File Protection Engine Intercepts I/O Requests for Persistent Data Security
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods for protecting digital files from unauthorized access and data leakage are inadequate, as they either rely on limited operating system controls or full disk encryption, which does not ensure protection once the file is decrypted and distributed, and are susceptible to data leakage outside the security domain.
Innovation Solution
Implementing a system that transparently protects and unprotects file data content using a file protection engine that intercepts and classifies input/output requests based on file attributes, applying data transformations such as encryption or pseudonymization to ensure persistent protection and control access policies, even when files are disseminated across networks.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If full disk encryption is used to protect digital files, then data security is improved, but the files become vulnerable to data leakage once decrypted and distributed outside the security domain
Solution Approach 1:
The patent applies preliminary action by embedding protective metadata and access control policies into the file before distribution. The file is prepared with embedded credentials, digital rights management information, and usage restrictions in advance, so that even when the file is copied or transmitted outside the security domain, these protective measures travel with the file and continue to enforce security policies without requiring the receiving system to have the same security infrastructure.
2Ease of operation
If operating system credentials are used to control file access, then access control is enforced within the security domain, but protection is lost when files are accessed outside that domain
Solution Approach 1:
The patent implements universality by creating a multi-layered access control system that combines traditional operating system credentials with embedded file-level security mechanisms. The file contains multiple layers of access control information including digital rights management data, usage policies, and cryptographic credentials that can be enforced across different operating systems and security domains. This allows the same file to maintain protection whether accessed locally or distributed externally.
3Reliability
If file content is encrypted to prevent unauthorized access, then data protection is improved, but the file cannot be freely accessed or modified by authorized users
Solution Approach 1:
The patent applies dynamics by implementing dynamic decryption and transformation of file content based on the credentials and context of the accessing user. When an authorized user accesses the file, the system dynamically evaluates their credentials against the embedded policies and decrypts or transforms the content appropriately. This allows the same encrypted file to be accessible to multiple authorized users with different permission levels, while maintaining strong protection against unauthorized access.
Data Source
AI summary
A technique includes intercepting, by a computer, an input/output (I/O) request that is directed to a file; and in response to the interception of the I/O request, accessing, by the computer, file system attributes that are associated with the file and are stored separately from the file. The technique includes classifying, by the computer, the I/O request based on the file system attributes; and performing, by the computer, a data transformation that is associated with the file based on the classification.