Application Security Module for Data Leakage Prevention

Solution Overview

Problem

Existing data management systems fail to effectively prevent data leakage by allowing applications with high authority levels to access and copy sensitive information from high-security zones to lower-security zones, compromising data security.

Innovation Solution

A computer system module that monitors and controls access by determining an application's restriction level based on previously accessed security zones, preventing writes to zones with lower security levels and notifying users of restriction levels to prevent unintended data transfers.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Adaptability or versatility

If an application with high authority level is allowed to access high security zones, then the application can retrieve and process sensitive information, but the application can also copy this information to lower security zones causing data leakage

Engineering Contradiction:

Improveapplication access capabilityVSAvoiddata leakage risk

Core Design Contradiction:

Adaptability or versatilityVSObject-affected harmful factors

Solution Approach 1:

The system performs preliminary actions by establishing a restriction level for the application before it accesses security zones. This restriction level is set based on the highest security level the application has previously accessed, preventing the application from writing to lower security zones before the harmful action (data leakage) can occur

Inventive Principle:

Principle #10Preliminary action

Solution Approach 2:

The patent introduces an intermediary mechanism (the restriction level determination module and security module) that mediates between the application's authority level and its actual access permissions. This intermediary enforces write restrictions based on the application's access history, blocking potential data leakage paths while allowing legitimate high-security access

Inventive Principle:

Principle #24Intermediary (Mediator)

2Ease of operation

If simple authority level control is implemented, then data access can be managed based on user permissions, but it is insufficient to prevent data leakage through copy operations

Engineering Contradiction:

Improveaccess control simplicityVSAvoiddata security

Core Design Contradiction:

Ease of operationVSReliability

Solution Approach 1:

The system performs preliminary actions by establishing a restriction level for the application before it accesses security zones. This restriction level is set based on the highest security level the application has previously accessed, preventing the application from writing to lower security zones before the harmful action (data leakage) can occur

Inventive Principle:

Principle #10Preliminary action

Solution Approach 2:

The system implements feedback by continuously monitoring the application's access history and dynamically adjusting the restriction level. The security module checks the application's previous access patterns and updates the restriction level accordingly, creating a closed-loop control system that adapts to prevent data leakage while maintaining operational simplicity

Inventive Principle:

Principle #23Feedback

3Productivity

If an application copies information from high security files to low security files, then information processing can be performed, but security protection is compromised

Engineering Contradiction:

Improveinformation processing efficiencyVSAvoidsecurity level compromise

Core Design Contradiction:

ProductivityVSObject-affected harmful factors

Solution Approach 1:

The system performs preliminary actions by establishing a restriction level for the application before it accesses security zones. This restriction level is set based on the highest security level the application has previously accessed, preventing the application from writing to lower security zones before the harmful action (data leakage) can occur

Inventive Principle:

Principle #10Preliminary action

Solution Approach 2:

The patent applies local quality by implementing different access controls for different security zones based on the application's specific access history. Rather than applying a uniform restriction, the system tailors the restriction level to each application's individual access patterns, allowing productive operations in appropriate zones while blocking unauthorized writes to lower security zones

Inventive Principle:

Principle #3Local quality

Data Source

PatentUS8959657B2Secure data management

Publication Date: 2015.02.17 IVANTI US LLC

AI summary

The disclosed subject matter includes a method. The method includes identifying an attempt to access, by an application instance running in a user space of an operating system, a first security zone of a computer readable medium, where the first security zone is associated with a first security level. The method further includes determining whether a restriction level associated with the application instance is higher than the first security level, where the restriction level is a function of previous security zones that have been accessed by the application instance. When the restriction level associated with the application instance is higher than the first security level, the method would prevent the application instance from writing to the first security zone. When the restriction level associated with the application instance is not higher than the first security level, the method would authorize the application instance to access the first security zone.