Externally Imported File Management via Origin Tracking
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing file management systems fail to distinguish between internally created and externally imported files effectively, leading to difficulties in tracking file import paths, sharing within companies, and managing the use and security of externally imported files.
Innovation Solution
A method and device for managing externally imported files by determining whether a file is a monitoring target based on management policy information, collecting file and network traffic information, and recording import information to differentiate and process externally imported files through classification, deletion, or encryption.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Device complexity
If files are managed without distinguishing internally created files from externally imported files, then the file management system is simple, but it becomes difficult to track file import paths, sharing history, and manage security of externally imported files
Solution Approach 1:
The patent segments file management into two distinct categories: internally created files and externally imported files. This segmentation is achieved by introducing a file attribute that identifies the origin of each file, allowing the system to track and manage externally imported files separately while maintaining a unified file management structure. The segmentation enables selective tracking of import paths and sharing history only for externally imported files, rather than all files.
Solution Approach 2:
The patent introduces an intermediary mechanism in the form of a file attribute or metadata field that records whether a file is externally imported. This intermediary element acts as a marker that triggers additional tracking and management actions. When this attribute is set, the system automatically tracks import paths, records sharing history, and applies security policies specific to externally imported files.
2Reliability
If externally imported files are managed separately from internally created files, then file security and import path tracking are improved, but the file management system becomes more complex
Solution Approach 1:
The patent implements a dynamic file management approach where the system automatically adjusts its behavior based on the file origin attribute. When a file is identified as externally imported, the system dynamically enables enhanced tracking, security checks, and import path recording. For internally created files, the system operates in a simpler mode without these additional overheads. This dynamic adaptation allows the system to maintain high security for externally imported files while avoiding unnecessary complexity for internally created files.
Solution Approach 2:
The patent changes the state of file management parameters based on the file origin. A key parameter is the 'file origin' attribute itself, which can have values such as 'internal' or 'external'. Based on this parameter, the system adjusts other parameters including whether to track import paths, record sharing history, and apply specific security policies. This parameter-driven approach allows flexible and adaptive file management without hardcoding separate management systems.
3Measurement precision
If file monitoring is performed at kernel level for every created file, then accurate detection of externally imported files is achieved, but system performance and resource consumption increase
Solution Approach 1:
The patent applies partial monitoring by not monitoring every file creation event at the kernel level with full overhead. Instead, it uses a selective approach: the kernel-level monitor sets a basic file origin attribute based on simple criteria (such as whether the creating process is a browser or email client), and then higher-level applications perform more detailed analysis only on files marked as potentially externally imported. This partial action reduces the performance overhead while maintaining detection accuracy.
Solution Approach 2:
The patent implements preliminary classification at the kernel level by setting a file origin attribute during file creation. This preliminary action uses minimal resources to tag files with basic origin information. Subsequent detailed analysis, including network traffic correlation and process behavior analysis, is performed only on files with the 'external' origin tag, rather than analyzing all files. This preliminary filtering significantly reduces the computational burden while maintaining accurate detection.
Data Source
AI summary
This application describes a method, a device, and a computer readable recording medium for managing an externally imported file. The method may be performed by determining that a created file is a monitoring target file based on a target extension and a target process of management policy information received from a management server, collecting file information of the file in response to the file being determined as the monitoring target file, determining whether the file is an externally imported file based on the file information and network traffic information, and recording import information in the file information in response to the file being determined as the externally imported file.