US20150161364A1 - System and method of applying access rules to files transmitted between computers - Google Patents
System and method of applying access rules to files transmitted between computers Download PDFInfo
- Publication number
- US20150161364A1 US20150161364A1 US14/209,210 US201414209210A US2015161364A1 US 20150161364 A1 US20150161364 A1 US 20150161364A1 US 201414209210 A US201414209210 A US 201414209210A US 2015161364 A1 US2015161364 A1 US 2015161364A1
- Authority
- US
- United States
- Prior art keywords
- file
- remote computer
- access
- computer
- access rules
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Granted
Links
Images
Classifications
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
- G06F21/30—Authentication, i.e. establishing the identity or authorisation of security principals
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
- G06F21/60—Protecting data
- G06F21/62—Protecting access to data via a platform, e.g. using keys or access control rules
- G06F21/6218—Protecting access to data via a platform, e.g. using keys or access control rules to a system of files or objects, e.g. local or distributed file system or database
Definitions
- the disclosure relates generally to the field of computer security and, more specifically, to systems, method and computer program products for protecting computers and data against unauthorized access by applying access rules to files transmitted between computers.
- the classic system for encryption of files and contents of the directories on a computer operates in accordance with encryption policies. Generally, these policies determine the sets of files that must be encrypted and the files that do not require encryption. In such a system, the most vulnerable and critical files (such as files containing confidential information whose loss is undesirable to its owner) on a disk are present in encrypted form. In corporate networks it is often possible to gain access by means of one computer on the network to the files of another computer. Despite the convenience of exchanging data between computers on the network, such a method has certain inadequacies in regard to protecting the data being transmitted—the files are transmitted in unencrypted form. To solve this problem, an encrypted data transmission channel is used or the files are transmitted in encrypted form.
- the present invention relates to systems, methods and computer program products for protecting computer equipment and data of end users against unauthorized access.
- a method for providing access to computer files includes receiving, by a hardware processor, from a remote computer, a request to access a file; determining one or more parameters of the requested file, the remote computer and a user of the remote computer; determining, based on the one or more parameters, access rules for the requested file, wherein the access rules specify at least encryption requirements for the requested file; and applying, by the hardware processor, the access rules to the requested file.
- a system for providing access to computer files includes a hardware processor configured to receive, from a remote computer, a request to access a file; determine one or more parameters of the requested file, the remote computer and a user of the remote computer; determine, based on the one or more parameters, access rules for the requested file, wherein the access rules specify at least encryption requirements for the requested file; and apply the access rules to the requested file.
- a computer program product stored on a non-transitory computer-readable storage medium, includes computer-executable instructions for providing access to computer files, including instructions for receiving, from a remote computer, a request to access a file; determining one or more parameters of the requested file, the remote computer and a user of the remote computer; determining, based on the one or more parameters, access rules for the requested file, wherein the access rules specify at least encryption requirements for the requested file; and applying the access rules to the requested file.
- FIG. 1A shows an aspect of an example system for protecting computer equipment and data against unauthorized access.
- FIG. 1B shows another aspect of an example system for protecting computer equipment and data against unauthorized access.
- FIG. 2 shows an aspect of an example method for protecting computer equipment and data against unauthorized access.
- FIG. 3 shows a sample of the application of rules of access to computer files.
- FIG. 4 shows an example of a general-purpose computer system on which systems and methods for protecting computer equipment and data against unauthorized access may be implemented.
- Example aspects are described herein in the context of a system, method and computer program product for protecting computer equipment and data from unauthorized access. Those of ordinary skill in the art will realize that the following description is illustrative only and is not intended to be in any way limiting. Other aspects will readily suggest themselves to those skilled in the art having the benefit of this disclosure. Reference will now be made in detail to implementations of the example aspects as illustrated in the accompanying drawings. The same reference indicators will be used to the extent possible throughout the drawings and the following description to refer to the same or like items.
- FIG. 1A shows an aspect of an example system for protecting computer equipment and data from unauthorized access.
- the system includes a local computer 100 and a remote computer 110 .
- the local computer 100 may include an encryption engine 101 , which serves to intercept requests to obtain access to files 102 of the local computer 100 arriving from a user 112 of the remote computer 110 , and also to ascertain the parameters of the following objects: the user 112 of the remote computer 110 , the file being requested, the remote computer 110 , etc.
- the parameters of the user 112 of the remote computer 110 may include, but not limited to, user account rights and user's role in the company (e.g., administrator, security officer, accountant, programmer, etc).
- the file parameters may include, but not limited to: an indicator of whether or not the file is encrypted; the file type (such as text with extension “txt”, text with extension “doc”); the hash sum of the file; and file attributes.
- the parameters of the remote computer 110 may include, but not limited to: indicators determining for each of the disks whether or not the disk is encrypted; the security level; the type of disk encryption—file level or full disk encryption.
- the security level may take on discrete values and depend on the date of the last updating of the antivirus database, the presence of unpatched vulnerabilities on the computer, the date of the last antivirus check and the result of this check (for example, the number of malicious programs neutralized, i.e., repaired or removed programs, the number of files infected, etc.), and also the list of installed applications.
- the security level can be expressed in a percent, where 100% represents the highest level of security, in which the latest update of the antivirus database has been installed on the computer, there is no vulnerabilities, and no file has been infected. By the same token, 0% represents the opposite situation, in which the antivirus database is outdated, there are numerous vulnerabilities and infected files.
- the encryption engine 101 of the local computer 100 may be also operable to transmit the established file access rules to the encryption engine 111 of the remote computer 110 .
- the encryption engine 111 of the remote computer 110 is designed to intercept the opening of files 102 by the user 112 of the remote computer 110 , and also to apply file access rules to files of the local computer 100 depending on the established parameters of the objects.
- these access rules may include, but not limited to: prohibiting access, granting transparent access to an encrypted file (i.e., the file will be decrypted and presented to the user 112 in clear text), or granting access to ciphertext.
- the local computer 100 also includes a database of access policies 103 , connected to the encryption engine 101 and containing access rules to the files 102 of the local computer 100 for the remote computer 110 depending on the parameters of the objects.
- the encryption engine 111 of the remote computer 110 may additionally provide the parameters of the remote computer 110 and its user to the encryption engine 101 of the local computer 100 .
- the user parameters may include, for example, the user's account rights on the remote computer 110 .
- FIG. 1B shows another aspect of an example system for protecting computer equipment and data from unauthorized access.
- the system contains all the elements presented above in FIG. 1A , and may also include a protection center 120 , connected to the encryption engines 101 , 111 of the local and remote computers 100 , 110 , respectively.
- the protection center 120 serves to designate the access policies, and also to exchange file encryption keys of the local computer 100 with the local and remote computers 100 , 110 .
- the protection center 120 may contain a database of access policies 103 , as described above.
- the encryption engine 101 may consult the database of access policies 103 via the protection center 120 .
- system may additionally contain an auxiliary database of access policies 121 , connected to the encryption engine 101 and designed to store the most requested access policies from the database 103 .
- database of access policies 103 may be further operable to store the parameters of the objects.
- FIG. 2 shows a particular aspect of the method of implementing the present invention in the context of the system shown in FIG. 1A .
- the user 112 of the remote computer 110 requests access to a file 102 (for example, it tries to open, copy, or alter a file) of the local computer 100 .
- the encryption engine 101 of the local computer 100 intercepts the request of the user 112 to obtain access to the file.
- the encryption engine 101 of the local computer 100 establishes the parameters of the objects, such as, for example, the user 112 of the remote computer 110 , the file being requested, the remote computer 110 .
- the next step will be 204 , in which the encryption engine 101 of the local computer 100 in accordance with the established parameters of the objects determines the access rule by means of the access policy database 103 .
- the encryption engine 101 transmits this rule to the encryption engine 111 of the remote computer 110 .
- the encryption engine 111 of the remote computer 110 applies the obtained access rule to the file being requested 102 of the local computer 100 .
- the procedure for applying the access rules, to be performed in step 206 will be disclosed in detail below in the description for FIG. 3 .
- step 203 there can occur an additional step 207 , in which the encryption engine 101 of the local computer 100 checks whether all necessary parameters have been established. In certain situations, some of the parameters cannot be established on the local computer 100 , although they can be established on the remote computer 110 . For example, the encryption engine 101 of the local computer 100 cannot determine the account rights of the remote computer 110 if the remote computer 110 itself does not furnish this information. Thus, if all necessary parameters have been established in step 207 , the flow chart returns to step 204 . Otherwise, in step 208 , the encryption engine 101 of the local computer 100 requests the missing parameters from the encryption engine 111 of the remote computer 110 , which sends them back in the next step 209 . As a result, the flow chart returns to step 204 , as described above in detail.
- Table 1 below presents an example of the content of the database of access policies.
- the database of access policies can constitute a table, the rows of which contain the access rules. For each rule there are defined the conditions of its occurrence and the action performed by the encryption engine 101 of the local computer 100 when this rule is selected.
- the rules in the table are kept in order of decreasing priority, so that if several rules fall under a specified condition, the rule with the highest priority will be selected.
- Hash sum on the black list Prohibit access 2 Hash sum is found on the list of mandatory encryp- Provide tion files cipher text 3 a.
- File contains the “system” attribute, Provide b. security level >90%, cipher text c. user account rights - personal computer (PC) administrator 4
- File contains the “system” attribute
- File contains the “read only” attribute
- Provide the system disk of the remote PC is encrypted cipher text
- File contains the “read only” attribute Prohibit access
- the first rule has the highest priority and the last rule the lowest.
- the database of access policies may additionally contain black lists of hash sums of files which are critically important or confidential files. Access to such files by the user 112 of the remote computer 110 will be prohibited according to the first rule of Table 1.
- the database of access policies may contain a list of mandatory encryption files, which keeps the hash sums of files that are kept in encrypted form on the local computer 100 . According to rule No. 2 of Table 1, such files will be furnished to the remote computer 110 in encrypted form.
- a file is a system file and at the same time the security level of the remote computer 110 is greater than 90%, and also if the user 112 of this computer has administrator rights, then the file will be presented to the remote computer 110 in the form of cipher text. However, if even one of conditions “a” to “c” is not fulfilled, this rule will not be used. For example, if a particular file is also a system file, but the security level of the remote computer 110 is equal to 85%, the more harsh rule No. 4 will be applied, whereby access to the file will be prohibited.
- a default rule may be applied, such as allowing access to the file.
- the access policies may be designated and changed periodically by the administrator of the local computer 100 .
- the encryption engine 101 of the local computer 100 can allow the user 112 of the local computer 100 to select the access rule manually.
- the access policies may be changed based on various additional conditions, such as, for example, the time of day and the account rights of the user 112 of the local computer 100 . For example, during business hours one set of access policies may be used, and during nonbusiness hours another set.
- step 204 the encryption engine 101 requests access rules from the protection center 120 , which in turn provides the access rules to the encryption engine 101 according to the database of access policies 103 .
- the encryption engine 101 of the local computer 100 may request the missing parameters of the objects in the database 103 , and if there are none in the database 103 either, the protection center 120 in turn may request them from the encryption engine 111 of the remote computer 110 and keeps them in the database 103 .
- some of the database of access policies 103 may be kept in an auxiliary database 121 . In this case, the encryption engine 101 will determine the access rules with the aid of the auxiliary database 121 .
- FIG. 3 shows an example of the use of rules of access to the files of a computer.
- the rule for access to the file being requested is determined. If the access rule is prohibitory, then in step 320 access to the file is blocked.
- the user 112 of the remote computer 110 may be sent a message as to the reason for prohibiting access.
- the user 112 of the remote computer 110 may be asked to enter a password for access to the file.
- the next step will be 310 , in which the encryption engine 101 of the local computer 100 sends the file to the encryption engine 111 of the remote computer 110 , which in turn presents it to the user 112 of the computer in step 311 .
- step 302 If an access rule is selected whereby the file should be presented in the form of cipher text, the flow chart continues in step 302 . If the file was originally encrypted, it is sent on to the remote computer 110 . But if the file was not encrypted, the encryption engine 101 of the local computer 100 may encrypt the file before sending it to the remote computer 110 . In step 303 , the remote computer 110 receives the file, decrypts it and presents it to the user 112 .
- a symmetrical encryption may be used for encrypting the files, in which the encryption engines 101 , 111 of the local and remote computers 100 , 110 previously exchange the key that will be used for both encryption and decryption of the data.
- a public-key encryption scheme may be used, in which the encryption engines 101 , 111 of the local and remote computers 100 , 110 have one public key and one private key each.
- the encryption engine 101 of the local computer 100 can encrypt files with the public key of the encryption engine 111 of the remote computer 110 .
- such a file can only be decrypted by the remote computer 110 using its private key.
- the protection center 120 can participate in the file transfer process.
- the encryption engine 101 of the local computer 100 tan encrypt a file by means of a certain “file key”, which is then encrypted by the public key of the protection center 120 and placed in the metadata of the file.
- the encryption engine 111 of the remote computer 110 can extract the encrypted “file key” from the metadata of the file and send it to the protection center 120 , which decrypts it by its private key and sends it back to the remote computer 110 .
- the protection center 120 may not decrypt the “file key”, even if the file should be presented in open form according to the access rule.
- the protection center 120 may contain a copy of the database of access policies 121 and use it for an additional checking of the rules of access of the remote computer 110 to the files of the local computer 100 .
- two possible access rules may be determined for the file being requested: to provide the decrypted file during business hours; to provide cipher text the rest of the time.
- the protection center 120 will not provide the decrypted “file key” to the encryption engine 111 , since the rule for access to the file has changed.
- FIG. 4 depicts an example configuration of a general-purpose computer 5 that can be used to implement the disclosed system and methods for protecting computer equipment and data from unauthorized access.
- the computer system 5 may include, but not limited to, a personal computer, a notebook, tablet computer, a smart phone, a network server, a router, or other type of computing device.
- computer system 5 may include one or more hardware processors 15 , system memory 20 , one or more hard disk drive(s) 30 , optical drive(s) 35 , serial port(s) 40 , graphics card 45 , audio card 50 and network card(s) 55 connected by system bus 10 .
- System bus 10 may be any of several types of bus structures including a memory bus or memory controller, a peripheral bus and a local bus using any of a variety of known bus architectures.
- Processor 15 may include one or more Intel® Core 2 Quad 2.33 GHz processors or other type of microprocessor.
- System memory 20 may include a read-only memory (ROM) 21 and random access memory (RAM) 23 .
- Memory 20 may be implemented as in DRAM (dynamic RAM), EPROM, EEPROM, Flash or other type of memory architecture.
- ROM 21 stores a basic input/output system 22 (BIOS), containing the basic routines that help to transfer information between the components of computer system 5 , such as during start-up.
- BIOS basic input/output system
- RAM 23 stores operating system 24 (OS), such as Windows® XP Professional or other type of operating system, that is responsible for management and coordination of processes and allocation and sharing of hardware resources in computer system 5 .
- OS operating system 24
- Memory 20 also stores applications and programs 25 .
- Memory 20 also stores various runtime data 26 used by programs 25 .
- Computer system 5 may further include hard disk drive(s) 30 , such as SATA HDD, and optical disk drive(s) 35 for reading from or writing to a removable optical disk, such as a CD-ROM, DVD-ROM or other optical media.
- Hard disk drive(s) 30 such as SATA HDD
- optical disk drive(s) 35 for reading from or writing to a removable optical disk, such as a CD-ROM, DVD-ROM or other optical media.
- Drives 30 and 35 and their associated computer-readable media provide non-volatile storage of computer readable instructions, data structures, applications and program modules/subroutines that implement algorithms and methods disclosed herein.
- exemplary computer system 5 employs magnetic and optical disks
- other types of computer readable media that can store data accessible by a computer system 5 , such as magnetic cassettes, flash memory cards, digital video disks, RAMs, ROMs, EPROMs and other types of memory may also be used in alternative aspects of the computer system 5 .
- Computer system 5 further includes a plurality of serial ports 40 , such as Universal Serial Bus (USB), for connecting data input device(s) 75 , such as keyboard, mouse, touch pad and other.
- Serial ports 40 may be also be used to connect data output device(s) 80 , such as printer, scanner and other, as well as other peripheral device(s) 85 , such as external data storage devices and the like.
- System 5 may also include graphics card 45 , such as nVidia® GeForce® GT 240M or other video card, for interfacing with a monitor 60 or other video reproduction device.
- System 5 may also include an audio card 50 for reproducing sound via internal or external speakers 65 .
- system 5 may include network card(s) 55 , such as Ethernet, WiFi, GSM, Bluetooth or other wired, wireless, or cellular network interface for connecting computer system 5 to network 70 , such as the Internet.
- the systems and methods described herein may be implemented in hardware, software, firmware, or any combination thereof. If implemented in software, the methods may be stored as one or more instructions or code on a non-transitory computer-readable medium.
- Computer-readable medium includes data storage.
- such computer-readable medium can comprise RAM, ROM, EEPROM, CD-ROM, Flash memory or other types of electric, magnetic, or optical storage medium, or any other medium that can be used to carry or store desired program code in the form of instructions or data structures and that can be accessed by a processor of a general purpose computer.
- engines refers to a real-world device, component, or arrangement of components implemented using hardware, such as by an application specific integrated circuit (ASIC) or field-programmable gate array (FPGA), for example, or as a combination of hardware and software, such as by a microprocessor system and a set of instructions to implement the engine's functionality, which (while being executed) transform the microprocessor system into a special-purpose device.
- ASIC application specific integrated circuit
- FPGA field-programmable gate array
- An engine may also be implemented as a combination of the two, with certain functions facilitated by hardware alone, and other functions facilitated by a combination of hardware and software.
- At least a portion, and in some cases, all, of an engine may be executed on the processor of a general purpose computer (such as the one described in greater detail in FIG. 4 above). Accordingly, each engine can be realized in a variety of suitable configurations, and should not be limited to any particular implementation exemplified herein.
Abstract
Description
- This application claims benefit of priority under 35 U.S.C. 119(a)-(d) to a Russian Application No. 2013153765 filed on Dec. 5, 2013, which is incorporated by reference herein.
- The disclosure relates generally to the field of computer security and, more specifically, to systems, method and computer program products for protecting computers and data against unauthorized access by applying access rules to files transmitted between computers.
- The demands for information security of computer devices connected to corporate networks are constantly growing. Theft and loss of data from corporate networks are on the rise, and the resulting financial losses inflict substantial harm to businesses. Due to vulnerabilities in the software and the human factor, data transmitted in a seemingly secure manner on a corporate network can be intercepted by hackers. Therefore, it is desirable to encrypt data transmitted between corporate workstations, notebooks and mobile devices.
- The classic system for encryption of files and contents of the directories on a computer operates in accordance with encryption policies. Generally, these policies determine the sets of files that must be encrypted and the files that do not require encryption. In such a system, the most vulnerable and critical files (such as files containing confidential information whose loss is undesirable to its owner) on a disk are present in encrypted form. In corporate networks it is often possible to gain access by means of one computer on the network to the files of another computer. Despite the convenience of exchanging data between computers on the network, such a method has certain inadequacies in regard to protecting the data being transmitted—the files are transmitted in unencrypted form. To solve this problem, an encrypted data transmission channel is used or the files are transmitted in encrypted form.
- Existing data encryption systems provide for a secure exchange of data between computers with the use of encryption methods, but this entails an additional computing burden on the processor of the user device. Another drawback of existing data encryption systems is a lack of proper checking of the level of trust of the party requesting access to important files. Thus, the need arises for a solution that increases the security of data transmission on a corporate network without unduly increasing computing burdens on the user devices.
- The present invention relates to systems, methods and computer program products for protecting computer equipment and data of end users against unauthorized access.
- According to an aspect, a method for providing access to computer files includes receiving, by a hardware processor, from a remote computer, a request to access a file; determining one or more parameters of the requested file, the remote computer and a user of the remote computer; determining, based on the one or more parameters, access rules for the requested file, wherein the access rules specify at least encryption requirements for the requested file; and applying, by the hardware processor, the access rules to the requested file.
- According to another aspect, a system for providing access to computer files includes a hardware processor configured to receive, from a remote computer, a request to access a file; determine one or more parameters of the requested file, the remote computer and a user of the remote computer; determine, based on the one or more parameters, access rules for the requested file, wherein the access rules specify at least encryption requirements for the requested file; and apply the access rules to the requested file.
- According to yet another aspect, a computer program product, stored on a non-transitory computer-readable storage medium, includes computer-executable instructions for providing access to computer files, including instructions for receiving, from a remote computer, a request to access a file; determining one or more parameters of the requested file, the remote computer and a user of the remote computer; determining, based on the one or more parameters, access rules for the requested file, wherein the access rules specify at least encryption requirements for the requested file; and applying the access rules to the requested file.
- The above simplified summary of example aspects serves to provide a basic understanding of the invention. This summary is not an extensive overview of all contemplated aspects, and is intended to neither identify key or critical elements of all aspects nor delineate the scope of any or all aspects of the invention. Its sole purpose is to present one or more aspects in a simplified form as a prelude to the more detailed description of the invention that follows. To the accomplishment of the foregoing, the one or more aspects of the invention include the features described and particularly pointed out in the claims.
- The accompanying drawings, which are incorporated into and constitute a part of this specification, illustrate one or more example aspects of the invention and, together with the detailed description, serve to explain their principles and implementations.
-
FIG. 1A shows an aspect of an example system for protecting computer equipment and data against unauthorized access. -
FIG. 1B shows another aspect of an example system for protecting computer equipment and data against unauthorized access. -
FIG. 2 shows an aspect of an example method for protecting computer equipment and data against unauthorized access. -
FIG. 3 shows a sample of the application of rules of access to computer files. -
FIG. 4 shows an example of a general-purpose computer system on which systems and methods for protecting computer equipment and data against unauthorized access may be implemented. - Example aspects are described herein in the context of a system, method and computer program product for protecting computer equipment and data from unauthorized access. Those of ordinary skill in the art will realize that the following description is illustrative only and is not intended to be in any way limiting. Other aspects will readily suggest themselves to those skilled in the art having the benefit of this disclosure. Reference will now be made in detail to implementations of the example aspects as illustrated in the accompanying drawings. The same reference indicators will be used to the extent possible throughout the drawings and the following description to refer to the same or like items.
-
FIG. 1A shows an aspect of an example system for protecting computer equipment and data from unauthorized access. The system includes alocal computer 100 and aremote computer 110. Thelocal computer 100 may include anencryption engine 101, which serves to intercept requests to obtain access tofiles 102 of thelocal computer 100 arriving from auser 112 of theremote computer 110, and also to ascertain the parameters of the following objects: theuser 112 of theremote computer 110, the file being requested, theremote computer 110, etc. - In one aspect, the parameters of the
user 112 of theremote computer 110 may include, but not limited to, user account rights and user's role in the company (e.g., administrator, security officer, accountant, programmer, etc). In another aspect, the file parameters may include, but not limited to: an indicator of whether or not the file is encrypted; the file type (such as text with extension “txt”, text with extension “doc”); the hash sum of the file; and file attributes. In yet another aspect, the parameters of theremote computer 110 may include, but not limited to: indicators determining for each of the disks whether or not the disk is encrypted; the security level; the type of disk encryption—file level or full disk encryption. In one aspect, the security level may take on discrete values and depend on the date of the last updating of the antivirus database, the presence of unpatched vulnerabilities on the computer, the date of the last antivirus check and the result of this check (for example, the number of malicious programs neutralized, i.e., repaired or removed programs, the number of files infected, etc.), and also the list of installed applications. For example, the security level can be expressed in a percent, where 100% represents the highest level of security, in which the latest update of the antivirus database has been installed on the computer, there is no vulnerabilities, and no file has been infected. By the same token, 0% represents the opposite situation, in which the antivirus database is outdated, there are numerous vulnerabilities and infected files. - The
encryption engine 101 of thelocal computer 100 may be also operable to transmit the established file access rules to theencryption engine 111 of theremote computer 110. Theencryption engine 111 of theremote computer 110 is designed to intercept the opening offiles 102 by theuser 112 of theremote computer 110, and also to apply file access rules to files of thelocal computer 100 depending on the established parameters of the objects. In one aspect, these access rules may include, but not limited to: prohibiting access, granting transparent access to an encrypted file (i.e., the file will be decrypted and presented to theuser 112 in clear text), or granting access to ciphertext. - The
local computer 100 also includes a database ofaccess policies 103, connected to theencryption engine 101 and containing access rules to thefiles 102 of thelocal computer 100 for theremote computer 110 depending on the parameters of the objects. - In one aspect, the
encryption engine 111 of theremote computer 110 may additionally provide the parameters of theremote computer 110 and its user to theencryption engine 101 of thelocal computer 100. The user parameters may include, for example, the user's account rights on theremote computer 110. -
FIG. 1B shows another aspect of an example system for protecting computer equipment and data from unauthorized access. In this particular aspect, the system contains all the elements presented above inFIG. 1A , and may also include aprotection center 120, connected to theencryption engines remote computers protection center 120 serves to designate the access policies, and also to exchange file encryption keys of thelocal computer 100 with the local andremote computers protection center 120 may contain a database ofaccess policies 103, as described above. Theencryption engine 101 may consult the database ofaccess policies 103 via theprotection center 120. In another aspect, the system may additionally contain an auxiliary database ofaccess policies 121, connected to theencryption engine 101 and designed to store the most requested access policies from thedatabase 103. In a particular aspect, the database ofaccess policies 103 may be further operable to store the parameters of the objects. -
FIG. 2 shows a particular aspect of the method of implementing the present invention in the context of the system shown inFIG. 1A . In afirst step 201, theuser 112 of theremote computer 110 requests access to a file 102 (for example, it tries to open, copy, or alter a file) of thelocal computer 100. Instep 202, theencryption engine 101 of thelocal computer 100 intercepts the request of theuser 112 to obtain access to the file. In thenext step 203, theencryption engine 101 of thelocal computer 100 establishes the parameters of the objects, such as, for example, theuser 112 of theremote computer 110, the file being requested, theremote computer 110. The next step will be 204, in which theencryption engine 101 of thelocal computer 100 in accordance with the established parameters of the objects determines the access rule by means of theaccess policy database 103. Instep 205, theencryption engine 101 transmits this rule to theencryption engine 111 of theremote computer 110. As a result, instep 206, theencryption engine 111 of theremote computer 110 applies the obtained access rule to the file being requested 102 of thelocal computer 100. The procedure for applying the access rules, to be performed instep 206, will be disclosed in detail below in the description forFIG. 3 . - In one particular aspect, following
step 203 there can occur anadditional step 207, in which theencryption engine 101 of thelocal computer 100 checks whether all necessary parameters have been established. In certain situations, some of the parameters cannot be established on thelocal computer 100, although they can be established on theremote computer 110. For example, theencryption engine 101 of thelocal computer 100 cannot determine the account rights of theremote computer 110 if theremote computer 110 itself does not furnish this information. Thus, if all necessary parameters have been established instep 207, the flow chart returns to step 204. Otherwise, instep 208, theencryption engine 101 of thelocal computer 100 requests the missing parameters from theencryption engine 111 of theremote computer 110, which sends them back in thenext step 209. As a result, the flow chart returns to step 204, as described above in detail. - Table 1 below presents an example of the content of the database of access policies. In one aspect, the database of access policies can constitute a table, the rows of which contain the access rules. For each rule there are defined the conditions of its occurrence and the action performed by the
encryption engine 101 of thelocal computer 100 when this rule is selected. The rules in the table are kept in order of decreasing priority, so that if several rules fall under a specified condition, the rule with the highest priority will be selected. -
TABLE 1 No Condition Action 1 Hash sum on the black list Prohibit access 2 Hash sum is found on the list of mandatory encryp- Provide tion files cipher text 3 a. File contains the “system” attribute, Provide b. security level >90%, cipher text c. user account rights - personal computer (PC) administrator 4 File contains the “system” attribute Prohibit access 5 File contains the “read only” attribute, Provide the system disk of the remote PC is encrypted cipher text 6 File contains the “read only” attribute Prohibit access - In Table 1, the first rule has the highest priority and the last rule the lowest. In a particular aspect, the database of access policies may additionally contain black lists of hash sums of files which are critically important or confidential files. Access to such files by the
user 112 of theremote computer 110 will be prohibited according to the first rule of Table 1. In yet another aspect, the database of access policies may contain a list of mandatory encryption files, which keeps the hash sums of files that are kept in encrypted form on thelocal computer 100. According to rule No. 2 of Table 1, such files will be furnished to theremote computer 110 in encrypted form. - In the present example, if a file is a system file and at the same time the security level of the
remote computer 110 is greater than 90%, and also if theuser 112 of this computer has administrator rights, then the file will be presented to theremote computer 110 in the form of cipher text. However, if even one of conditions “a” to “c” is not fulfilled, this rule will not be used. For example, if a particular file is also a system file, but the security level of theremote computer 110 is equal to 85%, the more harsh rule No. 4 will be applied, whereby access to the file will be prohibited. - Similarly, if the file contains the “read only” attribute, it comes under rule No. 5 if it is additionally known that the system disk on the
remote computer 110 is encrypted (thus increasing the security of the computer). Otherwise, if the system disk on theremote computer 110 is not encrypted, the next lower priority rule No. 6 will be carried out. - In one aspect, if none of conditions 1-6 is fulfilled, a default rule may be applied, such as allowing access to the file.
- In another aspect, the access policies may be designated and changed periodically by the administrator of the
local computer 100. In yet another aspect, instep 204 theencryption engine 101 of thelocal computer 100 can allow theuser 112 of thelocal computer 100 to select the access rule manually. - In yet another aspect, the access policies may be changed based on various additional conditions, such as, for example, the time of day and the account rights of the
user 112 of thelocal computer 100. For example, during business hours one set of access policies may be used, and during nonbusiness hours another set. - In a particular aspect in which the system shown in
FIG. 1B is used, instep 204 theencryption engine 101 requests access rules from theprotection center 120, which in turn provides the access rules to theencryption engine 101 according to the database ofaccess policies 103. In another sample aspect, instep 208 theencryption engine 101 of thelocal computer 100 may request the missing parameters of the objects in thedatabase 103, and if there are none in thedatabase 103 either, theprotection center 120 in turn may request them from theencryption engine 111 of theremote computer 110 and keeps them in thedatabase 103. In yet another aspect, some of the database ofaccess policies 103 may be kept in anauxiliary database 121. In this case, theencryption engine 101 will determine the access rules with the aid of theauxiliary database 121. -
FIG. 3 shows an example of the use of rules of access to the files of a computer. Instep 301 the rule for access to the file being requested is determined. If the access rule is prohibitory, then instep 320 access to the file is blocked. In one aspect, theuser 112 of theremote computer 110 may be sent a message as to the reason for prohibiting access. In another aspect, theuser 112 of theremote computer 110 may be asked to enter a password for access to the file. - If the selected access rule allows the file to be presented in decrypted form, the next step will be 310, in which the
encryption engine 101 of thelocal computer 100 sends the file to theencryption engine 111 of theremote computer 110, which in turn presents it to theuser 112 of the computer instep 311. - If an access rule is selected whereby the file should be presented in the form of cipher text, the flow chart continues in
step 302. If the file was originally encrypted, it is sent on to theremote computer 110. But if the file was not encrypted, theencryption engine 101 of thelocal computer 100 may encrypt the file before sending it to theremote computer 110. Instep 303, theremote computer 110 receives the file, decrypts it and presents it to theuser 112. In a particular aspect, a symmetrical encryption may be used for encrypting the files, in which theencryption engines remote computers encryption engines remote computers encryption engine 101 of thelocal computer 100 can encrypt files with the public key of theencryption engine 111 of theremote computer 110. Thus, such a file can only be decrypted by theremote computer 110 using its private key. - In yet another aspect, the
protection center 120 can participate in the file transfer process. For example, theencryption engine 101 of thelocal computer 100 tan encrypt a file by means of a certain “file key”, which is then encrypted by the public key of theprotection center 120 and placed in the metadata of the file. Thus, theencryption engine 111 of theremote computer 110 can extract the encrypted “file key” from the metadata of the file and send it to theprotection center 120, which decrypts it by its private key and sends it back to theremote computer 110. In a particular aspect, theprotection center 120 may not decrypt the “file key”, even if the file should be presented in open form according to the access rule. Such an outcome is possible, for example, if theremote computer 110 has been hacked and information about the hacking has succeeded in reaching theprotection center 120, but the database ofaccess policies 103 was not updated. In a particular aspect, theprotection center 120 may contain a copy of the database ofaccess policies 121 and use it for an additional checking of the rules of access of theremote computer 110 to the files of thelocal computer 100. For example, two possible access rules may be determined for the file being requested: to provide the decrypted file during business hours; to provide cipher text the rest of the time. Thus, if the file was sent by theencryption engine 101 at the end of the work day, but on account of the large size of the file it was already outside business hours when theremote computer 110 received it, theprotection center 120 will not provide the decrypted “file key” to theencryption engine 111, since the rule for access to the file has changed. -
FIG. 4 depicts an example configuration of a general-purpose computer 5 that can be used to implement the disclosed system and methods for protecting computer equipment and data from unauthorized access. Thecomputer system 5 may include, but not limited to, a personal computer, a notebook, tablet computer, a smart phone, a network server, a router, or other type of computing device. As shown,computer system 5 may include one ormore hardware processors 15,system memory 20, one or more hard disk drive(s) 30, optical drive(s) 35, serial port(s) 40,graphics card 45,audio card 50 and network card(s) 55 connected by system bus 10. System bus 10 may be any of several types of bus structures including a memory bus or memory controller, a peripheral bus and a local bus using any of a variety of known bus architectures.Processor 15 may include one or more Intel® Core 2 Quad 2.33 GHz processors or other type of microprocessor. -
System memory 20 may include a read-only memory (ROM) 21 and random access memory (RAM) 23.Memory 20 may be implemented as in DRAM (dynamic RAM), EPROM, EEPROM, Flash or other type of memory architecture.ROM 21 stores a basic input/output system 22 (BIOS), containing the basic routines that help to transfer information between the components ofcomputer system 5, such as during start-up.RAM 23 stores operating system 24 (OS), such as Windows® XP Professional or other type of operating system, that is responsible for management and coordination of processes and allocation and sharing of hardware resources incomputer system 5.Memory 20 also stores applications and programs 25.Memory 20 also storesvarious runtime data 26 used byprograms 25. -
Computer system 5 may further include hard disk drive(s) 30, such as SATA HDD, and optical disk drive(s) 35 for reading from or writing to a removable optical disk, such as a CD-ROM, DVD-ROM or other optical media.Drives exemplary computer system 5 employs magnetic and optical disks, it should be appreciated by those skilled in the art that other types of computer readable media that can store data accessible by acomputer system 5, such as magnetic cassettes, flash memory cards, digital video disks, RAMs, ROMs, EPROMs and other types of memory may also be used in alternative aspects of thecomputer system 5. -
Computer system 5 further includes a plurality ofserial ports 40, such as Universal Serial Bus (USB), for connecting data input device(s) 75, such as keyboard, mouse, touch pad and other.Serial ports 40 may be also be used to connect data output device(s) 80, such as printer, scanner and other, as well as other peripheral device(s) 85, such as external data storage devices and the like.System 5 may also includegraphics card 45, such as nVidia® GeForce® GT 240M or other video card, for interfacing with amonitor 60 or other video reproduction device.System 5 may also include anaudio card 50 for reproducing sound via internal orexternal speakers 65. In addition,system 5 may include network card(s) 55, such as Ethernet, WiFi, GSM, Bluetooth or other wired, wireless, or cellular network interface for connectingcomputer system 5 to network 70, such as the Internet. - In various aspects, the systems and methods described herein may be implemented in hardware, software, firmware, or any combination thereof. If implemented in software, the methods may be stored as one or more instructions or code on a non-transitory computer-readable medium. Computer-readable medium includes data storage. By way of example, and not limitation, such computer-readable medium can comprise RAM, ROM, EEPROM, CD-ROM, Flash memory or other types of electric, magnetic, or optical storage medium, or any other medium that can be used to carry or store desired program code in the form of instructions or data structures and that can be accessed by a processor of a general purpose computer.
- In various aspects, the systems and methods described in the present disclosure in terms of engines. The term “engines” as used herein refers to a real-world device, component, or arrangement of components implemented using hardware, such as by an application specific integrated circuit (ASIC) or field-programmable gate array (FPGA), for example, or as a combination of hardware and software, such as by a microprocessor system and a set of instructions to implement the engine's functionality, which (while being executed) transform the microprocessor system into a special-purpose device. An engine may also be implemented as a combination of the two, with certain functions facilitated by hardware alone, and other functions facilitated by a combination of hardware and software. In certain implementations, at least a portion, and in some cases, all, of an engine may be executed on the processor of a general purpose computer (such as the one described in greater detail in
FIG. 4 above). Accordingly, each engine can be realized in a variety of suitable configurations, and should not be limited to any particular implementation exemplified herein. - In the interest of clarity, not all of the routine features of the aspects are disclosed herein. It will be appreciated that in the development of any actual implementation of the invention, numerous implementation-specific decisions must be made in order to achieve the developer's specific goals, and that these specific goals will vary for different implementations and different developers. It will be appreciated that such a development effort might be complex and time-consuming, but would nevertheless be a routine undertaking of engineering for those of ordinary skill in the art having the benefit of this disclosure.
- Furthermore, it is to be understood that the phraseology or terminology used herein is for the purpose of description and not of restriction, such that the terminology or phraseology of the present specification is to be interpreted by the skilled in the art in light of the teachings and guidance presented herein, in combination with the knowledge of the skilled in the relevant art(s). Moreover, it is not intended for any term in the specification or claims to be ascribed an uncommon or special meaning unless explicitly set forth as such.
- The various aspects disclosed herein encompass present and future known equivalents to the known components referred to herein by way of illustration. Moreover, while aspects and applications have been shown and described, it would be apparent to those skilled in the art having the benefit of this disclosure that many more modifications than mentioned above are possible without departing from the inventive concepts disclosed herein.
Claims (28)
Priority Applications (1)
Application Number | Priority Date | Filing Date | Title |
---|---|---|---|
EP14162552.5A EP2881887B1 (en) | 2013-12-05 | 2014-03-31 | System and method of applying access rules to files transmitted between computers |
Applications Claiming Priority (2)
Application Number | Priority Date | Filing Date | Title |
---|---|---|---|
RU2013153765 | 2013-12-05 | ||
RU2013153765/08A RU2573785C2 (en) | 2013-12-05 | 2013-12-05 | System and method for applying file access rules during transfer thereof between computers |
Publications (2)
Publication Number | Publication Date |
---|---|
US20150161364A1 true US20150161364A1 (en) | 2015-06-11 |
US9058472B1 US9058472B1 (en) | 2015-06-16 |
Family
ID=53271459
Family Applications (1)
Application Number | Title | Priority Date | Filing Date |
---|---|---|---|
US14/209,210 Active US9058472B1 (en) | 2013-12-05 | 2014-03-13 | System and method of applying access rules to files transmitted between computers |
Country Status (2)
Country | Link |
---|---|
US (1) | US9058472B1 (en) |
RU (1) | RU2573785C2 (en) |
Cited By (4)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US20190124084A1 (en) * | 2017-10-19 | 2019-04-25 | International Business Machines Corporation | Secure access management for tools within a secure environment |
US10990993B2 (en) * | 2019-05-23 | 2021-04-27 | Capital One Services, Llc | Securing lender output data |
US11423098B2 (en) * | 2020-07-29 | 2022-08-23 | Sap Se | Method and apparatus to generate a simplified query when searching for catalog items |
US11941131B1 (en) * | 2020-12-31 | 2024-03-26 | Meta Platforms Technologies, Llc | Isolation of secrets from an operating system |
Citations (6)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US7093250B1 (en) * | 2001-10-11 | 2006-08-15 | Ncr Corporation | Priority scheduler for database access |
US20100242082A1 (en) * | 2009-03-17 | 2010-09-23 | Keene David P | Protecting sensitive information from a secure data store |
US20110162040A1 (en) * | 2009-01-23 | 2011-06-30 | Randall Stephens | Owner Controlled Transmitted File Protection and Access Control System and Method |
US20110302310A1 (en) * | 2010-06-04 | 2011-12-08 | John Diachina | Layered access control for machine type communication devices |
US8365252B2 (en) * | 2008-10-21 | 2013-01-29 | Lookout, Inc. | Providing access levels to services based on mobile device security state |
US8732800B1 (en) * | 2007-03-26 | 2014-05-20 | Jerry Askew | Systems and methods for centralized management of policies and access controls |
Family Cites Families (8)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US7681034B1 (en) | 2001-12-12 | 2010-03-16 | Chang-Ping Lee | Method and apparatus for securing electronic data |
US6678828B1 (en) * | 2002-07-22 | 2004-01-13 | Vormetric, Inc. | Secure network file access control system |
RU2393531C2 (en) * | 2004-06-21 | 2010-06-27 | Майкрософт Корпорейшн | Antivirus for storage of elements |
US20070101400A1 (en) | 2005-10-31 | 2007-05-03 | Overcow Corporation | Method of providing secure access to computer resources |
US7716240B2 (en) | 2005-12-29 | 2010-05-11 | Nextlabs, Inc. | Techniques and system to deploy policies intelligently |
US8806207B2 (en) | 2007-12-21 | 2014-08-12 | Cocoon Data Holdings Limited | System and method for securing data |
US7930760B2 (en) | 2008-04-01 | 2011-04-19 | Microsoft Corporation | Centralized enforcement of name-based computer system security rules |
WO2012016091A2 (en) | 2010-07-28 | 2012-02-02 | Nextlabs, Inc. | Protecting documents using policies and encryption |
-
2013
- 2013-12-05 RU RU2013153765/08A patent/RU2573785C2/en active
-
2014
- 2014-03-13 US US14/209,210 patent/US9058472B1/en active Active
Patent Citations (6)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US7093250B1 (en) * | 2001-10-11 | 2006-08-15 | Ncr Corporation | Priority scheduler for database access |
US8732800B1 (en) * | 2007-03-26 | 2014-05-20 | Jerry Askew | Systems and methods for centralized management of policies and access controls |
US8365252B2 (en) * | 2008-10-21 | 2013-01-29 | Lookout, Inc. | Providing access levels to services based on mobile device security state |
US20110162040A1 (en) * | 2009-01-23 | 2011-06-30 | Randall Stephens | Owner Controlled Transmitted File Protection and Access Control System and Method |
US20100242082A1 (en) * | 2009-03-17 | 2010-09-23 | Keene David P | Protecting sensitive information from a secure data store |
US20110302310A1 (en) * | 2010-06-04 | 2011-12-08 | John Diachina | Layered access control for machine type communication devices |
Cited By (17)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US11799861B2 (en) | 2017-10-19 | 2023-10-24 | International Business Machines Corporation | Secure access management for tools within a secure environment |
US20190253421A1 (en) * | 2017-10-19 | 2019-08-15 | International Business Machines Corporation | Secure access management for tools within a secure environment |
US10834081B2 (en) * | 2017-10-19 | 2020-11-10 | International Business Machines Corporation | Secure access management for tools within a secure environment |
US10924486B2 (en) * | 2017-10-19 | 2021-02-16 | International Business Machines Corporation | Secure access management for tools within a secure environment |
US20190124084A1 (en) * | 2017-10-19 | 2019-04-25 | International Business Machines Corporation | Secure access management for tools within a secure environment |
US10990993B2 (en) * | 2019-05-23 | 2021-04-27 | Capital One Services, Llc | Securing lender output data |
US11138621B2 (en) | 2019-05-23 | 2021-10-05 | Capital One Services, Llc | Normalization grid |
US11669805B2 (en) | 2019-05-23 | 2023-06-06 | Capital One Services, Llc | Single sign-on through customer authentication systems |
US11676102B2 (en) | 2019-05-23 | 2023-06-13 | Capital One Services, Llc | Searchable index encryption |
US11676103B2 (en) * | 2019-05-23 | 2023-06-13 | Capital One Services, Llc | Flexible format encryption |
US20230334424A1 (en) * | 2019-05-23 | 2023-10-19 | Capital One Services, Llc | Flexible format encryption |
US20210217036A1 (en) * | 2019-05-23 | 2021-07-15 | Capital One Services, Llc | Securing lender output data |
US11797932B2 (en) * | 2019-05-23 | 2023-10-24 | Capital One Services, Llc | Securing lender output data |
US11875308B2 (en) | 2019-05-23 | 2024-01-16 | Capital One Services, Llc | Normalization grid for secured multi-lender platform |
US11915196B2 (en) | 2019-05-23 | 2024-02-27 | Capital One Services, Llc | Self-service lender portal |
US11423098B2 (en) * | 2020-07-29 | 2022-08-23 | Sap Se | Method and apparatus to generate a simplified query when searching for catalog items |
US11941131B1 (en) * | 2020-12-31 | 2024-03-26 | Meta Platforms Technologies, Llc | Isolation of secrets from an operating system |
Also Published As
Publication number | Publication date |
---|---|
RU2573785C2 (en) | 2016-01-27 |
RU2013153765A (en) | 2015-06-10 |
US9058472B1 (en) | 2015-06-16 |
Similar Documents
Publication | Publication Date | Title |
---|---|---|
US11057355B2 (en) | Protecting documents using policies and encryption | |
US11239994B2 (en) | Techniques for key provisioning in a trusted execution environment | |
US10268827B2 (en) | Method and system for securing data | |
US9076004B1 (en) | Systems and methods for secure hybrid third-party data storage | |
US20180241572A1 (en) | Techniques for remote sgx enclave authentication | |
US9515832B2 (en) | Process authentication and resource permissions | |
KR101335133B1 (en) | Posture-based data protection | |
US8893300B2 (en) | Security systems and methods to reduce data leaks in enterprise networks | |
US20220286448A1 (en) | Access to data stored in a cloud | |
US8938778B2 (en) | System and method for controlling user access to encrypted data | |
US9286486B2 (en) | System and method for copying files between encrypted and unencrypted data storage devices | |
US20130067243A1 (en) | Secure Data Synchronization | |
US9460305B2 (en) | System and method for controlling access to encrypted files | |
EP3200114B1 (en) | Trusted execution environment | |
US10015173B1 (en) | Systems and methods for location-aware access to cloud data stores | |
US20150264047A1 (en) | Method and system for providing secure communication between multiple operating systems in a communication device | |
US9058472B1 (en) | System and method of applying access rules to files transmitted between computers | |
US10169584B1 (en) | Systems and methods for identifying non-malicious files on computing devices within organizations | |
EP2835758B1 (en) | System and method for controlling access to encrypted files | |
EP2881887B1 (en) | System and method of applying access rules to files transmitted between computers | |
KR102005534B1 (en) | Smart device based remote access control and multi factor authentication system | |
Mulani | How Smart is your Android Smartphone? | |
Hughes | Android mobile security: A comprehensive evaluation of its feats and flaws |
Legal Events
Date | Code | Title | Description |
---|---|---|---|
AS | Assignment |
Owner name: KASPERSKY LAB ZAO, RUSSIAN FEDERATION Free format text: ASSIGNMENT OF ASSIGNORS INTEREST;ASSIGNORS:MAKAROV, ALEXANDER N.;STROGOV, VLADIMIR V.;KIRIKOVA, EVGENIYA P;REEL/FRAME:032432/0335 Effective date: 20140304 |
|
STCF | Information on status: patent grant |
Free format text: PATENTED CASE |
|
MAFP | Maintenance fee payment |
Free format text: PAYMENT OF MAINTENANCE FEE, 4TH YEAR, LARGE ENTITY (ORIGINAL EVENT CODE: M1551); ENTITY STATUS OF PATENT OWNER: LARGE ENTITY Year of fee payment: 4 |
|
MAFP | Maintenance fee payment |
Free format text: PAYMENT OF MAINTENANCE FEE, 8TH YEAR, LARGE ENTITY (ORIGINAL EVENT CODE: M1552); ENTITY STATUS OF PATENT OWNER: LARGE ENTITY Year of fee payment: 8 |