Method and apparatus for handling files containing confidential or sensitive information

• US 7,519,984 B2
• Filed: 06/27/2002
• Issued: 04/14/2009
• Est. Priority Date: 06/27/2002
• Status: Expired due to Fees

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Dinh, Hung The, Sidhu, Mandeep Singh, Bhogal, Kulvir Singh, Ishmael, Nizamudeen Jr., Hu, Teng
• Primary Examiner(s): NGUYEN, MINH DIEU T
• Application Number:
  US10/185,693
• Publication Number:
  US 20040003289A1
• Time in Patent Office: 2,483 Days
• Field of Search: 726 1- 2, 726/3, 726/16, 726 30- 31, 713/193, 709/219, 707/9
• US Class Current: 726/2
• CPC Class Codes: G06F 21/6245 Protecting personal data, e.g. for financial or medical purposes
• CPC Class Codes: G06F 2221/2141 Access rights, e.g. capability lists, access control lists, access tables, access matrices

Abstract

A method, apparatus, and computer instructions for managing files in a data processing system. An attribute for a file is specified as having a special designation. The file with the attribute having the special designation is processed, by the operating system, in a different manner from other files when performing operations, such as, for example, copying the file to a removable media, printing the file, or sending the file over a network.

Claims

1. In a data processing system in which a user application accesses files managed by an operating system that includes a file access control module, a method for managing file access requests, the method comprising:

receiving at an operating system file manager, a request from said user application to access a file;

responsive to receiving said file access request, utilizing said operating system file access control module to determine whether a confidentiality attribute has been set for the file and a type of file access being requested;

responsive to determining that the confidentiality attribute is set, determining whether the type of file access being requested is one of a plurality of pre-specified access types; and

responsive to determining that the type of file access being requested is one of the plurality of pre-specified access types, processing the file access request using pre-specified confidentiality protection procedures associated with the one of the plurality of pre-specified access types.

2. The method of claim 1 further comprising:

responsive to determining that the confidentiality attribute is set, processing the file access request when the request is to send the file to an output device.

3. The method of claim 2, wherein the output device is a network adapter and wherein the processing step includes:

determining whether the file is encrypted when sending the file onto a network through the network adapter; and

preventing sending of the file onto the network if the file is unencrypted.

4. The method of claim 1, wherein the processing step further includes:

determining whether the file is encrypted when the request is to attach the file to an email message; and

preventing attachment of the file if the file is unencrypted.