operated to monitor and manage each sentry 110. The central sentry platform 140 can include a controller 106, a collector 105, a web service 108, and a database 107. The controller 106 can send control and management information to the computer system 10 for execution or practice by the sentry 110; the collector 105 can collect information from the sentry 110; the web service 108 can provide a user with an interface to the data self-protection system 100 (e.g., presenting data analysis and visualization results, or receiving user input for control and management); and the database 107 can store various information, such as sentry records, control and management information, operation logs, etc.

[0091] The controller 106 can connect with the sentries 110 to perform software package delivery, software installation, activation, promotion, configuration, updates, and license renewal. The controller 106 can send various information to each sentry application 102 of each sentry 110. For example, the controller 106 can send a data self-protection policy to each sentry 110. In some embodiments, the controller 106 can configure the file system filter 103 of each sentry by sending the data self-protection policy to the sentry application 102.

[0092] In some embodiments, the controller 106 can be configured to perform software package delivery. For example, the controller 106 can input the IP address, valid port number, valid username, and corresponding password of the computer system 10 to be protected by the sentry 110. The controller 106 can use services such as SSH on Linux or Remote Desktop on Windows to reach the computer system 10 for remote operation. The controller 106 can include script code that establishes a control channel between the central sentry platform 140 and one or more sentries 110 to deliver the software package based on the operating system of the computer system 10. The controller 106 can automatically detect the operating system of the computer system 10 and deliver the appropriate software package. In some embodiments, the script can be pushed to execute on the computer system 10, enabling the computer system 10 to access a given file server to retrieve the appropriate software package. In some embodiments, the controller 106 can receive the IP address, valid port number, valid username, and corresponding password as user input only once and create a dedicated user account for the computer system 10 for subsequent use. In some embodiments, the controller 106 can use credentials to perform automatic login.

[0093] In some embodiments, the controller 106 may contain script code for automatically installing the sentry 110 software on the computer system 10. It may contain different sets of code for computer systems 110 with different operating systems, such as various Linux and Windows systems.

[0094] In some embodiments, the controller 106 may include script code for automatically activating the sentry 110 software on the computer system 10. The first execution of the installed software may trigger the generation of a unique number that can be used to identify the computer system 10 in the central sentry platform 140. The automatic activation may include obtaining the unique ID of the sentry 110, sending it back to the central sentry platform 140, generating an activation certificate on the central sentry platform 140, sending the activation certificate back to the sentry 110, and applying the activation certificate on the sentry 110.

[0095] In some implementations, the controller 106 may be implemented using programming languages other than script code.

[0096] In some embodiments, the controller 106 can select a sentry 110 on the computer system 10 and configure the sentry 110. This can include establishing two lists, one for protected data files and another for authorized applications. These two lists can be included in the data self-protection policy. In some embodiments, the list of protected files can be established on the central sentry platform 140 via a graphical user interface that is part of the web service 108 and the controller 106. The web service component 108 can collect user input, pass it to the sentry application 102 for execution through the controller 106, obtain feedback from the sentry application 102, and send it back to the controller 106. The controller 106 can further present the feedback to the web service 108 for display to the user.

[0097] In some embodiments, the controller 106 can manage the sentries 110 by performing package updates. In particular, the central sentry platform 140 can detect the version number of the current package installed on each sentry 110, prompt the administrator to perform the package update, and help the administrator perform the update. For example, package updates can be designed to support two types: the first type is a major update, which requires a system restart and requires administrator supervision; the second type is a minor update, which does not require a system restart and can therefore be performed automatically and quietly without the administrator's attention. Generally speaking, if the file system filter 103 is updated, the update can be considered major, which is rare. In most cases, the update may only include changes to the user mode application 101 and is minor.

[0098] In some embodiments, the controller 106 can manage the sentries 110 by performing license updates. License updates can be initiated by an administrator and automatically performed by the central sentry platform 140, i.e., the controller 106 can push the update certificate to the corresponding sentry 110 and the central sentry platform 140 can automatically perform the license update operation.

[0099] The collector 105 can receive information from each sentry 110 to allow the central sentry platform 140 to monitor each sentry 110. The collector 105 can receive information from the sentry application 102. For example, the collector 105 can receive information about data sentry records, including data access logs, system performance information such as memory consumption, CPU usage, disk usage, etc. The user-mode sentry application 102 can act as a bridge between the file system filter 103 and the collector 105 for recording data sentry information for data usage monitoring and management, as well as for recording system performance information.

[0100] The collector 105 may receive information about access to encrypted data stored on each computer system 10 on which a sentry 110 is installed. For example, the collector 105 may receive information about each access request checked by each sentry 110. In some embodiments, this information may include, for each access request made by each process: information about the computer system 10, information about the process including the application, file information about the encrypted data, the time of the attempted access, and the result of the check.

[0101] For example, the information may include sentry records that include a time series of events of applications being granted access to protected data files or applications being blocked from accessing protected data files. These records may also contain detailed information about each computer system 10, such as its name, its IP address, and a timestamp. These records may be generated by the file system filter 103 on each computer system 10. The records may be in their original format, or may be partially compressed or fully compressed for better processing efficiency. In some embodiments, protected file names and application names may be replaced with hash values as a partial compression solution to save disk space. In some other embodiments, a complete record of a particular application accessing a given data file on a computer system 10 with a known IP may be recorded as a dictionary entry, and all its repetitions may be recorded as indexes in the dictionary.

[0102] In some embodiments, the information collected by the collector 105 may also include details about all running processes or certain specific processes, regardless of whether they are accessing protected files. This information can be used to better understand the computing performance of the corresponding computer system 10. For example, it can be used to detect malware that is depleting system resources, such as some mining bots.

[0103] The collector 105 may also receive information about the operating status of the corresponding computer system 10 from each sentry 110, so that the central sentry platform 140 can monitor the operating status of each computer system 10. For example, the operating status of each computer system 10 may include operational statistics related to the resources of the computer system 10. In some embodiments, the operating status may include the current usage level of each resource relative to the total capacity of the resource. For example, the resources may include the memory, processor, and disk space of the computer system 10.

[0104] In some embodiments, the information may include system information about each computer system 10, such as CPU usage, memory consumption, and disk usage. Various methods can be used to collect information, such as API calls or system utilities on the computer system 10. In some embodiments, CPU usage, memory consumption, and disk usage can be represented by three integers indicating percentages ranging from 0 to 100. Without excessively affecting security and reliability, the precision of these values can be further reduced to obtain better storage efficiency, for example, by quantizing the values to map the percentages to a range of 0 to 50. In some embodiments, the CPU usage for each computer system 10 at each time instance can be recorded as an array of percentages corresponding to multiple cores. In some embodiments, the disk usage for each computer system 10 can be recorded as an array of percentages corresponding to multiple disks or partitions.

[0105] In some embodiments, the operating status may include the system vitality of the computer system 10. The system vitality may be calculated based on various system parameters, such as instantaneous CPU usage, instantaneous memory usage, disk space, etc. For example, the system vitality sv may be calculated as:

[0106] If(MemUsePer>0.95||CpuUsePer>0.95||DiskUsePer>0.95)

[0107] sv=0;

[0108] else

[0109] sv=1-(MemUsePer+CpuUsePer+DiskUsePer) / 3;

[0110] MemUsePer, CpuUsePer, and DiskUsePer represent the percentage of used memory, the percentage of used CPU, and the percentage of used disk space, respectively.

[0111] In some embodiments, the operating condition may include an average payload mutation index. The average payload mutation index may indicate the average value of sudden changes in file access activities of authorized applications to protected files permitted by the file system filter 103. For example, the index may be defined as follows:

[0112] LoadIndex=(CCFA / CTI) / (TCFA / ETW)

[0113] Where CCFA is the current count of file accesses within a given time interval, CTI is the length of the current time interval in minutes, TCFA is the total count of file accesses within an extended time window, and ETW is the length of the extended window in minutes. For an extended time window, it is typically selected to be a larger time window encompassing the current time interval. For example, the left margin of the current time interval is extended by a given number of minutes to advance to the earliest time in the system, and the right margin of the current time interval is extended by a given number of minutes to postpone to the latest time in the system. In some embodiments, the count of file accesses may refer to accesses to protected data files by authorized applications permitted by the file system filter 103. In this case, the resulting index is defined as the payload index. In some embodiments, the arithmetic mean of the payload indices from multiple sentries can be calculated as the average payload mutation index. In some embodiments, file access counts may be collected for all accessed protected data files, including those allowed by authorized applications and those blocked by unauthorized applications. In this case, the resulting payload index has the meaning of an overall payload mutation index. In some embodiments, file access counts may be collected for all protected data files accessed only by unauthorized applications. In this case, all accesses will be blocked by the file system driver. The resulting index can be named the hack mutation index. A sudden change in the hack index may indicate a virus outbreak.

[0114] In some embodiments, each sentry 110 may send a time series of heartbeats to the central sentry platform 140. The time series of heartbeats may be encrypted so that it can only be modified by the sentry 110. Encryption may prevent users with root, administrative, or supervisor-level access to the computer system 10 from modifying the time series of heartbeats. The time series of heartbeats may be sent via a communication channel that links the central sentry platform 140 to the file system filter 103 via the sentry application 102. The central sentry platform 140 may monitor the time series of heartbeats to assess the status of the sentries 110. The time series of heartbeats may be defined as a regular signal generated by each sentry 110 and sent to the central sentry platform 140 to indicate whether the sentry 110 is functioning properly. When an intrusion occurs and the data self-protection system 100 is under attack, the central sentry platform 140 may infer from the heartbeat signal whether the protection system 100 has been affected. The heartbeat information may be recorded and stored in its original format as a regular signal received at regular time intervals. For better storage efficiency, this can be converted into a run-length code, or a sequence of start and stop time instances of a normal heartbeat signal.

[0115] In some embodiments, the communication between the sentry application 102 and the collector 105 can be based on a standard format that facilitates information exchange and good scalability, such as Extensible Markup Language (XML). The collector 105 can include an XML parser to extract all information received from the sentry application 102 and store them in the database 107 in its original format or in a new format to facilitate data visualization and / or analysis. In other embodiments, the communication between the sentry application 102 and the collector 105 can be based on any specific format agreed upon between the sender and the receiver.

[0116] In some embodiments, the collector 105 can act as an http server listening on a specific port at a given IP address accessible to all computer systems 10. The connection between the sentry application 102 and the collector 105 can be initiated by the sentry application 102. In other embodiments, the collector 105 can act as an http client that polls all sentry applications 102 for new information. This may be particularly desirable when the central sentry platform 140 is installed on a computer whose IP address is not directly accessible to the computer system 110, but the computer system 110 is equipped with an IP address that is directly accessible to the central sentry platform 140.

[0117] The database 107 can store various information collected by the collector 105 or to be sent by the controller 106. For example, the database 107 can store sentry records, operation status, and heartbeat information received by the collector 105. In another example, the database 107 can store data self-protection policies to be sent to the sentry 110.

[0118] In some implementations, InfluxDB can be used to store time series, such as heartbeats, and / or system information, such as CPU usage, memory consumption, disk usage, etc. Such high-frequency and low-retention information may be well suited for InfluxDB due to its fast insertion and search speed.

[0119] In some implementations, ElasticSearch can be used to store sentry records for applications that access protected files. ElasticSearch works well for low-frequency and long-retention information and allows document-style records.

[0120] In some embodiments, a non-time-series database can be used to store information collected from sentries 110 with an appropriate schema design. For example, a two-column architecture can be used to store heartbeat data to record only the period of continuous heartbeats, where the first column is an index indicating the start time and the second column is an index indicating the end time. When a new heartbeat signal is received, the difference between the current time and the end time period of the last row can be compared with a predefined time interval. If the difference exceeds a certain threshold (e.g., twice the regular time interval), the end time period of the last row can be updated to the current time. Otherwise, a new row can be inserted using the current time as the start time and end time. In some embodiments, the heartbeat data can include time changes and channel delays. In some embodiments, system information can be recorded in a four-column architecture that includes a column of time index plus three columns, each of which is one byte and indicates the percentage of CPU usage, memory consumption, and disk usage, respectively.

[0121] The web service 108 can provide various interfaces for users to interact with the central sentry platform 140. For example, the web service 108 can provide an interface that allows users to change the access permissions of processes in the data self-protection policy. The web service 108 can also provide a visualization display to display various data collected by the central sentry platform 140. For example, the web service 108 can generate various graphical components that are used to visualize the overall status of the computer system 10 on which the sentry 110 is installed, such as system vitality, CPU usage, memory usage, disk space, heartbeat, etc. The graphical components can also visualize data sentry records and their derived information, including the effective load mutation index, the overall load mutation index, the intrusion mutation index, etc.

[0122] Web service 108 can query database 107 to generate graphical components. In some embodiments, to balance the efficiency of recording raw information from sentry 110 and querying database 107 for visualization, a separate service can be established to extract raw information and generate and store derived information in a database table.

[0123] In some implementations, the visual display can display indicators that display information associated with the information received from the sentry 110. For example, the web service 108 can provide a plurality of operational status indicators that indicate operational conditions received from the sentry 110. In another example, the web service 108 can provide a plurality of access status indicators that indicate inspected access requests received from the sentry 110.

[0124] In some embodiments, the visual display can display multiple computer representations. Each computer representation can correspond to one of the computer systems 110 on which the Sentry is installed. Each computer representation can be provided in association with one or more indicators that display information received from the Sentry 110 installed on the corresponding computer system 10. For example, each computer representation can be provided in association with one or more operating status indicators or access status indicators associated with the corresponding computer system 10.

[0125] In some embodiments, a visual display may indicate the overall health of all sentries 110 and all computer systems 10 that are installed and guarding the sentries 110. The visual display may include a graphical illustration of the overall assessment of how many computer systems 10 are healthy; how many are unhealthy; and how many are borderline based on some criteria, such as applying a threshold to system health.

[0126] In some embodiments, the visual display may indicate the average system vitality of all computer systems 10 protected by the sentry 110. The visual display may include a graphical illustration of the average system vitality as described above.

[0127] In some embodiments, the visual display can include a graphical representation of the overall load mutation index and / or the effective load mutation index. This representation can use colors or other visual elements, such as circles with various radii. For example, visual elements can be used to indicate various types of status, such as normal, abnormal, and intermediate status. In some embodiments, the visualization can be customized using various time periods, such as the last 24 hours, the last 7 days, the last 30 days, or the last 12 months. The time period can present an overall picture of the information received from the sentries on the computer system 110 over different time periods.

[0128] In some embodiments, a visual display can show the status of each computer system 10. This status may include the health of the computer system 10, information received from the computer system 10, statistics on protected files stored on the computer system 10, and the like. The visual display can provide an overall picture of the information received from the computer system 10 and the system health of the computer system 10. For example, the visual display can include a color map representing the health of a particular computer system 10 over a specific time period. For example, the time period can be one year. Each pixel in the color map can be a specific color representing a specific state of the computer system 10. For example, the pixels can be R (pure red), B (pure blue), and G (pure green), representing three stages of system resources: nearly exhausted, quite sufficient, and abundant. The relevant resources can be CPU usage, memory usage, disk space, and the like. In another example, the color pixels can be used to represent derived system parameters, such as system health. In another example, the color map can be created by multiplying each ratio of the CPU usage percentage, memory usage percentage, and disk usage percentage by 255 and associating them with the colors pure green G, pure red R, and pure blue B. In this way, the health of the system at each moment can be represented by a color pixel. When all percentages are close to 1, the color may approach pure white, indicating that the machine may have crashed. The resolution of the color map may depend on the sampling frequency. For example, if sampling is performed every minute for 365 days a year, the size of the color map may be 1440x365. Each row may represent the health status for that day, while each column may represent the health status at a different time of day. In some embodiments, a video clip of multiple color maps may be generated to represent the health status of multiple computer systems 10.

[0129] In some embodiments, the central sentry platform 140 may provide a dynamic search function. The dynamic search function may facilitate searching for items contained in information received from the sentry 110. For example, the dynamic search function may be used to search for inspected access requests received from the sentry 110. The dynamic search function may be used to explore various raw information collected and accumulated on the central sentry platform 140, such as file access records and derived information, such as load indices, to further facilitate data analysis by system administrators.

[0130] In some embodiments, the search conditions can be divided into two categories. The first category is for data file access activities, which can include data access time, computer system name, computer system operating system, computer system group ID, computer system IP address, target file full path, application, and the final decision of the file system filter 103 to allow or block file access. The second category can be computer system status, including computer system health, computer system ID in the system, computer system group ID, computer system life, CPU usage, memory usage, disk space, computer system registration time, etc.

[0131] In some implementations, the dynamic search function may first present all conditions to the end user, automatically check the logical relationships of all selected conditions, and gradually enable / disable certain conditions to obtain the best user experience.

[0132] In some embodiments, the search functionality may include a flexible method for displaying search results for file access records. For example, the results may be presented as a table with columns that can be selected by the end user to include or exclude, such as the time of recording, computer system name, protected file path, application, operating system, IP address, etc. In another exemplary embodiment, the results may be presented as the following graphics, such as: a bar chart for Data Sentry records; a bar chart of Data Self-Protection as details of protected files (such as the number of protected files and the type of files); bar charts of the overall load mutation index, the effective load mutation index, and the attack mutation index, etc.

[0133] In some embodiments, the search function may include a flexible method for displaying search results for computer system status. For example, the results may be presented as a table with columns that can be selected by the end user to include or exclude, such as computer system health, computer system name, group ID, heartbeat status, computer system vitals, CPU usage, memory usage, disk space, computer system registration time, operating system, IP address, etc. In another embodiment, the results may be presented as a graph, such as triangles for computer system information such as CPU usage, memory usage, and disk space, or a heartbeat graph, etc.

[0134] In some embodiments, the central Sentry platform 140 can collect and record every action taken by an administrator user, such as viewing Sentry logs and / or computer system status, performing dynamic searches, registering a Sentry 110 on a new computer system 10, activating a Sentry 110 on a new computer system 10, configuring a Sentry 110 on a computer system 10 to create a protected area for data files, configuring a Sentry 110 on a computer system 10 to grant an application permission to access protected data files, etc. In some embodiments, all actions can be permanently logged, meaning that the system 100 may not support updating or deleting records once they are generated, resulting in a comprehensive collection of file access logs for all data protected by all Sentry 110s and all visualization, monitoring, and management actions performed by system administrators on these Sentry 110s. This can provide a solid foundation for forensic analysis, including establishing evidence of an intruder or attempted intrusion, discovering vulnerabilities in the system 100, and tracking / monitoring the activities of system administrators.

[0135] In some embodiments, the central sentry platform 140 can generate statistical reports of data sentry information and computer system status information, which can be used as data security reports by various departments and / or personnel in the organization.

[0136] Now refer to Figure 3 , shows an example method 300 for enabling data self-protection according to an embodiment. In some embodiments, the data self-protection method 300 can be implemented using the data self-protection system 100.

[0137] At 302, a sentry 110 is installed on a computer system 10. For example, a file system filter 103 may be installed in the kernel of the computer system 10, and a sentry application 102 may be installed in the user space 120 of the computer system. The sentry 110 may encrypt and control access to data stored on the computer system 10. In some implementations, multiple sentries 110 may be installed on multiple computer systems 10, with each sentry 110 being installed on a different computer system 10.

[0138] At 304, the central sentry platform 140 is placed in communication with the sentry 110. For example, the central sentry platform 140 may include a collector 105 for receiving data from the sentry 110 and a controller 106 for sending data to the sentry 110. In some embodiments, the central sentry platform 140 may be connected to each of the plurality of sentries 110.

[0139] At 306, the central sentry platform 140 is operated to send the data self-protection policy to the sentries 110. For example, the central sentry platform 140 may operate the controller 106 to send: a list of applications 101 that are authorized to access the plaintext content of encrypted data stored on the computer system 10, and a list of applications 101 that are authorized to access the ciphertext content of encrypted data stored on the computer system 10. In some embodiments, the central sentry platform 140 may send the data self-protection policy to each sentry 110 in a plurality of sentries.

[0140] At 308, the file system filter 103 is operated to control access to the encrypted data stored on the computer system 10 in accordance with the data self-protection policy. For example, the file system filter 103 may process each file access request made by the process and grant or deny the file access request in accordance with the data self-protection policy. For example, the file system filter 103 may determine whether the application associated with the process making the file access request is permitted to access the plaintext content, the ciphertext content, or neither. In some embodiments, each file system filter 103 of each sentry 110 in the plurality of sentries 110 may control access to the encrypted data stored on the corresponding computer system 10.

[0141] At 310, the central sentry platform 140 is operated to monitor the sentries 110. For example, the central sentry platform 140 may receive information from the sentries 110 at the collector 105 regarding access to encrypted data stored on the computer system 10. In another example, the central sentry platform 140 may receive information from the sentries 110 at the collector 105 regarding the operation of the computer system 10. In some implementations, the central sentry platform 140 may monitor each of the plurality of sentries 110.

[0142] A number of example embodiments have been described herein. However, it will be understood by those skilled in the art that other changes and modifications may be made without departing from the scope of the embodiments as defined in the appended claims.

Claims

1. A method for enabling data self-protection on at least one computer system, the method comprising: installing a sentry on a computer system of the at least one computer system, wherein the sentry comprises a file system filter installed on a kernel of the computer system, the file system filter integrating mandatory access control with encryption; providing a central sentry platform in electronic communication with the sentries installed on the computer system, the central sentry platform being separate from the core of the computer system; operating the central sentry platform to send a data self-protection policy to the sentry, wherein the data self-protection policy is encrypted so that the data self-protection policy can only be modified by the central sentry platform; The file system filter is operated to control access to the encrypted data stored on the computer system by: for each process that makes a file access request to the encrypted data, the file system filter receives and processes the file access request according to the data self-protection policy to grant or deny the file access request; and The central sentry platform is operated to monitor the sentry and receive information from the sentry relating to access to the encrypted data stored on the computer system.

2. The method according to claim 1, wherein The at least one computer system includes a plurality of computers; Installing the sentinel includes installing a plurality of sentinsels, and installing the plurality of sentinsels includes: for each computer among the plurality of computers, installing a corresponding sentinel on the computer, wherein installing the corresponding sentinel on the computer includes: installing the file system filter of the corresponding sentinel on the kernel of the computer; Providing the central sentry platform includes: providing the central sentry platform on a computer system in electronic communication with the plurality of sentries; Operating the central sentry platform to send the data self-protection policy includes operating the central sentry platform to send a plurality of data self-protection policies, and sending the plurality of data self-protection policies includes: for each of the plurality of sentries, sending a corresponding data self-protection policy to the sentry; Operating the file system filter to control access to encrypted data stored on the computer system includes: for each of the plurality of computers, operating the file system filter of the corresponding sentry installed on the computer to control access to the encrypted data stored on the computer according to the corresponding data self-protection policy sent to the corresponding sentry; and Operating the central sentry platform to monitor the sentry includes, for each computer of the plurality of computers, operating the central sentry platform to monitor the corresponding sentry on the computer to receive information from the sentry regarding access to the encrypted data stored on the computer.

3. The method according to claim 2, wherein: For each of the plurality of computers, operating the file system filter of the corresponding sentry installed on the computer further comprises operating the file system filter to check each access request made by each process to access the encrypted data stored on the computer according to the corresponding data self-protection policy sent to the sentry, the checking being performed by: If the corresponding data self-protection policy allows plaintext access, the access request is granted and the encrypted data is decrypted. If the corresponding data self-protection policy allows ciphertext access, then grant the access request without decrypting the encrypted data, or If the corresponding data self-protection policy does not allow either plaintext access or ciphertext access, denying the access request; and Operating the central sentry platform to monitor each of the plurality of sentries to receive information from the sentries further comprises monitoring each sentry to receive information about all inspected access requests from the sentry.

4. The method according to claim 3, wherein: For each access request made by each process on each of the multiple computers, the information about all checked access requests includes: information about the computer; information about the process, including the application of the process; file information of the encrypted data; the time of the access attempt associated with the access request; and the inspection result made by the corresponding sentry on the computer.

5. The method according to claim 3, further comprising: For each of the plurality of computers, in addition to checking all access requests to the encrypted data stored on the computer, operating the corresponding sentry installed on the computer to monitor the operation of the computer; Wherein, for each computer in the plurality of computers, operating the central sentry platform to monitor each sentry further comprises: operating the central sentry platform to receive information related to the operating status of the computer from the sentry.

6. The method according to claim 5, wherein: For each computer in the plurality of computers, The operating status of the computer includes: for a plurality of resources of the computer, a current usage level of each of the plurality of resources relative to a total capacity of the resources on the computer; The multiple resources include the computer's memory, processor, and disk space.

7. The method according to claim 3, wherein: For each of the multiple computers: The data self-protection policy sent to the corresponding sentry installed on the computer includes: a plaintext authorization list having all legitimate applications of the process that are authorized to access the plaintext content of the encrypted data; and a ciphertext authorization list having all legitimate applications of the process that are authorized to access the ciphertext content of the encrypted data; For each access request to the encrypted data, the file system filter of the Sentry makes the following decisions: When the process making the access request is authenticated by the sentry as a process of a legitimate application listed in the plaintext authorization list, plaintext access is allowed. When the process making the access request is authenticated by the sentry as a legitimate application process listed on the ciphertext authorization list, ciphertext access is allowed; and When the process making the access request is not authenticated by the sentry as a process of a legitimate application listed on the plaintext authorization list and is also not authenticated as a process of a legitimate application listed on the ciphertext authorization list, neither plaintext access nor ciphertext access is allowed.

8. The method according to claim 7, wherein: For each of the plurality of computers, installing the corresponding sentry on the computer further comprises: installing a sentry application of the sentry on a user space of the computer, the user space being separate from a kernel space of the computer, the sentry application of the sentry being linked to communicate with the file system filter of the sentry; and A plurality of communication channels is provided, wherein, for each computer of the plurality of computers, the plurality of communication channels includes a communication channel linking the central sentry platform to the file system filter of the sentry for the computer via the sentry application of the sentry for the computer.

9. The method according to claim 8, further comprising: For each of the plurality of sentries, Define the heart rate, operating the sentry to transmit a time sequence of heartbeats to the central sentry platform via the communication channel linking the central sentry platform to the file system filter of the sentry at a heartbeat frequency, the time sequence of heartbeats being encrypted such that the time sequence of heartbeats can only be modified by the sentry; monitoring a time series of the heartbeats; as well as The central sentry platform is operated to assess a status of the sentry based at least in part on monitoring a time series of the heartbeats.

10. The method according to claim 4, further comprising: A visual display associated with the central sentry platform is provided to display a plurality of access status indicators for indicating and displaying information regarding all inspected access requests received from the plurality of sentries.

11. The method according to claim 10, wherein: Providing the visual display comprises: providing, for each computer of the plurality of computers, a plurality of computer representations on the visual display, the plurality of computer representations including a corresponding computer representation representing the computer; and For each computer representation provided on the visual display, at least one access status indicator from a plurality of access status indicators is provided in association with the computer representation to display and indicate at least some information relating to all inspected access requests received from the corresponding sentry on the computer represented by the computer representation.

12. The method according to claim 6, further comprising: A visual display associated with the central sentry platform is provided to display a plurality of operational status indicators for indicating and displaying the operational conditions received from the plurality of sentries.

13. The method according to claim 12, wherein: Providing the visual display comprises: providing, for each computer of the plurality of computers, a plurality of computer representations on the visual display, the plurality of computer representations including a corresponding computer representation representing the computer; and For each computer representation provided on the visual display, at least one of the plurality of operating status indicators is provided in association with the computer representation to display and indicate at least one operational condition received from the corresponding sentry on the computer represented by the computer representation.

14. The method according to claim 4, further comprising: A dynamic search function is provided at the central sentry platform for searching for items contained in the information about all inspected access requests received from the plurality of sentries.

15. A system for enabling data self-protection, the system comprising: at least one computer system, wherein a sentry is installed on a computer system in the at least one computer system, the sentry comprising a file system filter installed on a kernel of the computer system, the file system filter integrating mandatory access control with encryption; and; a central sentry platform in electronic communication with the sentries installed on the computer system, the central sentry platform being separate from the core of the computer system; Among them, during operation: The central sentry platform sends a data self-protection policy to the sentry, wherein the data self-protection policy is encrypted so that the data self-protection policy can only be modified by the central sentry platform; The file system filter controls access to the encrypted data stored on the computer system in the following manner: for each process that makes a file access request to the encrypted data, the file system filter receives and processes the file access request according to the data self-protection policy to grant or deny the file access request; The central sentry platform monitors the sentries and receives information from the sentries related to access to the encrypted data stored on the computer system.

16. The system according to claim 15, wherein: The at least one computer system includes a plurality of computers; A corresponding sentry is installed on each of the plurality of computers, wherein the file system filter of the corresponding sentry is installed on the kernel of the computer; The central sentry platform is provided on a computer system in electronic communication with the plurality of sentries; The central sentry platform is operable to send a plurality of data self-protection policies, for each sentry of the plurality of sentries, the plurality of data self-protection policies including a corresponding data self-protection policy for the sentry; For each computer of the plurality of computers, the file system filter of the corresponding sentry installed on the computer is operable to: control access to the encrypted data stored on the computer according to the corresponding data self-protection policy sent to the corresponding sentry; and For each computer of the plurality of computers, the central sentry platform is operable to monitor the corresponding sentry on the computer to receive information from the sentry regarding access to the encrypted data stored on the computer.

17. The system according to claim 16, wherein: For each of the plurality of computers, the file system filter of the corresponding sentry installed on the computer is operable to check each access request made by each process to access the encrypted data stored on the computer according to the corresponding data self-protection policy sent to the sentry, by: If the corresponding data self-protection policy allows plaintext access, granting the access request and decrypting the encrypted data; If the corresponding data self-protection policy allows ciphertext access, granting the access request without decrypting the encrypted data; If the corresponding data self-protection policy does not allow either plaintext access or ciphertext access, rejecting the access request; as well as The central sentry platform is operable to monitor each sentry to receive information about all inspected access requests from the sentry.

18. The system according to claim 17, wherein: For each access request made by each process on each of the multiple computers, the information about all checked access requests includes: information about the computer; information about the process, including the application of the process; file information of the encrypted data; access attempt time associated with the access request; and a check result made by the corresponding sentry on the computer.

19. The system according to claim 17, wherein: For each of the plurality of computers, in addition to checking all access requests to the encrypted data stored on the computer, the corresponding sentry installed on the computer is further operable to monitor the operation of the computer; and For each computer of the plurality of computers, the central sentry platform is operable to receive information related to the operating condition of the computer from the corresponding sentry.

20. The system of claim 19, wherein: For each computer in the plurality of computers, The operating status of the computer includes: for a plurality of resources of the computer, a current usage level of each of the plurality of resources relative to a total capacity of the resources on the computer; The multiple resources include the computer's memory, processor, and disk space.

21. The system of claim 17, wherein: For each of the multiple computers: The data self-protection policy sent to the corresponding sentry installed on the computer includes: a plaintext authorization list having all legitimate applications of the process that are authorized to access the plaintext content of the encrypted data; and a ciphertext authorization list having all legitimate applications of the process that are authorized to access the ciphertext content of the encrypted data; For each file access request to access the encrypted data, the file system filter of the Sentry makes the following decisions: When the process making the access request is authenticated by the sentry as a process of a legitimate application listed in the plaintext authorization list, plaintext access is allowed. When the process making the access request is authenticated by the sentry as a process of a legitimate application listed in the ciphertext authorization list, ciphertext access is allowed. When the process making the access request is not authenticated by the sentry as a process of a legitimate application listed on the plaintext authorization list and is also not authenticated as a process of a legitimate application listed on the ciphertext authorization list, neither plaintext access nor ciphertext access is allowed.

22. The system of claim 21, wherein: For each of the plurality of computers, a sentry application of the sentry is installed on a user space of the computer, the user space being separate from a kernel space of the computer, the sentry application of the sentry being linked to communicate with the file system filter of the sentry; and The system also includes a plurality of communication channels, wherein, for each computer of the plurality of computers, the plurality of communication channels includes a communication channel linking the central sentry platform to the file system filter of the sentry for the computer via the sentry application of the sentry for the computer.

23. The system of claim 22, wherein: For each of the plurality of sentries, The sentry is operable to: send a time sequence of heartbeats to the central sentry platform at a heartbeat frequency via the communication channel linking the central sentry platform to the file system filter of the sentry, the time sequence of heartbeats being encrypted such that the time sequence of heartbeats can only be modified by the sentry; The central sentry platform is operable to monitor a time sequence of the heartbeats; and the central sentry platform is operable to assess a status of the sentry based at least in part on monitoring the time sequence of the heartbeats.

24. The system of claim 18, wherein: The central sentry platform is operable to provide a visual display to display a plurality of access status indicators for indicating and displaying information regarding all inspected access requests received from the plurality of sentries.

25. The system of claim 24, wherein: Providing the visual display comprises: providing, for each computer of the plurality of computers, a plurality of computer representations on the visual display, the plurality of computer representations including a corresponding computer representation representing the computer; and For each computer representation provided on the visual display, at least one access status indicator of the plurality of access status indicators is provided in association with the computer representation to display and indicate at least a portion of information relating to all inspected access requests received from the corresponding sentry on the computer represented by the computer representation.

26. The system of claim 20, wherein: The central sentry platform is operable to provide a visual display for displaying a plurality of operational status indicators for indicating and displaying the operational conditions received from the plurality of sentries.

27. The system of claim 26, wherein: Visual displays provided include: providing, for each computer in the plurality of computers, a plurality of computer representations on the visual display, the plurality of computer tables including a corresponding computer representation representing the computer; and, For each computer representation provided on the visual display, at least one of the plurality of operating status indicators is provided in association with the computer representation to display and indicate at least one operational condition received from the corresponding sentry on the computer represented by the computer representation.

28. The system of claim 25, wherein: The central sentry platform is operable to provide a dynamic search function for searching for items contained in the information regarding all inspected access requests received from the plurality of sentries.

Images