Kernel-Level Security Label Map for Application Data Protection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Enterprises face challenges in securing enterprise emails, presentations, and documents from theft and unauthorized access, particularly in bring-your-own-device models where malicious applications can breach security, leading to data breaches.
Innovation Solution
Implementing kernel-level application data protection by embedding security labels in files created, downloaded, or received by protected applications, and using a security label map to permit or deny access based on the application's permissions, ensuring only authorized applications can access sensitive files.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If users are allowed to install any applications on enterprise devices, then user adoption rates and device versatility improve, but security risk increases due to potential malicious applications accessing enterprise files
Solution Approach 1:
The patent implements application-specific security labels on files, where each file has security labels that identify which applications are permitted to access it. This allows different security rules to apply to different files and applications locally, rather than applying a uniform security policy across all files and applications. The kernel intercepts file access requests and checks the security labels to determine whether to permit or deny access based on the specific application making the request and the specific file being accessed.
Solution Approach 2:
The patent introduces a kernel-level intermediary that sits between applications and files. The kernel intercepts system calls made by applications to access files and acts as a mediator that checks security labels on both the application and the file. This intermediary layer prevents malicious applications from directly accessing protected files while still allowing legitimate applications to access files they are permitted to view, thus resolving the contradiction between versatility and security.
2Reliability
If enterprise content is protected with strict access controls, then data security improves, but user productivity decreases due to limited application access
Solution Approach 1:
The patent implements dynamic access control where the permitted applications for each file can be flexibly configured by enterprise administrators. Rather than static, one-size-fits-all security policies, the system allows dynamic adjustment of which applications can access which files based on enterprise needs. This dynamic approach enables security policies to adapt to different workflows and use cases, maintaining security while supporting productivity.
Solution Approach 2:
The patent segments enterprise files into different security zones based on sensitivity and required access permissions. Each file can have its own security labels specifying which applications are permitted to access it. This segmentation allows highly sensitive files to have strict access controls while less sensitive files can be more freely accessible, thus protecting critical data without unnecessarily limiting productivity for general business operations.
3Reliability
If all files of a particular type are forced to be accessible only using a particular application, then data protection improves, but user flexibility and ease of operation deteriorate
Solution Approach 1:
The patent applies security labels at the individual file level rather than at the file type level. Each file can have its own security labels specifying which applications are permitted to access it, rather than forcing all files of a particular type to be accessible only through a single application. This local quality approach allows users to access files with permitted applications of their choice while maintaining security controls.
Solution Approach 2:
The patent creates a universal security framework that works across all file types and applications. The kernel-level security label mechanism provides a common interface for enforcing access controls regardless of file type or application. This universal approach allows multiple applications to access the same file if they are all permitted by the security labels, providing user flexibility while maintaining consistent security protection across the enterprise.
Data Source
AI summary
Disclosed are various examples for kernel level application data protection. In one example, a security label and a list of permitted applications are received. The security label is utilized to limit access to files that embed the security label. A security label map is written within a kernel layer of the client device. The security label map includes the security label and the list of permitted applications. A secured file is generated by embedding the security label within a file stored on the client device.