File System Firewall for Application-Based Access Control
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current file system security measures primarily focus on user permissions, neglecting the potential malicious impact of application code, which can compromise the computing environment and file system, thus leaving a vulnerability unaddressed.
Innovation Solution
A file system firewall is introduced that intercepts requests, forms rule keys from application-based attributes, and applies access rules to permit or deny file system access, allowing end users to create new rules if none exist, thereby enhancing application-based security.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If file system security relies exclusively on user permissions, then user access control is simplified, but application code vulnerabilities remain unaddressed
Solution Approach 1:
The patent segments the security control mechanism by introducing a separate file system firewall layer that operates independently from traditional user permission systems. This firewall layer specifically monitors and controls application code access patterns, allowing user permissions to remain simple while adding a dedicated security layer for application behavior monitoring.
Solution Approach 2:
The file system firewall acts as an intermediary component positioned between the file system and the operating system. It intercepts file access requests from applications, evaluates them against predefined security rules, and determines whether to permit or deny access, thereby mediating between application code and the file system without requiring changes to user permission structures.
2Reliability
If a file system firewall is introduced to monitor application code, then security against malicious applications improves, but system complexity increases
Solution Approach 1:
The file system firewall is designed as a universal security mechanism that can handle multiple types of file access requests (read, write, execute, delete) and apply consistent security rules across different applications. This multi-functional approach consolidates security management into a single component rather than requiring separate security mechanisms for each application or access type.
Solution Approach 2:
The system includes automated rule management capabilities where the firewall can learn from user decisions and automatically create security rules. When users manually permit or deny specific application access patterns, the system captures these decisions and converts them into automated rules, reducing the need for continuous manual intervention and simplifying ongoing security management.
3Ease of operation
If manual user permission management is used, then application-based security control is unnecessary, but malicious application code cannot be blocked
Solution Approach 1:
The file system firewall implements preliminary security checks by evaluating application access requests against predefined security rules before the actual file access occurs. This preventive mechanism blocks potentially malicious application code from executing harmful operations on the file system, while still allowing legitimate applications to operate normally under established rules.
Solution Approach 2:
The system incorporates feedback mechanisms where user responses to security prompts are captured and used to refine and update security rules. When users manually approve or deny application access, this feedback is processed to automatically generate or modify firewall rules, creating a learning system that improves security control over time while reducing manual intervention requirements.
Data Source
AI summary
Embodiments of the invention address deficiencies of the art in respect to file system access and provide a method, system and apparatus for a file system firewall. In one embodiment of the invention, a data processing system configured for file system access can be provided. The data processing system can include a file system, an operating system, a set of access rules, each of the access rules having an associated rule key, and a file system firewall disposed between the file system and the operating system. The file system firewall can include program code enabled to permit or deny a file system request according to an access rule in the set of access rules associated with a rule key formed from an application based attribute in the file system request.