Method and system for providing restricted access to a storage medium

• US 9,881,013 B2
• Filed: 06/07/2016
• Issued: 01/30/2018
• Est. Priority Date: 07/31/1998
• Status: Expired due to Fees

• Current Assignee: KOM Software Inc.
• Original Assignee: KOM Software Inc.
• Inventors: Shaath, Kamel
• Primary Examiner(s): NGUYEN, HIEP T
• Application Number:
  US15/175,036
• Publication Number:
  US 20160283495A1
• Time in Patent Office: 602 Days
• CPC Class Codes: G06F 12/1416 by checking the object accessibility, e.g. type of access defined by the memory independently of subject rights G06F12/1458 takes precedence
• CPC Class Codes: G06F 12/1466 Key-lock mechanism
• CPC Class Codes: G06F 16/122 using management policies backup systems G06F11/1446; file migration policies for HSM systems G06F16/185
• CPC Class Codes: G06F 16/176 Support for shared access to files; File sharing support
• CPC Class Codes: G06F 21/6227 where protection concerns the structure of data, e.g. records, types, queries
• CPC Class Codes: G06F 2221/2141 Access rights, e.g. capability lists, access control lists, access tables, access matrices

Abstract

A system, apparatus, method, or computer program product of restricting file access is disclosed wherein a set of file write access commands are determined from data stored within a storage medium. The set of file write access commands are for the entire storage medium. Any matching file write access command provided to the file system for that storage medium results in an error message. Other file write access commands are, however, passed onto a device driver for the storage medium and are implemented. In this way commands such as file delete and file overwrite can be disabled for an entire storage medium.

Claims

1. A computer implemented method for applying, by at least one computer processor, a computer file system operation access privilege to a computer storage medium, comprises:

electronically associating, by the at least one computer processor, the computer file system operation access privilege with at least a portion of the computer storage medium;

electronically intercepting, by the at least one computer processor, by at least one computer file system trap layer or at least one file system filter layer of the at least one computer processor, an attempted operation on said at least a portion of the computer storage medium,

wherein said electronically intercepting occurs regardless of an identity of a user electronically attempting the attempted operation;

electronically comparing, by the at least one computer processor, the attempted operation to the computer file system operation access privilege; and

electronically allowing, or electronically denying, by the at least one computer processor, the attempted operation based on the electronically comparing the attempted operation to the computer file system operation access privilege.

2. The computer implemented method according to claim 1, wherein said electronically allowing or said electronically denying, by the at least one computer processor, comprises at least one of:

electronically allowing, or electronically denying, by the at least one computer processor, the attempted operation based on a content of a logical file associated with said at least a portion of the computer storage medium.

3. The computer implemented method according to claim 2, wherein said electronically allowing, or said electronically denying, by the at least one computer processor, comprises at least one of:

electronically allowing, or electronically cancelling, by the at least one computer processor, the attempted operation based on the content of the file.

4. The computer implemented method according to claim 1, wherein said electronically allowing, or said electronically denying, by the at least one computer processor, the attempted operation comprises:

electronically allowing, by the at least one computer processor, a create file operation to create a file on at least a portion of the computer storage medium;

electronically evaluating, by the at least one computer processor, a content of the file; and

at least one of;

electronically allowing, by the at least one computer processor, the attempted operation, or

electronically deleting, by the at least one computer processor, the file based on said evaluating.

5. The computer implemented method according to claim 1, wherein said electronically associating, by the at least one computer processor, the access privilege comprises:

electronically associating, by the at least one computer processor, the computer file system operation access privilege with said at least a portion of the computer storage medium based on a file attribute of a logical file associated with said at least a portion of the computer storage medium.

6. The computer implemented method according to claim 1, wherein said electronically enforcing, by the at least one computer processor, the computer file system operation access privilege comprises:

electronically enforcing, by the at least one computer processor, a retention access privilege comprising;

electronically preventing, by the at least one computer processor, said a least a portion of the computer storage medium in a retained state from being modified while a retention period of said at least a portion of the computer storage medium is unexpired.

7. The computer implemented method according to claim 6, wherein said electronically enforcing, by the at least one computer processor, the retention access privilege comprises at least one of:

wherein said electronically enforcing, by the at least one computer processor, the retention access privilege for at least one of;

a file name, a file attribute, a file path, or a file content, of a logical file associated with said at least a portion of the computer storage medium;

wherein said electronically enforcing, by the at least one computer processor, the retention access privilege comprises;

electronically determining, by the at least one computer processor, if said at least a portion of the computer storage medium is eligible to enter the retained state based on a content of said at least a portion of the computer storage medium;

or

electronically determining, by the at least one computer processor, if said at least a portion of the computer storage medium is eligible to enter the retained state based on a content of said at least a portion of the computer storage medium,

wherein said electronically determining, by the at least one computer processor, comprises;

electronically determining, by the at least one computer processor, if said at least a portion of the computer storage medium is eligible to enter the retained state based on a content group associated with said at least a portion of the computer storage medium, the content group associated based on electronically evaluating, by the at least one computer processor, said at least a portion of the computer storage medium for pre-defined content.

8. The computer implemented method according to claim 6, wherein said electronically associating, by the at least one computer processor, the retention access privilege comprises electronically holding, by the at least computer processor, the retained state.

9. The computer implemented method according to claim 1, wherein said electronically intercepting comprises:

electronically intercepting, by the at least one computer processor, requests in a trap layer to determine or limit operations to specific users or groups;

wherein the trap layer, by the at least one computer processor, electronically reviews an operation, and electronically determines whether the operation is allowable, modifiable, or should be rejected;

wherein if the operation is restricted, then the operation is electronically rejected, by the at least one computer processor; and

wherein rejection is based on an actual operation, not just based on a simple access control privilege.

10. The computer implemented method according to claim 1, wherein said electronically intercepting comprises:

electronically intercepting, by the at least one computer processor, comprising;

electronically determining a privilege or limiting a privilege to extend beyond validation of a user credential and to an actual process name; and

electronically processing attributes including an executable or binary or application; and

at least one of;

a) electronically enforcing policies comprising;

electronically limiting operations to specific executables or applications, and

electronically extending to limiting operations privileged applications can execute or perform;

or

b) electronically authenticating a digital signature of privileged executables or applications, electronically validating that the privileged executables or applications are authentic originals and have not been altered, tampered, or modified.

11. The computer implemented method according to claim 1, wherein said electronically intercepting comprises:

electronically intercepting file system operations to determine file replication operations;

electronically creating special logs to track filesystem modifications comprising electronically tracking changes comprising at least one of attributes, size, name or security and comprising at least one of;

a) electronically creating individual log files in a hidden part of the filesystem, electronically maintaining a persistent log of modifications or changes to be replicated; and

at least one of;

i. wherein the hidden individual log files contain actual modification information to reflect what changed;

or

ii. wherein actual information about actual changes is stored with the original file, the change is stored as at least one of;

an extended attribute, or an alternate data stream;

b) electronically collecting changes in a common single log file including electronically tracking all filesystem changes, and managing the log file size and creating more log files as required and tracking the changes as extended attributes or alternate data streams;

c) electronically maintaining the log files persistent until the operations have been replicated to another location, depending on whether at least one of;

the logs are limited to electronically covering specific peers in the replication group, or whether the logs cover all members then the logs can be purged, accordingly;

d) electronically replicating and synchronizating status of individual filesystem components comprising files, or folders, comprising maintaining by the trap layer and storing with the files and folders as at least one of;

extended attributes or alternate data streams;

e) electronically managing, by the trap layer all the metadata associated with the replication details;

or

f) electronically actual copying or electronically transposing of the file system changes or modifications by another user space service or executable communicating across the network to other volumes, and the volumes comprise volumes of at least one of;

the same server, or remote servers.

12. The computer implemented method according to claim 1, wherein said electronically intercepting comprises:

electronically allowing, by the trap layer, policies to be associated with individual folders so policies are inherited by any child folders; and

the policies are assigned to individual files, wherein the individual files comprise existing files.

13. The computer implemented method according to claim 1, wherein said electronically intercepting comprises:

electronically intercepting, by the trap layer, other operations depending on the object that is being filtered;

wherein in the context of the volume or the disk then the trap layer intercepts operations that target integrity of the volume or the file system partition;

wherein such operations result in at least one of;

electronically deleting the volume, or electronically reformatting the filesystem on the partition.

14. The computer implemented method according to claim 1, wherein said electronically intercepting comprises:

wherein the trap layer electronically converts existing volumes that contain existing data to secure encrypted volumes comprising at least one of;

a. the trap layer electronically encrypts a used space of the volume and possibly wipes out and erases the unused portions of the volume;

b. the trap layer electronically maintains a hidden portion of the volume that is used to save a copy of the original data being converted;

c. the trap layer electronically maintains statistics on progress and percent complete, including when did conversion start and when is completion expected;

d. the trap layer electronically manages the entire process in the background;

or

e. the trap layer electronically maintains checksums of data to determine whether the data was converted and encrypted properly;

wherein encryption and conversion are not limited to AES-256 encryption and offer selectable options or newer defaults.

15. The computer implemented method according to claim 1, wherein said electronically intercepting comprises:

wherein the trap layer electronically adds additional information and attributes to allow process that electronically interrogates change logs to keep track of status and statistics of filesystem information;

wherein the attributes are used by user space services or applications or executables to electronically keep track of which files and folders have been modified; and

wherein the changes allow the service to electronically collect statistics about how many folders exist and how many files, overall used space, how many files are retained, how many are on legal hold, how many have expired, projections of approximately when volume is expected to be full, and how many files and space would be freed up after some specific time has passed.

16. A computer program product embodied on a nontransitory computer accessible medium, said computer program product for applying a computer file system operation access privilege to a computer storage medium when executed on at least one computer processor, performing a method comprising:

electronically associating, by the at least one computer processor, the computer file system operation access privilege with at least a portion of the computer storage medium;

electronically intercepting, by the at least one computer processor, by at least one computer file system trap layer or said at least one computer file system filter layer an attempted operation on said at least a portion of the computer storage medium,

wherein said electronically intercepting occurs regardless of an identity of a user electronically attempting the attempted operation;

electronically comparing, by the at least one computer processor, the attempted operation to the operation access privilege; and

electronically allowing, or electronically denying, by the at least one computer processor, the attempted operation based on the comparing of the attempted operation to the operation access privilege.

17. The computer program product according to claim 16, wherein said electronically allowing or said electronically denying of the attempted operation of the method comprises at least one of:

electronically allowing, or electronically denying, by the at least one computer processor, the attempted operation based on a content of a logical file associated with said at least a portion of the computer storage medium;

electronically allowing, or electronically cancelling, by the at least one computer processor, the attempted operation based on the content of the file;

or

electronically allowing, by the at least one computer processor, a create file operation to create a file on at least a portion of the computer storage medium, electronically evaluating, by the at least one computer processor, a content of the file, and at least one of;

electronically allowing, by the at least one computer processor, the attempted operation, or electronically deleting, by the at least one computer processor, the file based on said electronically evaluating.

18. The method according to claim 16, wherein said electronically associating the access privilege comprises electronically associating, by the at least one computer processor, the access privilege with said at least a portion of the computer storage medium based on a file attribute of a logical file associated with said at least a portion of the computer storage medium.

19. The method according to claim 16, wherein said electronically enforcing the access privilege comprises enforcing, by the at least one computer processor, a retention access privilege comprising electronically preventing, by the at least one computer processor, said a least a portion of the computer storage medium in a retained state from being modified while a retention period of said at least a portion of the computer storage medium is unexpired.

20. A system for applying a computer file system operation access privilege to at least one computer storage medium, comprising:

at least one computer processor; and

at least one memory storage device, coupled to said at least one computer processor; and

the at least one computer storage medium, coupled to said at least one computer processor,

wherein said at least one computer processor is configured to;

electronically associate the computer file system operation access privilege with at least a portion of the computer storage medium;

electronically intercept by at least one computer file system trap layer or at least one file system filter layer of the at least one computer processor, an attempted operation on said at least a portion of the computer storage medium,

wherein said at least one computer processor configured to electronically intercept is configured to do so regardless of an identity of a user electronically attempting the attempted operation;

electronically compare the attempted operation to the computer file system operation access privilege; and

electronically allow, or electronically deny, by the at least one computer processor, the attempted operation based on a result of the electronic comparison of the attempted operation to the computer file system operation access privilege.