Maintaining security for file copy operations

• US 20070016771A1
• Filed: 09/16/2005
• Published: 01/18/2007
• Est. Priority Date: 07/11/2005
• Status: Abandoned Application

• Current Assignee: Simdesk Technologies, Inc.
• Original Assignee: Simdesk Technologies, Inc.
• Inventors: Allison, Gary, Eaton, John, Radulovich, Mark
• Application Number:
  US11/228,151
• Publication Number:
  US 20070016771A1
• Time in Patent Office: Days
• US Class Current: 713/165
• CPC Class Codes: G06F 21/6209 to a single file or object, e.g. in a secure envelope, encrypted and accessed using a key, or with access control rules appended to the object itself
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: G06F 2221/2117 User registration
• CPC Class Codes: G06F 2221/2141 Access rights, e.g. capability lists, access control lists, access tables, access matrices
• CPC Class Codes: G06F 2221/2153 Using hardware token as a secondary aspect
• CPC Class Codes: H04L 2209/80 Wireless
• CPC Class Codes: H04L 9/0897 involving additional devices, e.g. trusted platform module [TPM], smartcard or USB

Abstract

Securing computer files in which a publish permission is present in a file system. Upon receiving a request to write data from one file to another, the file system determines whether publish permission is needed. If so and the user lacks the publish permission, the request is rejected. Disclosed is securing computer files which include encrypting metadata about an encrypted file and storing both the encrypted file and the encrypted metadata. The metadata includes a key for decrypting the encrypted file. The key for decrypting the metadata is stored in a USB security token. Disclosed is securing computer files which include copying material from a window displaying the contents of a file to a clipboard application. The file or window is associated with the material. The clipboard application can deny a request to paste material associated with one file to a window displaying the contents of a different file.

Claims

1. A method for securing files on a computer system comprising:

classifying a first folder containing files as a secure folder with a selected security setting;

receiving a request from a user to write a first file in said first folder to a second folder having a different security setting than said first folder;

determining if the user has a publish permission to write said first file to said second folder;

if publish permission is present, writing said first file to said second folder; and

if publish permission is not present, denying the request to write said first file.

2. The method of claim 1, wherein the security settings for said first and second folders are based on the users present in a group assigned to each folder, and

wherein the users present in the group for said first folder and the group for said second folder are different.

3. The method of claim 1, further comprising:

receiving a request from a user to write said first file to a third folder having the same security setting as said first folder; and

writing said first file to said third folder.

4. The method of claim 1, wherein the security setting for said first folder is based on the users present in a group assigned to said first folder, and further comprising:

receiving a request from the user to write said first file to a third folder accessible only by the user; and

writing said first file to said third folder.

5. The method of claim 4, wherein writing said first file to said third folder is performed only if the user has publish permission.

6. The method of claim 4, further comprising:

receiving a request from the user to write said first file copy from said third folder to said second folder;

determining if the user has publish permission to write said first file copy to said second folder;

if publish permission is present, writing said first file copy to said second folder; and

if publish permission is not present, denying the request to write said first file copy.

7. The method of claim 4, wherein said first folder is present on a shared storage element and said third folder is present on a local computer.

8. The method of claim 4, wherein said first folder and said third folder are present on a shared storage element.

9. A computer-readable medium or media having computer-executable instructions for performing the method recited in any one of claims 1-8.

10. A computer system for securing computer files, the system comprising:

a processor unit;

a memory operatively coupled to the processor unit; and

an application executable within the processor unit and memory, the application capable of performing the method recited in any of claims 1-8.