File Operation History Detection via Nested Meta-Information
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing systems fail to effectively detect intentional file leaks from a client PC to external server computers and do not readily display file operation history.
Innovation Solution
The solution involves using meta-information related to file operations, such as storage identification, operation generation, and copy frequency, which is stored and managed to detect and display file operation history, and an illegal operation detection system that monitors and alerts on suspicious access patterns.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Loss of information
If meta-information is stored in a predetermined storage area inside a file or in another area outside of the file, then file operation history can be detected and displayed, but the system complexity increases due to additional storage and management requirements
Solution Approach 1:
The patent embeds meta-information directly within the file structure itself, creating a nested information architecture where operation history is stored inside the file rather than requiring separate external storage systems. This nesting approach reduces system complexity while preserving complete operation history.
Solution Approach 2:
The patent creates copies of operation history information in multiple locations (both inside files and in external storage areas), allowing the system to detect and display file operation history from multiple sources. This copying strategy ensures history preservation while providing flexibility in management architecture.
2Reliability
If the monitoring apparatus monitors operations with respect to information on a screen of an output apparatus, then illegal file operations can be detected, but the device complexity and resource consumption increase
Solution Approach 1:
The patent introduces an agent program as an intermediary component that runs on the client computer and collects operation information. This agent acts as a mediator between the monitoring apparatus and the file system, reducing the complexity burden on the central monitoring system while maintaining reliable detection capabilities.
Solution Approach 2:
The monitoring function is segmented into distributed components: the agent program on each client computer handles local operation collection, while the management apparatus handles centralized analysis. This segmentation reduces device complexity by distributing monitoring tasks across multiple systems rather than requiring a single complex centralized monitor.
3Measurement precision
If access source identification and assignment is performed for all input information, then the precision of illegal operation detection is improved, but the processing time and system resource usage increase
Solution Approach 1:
The patent performs access source identification and assignment in advance, during the file operation itself, rather than analyzing operations after they occur. This preliminary action ensures precise tracking of file origins while minimizing processing time by capturing identification data at the moment of operation rather than requiring retroactive analysis.
Data Source
AI summary
The present invention efficiently displays in a tree structure form a file operation history. A file storage identifier, an operation identifier, and a count are stored as additional meta-information in an alternate data stream with respect to each file stored in a client terminal file system. The operation identifier manages a number of operations (operation generations). The count manages copy frequencies. This meta-information is also sent to a management apparatus, and used for displaying the file operation history in a tree structure form.