Encrypted File Access Control via Dynamic Policy Enforcement
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing systems for controlling access to encrypted files on corporate networks are inadequate as they allow authorized applications to transfer encrypted files outside the network, potentially leading to data leaks, despite vulnerabilities in software and human factors increasing data interception risks.
Innovation Solution
A system that detects requests from applications to access encrypted files, identifies the application, and applies file access policies to control access by providing access in encrypted or decrypted form, blocking access, or deleting files after blocked attempts, with options to check for network connections and user account types, and requiring passwords, while prioritizing policies and applying them to child applications.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If files are encrypted on disk with classic access policies, then data security is improved, but authorized applications can still transfer files outside the corporate network causing data leaks
Solution Approach 1:
The patent implements dynamic access control by monitoring application behavior in real-time. The system observes file access patterns, detects attempts to transfer files outside the corporate network, and dynamically adjusts access permissions based on detected threats. This transforms static encryption into a dynamic security system that adapts to prevent data leaks while maintaining authorized access.
Solution Approach 2:
The system incorporates feedback mechanisms by monitoring application actions and file transfer attempts. When the system detects an application attempting to transfer an encrypted file outside the corporate network, it receives feedback about this suspicious activity and responds by blocking the transfer or alerting security personnel, thereby preventing data leaks.
2Object-generated harmful factors
If access control policies are implemented to prevent file transfers, then data leak risk is reduced, but application flexibility and ease of operation are worsened
Solution Approach 1:
The system applies partial control by monitoring only specific suspicious actions (attempts to transfer files outside the corporate network) rather than blocking all file operations. This selective approach prevents data leaks while maintaining flexibility for legitimate application operations within the corporate network.
Solution Approach 2:
The access control system is segmented into multiple layers: file-level encryption, application-level monitoring, and network-level transfer control. This segmentation allows different levels of control to work independently, preventing data leaks at the transfer level while maintaining application flexibility at the operational level.
3Measurement precision
If multiple file access policies are applied with different priorities, then access control precision is improved, but system complexity increases
Solution Approach 1:
The system performs preliminary actions by pre-defining access policies with assigned priorities before file access operations occur. When multiple policies apply to a file, the system automatically selects the highest-priority policy without requiring complex real-time analysis, thereby maintaining precision while reducing operational complexity.
Data Source
AI summary
Disclosed are systems, methods and computer program products for controlling access to encrypted files. In one aspect, the system detects a request from an application to access an encrypted file. The system identifies the application that requested access to the encrypted file and one or more file access policies associated with the application. The file access policy specifies at least a file access method associated with the application. The system then controls access to the file based on the identified one or more file access policies.