Browser File Protection for Encrypted Data Access Control
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Organizations face challenges in managing desktop applications to prevent data exfiltration, such as copying, printing, and sending data files to unauthorized parties, due to the proprietary nature of these applications complicating oversight and control.
Innovation Solution
A web browser is configured to receive data files, apply predefined data restrictions, encrypt them using a unique encryption key, and provide access to authorized applications while enforcing these restrictions, with a file protection service managing decryption and restriction enforcement.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If desktop applications are used to access data files, then data accessibility and application functionality are improved, but data security and control over data exfiltration deteriorate due to proprietary nature complicating oversight
Solution Approach 1:
A file protection service acts as an intermediary between desktop applications and data files. The service intercepts file access requests, decrypts files with enforced restrictions, and returns them to applications. This mediator approach allows proprietary applications to access data while the intermediary enforces security policies, resolving the contradiction between application functionality and data security.
Solution Approach 2:
Data files are encrypted with restrictions applied before they are accessed by desktop applications. The encryption and restriction enforcement are performed in advance, so that even though applications can freely access the decrypted files, the damage is already contained by the pre-applied restrictions. This preliminary security measure maintains both accessibility and security.
2Reliability
If data files are encrypted with unique keys, then data security and protection against unauthorized access are improved, but system complexity and key management burden increase
Solution Approach 1:
The file protection service provides universal encryption and decryption functionality for all data files accessed through it. Rather than requiring separate encryption mechanisms for each application or file type, a single multi-functional service handles all encryption, key management, and restriction enforcement, reducing overall system complexity while maintaining strong security.
3Reliability
If data restrictions are enforced through web browser protocols, then data control and security oversight are improved, but compatibility with proprietary desktop applications deteriorates
Solution Approach 1:
The file protection service serves as an intermediary that translates between web browser-based security protocols and proprietary desktop application file access. The service receives encrypted files with web-based restrictions, decrypts them with enforced policies, and provides them to various desktop applications regardless of their native protocols, maintaining both data control and application compatibility.
Data Source
AI summary
A computer network security method including configuring a web browser to receive a data file via a computer network, determine in accordance with any predefined policy that the data file is subject to predefined data restriction, and provide the data file to a file protection service together with identification of the predefined data restriction, where the file protection service is configured to modify the data file to include the identification of the predefined data restriction, encrypt the data file, and provide the encrypted data file to the web browser, and configuring the web browser to provide the encrypted data file for access by a computer-hosted application that is configured to access a decryption key that is configured to decrypt the data file, decrypt the data file using the decryption key, and enforce the predefined data restriction identified in the data file.