File System Filter Driver for Information Leakage Prevention

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Conventional information leakage prevention techniques are insufficient against emerging malicious applications that can steal or manipulate encrypted data, as they allow unauthorized access and do not effectively prevent duplication, reading, or alteration of file content by untrusted applications.

Innovation Solution

A system that includes an application identification module using hash values, an association table with file-type and trusted-application data, and an access control module to determine whether to deny content access by applications to encrypted, decrypted, or unencrypted file content, employing a file system filter driver protocol and virus scanning to identify trusted applications and prevent unauthorized access.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If conventional ILP techniques use encryption and passwords to protect confidential information, then unauthorized access to file content is prevented, but malicious applications can still steal encrypted content or manipulate it without decryption

Engineering Contradiction:

Improveprotection of confidential informationVSAvoidmalicious application access to encrypted content

Core Design Contradiction:

ReliabilityVSObject-affected harmful factors

Solution Approach 1:

The patent introduces a file system filter driver as an intermediary layer between applications and encrypted files. This filter driver intercepts all file access requests, validates application credentials against a whitelist stored in the registry, and controls whether applications can access encrypted file contents. The intermediary prevents malicious applications from stealing or manipulating encrypted content while allowing trusted applications to function normally.

Inventive Principle:

Principle #24Intermediary (Mediator)

Solution Approach 2:

The system performs preliminary validation of application credentials before allowing access to encrypted files. The whitelist of trusted applications is pre-configured in the registry, and the file system filter driver checks application credentials in advance of any file access operation. This preliminary action prevents unauthorized applications from accessing encrypted content before they can cause harm.

Inventive Principle:

Principle #10Preliminary action

2Ease of operation

If ILP programs allow applications to access encrypted content, then legitimate applications can read and process files, but unauthorized applications can steal or manipulate the content

Engineering Contradiction:

Improveapplication access to file contentVSAvoidinformation leakage through unauthorized access

Core Design Contradiction:

Ease of operationVSLoss of information

Solution Approach 1:

The file system filter driver acts as an intermediary that controls all file access requests. It validates application credentials against the whitelist and selectively allows or blocks access to encrypted file contents. This intermediary mechanism maintains ease of operation for legitimate applications while preventing information leakage to unauthorized applications.

Inventive Principle:

Principle #24Intermediary (Mediator)

Solution Approach 2:

The system applies different access control policies to different applications based on their credentials. Trusted applications in the whitelist receive full access to encrypted file contents, while untrusted applications are completely blocked. This local quality approach ensures that each application receives appropriate access rights based on its trust level.

Inventive Principle:

Principle #3Local quality

3Reliability

If ransomware applications can access file content, then they can threaten to delete or encrypt data, but conventional ILP cannot prevent the ransomware from obtaining confidential information

Engineering Contradiction:

Improveprotection against ransomwareVSAvoidILP technique effectiveness against emerging threats

Core Design Contradiction:

ReliabilityVSAdaptability or versatility

Solution Approach 1:

The system performs preliminary validation of application credentials before allowing access to encrypted files. The whitelist of trusted applications is pre-configured in the registry, and the file system filter driver checks application credentials in advance of any file access operation. This preliminary action prevents ransomware and other malicious applications from accessing encrypted content or obtaining confidential information.

Inventive Principle:

Principle #10Preliminary action

Solution Approach 2:

The system applies preliminary anti-action by blocking all applications except those in the whitelist from accessing encrypted file contents. This preemptive block prevents ransomware from stealing, deleting, or manipulating encrypted files before any harmful action can occur. The system counteracts potential malicious actions before they can be executed.

Inventive Principle:

Principle #9Preliminary anti-action

Data Source

PatentUS11841970B1Systems and methods for preventing information leakage

Publication Date: 2023.12.12 TREND MICRO INC

AI summary

A system for preventing information leakage due to access by an application to a file is provided. The system for preventing information leakage includes an application identification module configured to obtain data associated with the application. The system for preventing information leakage also includes an association table containing file-type data and trusted-application data. In addition, the system also includes an access control module to determine the application identifier and the association table. The system for preventing information leakage is configured to determine whether to deny content access by the application to content of the file as saved in the file.