Process-Level File Access Control via Behavioral Exposure Monitoring
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Enterprise networks face challenges in effectively detecting and responding to the growing number and sophistication of malware and security breaches, with existing security techniques failing to provide adequate protection against increasingly complex threats.
Innovation Solution
An extension to the file system on an endpoint that supports transparent, process-level control over encryption and decryption of files, combined with an integrity monitor that evaluates the security state of processes to detect potential threats, applies behavioral rules to determine exposure, and conditionally decrypts files to restrict access based on exposure state, using a cryptographic key that can be deleted upon compromise.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If existing security techniques are used to protect enterprise networks, then basic security coverage is provided, but they fail to detect and respond to sophisticated malware and security breaches
Solution Approach 1:
The patent implements dynamic security monitoring that adapts to process behavior in real-time. The integrity monitor continuously evaluates security states and updates exposure assessments based on observed process actions, allowing the system to respond dynamically to sophisticated threats rather than relying on static security rules
Solution Approach 2:
The patent introduces a file system extension as an intermediary layer between processes and encrypted files. This extension includes an integrity monitor that mediates access requests by evaluating process security states, determining exposure levels, and conditionally allowing or blocking file access based on behavioral analysis, thereby enhancing security without requiring complete system redesign
2Reliability
If all files are encrypted to prevent unauthorized access, then data security is improved, but process-level control and selective access become more complex
Solution Approach 1:
The patent segments file access control to the process level rather than applying uniform encryption controls. The file system extension evaluates each process individually, assigning security states and exposure levels to specific processes based on their behavioral characteristics, allowing selective access control that adapts to each process's threat profile
Solution Approach 2:
The integrity monitor implements feedback mechanisms by continuously monitoring process behavior, evaluating security states, and using this information to dynamically control file access. The system feeds exposure assessment results back into the file system extension, which adjusts access decisions based on the current security evaluation, creating a closed-loop control system
3Measurement precision
If behavioral rules are applied to monitor process exposure state, then detection precision is improved, but the number of rules and monitoring complexity increase
Solution Approach 1:
The patent applies behavioral monitoring rules locally to individual processes based on their specific characteristics and risk profiles. Rather than uniformly applying all monitoring rules to all processes, the system evaluates each process's security state and applies relevant behavioral rules selectively, improving detection precision while reducing unnecessary monitoring overhead
Data Source
AI summary
Securing an endpoint against exposure to unsafe content includes encrypting files to prevent unauthorized access, and monitoring an exposure state of a process to potentially unsafe content by applying behavioral rules to determine whether the exposure state is either exposed or secure, where (1) the process is initially identified as secure, (2) the process is identified as exposed when the process opens a network connection to a URL that is not internal to an enterprise network of the endpoint and that has a poor reputation, (3) the process is identified as exposed when it opens a file identified as exposed, and (4) the process is identified as exposed when another exposed process opens a handle to the process. Access to the files may be restricted when the process is exposed by controlling access through a file system filter that conditionally decrypts files for the process according to its exposure state.