Patent ID: 7870387
Filing Date: 2011-01-11
Classification: G06F,H04L

Abstract:
1. A method for authorizing file system actions on a computer, comprising: intercepting a file system action attempt indicating an action by a process on a file; determining a program file representing code being executed by the process; allowing the action to proceed when it is authorized, as indicated by an authorization policy, wherein a first log is generated for the action, and wherein a first set of attributes is identified as being associated with the action, the first set of attributes including an action type, a request type, a date and a time at which the action is being attempted, and a set of differences between one or more parts of content of an object sought to be altered by the action, and wherein the differences identify changes between the content before and after the action; and blocking the action when it is not authorized and when a first mode is being used, and wherein a second mode is configured to allow the action when it is not authorized according to the authorization policy and a second log is subsequently generated to identify the unauthorized action as having occurred; wherein the authorization policy indicates whether the process is authorized to perform the action on the file.