Monitoring Component for Blocking Unauthorized Data Access
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods fail to accurately distinguish between user-initiated and unauthorized data access, often blocking valid user access due to differences in graphic user interface (GUI) and internal logic processes, while allowing malicious data access to proceed without user intervention.
Innovation Solution
A method that utilizes a user operation event provided by a user accessibility management module to monitor and differentiate between user-initiated and unauthorized data access, blocking access when it does not align with user operations, and allowing access when it does, using a monitoring software component that hooks APIs and device drivers to detect and manage access attempts.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If data access blocking is implemented by comparing process types (GUI process vs internal logic process), then unauthorized data access can be blocked, but valid user data access may also be blocked due to process type differences
Solution Approach 1:
The system segments the monitoring approach by dividing data access events into two distinct categories: user operation events (from GUI interactions) and non-user operation events (from internal logic or malicious codes). This segmentation allows the system to apply different handling rules to each category, ensuring user access is permitted while blocking unauthorized access.
Solution Approach 2:
The system introduces an intermediary monitoring component that sits between the data access request and the actual data. This intermediary intercepts access requests, determines whether they originate from user operations or internal logic processes, and makes blocking decisions based on this determination, thereby preventing false blocking of valid user access.
2Reliability
If all data access by internal logic processes is blocked, then malicious data access can be prevented, but legitimate internal data processing cannot proceed
Solution Approach 1:
The system segments non-user operations into two categories: malicious code access and legitimate internal logic access. By further analyzing the characteristics and sources of non-user operations, the system can distinguish between harmful malicious codes and necessary internal processing, allowing legitimate internal data processing to proceed while blocking malicious access.
Solution Approach 2:
The system implements feedback mechanisms where the monitoring component continuously analyzes data access patterns, process behaviors, and system states to dynamically adjust blocking decisions. This feedback loop enables the system to learn and adapt, ensuring that legitimate internal processing is maintained while malicious codes are blocked.
3Measurement precision
If monitoring of all data access is implemented, then unauthorized access can be detected, but system performance and user experience deteriorate
Solution Approach 1:
The system applies partial monitoring by focusing only on specific data access events that require security scrutiny, rather than monitoring all data access uniformly. By selectively monitoring only relevant access patterns and using efficient event comparison techniques, the system maintains high detection accuracy while minimizing performance overhead and avoiding excessive processing.
Data Source
AI summary
Methods and apparatuses for blocking unauthorized data access are provided, one of methods comprises, monitoring whether there is an access to an object by an accessing instance, receiving an user operation event from a user accessibility management module, wherein the user operation event is created by the user accessibility management module and includes information on a user operation object and blocking at least one of the access to the object and a transmission of the object to an external device via a network, in accordance with the access to the object is monitored, when the accessed object is different from the user operation object or no user operation event is provided for the accessed object.