Process-Based File Access Control for Ransomware Mitigation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In computing environments, existing access control methods rely on user-based permissions, which can be compromised if an authorized user's processes, such as ransomware, access and modify files maliciously, lacking process-specific control to prevent unauthorized file access.
Innovation Solution
Implementing a method and system for process-based file access control in a virtualized computing environment, where an agent collects information on processes accessing files, generates a policy based on access patterns, and traps file access requests to allow or deny access based on the policy, thereby restricting unauthorized process access even if launched by an authorized user.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If user-based access control is used, then ease of operation is improved, but security is worsened because any process launched by an authorized user can access all files associated with that user
Solution Approach 1:
The patent segments the broad user-based access control into finer-grained process-based access control. Instead of granting all processes launched by a user equal access to all user files, the system creates separate access control lists for individual processes, allowing precise control over which processes can access which files. This segmentation maintains ease of operation through automated policy generation while improving security by restricting process-specific access.
Solution Approach 2:
The patent applies local quality by making access control permissions specific to each process-file interaction rather than applying uniform user-level permissions across all files. The system generates customized access control policies for each process based on its characteristics and required file access patterns, ensuring that each process receives only the minimum necessary permissions rather than blanket access to all user files.
2Reliability
If process-based access control is implemented, then security is improved, but device complexity is worsened due to the need for policy generation and enforcement mechanisms
Solution Approach 1:
The patent applies preliminary action by generating access control policies in advance during a learning mode before actual file access operations begin. The system collects information about process behavior patterns and pre-generates access control policies that can be enforced during protected mode. This preliminary policy generation reduces the complexity of real-time access control decisions by having policies ready beforehand rather than creating them on-the-fly during file access operations.
Solution Approach 2:
The system implements self-service by automatically generating access control policies based on collected process information without requiring manual administrative configuration. The policy generation mechanism autonomously analyzes process behavior patterns and creates appropriate access control rules, reducing the operational complexity that would otherwise be associated with manual policy management and enforcement.
3Measurement precision
If comprehensive process monitoring is performed, then measurement precision is improved for security analysis, but loss of time is worsened due to continuous information collection and verification
Solution Approach 1:
The patent reduces time loss by performing comprehensive process information collection and analysis during a preliminary learning mode before protected mode begins. During this learning phase, the system gathers detailed process information and generates access control policies in advance. Once policies are generated, the protected mode can enforce them with minimal real-time verification overhead, thus maintaining high measurement precision for security while reducing continuous monitoring time requirements.
Data Source
AI summary
Example methods are provided for adaptive file access authorization using process access patterns. In a learning mode, attributes and other information, which are associated with applications or with processes that are related to the applications and that attempt to access a file system, are collected and used to generate a policy. In a protected mode, file access requests are examined against the policy, and are granted access to the file system or are denied access to the file system based on the contents of the policy. The policy may be updated so as to adapt to changes in the access patterns and to changes in the application or processes.