Systems and methods for file access auditing

• US 9,489,523 B2
• Filed: 04/08/2011
• Issued: 11/08/2016
• Est. Priority Date: 04/08/2010
• Status: Active Grant

• Current Assignee: University of Washington
• Original Assignee: University of Washington
• Inventors: Geambasu, Roxana, Kohno, Tadayoshi, Levy, Henry, Gribble, Steven
• Primary Examiner(s): Revak, Christopher
• Assistant Examiner(s): Savenkov, Vadim
• Application Number:
  US13/640,034
• Publication Number:
  US 20130198522A1
• Time in Patent Office: 2,041 Days
• Field of Search: 713/182, 713/193, 726 26- 27
• US Class Current: 1/1
• CPC Class Codes: G06F 21/62 Protecting access to data via a platform, e.g. using keys or access control rules
• CPC Class Codes: G06F 21/88 Detecting or preventing theft or loss
• CPC Class Codes: G06F 2221/2101 Auditing as a secondary aspect

Abstract

Systems and methods for providing an auditing file system for theft-prone devices are disclosed. The auditing file system supports fine-grained file auditing: a user may obtain reliable, explicit evidence that no files have been accessed after a device'"'"'s loss. A user may also disable future file access after a device'"'"'s loss, even in the absence of device network connectivity. In one embodiment, files are encrypted locally but the encryption keys are stored remotely, so that an audit server is queried for encryption keys to access protected files. By configuring the audit server to refuse to return a particular file'"'"'s key, the user can prevent new accesses after the device is lost.

Claims

1. A computer-implemented method for forcing file access auditing, the method comprising:

receiving, by an auditing file system executing on a processor associated with a protected computing device, a request to access a protected file;

receiving, by the auditing file system of the protected computing device from a remote file access auditing server, a file key that allows access to data within the protected file;

providing access to data within the protected file by the auditing file system of the protected computing device in response to the request by using the file key;

protecting data within the protected file using a data key;

protecting the data key by using the file key to create a protected data key;

receiving a request to update metadata associated with the protected file;

transmitting, to a remote metadata access auditing server, a metadata update notification; and

protecting the protected data key using cryptography to create a further protected data key;

wherein the further protected data key remains protected using cryptography at least until receipt of an acknowledgement of the metadata update notification from the metadata access auditing server.

2. The method of claim 1, further comprising:

storing the file key; and

deleting the stored file key after a predetermined first amount of time elapses.

3. The method of claim 2, further comprising:

receiving an acknowledgement from the remote file access auditing server of an additional request to access the protected file before the predetermined first amount of time elapses; and

resetting the predetermined first amount of time to elapse before deleting the stored file key.

4. The method of claim 1, wherein providing access to data within the protected file in response to the request by using the file key includes providing access to data within the protected file in response to the request by using the file key to access the data key from the protected data key, and by using the data key to provide access to the data within the protected file.

5. The method of claim 4, wherein the metadata update notification includes one or more metadata changes.

6. The method of claim 5, wherein protecting the protected data key using cryptography to create a further protected data key includes:

protecting at least a portion of metadata associated with the protected file and further protecting the protected data key using a public key associated with the remote metadata access auditing server to create the further protected data key;

wherein the metadata and protected data key remain protected using the public key at least until receipt of an acknowledgement of the metadata update notification from the metadata access auditing server.

7. The method of claim 6, further comprising:

transmitting the protected metadata and the further protected data key to the metadata access auditing server; and

receiving from the metadata access auditing server the protected data key in response to the metadata access auditing server retrieving the protected data key from the further protected data key by using a private key of the metadata access auditing server.

8. The method of claim 5, wherein protecting the protected data key using cryptography to create a further protected data key includes:

protecting at least a portion of metadata associated with the protected file and further protecting the protected data key using identity-based cryptography to create a further protected data key, wherein a public key used for identity-based cryptography is based at least on a changed portion of the metadata associated with the protected file;

wherein the metadata and protected data key remain protected using identity-based cryptography at least until receipt of the acknowledgement of the metadata update notification from the metadata access auditing server.

9. The method of claim 8, further comprising:

transmitting, to the metadata access auditing server, the changed portion of the metadata on which the public key was based; and

receiving from the metadata access auditing server a private key usable to access the further protected data key, the private key corresponding to the public key.

10. The method of claim 1, further comprising:

receiving, from a file access auditing server, one or more prefetched keys that allow access to data within files related to the protected file.

11. The method of claim 1, wherein providing access to data within the protected file in response to the request by using the file key includes accessing data within the file using at least one of a public key cryptography algorithm, a symmetric key cryptography algorithm, an identity-based cryptography algorithm, or an all-or-nothing transformation algorithm.

12. The method of claim 1, wherein receiving, from the remote file access auditing server, the file key that allows access to data within the protected file includes receiving the file key from a paired device that previously received the file key from the remote file access auditing server.

13. The method of claim 1, further comprising using a trusted platform module (TPM) device to store one or more keys.

14. A computer-implemented method for associating metadata with file access request audit logs, the method comprising:

allocating, by a client device, an audit ID for the file;

registering, by the client device, a file with an auditing file system of the client device, wherein the file is associated with metadata, and wherein registering the file includes transmitting, by the client device, the audit ID and the metadata to a remote metadata access auditing server; and

in response to a request to update the metadata;

encrypting, by the client device, a first portion of the metadata using an identity-based cryptography public key to create encrypted metadata and thereby prevent access to the first portion of the metadata, wherein the identity-based cryptography public key is based on a second portion of the metadata;

transmitting, by the client device, a metadata update request to the remote metadata access auditing server; and

in response to receiving a metadata update confirmation from the remote metadata access auditing server, decrypting, by the client device, the encrypted metadata using an identity-based cryptography private key and thereby allow access to the first portion of the metadata, wherein the identity-based cryptography private key is included in the metadata update confirmation from the remote metadata access auditing server.

15. The computer-implemented method of claim 14, wherein the metadata includes at least one of a file path, a creating process, a file description, and an extended attribute.

16. The computer-implemented method of claim 14, further comprising:

transmitting the audit ID to a remote file access auditing server;

receiving a file key from the remote file access auditing server; and

protecting contents of the file using the file key.

17. The computer-implemented method of claim 14, further comprising:

generating a file key;

protecting contents of the file using the file key; and

transmitting the audit ID and the file key to a remote file access auditing server.

18. The computer-implemented method of claim 16, wherein the remote file access auditing server is separate from the remote metadata access auditing server.

19. The computer-implemented method of claim 14, further comprising updating the metadata in a local storage device in response to receiving the metadata update confirmation.

20. A computer-implemented method for auditing file accesses, the method comprising:

allocating, by a client device, an audit ID for a file;

generating, by the client device, a file key;

protecting, by an auditing file system of the client device, contents of the file using the file key;

transmitting, by the client device, the audit ID and the file key to a remote file access auditing server;

transmitting, by the client device, the audit ID and metadata associated with the file to a remote metadata access auditing server;

transmitting, by the client device, a metadata update request to the remote metadata access auditing server; and

preventing access by the client device to the contents of the file by encrypting the file key until a metadata update confirmation is received from the remote metadata access auditing server; and

decrypting the encrypted file key in response to receiving the metadata update confirmation from the remote metadata access auditing server.

21. The computer-implemented method of claim 20, wherein the remote metadata access auditing server is separate from the remote file access auditing server.

22. The computer-implemented method of claim 20, further comprising:

receiving, from the remote file access auditing server, one or more key request records in response to a request for key request records associated with a given time period, wherein each key request record includes an audit ID; and

transmitting, to the remote metadata access auditing server, a request for metadata associated with an audit ID of a key request record of the one or more key request records.