Patent ID: 9594901
Date: 2017-03-14
CPC Classifications: G06F

Claim:
1. A method, comprising: storing, in a memory device, an operating system having a hierarchical file structure; executing, by a hardware processor coupled to the memory device, the operating system; establishing, by the hardware processor, a directory in the hierarchical file structure having a first access permission defined by a first owner; establishing, by the hardware processor, a mid-level directory in the directory, the mid-level directory having no access permission associated with the directory, the mid-level directory having multiple directory paths, each one of the multiple directory paths having a different access permission, and some directory paths of the multiple directory paths being purposefully invalid as invalid directory paths; establishing, by the hardware processor, a subdirectory in the mid-level directory having a second access permission defined by a second owner different from the first owner defining the first access permission; granting, by the hardware processor, access to both the directory and to the mid-level directory in response to a first successful authentication to the first access permission; holding, by the hardware processor, the access in the mid-level directory until the second access permission is authenticated as defined by the second owner; determining, by the hardware processor, a count of the invalid directory paths selected during authentication attempts while the access is held in the mid-level directory; and generating, by the hardware processor, a first security threat in response to the count of the invalid directory paths; determining, by the hardware processor, a second successful authentication to the second access permission to the subdirectory; determining, by the hardware processor, an access time to successfully authenticate to the second access permission to the subdirectory; comparing, by the hardware processor, the access time to a threshold time; granting, by the hardware processor, a traversal from the mid-level directory into the subdirectory in response to the access time being less than the threshold time; determining a second security threat in response to the access time being equal to or greater than the threshold time; and generating an alarm in response to at least one of the first security threat and the second security threat.