File Access Control via Fingerprint Verification
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current data loss prevention systems adopt an 'all or nothing' approach, lacking selective access control, which prevents creators or owners from managing file access after sharing or making files public, leading to unauthorized sharing.
Innovation Solution
A system that determines a fingerprint of a file upon creation or receipt, defines permitted users and actions, and compares the file's fingerprint at access time to ensure authorized actions, providing proactive security and preventing unauthorized sharing.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If users are given full access to read, copy, and modify targeted data, then ease of operation is improved, but security and control over the data deteriorates
Solution Approach 1:
The patent segments access control into multiple levels: full access, read-only access, and no access. This allows the system to provide ease of operation for permitted actions while maintaining security and control through granular permission settings. Users can be granted specific access rights based on their needs, resolving the contradiction between operational ease and data control.
Solution Approach 2:
The patent implements dynamic access control where permissions can be changed after file sharing. The system allows creators to modify access permissions, revoke access, or update permitted actions at any time. This dynamic capability enables the system to maintain both ease of operation during legitimate use and security/control when permissions need to be adjusted, resolving the static nature of traditional access control.
2Reliability
If users are prevented from accessing targeted data entirely, then security and control over the data is improved, but ease of operation deteriorates
Solution Approach 1:
The patent applies local quality by granting different access permissions to different users for the same file. Instead of a blanket prevent-or-allow approach, the system allows specific users to access specific portions of data or perform specific actions (read, copy, modify) based on their individual permissions. This resolves the contradiction by providing control at the granular level while maintaining operational ease for authorized users.
3Device complexity
If selective permission to access files is not permitted, then device complexity is reduced, but loss of information control increases
Solution Approach 1:
The patent implements preliminary action by establishing access permissions and permitted actions before file sharing occurs. The system pre-defines what users can and cannot do with shared files, and these permissions are enforced automatically. This preliminary setup prevents information loss control issues without requiring complex real-time monitoring, as the control framework is already in place before sharing begins.
Solution Approach 2:
The patent incorporates feedback mechanisms where the system monitors file access and actions against the predefined permissions. When a user attempts an action, the system provides feedback by allowing or blocking the action based on pre-established rules. This automated feedback loop maintains information control without adding significant complexity, as the enforcement is systematic and rule-based rather than requiring manual intervention.
Data Source
AI summary
Embodiments for preventing data loss and allowing selective data access are provided. In some embodiments, the system and method are configured to receive task protocols and registration requests; determine an allowed list based on the protocols or requests, the list comprising registered data and codes needed to execute a task; allow a user to establish a connection to a device to execute the task on the device; identify data being transferred to and from the device; compare the data being transferred and the allowable list; and determine that at least some of the data being transferred is allowable.