Server-Client Clipboard Control via Instruction Interception
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current server-based computing systems face challenges in preventing unauthorized acquisition of confidential information, particularly when client apparatuses have storage devices, as they can copy and transmit sensitive data, and existing access control methods cannot restrict specific types of access, such as read-only access.
Innovation Solution
A system and method that utilize a shared storage area between the server and client apparatuses, where output and reading processes are detected and controlled through API calls, with authentication and encryption mechanisms to ensure only authorized clients can access and acquire data, using instruction information to specify acquisition methods and store data securely.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If a personal computer or client apparatus with its own storage device is used, then productivity is improved and server load is reduced, but security deteriorates as confidential information can be copied and taken out illegally
Solution Approach 1:
The patent extracts the harmful capability of copying confidential information from the client apparatus by intercepting clipboard API calls. The output control section detects output-processing API calls and prevents actual data copying to the client's storage device, while still allowing the application to function. This separates the useful function (application operation) from the harmful function (unauthorized data copying).
Solution Approach 2:
The patent introduces an intermediary mechanism (the output control section and reading control section) between the application program and the clipboard function. This intermediary detects API calls, verifies authorization, and controls whether data can be copied or read, thereby mediating between the need for data access and the need for security protection.
2Ease of operation
If MAC address and IP address-based access control is implemented, then ease of operation is improved with uniform access prohibition, but adaptability deteriorates as it cannot control specific types of access or handle impersonation
Solution Approach 1:
The patent implements dynamic access control by detecting the type of API call (output-processing or reading-processing) and applying different authorization rules accordingly. The system can dynamically adjust what operations are permitted based on the specific request, rather than applying a static blanket prohibition. This allows fine-grained control over different types of access while maintaining ease of operation.
Solution Approach 2:
The patent applies different security controls to different locations in the data flow. The output control section controls where data can be written (preventing copies to client storage), while the reading control section controls where data can be read from (allowing reads only from server storage). This local differentiation of access control enables flexible, context-specific security policies.
3Ease of operation
If clipboard function is enabled for convenience, then ease of operation is improved, but security deteriorates as confidential information can be transmitted to unauthorized clients
Solution Approach 1:
The patent converts the potentially harmful clipboard function into a beneficial controlled feature. By monitoring and controlling clipboard operations, the system maintains the convenience of data copying for authorized operations while preventing unauthorized data exfiltration. The same mechanism that enables convenience (clipboard access) is used to enforce security controls.
Solution Approach 2:
The patent implements feedback control by detecting clipboard API calls and responding with authorization decisions. The output control section detects output calls and prevents unauthorized writes, while the reading control section detects read calls and permits only authorized reads. This feedback loop maintains security while preserving useful functionality.
Data Source
Figure 1
Figure 2
Figure 3~4
AI summary
An object is to prevent information leakage from a server apparatus without deteriorating user's convenience. In order to attain the above object, disclosed is a system including a server apparatus executes an application program and a client apparatus enabling a user to utilize the application program by communicating with the server apparatus based on an instruction of the user. The server apparatus includes: an output detection section for detecting output-processing which is processing of outputting data from the application program into a shared area; and an output control section for storing instruction information in the shares area, instead of storing the output data outputted from the application program therein, in response to the detection of the output-processing, the instruction information specifying an acquisition method by which an authorized client apparatus acquires the output data. The client apparatus includes: a reading detection section for detecting reading-processing which is processing of reading data from the shared area; and a reading control section which reads the instruction information from the shared area in response to the detection of the reading-processing, and which acquires the output data by the acquisition method specified by the instruction information.