Kernel-Level Data Protection Module for Encrypted File Access
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing cybersecurity technologies are vulnerable to sophisticated attacks, such as ransomware and phishing, and fail to prevent unauthorized access to sensitive data, especially after malware intrusion into computer systems.
Innovation Solution
A data protection module operating as a kernel-level file system filter implements process authentication and authorization to manage access to encrypted and unencrypted data files, denying access to unauthorized processes and providing access based on predefined authorization levels.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional cybersecurity technologies (firewalls, encryption, role-based access control) are implemented, then basic data protection is provided, but sophisticated attacks such as ransomware and phishing can still bypass these measures
Solution Approach 1:
The patent applies preliminary action by establishing a kernel-level filter driver that proactively intercepts and monitors all file access requests before they reach the actual data storage. This preemptive positioning allows the system to detect and block malicious processes (such as ransomware) before they can access or encrypt sensitive data, rather than reacting after damage occurs. The filter driver is installed and configured in advance to recognize authorized processes and deny access to unauthorized ones, providing continuous protection against known and unknown attack vectors.
2Reliability
If process authentication and authorization monitoring is implemented at the kernel level, then unauthorized access to encrypted data is prevented, but system complexity increases
Solution Approach 1:
The patent employs an intermediary approach by introducing a kernel-level filter driver as a mediator between user-space applications and the actual file system storage. This filter driver sits in the middle of the access chain, intercepting file read/write requests and performing authentication and authorization checks before allowing access to reach the storage device. The intermediary layer consolidates security functions (process identification, authorization verification, encryption key management) in a dedicated component, simplifying the overall system architecture while maintaining strong access controls. Authorized processes receive file handles that grant access to the filter driver, which then permits the actual data access without requiring complex distributed security infrastructure.
Data Source
AI summary
The described embodiments relate to data protection methods, systems, and computer program products. A process-based encrypted data access policing system is proposed based on methods of encrypted data file management, process authentication and authorization, Trojan detection for authorized processes, encryption key generation and caching, and encrypted-file cache management. The process-based encrypted data access policing system may be implemented as a kernel level file system filter and a user-mode filter companion application, which polices the reading/writing of encrypted data in either a server system or an endpoint computer and protects data from data breaches and known or unknown attacks including ransomware and/or phishing attacks.