SYSTEM AND METHOD FOR AUDITING FILE ACCESS TO SECURE MEDIA BY NODES OF A PROTECTED SYSTEM

• US 20170351877A1
• Filed: 03/27/2017
• Published: 12/07/2017
• Est. Priority Date: 06/03/2016
• Status: Active Grant

• Current Assignee: Honeywell International Inc.
• Original Assignee: Honeywell International Inc.
• Inventors: Knapp, Eric D., Boice, Eric T.
• Granted Patent: US 10,643,007 B2
• Time in Patent Office: Days
• CPC Class Codes: G06F 16/176 Support for shared access to files; File sharing support
• CPC Class Codes: G06F 21/562 Static detection
• CPC Class Codes: G06F 21/602 Providing cryptographic facilities or services
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: G06F 21/78 to assure secure storage of data address-based protection against unauthorised use of memory G06F12/14; record carriers for use with machines and with at least a part designed to carry digital markings G06K19/00
• CPC Class Codes: G06F 2221/2101 Auditing as a secondary aspect
• CPC Class Codes: H04L 63/1433 Vulnerability analysis
• CPC Class Codes: H04L 63/1441 Countermeasures against malicious traffic countermeasures against attacks on cryptographic mechanisms H04L9/002
• CPC Class Codes: H04L 63/145 the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms

Abstract

A method includes detecting a storage device and determining whether the storage device has been checked-in for use with at least a protected node. The method also includes granting access to the storage device in response to determining that the storage device has been checked-in for use with at least the protected node. The method further includes storing data identifying file activity involving the storage device on the storage device. The data could identify all files copied to or from the storage device and all file activity that is blocked from occurring on the storage device. The method may also include copying one or more log files stored at the protected node onto the storage device, and storing the data identifying the file activity may include appending data identifying details of the file activity to the one or more log files.

Claims

1. A method comprising:

detecting a storage device;

determining whether the storage device has been checked-in for use with at least a protected node;

granting access to the storage device in response to determining that the storage device has been checked-in for use with at least the protected node; and

storing data identifying file activity involving the storage device on the storage device.

2. The method of claim 1, wherein the data identifies meaningful file access involving the storage device.

3. The method of claim 2, wherein the data identifies all files copied to or from the storage device and all file activity that is blocked from occurring on the storage device.

4. The method of claim 1, further comprising:

copying one or more log files stored at the protected node onto the storage device.

5. The method of claim 4, wherein storing the data identifying the file activity comprises:

appending data identifying details of the file activity to the one or more log files.

6. The method of claim 5, wherein the data identifying the details of the file activity comprises data identifying:

a source node or device identifier;

a target node or device identifier;

one or more addresses of each of the source and target nodes or devices;

a file name, a file size, a file type, and a file permission of a file associated with the file activity;

an active user associated with the file activity; and

whether the file activity was allowed, blocked, or successful.

7. An apparatus comprising:

at least one interface configured to be coupled to a storage device; and

at least one processing device configured to;

detect the storage device;

determine whether the storage device has been checked-in for use with at least the apparatus;

grant access to the storage device in response to determining that the storage device has been checked-in for use with at least the apparatus; and

store data identifying file activity involving the storage device on the storage device.

8. The apparatus of claim 7, wherein the data identifies meaningful file access involving the storage device.

9. The apparatus of claim 8, wherein the data identifies all files copied to or from the storage device and all file activity that is blocked from occurring on the storage device.

10. The apparatus of claim 7, wherein the at least one processing device is further configured to:

copy one or more log files stored at the protected node onto the storage device; and

append data identifying details of the file activity to the one or more log files.

11. A method comprising:

detecting a storage device;

determining that the storage device has been previously checked-in for use with at least one protected node;

performing a check-out process for the storage device, the check-out process modifying the storage device so that the storage device is not recognizable by the at least one protected node;

retrieving data from the storage device, the data identifying file activity involving the storage device and the at least one protected node; and

storing the data.

12. The method of claim 11, wherein the data identifies all files copied to or from the storage device and all file activity that is blocked from occurring on the storage device.

13. The method of claim 11, wherein:

retrieving the data from the storage device comprises copying one or more log files from the storage device, the one or more log files being encrypted; and

the method further comprises decrypting the one or more log files.

14. The method of claim 11, wherein the data comprises, for each file activity, data identifying:

a source node or device identifier;

a target node or device identifier;

one or more addresses of each of the source and target nodes or devices;

a file name, a file size, a file type, and a file permission of a file associated with the file activity;

an active user associated with the file activity; and

whether the file activity was allowed, blocked, or successful.

15. The method of claim 11, further comprising at least one of:

generating an audit log using the data;

generating a report using the data; and

transmitting the data to an external destination.

16. An apparatus comprising:

at least one memory;

at least one interface configured to be coupled to a storage device; and

at least one processing device configured to;

detect the storage device;

determine that the storage device has been previously checked-in for use with at least one protected node;

perform a check-out process for the storage device, the check-out process modifying the storage device so that the storage device is not recognizable by the at least one protected node;

retrieve data from the storage device, the data identifying file activity involving the storage device and the at least one protected node; and

store the data in the at least one memory.

17. The apparatus of claim 16, wherein the data identifies all files copied to or from the storage device and all file activity that is blocked from occurring on the storage device.

18. The apparatus of claim 16, wherein:

the at least one processing device is configured to copy one or more log files containing the data from the storage device, the one or more log files being encrypted; and

the at least one processing device is further configured to decrypt the one or more log files.

19. A system comprising:

one or more protected nodes within a protected system, each protected node comprising;

at least one interface configured to be coupled to a storage device; and

at least one processing device configured to;

detect the storage device;

determine whether the storage device has been checked-in for use with at least the protected node;

grant access to the storage device in response to determining that the storage device has been checked-in for use with at least the protected node; and

store data identifying file activity involving the storage device on the storage device; and

a server configured to;

perform a check-in process so that one or more files on the storage device are (i) accessible by the one or more protected nodes within the protected system and (ii) not accessible by nodes outside of the protected system while the storage device is checked-in;

perform a check-out process so that the one or more files on the storage device are (i) accessible by the nodes outside of the protected system and (ii) not accessible by the one or more protected nodes within the protected system while the storage device is checked-out; and

retrieve and store the data identifying the file activity from the storage device.

20. The system of claim 19, wherein the server is configured to retrieve and store the data identifying the file activity as part of the check-out process.

21. The system of claim 19, wherein:

the at least one processing device of each protected node is further configured to store data identifying device access involving the storage device on the storage device; and

the server is further configured to retrieve and store the data identifying the device access from the storage device.