Encrypted File Access Control via Policy Enforcement
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing systems for encrypting files in corporate networks fail to effectively control access, leading to potential data leaks when authorized applications access encrypted files, as they can transfer these files outside the network in decrypted form.
Innovation Solution
A system that includes an encryption engine and a file access policy database to intercept and manage access requests based on predefined policies, providing files in encrypted or decrypted form depending on the application's trust level and user permissions, with administrative control over access rights and network connectivity.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If files are encrypted on disk to protect critical data, then data security is improved, but authorized applications can still transfer files outside the network in decrypted form causing data leaks
Solution Approach 1:
The system performs preliminary actions by establishing trust relationships between applications and files before access occurs. The policy enforcer pre-evaluates application trust levels and file sensitivity, then pre-determines whether to provide decrypted or encrypted content based on these pre-established trust parameters, preventing data leaks before they can occur
Solution Approach 2:
The patent introduces a policy enforcer as an intermediary component that mediates between the encryption service and applications. This intermediary evaluates trust relationships and controls the flow of decrypted content, ensuring that only trusted applications receive decrypted files while untrusted applications receive encrypted files, thus preventing unauthorized data transfers
2Ease of operation
If the system provides decrypted files to authorized applications, then application functionality is improved, but the risk of transferring files outside the network increases
Solution Approach 1:
The system applies local quality by providing different content states (decrypted vs encrypted) to different applications based on their individual trust levels. Trusted applications receive decrypted content for full functionality, while untrusted applications receive encrypted content for security, allowing each application to operate according to its security clearance level
Solution Approach 2:
The patent implements dynamics by making the content delivery adaptive rather than static. The system dynamically adjusts whether to provide decrypted or encrypted files based on real-time trust evaluations between applications and files, allowing the system to maintain both functionality and security according to the current security state
3Reliability
If the system blocks access to encrypted files, then data security is improved, but legitimate access requirements cannot be met
Solution Approach 1:
The system provides dynamic access control that adapts to different scenarios. Instead of blocking all access, the policy enforcer dynamically determines the appropriate response (decrypted access, encrypted access, or blocked access) based on the trust relationship between the application and the file, enabling flexible access control that meets both security and legitimacy requirements
Data Source
Figure 1
Figure 2
Figure 3
AI summary
Disclosed are systems, methods and computer program products for controlling access to encrypted files. In one aspect, the system detects a request from an application to access an encrypted file. The system identifies the application that requested access to the encrypted file and one or more file access policies associated with the application. The file access policy specifies at least a file access method associated with the application. The system then controls access to the file based on the identified one or more file access policies.