Office Action 2: Notice of Allowance (2024-09-10)

CLAIMS:
AMENDMENTS TO THE CLAIMS

This listing of claims shall replace all prior versions or listings of the claims in the application:

SVG {EMBED HERE} 0.346.5431. (Currently Amended) A file access right authentication method for an electronic device, the method comprising:
receiving a file access request, wherein the file access request includes a first process identifier and a request to access a first file on the electronic device;
obtaining the first process identifier and determining first fixed identity information corresponding to the first process identifier, wherein the fixed identity information includes a parameter that identifies a fixed attribute of an application program corresponding to the first file;
and determining if-thatthe first fixed identity information matches authorized fixed identity information corresponding to the first file, and,in response to the determining that the first fixed identity information matches authorized fixed identity information corresponding to the first file, authenticating the file access reques.
2\. (Currently Amended) The method according to claim 1, wherein the authenticating the file access request comprises:
 decrypting file-key ciphertext by using the first fixed identity information, determining that the decrypting is successful, and in response to determining that the decrypting is successful , efauthenticating the file access request , wherein the file-key ciphertext is ciphertext of a file key used to encrypt the first file.
3\. (Cancelled)

SVG {EMBED HERE} 0.346.5434. (Currently Amended) The method according to claim 1, wherein before receiving, by the electronic device, a-thefile access request, the method further comprises:
obtaining a process identifier and fixed identity information of a running application program, establishing a correspondence between the process identifier and the fixed identity information, and establishing a correspondence between a newly created file and the fixed identity information.
5\. (Currently Amended) The method according to claim 2, wherein before receiving, by the electronic device, a-thefile access request, the method further comprises:
encrypting the file key of the first file based on the fixed identity information corresponding to the first file and a file system primary key according to a preset key encryption algorithm, to generate the file-key ciphertext; and
encrypting the first file by using the file key of the first file, to generate ciphertext of the first file, wherein a header of the ciphertext of the first file comprises the authorized fixed identity information and the file-key ciphertext; and
the determiningthatthe first fixed identity information matches authorized fixed identity information corresponding to the first file comprises:
matching the first fixed identity information with the authorized fixed identity information in the header of the ciphertext of the first file.

6-9. (Canceled).78

10\. (Currently Amended) An electronic device, comprising a memory, a processor, and a computer program that is stored in the memory and that, when executed by the processor, causes the computer device to:
receive a file access request, wherein the file access request includes a first process identifier and a request to access a first file on the electronic device;
obtain the first process identifier, and determine first fixed identity information corresponding to the first process identifier, wherein the fixed identity information includes a parameter that identifies a fixed attribute of an application program corresponding to the first file;
andSVG {EMBED HERE} 0.346.543determine thatthe first fixed identity information matches authorized fixed identity information corresponding to the first file, and, in response to determining that the first fixed identity information matches authorized fixed identity information, authenticating the file access reques.

11\. (Currently Amended) The electronic device of claim 10, wherein the authenticating the file access request comprises:
 decrypting file-key ciphertext by using the first fixed identity information, determining that the decrypting is successful, and when the decrypting is successful,authenticatingthe file access request , wherein the file-key ciphertext is ciphertext of a file key used to encrypt the first file.

12\. (Cancelled)

13\. (Currently Amended) The electronic device according to claim 10, wherein before eceiving, by the electronic device, a-thefile access request, the computer device is further enabled to:
obtain a process identifier and fixed identity information of a running application program, establishing a correspondence between the process identifier and the fixed identity information, and establishing a correspondence between a newly created file and the fixed identity information.

14\. (Currently Amended) The electronic device according to claim 11, wherein before receiving, by the electronic device, the file access request, the computer device is further enabled to:
encrypt the file key of the first file based on the fixed identity information corresponding to the first file and a file system primary key according to a preset key encryption algorithm, to generate the file-key ciphertext; and
encrypt the first file by using the file key of the first file, to generate ciphertext of the firstAttorney Docket No. 5848-00305-USSVG {EMBED HERE} 0.1676.543file, wherein a header of the ciphertext of the first file comprises the authorized fixed identity information and the file-key ciphertext; and
the determiningthat the first fixed identity information matches with authorized fixed identity information corresponding to the first file comprises:
 matching the first fixed identity information with the authorized fixed identity information in the header of the ciphertext of the first file.

15\. (Currently Amended) A non-transitory computer readable medium, wherein the computer readable storage medium comprises a computer program that, when executed by a processor of an electronic device, cause the electronic device to:
receive a file access request, wherein the file access request includes a first process identifier and a request to access a first file on the electronic device;
obtain the first process identifier, and determine first fixed identity information corresponding to the first process identifier, wherein the fixed identity information includes a parameter that identifies a fixed attribute of an application program corresponding to the first file;
and determine that the first fixed identity information matches authorized fixed identity information corresponding to the first file, and, in response to determining that the first fixed identity information matches authorized fixed identity information corresponding to the first file, authenticating the file access request, wherein the fixed identity information includes a parameter that identifies a fixed attribute of an application program corresponding to the first file .

16\. (Currently Amended) The non-transitory computer readable medium according to claim 15, wherein the determine that authentication of the file access request succeeds comprises:
 decrypting file-key ciphertext by using the first fixed identity information, determining that the decrypting is successful,in response to determining that the decrypting is successful authenticatingthe file access request , wherein the file-key ciphertext isSVG {EMBED HERE} 0.346.543ciphertext of a file key used to encrypt the first file.

17\. (Cancelled)

18\. (Currently Amended) The non-transitory computer readable medium according to claim 15, wherein before eceiving, by the electronic device, a-thefile access request, the electronic device is further caused to:
obtain a process identifier and fixed identity information of a running application program, establishing a correspondence between the process identifier and the fixed identity information, and establishing a correspondence between a newly created file and the fixed identity information.

19\. (Currently Amended) The non-transitory computer readable medium according to claim 16, wherein before receiving, by the electronic device, a-thefile access request the electronic, wherein the electronic device is further caused to:
encrypt the file key of the first file based on the fixed identity information corresponding to the first file and a file system primary key according to a preset key encryption algorithm, to generate the file-key ciphertext; and
encrypt the first file by using the file key of the first file, to generate ciphertext of the first file, wherein a header of the ciphertext of the first file comprises the authorized fixed identity information and the file-key ciphertext; and
the determining thathe first fixed identity information with authorized fixed identity information corresponding to the first file comprises:
 matching the first fixed identity information with the authorized fixed identity information in the header of the ciphertext of the first file.

OFFICE ACTION:
DETAILED ACTION
Notice of Pre-AIA  or AIA  Status
The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
Foreign Priority
This application is a National Stage of International Application No. PCT/CN2020/0791 04, filed on March 13, 2020, which claims priority to Chinese Patent Application No. 201910220920.7, filed on March 22, 2019.
Response to Amendments
This office action is in response to the amendments filed on 05/15/2024. In which,
Claims 1, 10 and 15 are independent.
Claims 3, 6-9, 12 and 17 have been cancelled.
Claims 1-2, 5, 10-11, 13-14, 15-16 and 19 are amended.
Claim 1-2, 4-5, 10-11, 13-16 and 18-19 are allowed.
Response to Arguments
Applicant’s remarks, see page 9-10, filed on 05/15/2024, have been fully
considered and are persuasive in view of the remarks and claim amendments. In particular, independent claims (1, 10 and 15) are amended to incorporate the allowable subject matter of dependent claims (5, 14 and 19), respectively, as suggested on page 9 of the previous office action dated 01/10/2024. Therefore, rejections under 35 U.S.C. 103 as set forth in the previous office action has been waived.
Abstract objection has been waived in view of the new Abstract filed on 05/15/2024.
Specification objections have been waived in view of the specification amendments and remarks filed on 05/15/2024.
Claim objections has been waived in view of the claim amendments and remarks filed on 05/15/2024.
Claim rejections under 35 U.S.C. 112(b) has been waived in view of the claim amendments and remarks filed on 05/15/2024.
EXAMINER’S AMENDMENT
An examiner's amendment to the record appears below. Should the changes and/or additions be unacceptable to applicant, an amendment may be filed as provided by 37 CFR 1.312. To ensure consideration of such an amendment, it MUST be submitted no later than the payment of the issue fee.
Authorization for this examiner's amendment was given via a phone conversation, followed by an email, with the applicant’s representative- Letao Qin (Reg. No. 64,359) on 08/29/2024.
In the application, please replace all existing set of claims with:
1. (Currently Amended) A file access right authentication method for an electronic device, the method comprising:
receiving a file access request, wherein the file access request includes a first process identifier and a request to access a first file on the electronic device[[;]], wherein before receiving, by the electronic device, the file access request, the method further comprises:
encrypting a file key of the first file based on a fixed identity information corresponding to the first file and a file system primary key according to a preset key encryption algorithm, to generate a file-key ciphertext, and
encrypting the first file by using the file key of the first file, to generate ciphertext of the first file, wherein a header of the ciphertext of the first file comprises an authorized fixed identity information and the file-key ciphertext;
obtaining the first process identifier and determining first fixed identity information corresponding to the first process identifier, wherein the first fixed identity information includes a parameter that identifies a fixed attribute of an application program corresponding to the first file; and
determining that the first fixed identity information matches the authorized fixed identity information corresponding to the first file, and in response to the determining that the first fixed identity information matches the authorized fixed identity information corresponding to the first file, authenticating the file access request.
2. (Currently Amended) The method according to claim 1, wherein the authenticating of the file access request comprises: decrypting the file-key ciphertext by using the first fixed identity information, determining that the decrypting is successful, and in response to determining that the decrypting is successful, authenticating the file access request, wherein the file-key ciphertext is ciphertext of [[a]] the file key used to encrypt the first file.
3. (Cancelled).
4. (Previously Presented) The method according to claim 1, wherein before receiving, by the electronic device, the file access request, the method further comprises:
obtaining a process identifier and fixed identity information of a running application program, establishing a correspondence between the process identifier and the fixed identity information, and establishing a correspondence between a newly created file and the fixed identity information.
5. (Currently Amended) The method according to claim [[2]] 1, wherein
the determining that the first fixed identity information matches the authorized fixed identity information corresponding to the first file comprises:
matching the first fixed identity information with the authorized fixed identity information in the header of the ciphertext of the first file.
6-9. (Cancelled).
10. (Currently Amended) An electronic device, comprising a memory, a processor, and a computer program that is stored in the memory and that, when executed by the processor, causes the electronic device to:
receive a file access request, wherein the file access request includes a first process identifier and a request to access a first file on the electronic device[[;]], wherein before receiving, by the electronic device, the file access request, the electronic device is further caused to:
encrypt a file key of the first file based on a fixed identity information corresponding to the first file and a file system primary key according to a preset key encryption algorithm, to generate a file-key ciphertext, and
encrypt the first file by using the file key of the first file, to generate ciphertext of the first file, wherein a header of the ciphertext of the first file comprises an authorized fixed identity information and the file-key ciphertext;
obtain the first process identifier, and determine first fixed identity information corresponding to the first process identifier, wherein the first fixed identity information includes a parameter that identifies a fixed attribute of an application program corresponding to the first file; and
determine that the first fixed identity information matches authorized fixed identity information corresponding to the first file, and, in response to determining that the first fixed identity information matches the authorized fixed identity information, authenticating the file access request.
11. (Currently Amended) The electronic device of claim 10, wherein the authenticating of the file access request comprises: decrypting the file-key ciphertext by using the first fixed identity information, determining that the decrypting is successful, and when the decrypting is successful, authenticating the file access request, wherein the file-key ciphertext is ciphertext of [[a]] the file key used to encrypt the first file.
12. (Cancelled).
13. (Currently Amended) The electronic device according to claim 10, wherein beforeelectronic device is further caused to:
obtain a process identifier and fixed identity information of a running application program, establishing a correspondence between the process identifier and the fixed identity information, and establishing a correspondence between a newly created file and the fixed identity information.
14. (Currently Amended) The electronic device according to claim [[11]] 10, wherein
the determining that the first fixed identity information matches [[with]] the authorized fixed identity information corresponding to the first file comprises:
matching the first fixed identity information with the authorized fixed identity information in the header of the ciphertext of the first file.
15. (Currently Amended) A non-transitory computer readable medium, wherein the computer readable storage medium comprises a computer program that, when executed by a processor of an electronic device, cause the electronic device to:
receive a file access request, wherein the file access request includes a first process identifier and a request to access a first file on the electronic device[[;]], wherein before receiving, by the electronic device, the file access request, the electronic device is further caused to:
encrypt a file key of the first file based on a fixed identity information corresponding to the first file and a file system primary key according to a preset key encryption algorithm, to generate a file-key ciphertext, and
encrypt the first file by using the file key of the first file, to generate ciphertext of the first file, wherein a header of the ciphertext of the first file comprises an authorized fixed identity information and the file-key ciphertext;
obtain the first process identifier, and determine first fixed identity information corresponding to the first process identifier, wherein the first fixed identity information includes a parameter that identifies a fixed attribute of an application program corresponding to the first file; and
determine that the first fixed identity information matches the authorized fixed identity information corresponding to the first file, and, in response to determining that the first fixed identity information matches the authorized fixed identity information corresponding to the first file, authenticating the file access request
16. (Currently Amended) The non-transitory computer readable medium according to claim 15, wherein the determine that authentication of the file access request succeeds comprises:
decrypting the file-key ciphertext by using the first fixed identity information, determining that the decrypting is successful, in response to determining that the decrypting is successful authenticating the file access request, wherein the file-key ciphertext is ciphertext of [[a]] the file key used to encrypt the first file.
17. (Cancelled).
18. (Previously Presented) The non-transitory computer readable medium according to claim 15, wherein before receiving, by the electronic device, the file access request, the electronic device is further caused to:
obtain a process identifier and fixed identity information of a running application program, establishing a correspondence between the process identifier and the fixed identity information, and establishing a correspondence between a newly created file and the fixed identity information.
19. (Currently Amended) The non-transitory computer readable medium according to claim [[16]] 15, wherein
the determining that the first fixed identity information matches the [[with]] authorized fixed identity information corresponding to the first file comprises:
matching the first fixed identity information with the authorized fixed identity information in the header of the ciphertext of the first file.
Allowable Subject Matter
Claims 1-2, 4-5, 10-11, 13-16 and 18-19 are allowed over the cited prior art of record.
The following is an examiner’s statement of reasons for allowance:
Examiner’s search did not yield any specific references that reasonably, either alone or in combination, would result in a proper rejection of all the claimed features presented in each of the independent claims 1, 10 and 15 under 35 U.S.C 102 or 35 U.S.C.103 with a proper motivation.
Thus, independent claims 1, 10 and 15 are allowed and the corresponding dependent claims depend upon one of the above-mentioned allowed claims are therefore allowed by the virtue of their dependencies.
The closest relevant prior art made of record are:
a)	Umebayashi et al. (US 20040010701 A1), the present invention relates to a data protection program and data protection method for protecting data, and more particularly to a data protection program and data protection method for restricting access to resources to be protected. For example, a data protection program is able to effectively restrict an unauthorized access to a resource to be protected even when the resource to be protected is in a state legitimately accessed by a user. The identification information about a program capable of accessing the resource to be protected is registered in an access permission management table. If an access request to access the resource to be protected is subsequently received, then identification information about a request source program which has outputted the access request is acquired. Then, it is determined whether access to the resource to be protected is permitted or not based on whether the identification information about the request source program has been registered in the access permission management table or not. If access to the resource to be protected is permitted, data in the resource to be protected is processed in response to the access request.
b)	 Yang et al. (US 2018/0102902 A1), the described embodiments relate generally to data access management and in particular relates to managing data access of processes executing on a computer system. In some cases, for each of at least one protected data file, associating that protected data file with the protected file identifier may include storing that protected data file in a file location within a predefined file directory area on the at least one storage module; and the protected file identifier for that protected data file can be the predefined file directory area. So that, when a read request is received from a requesting process P having a corresponding process ID. The read request also includes file identifying information enabling the data protection module to identify the data file F being requested (e.g. by identifying the file path of the data file). The data protection module may also identify requested data D from the file F that is being requested by process P.
c)	Nakamura et al. (US 20150363189 A1) discloses to monitor processes generated by an installer for the software when the software is installed. The operation unit generates, based on file information about files accessed by the generated processes and the relationships between the processes, software configuration information associating the file information about the files with the software.
d)	Sasaki et al. (US 5870477 A) discloses that when the IDs coincide with each
other, so that it is judged that decryption is possible. Such as, the ciphertext data is
deciphered using the deciphered management key (step 348), and plaintext data
obtained by the decryption is displayed on the display unit 2.
e) 	Sun, Zhe (CN 108228770 A) discloses to determine the application package
name corresponding to the id of the corresponding relation of the process name and the
determination of the target file corresponding to the application package name.
However, none of the closest cited prior art of record as mentioned above
teaches or suggests, either taken alone or in combination, neither anticipates nor
renders obvious, all of the claimed features presented in each of the independent
claims 1, 10 and 15. Such as,
with regards to the independent claim 1, the claim is drawn to a file access right authentication method for an electronic device, and recites limitations “wherein before receiving, by the electronic device, the file access request, the method further comprises: encrypting a file key of the first file based on a fixed identity information corresponding to the first file and a file system primary key according to a preset key encryption algorithm, to generate a file-key ciphertext, and encrypting the first file by using the file key of the first file, to generate ciphertext of the first file, wherein a header of the ciphertext of the first file comprises an authorized fixed identity information and the file-key ciphertext; determining first fixed identity information corresponding to the first process identifier, wherein the first fixed identity information includes a parameter that identifies a fixed attribute of an application program corresponding to the first file; and”, which are not disclosed in the closest cited prior art of record. For this reason, the claim limitations as recited in the independent claim 1 along with other features taken as a whole are allowable over the cited prior art of record.
with regards to the independent claim 10, the claim is drawn to an electronic device, and recites limitations “wherein before receiving, by the electronic device, the file access request, the electronic device is further caused to: encrypt a file key of the first file based on a fixed identity information corresponding to the first file and a file system primary key according to a preset key encryption algorithm, to generate a file-key ciphertext, and encrypt the first file by using the file key of the first file, to generate ciphertext of the first file, wherein a header of the ciphertext of the first file comprises an authorized fixed identity information and the file-key ciphertext; determine first fixed identity information corresponding to the first process identifier, wherein the first fixed identity information includes a parameter that identifies a fixed attribute of an application program corresponding to the first file; and”, which are not disclosed in the closest cited prior art of record. For this reason, the claim limitations as recited in the independent claim 10 along with other features taken as a whole are allowable over the cited prior art of record.
with regards to the independent claim 15, the claim is drawn to a non-transitory computer readable medium, and recites limitations “wherein before receiving, by the electronic device, the file access request, the electronic device is further caused to: encrypt a file key of the first file based on a fixed identity information corresponding to the first file and a file system primary key according to a preset key encryption algorithm, to generate a file-key ciphertext, and encrypt the first file by using the file key of the first file, to generate ciphertext of the first file, wherein a header of the ciphertext of the first file comprises an authorized fixed identity information and the file-key ciphertext; determine first fixed identity information corresponding to the first process identifier, wherein the first fixed identity information includes a parameter that identifies a fixed attribute of an application program corresponding to the first file; and”, which are not disclosed in the closest cited prior art of record. For this reason, the claim limitations as recited in the independent claim 15 along with other features taken as a whole are allowable over the cited prior art of record.
Thus, independent claims 1, 10 and 15 along with their dependent claims are allowed over the cited prior art of record.
Any comments considered necessary by applicant must be submitted no later than the payment of the issue fee and, to avoid processing delays, should preferably accompany the issue fee. Such submission should be clearly labeled “Comments on Statement of Reasons for Allowance.” In event of any post-allowance papers (e.g., IDS, 312 amendments, petition, etc.), Applicant is exhorted to mail papers to the Production Control Branch in Publications or faxed to post-allowance papers correspondence branch at (703) 308-5864 to expedite issuing process or call PUB’s Customer service if any questions at (703) 305-8497.
Conclusion

APPLICANT REBUTTAL: REMARKS
Claims 1-5 and 10-19 are pending, in which 1-4,10-13 and 15-18 stand rejected. Claims 5,14 and 19 are objected to.
The Abstract and Specification have been amended pursuant to the Examiner's suggestions.
The claims have been amended to eliminate the alleged "conditional" limitations noted by the Examiner and other language to which the Examiner objects.
Claims 5, 14 and 19 stand rejected under 35 U.S.C. §112(b) as being indefinite. The claim amendments obviate the §112 rejection.
Claims 5, 14 and 19 stand objected to as being dependent upon a rejected claim, but
would be allowable only if rewritten in independent form for including all of the limitations of the base claim and any intervening claims, and amended to overcome the claim objections and rejections under 112(b). For the reasons set forth below, the independent claims are believed to be allowable and thus claims 5, 14, and 19 have not been rewritten in independent form at this time.
Claims 1, 10 and 15 stand rejected under 35 U.S.C. §103 as being unpatentable over
Umebayashi et al. (U.S. Publication No. 2004/0010701 Al; hereinafter Ume) in view of Yang et al. (U.S. Publication No. 2018/0102902 Al; hereinafter Yang).
Initially, Applicant notes that the Examiner has construed the claims as not requiring the authentication procedure recited in the claims because it was deemed to be recited in conditional format. The amended claims expressly recite "determining that the first fixed identity information matches authorized fixed identity information corresponding to the first file, and, in response to the determining that the first fixed identity information matches authorized fixed
identity information corresponding to the first file, authenticating the file access request." The claims expressly recite the authentication step, without condition, and thus this step must be considered when applying the prior art.
The claimed invention utilizes an identification of the requesting program, as opposed to a conventional permission structure, to authenticate a request for a file. As noted in paragraph [0004] of the subject application, the invention addresses, for example, a situation where malware has attacked the operating system to obtain root access rights, by changing a permissions table, for example. In such a situation, the malware can directly obtain a file of another application, for example, to copy phone book information of a contacts application. The claimed identification of the requesting program prevents such access, even where the requesting malware program has the highest level of access permissions. To clarify the invention, the claims have been amended to expressly recite that "the fixed identity information includes a parameter that identifies a fixed attribute of an application program corresponding to the first file."
The Examiner cites to paragraphs [0080] and [0081] as teaching "obtaining the first process identifier and determining first fixed identity information corresponding to the first process identifier". However, the access method of Ume acquires a process ID of the requesting application and refers to a permissions table to retrieve a client identifier corresponding to the process ID. Therefore, Ume teaches the use of a permission table to determine access rights. It follows that Ume fails to teach or suggest the claimed authentication based on matching first fixed identity information with authorized fixed indent information.
The process taught by Ume does not have the above-noted advantages of the claimed invention. For example, in the process disclosed by Ume, malware could have obtained root permissions and thus the permissions table would have indicated that the malware was permitted
to access the file. In the claimed invention, only the original application corresponding to the file can access the file. Yang fails to cure this deficiency. Accordingly, the amended claims are allowable over the prior art of record.
Claims 2-3, 11-12 and 16-17 stand rejected under 35 U.S.C. §103 as being unpatentable over Ume in view of Yang, and further in view of Ohmori et al. (U.S. Publication No. 2008/0235517 A1; hereinafter Ohmori) and Asano, Tomoyuki (U.S. Publication No. 2003/0142826 A1; hereinafter Asano). However, the additional cited references fails to cure the deficiencies of Ume noted above.
Claims 4, 13 and 18 stand rejected under 35 U.S.C. §103 as being unpatentable over Ume in view of Yang, and further in view of Robert Scott Chapman, Ill (U.S. Publication No. 2016/0196442 A1; hereinafter Chapman). However, the additional cited references fails to cure the deficiencies of Ume noted above.
For the reasons noted above, withdrawal of the rejections is solicited.
Respectfully submitted,


CITED REFERENCE SUMMARIES: Ref US20160196442A1: Claims:
A method comprising: identifying, by a first process, a command in a command queue, the command from a second process and indicating an action on secure data; determining whether the command is permitted based on the action and a user credential; and responsive to determining the command is not permitted, removing, by the first process, the command from the command queue.
identifying, by a first process, a command in a command queue, the command from a second process and indicating an action on secure data;
determining whether the command is permitted based on the action and a user credential; and
responsive to determining the command is not permitted, removing, by the first process, the command from the command queue.
The method of claim 1 , wherein identifying the command comprises identifying an entry in the command queue associated with a secure storage location, and identifying the software application based on the entry.
The method of claim 2 , wherein identifying the entry comprises identifying a path on a computer-readable medium for the secure storage location or a process identifier of a software application accessing the secure data.
The method of claim 2 , wherein the secure storage location comprises a separately-mountable partition of a computer-readable medium.
The method of claim 1 , wherein the secure data comprises data stored within a secure storage location, and wherein identifying the command comprises identifying an entry in the command queue associated with a process identifier of a process accessing the secure data.
The method of claim 1 , wherein the command queue comprises an operating system command queue.
The method of claim 1 , wherein the command queue comprises an application server command queue.
The method of claim 1 , wherein the command queue comprises a virtual machine command queue.
The method of claim 1 , further comprising, responsive to determining the command is permitted, not removing the command from the command queue.
The method of claim 1 , wherein the command comprises at least one of a save command, a save as command, an open command, a move command, a rename command, a print command, a copy command, a cut command, a paste command, an email command, a screenshot command, a rename command, or a share command.
A device comprising: a non-transitory computer-readable medium; a processor in communication with the non-transitory computer readable medium, the processor configured to: monitor, by a first process, a command queue to identify commands from other processes, at least one of the commands indicating an action on secure data; access one or more access rules to determine whether the at least one command is permitted; and responsive to a determination the command is not permitted, remove the command from the command queue.
a non-transitory computer-readable medium;
a processor in communication with the non-transitory computer readable medium, the processor configured to: monitor, by a first process, a command queue to identify commands from other processes, at least one of the commands indicating an action on secure data; access one or more access rules to determine whether the at least one command is permitted; and responsive to a determination the command is not permitted, remove the command from the command queue.
monitor, by a first process, a command queue to identify commands from other processes, at least one of the commands indicating an action on secure data;
access one or more access rules to determine whether the at least one command is permitted; and
responsive to a determination the command is not permitted, remove the command from the command queue.
The device of claim 11 , wherein the processor is further configured to: identify an entry in the command queue associated with a secure storage location, and identify the software application based on the entry, to identify the command.
identify an entry in the command queue associated with a secure storage location, and
identify the software application based on the entry, to identify the command.
The device of claim 12 , wherein the processor is further configured to identify a path on a computer-readable medium for the secure storage location to identify the entry.
The device of claim 12 , wherein the secure storage location comprises a separately-mountable partition of a computer-readable medium.
The device of claim 11 , wherein the secure data comprises data stored within a secure storage location, and wherein the processor is further configured to identify an entry in the command queue associated with a process identifier of a process accessing the secure data to identify the command.
The device of claim 11 , wherein the command queue comprises an operating system command queue.
The device of claim 11 , wherein the processor is further configured to not remove the command from the command queue if the command is permitted.
The device of claim 11 , wherein the command comprises at least one of a save command, a save as command, an open command, a move command, a rename command, a print command, a copy command, a cut command, a paste command, an email command, a screenshot command, a rename command, or a share command.
A non-transitory computer-readable medium comprising program code, the program code comprising monitoring software executable by a processor, the monitoring software configured to: monitor a command queue to identify commands from other processes; identify a command indicating an action on secure data; transmit a request to determine whether the command is permitted; and responsive to a response to the request indicating that the command is not permitted, remove the command from the command queue.
monitor a command queue to identify commands from other processes;
identify a command indicating an action on secure data;
transmit a request to determine whether the command is permitted; and
responsive to a response to the request indicating that the command is not permitted, remove the command from the command queue.
The non-transitory computer-readable medium of claim 19 , wherein the program code further comprises program code for access rules software executable by a processor, the access rules software configured to: access an access rules data store, the access rules data store configured to store one or more rules associated with commands or user credentials; receive requests to determine whether commands associated with the requests are permitted; determine whether the commands are permitted based on the respective request and the one or more rules; and transmit a response message to the respective request.
access an access rules data store, the access rules data store configured to store one or more rules associated with commands or user credentials;
receive requests to determine whether commands associated with the requests are permitted;
determine whether the commands are permitted based on the respective request and the one or more rules; and
transmit a response message to the respective request.
The non-transitory computer-readable medium of claim 19 , wherein the monitoring software is further configured to: identify an entry in the command queue associated with a secure storage location; and identify the command based on the entry.
identify an entry in the command queue associated with a secure storage location; and
identify the command based on the entry.
The non-transitory computer-readable medium of claim 21 , wherein the monitoring software is further configured to identify a path on a computer-readable medium for the secure storage location or a process identifier of a software application accessing the secure data to identify the command.
The non-transitory computer-readable medium of claim 21 , wherein the secure storage location comprises a separately-mountable partition of a computer-readable medium.
The non-transitory computer-readable medium of claim 19 , wherein the secure data comprises data stored within a secure storage location, and wherein the monitoring software is further configured to identify an entry in the command queue associated with a process identifier of a process accessing the secure data to identify the command.
The non-transitory computer-readable medium of claim 19 , wherein the command queue comprises an operating system command queue.
The non-transitory computer-readable medium of claim 19 , wherein the monitoring software is further configured to, responsive to a determination that the command is permitted, not remove the command from the command queue.
The non-transitory computer-readable medium of claim 19 , wherein the command comprises at least one of a save command, a save as command, an open command, a move command, a rename command, a print command, a copy command, a cut command, a paste command, an email command, a screenshot command, a rename command, or a share command.
Ref US20040010701A1: Claims:
A data protection program for protecting data stored in a resource to be protected, said data protection program enabling a computer to carry out a processing sequence comprising: registering identification information about a program capable of accessing said resource to be protected in an access permission management table; if an access request to access said resource to be protected is received, acquiring identification information about a request source program which has outputted said access request; determining whether access to said resource to be protected is permitted or not based on whether the identification information about said request source program has been registered in said access permission management table or not; and if access to said resource to be protected is permitted, processing data in said resource to be protected in response to said access request.
registering identification information about a program capable of accessing said resource to be protected in an access permission management table; if an access request to access said resource to be protected is received, acquiring identification information about a request source program which has outputted said access request;
determining whether access to said resource to be protected is permitted or not based on whether the identification information about said request source program has been registered in said access permission management table or not; and
if access to said resource to be protected is permitted, processing data in said resource to be protected in response to said access request.
The data protection program according to claim 1 , wherein when the data in said resource to be protected is processed, if said access request is a request to write data, then data transferred from a process which executes said request source program is encrypted and then stored in said resource to be protected, and if said access request is a request to read data, data from said resource to be protected is decrypted and then transferred to a process which executes said request source program.
The data protection program according to claim 2 , wherein said processing sequence further comprises: registering a key associated with the identification information about the program in said access permission management table; and when data in said resource to be protected is to be encrypted and decrypted, encrypting and decrypting the data using said key registered in said access permission management table in association with the identification information about the request source program.
registering a key associated with the identification information about the program in said access permission management table; and
when data in said resource to be protected is to be encrypted and decrypted, encrypting and decrypting the data using said key registered in said access permission management table in association with the identification information about the request source program.
The data protection program according to claim 3 , wherein a value uniquely determined from a password entered into said program by a user is registered as said key in said access permission management table.
The data protection program according to claim 3 , wherein said processing sequence further comprises: when data in said resource to be protected is to be encrypted and decrypted, encrypting and decrypting the data using a value provided by combining said key associated with the identification information about the request source program and a specific value preset in said computer.
when data in said resource to be protected is to be encrypted and decrypted, encrypting and decrypting the data using a value provided by combining said key associated with the identification information about the request source program and a specific value preset in said computer.
The data protection program according to claim 1 , wherein said processing sequence further comprises: registering identification information about a folder, which contains data to be protected, in a protection resource management table; and using only said folder registered in said protection resource management table as said resource to be protected.
registering identification information about a folder, which contains data to be protected, in a protection resource management table; and
using only said folder registered in said protection resource management table as said resource to be protected.
The data protection program according to claim 1 , wherein said processing sequence further comprises: registering a set of the identification information about said program and a resource name of an accessible resource; and determining whether access to said resource to be protected is permitted or not based on whether a set of the identification information about said request source program and the resource name of an access destination specified by said access request has been registered in said access permission management table or not.
registering a set of the identification information about said program and a resource name of an accessible resource; and
determining whether access to said resource to be protected is permitted or not based on whether a set of the identification information about said request source program and the resource name of an access destination specified by said access request has been registered in said access permission management table or not.
A method of protecting data stored in a resource to be protected, said method comprising: registering identification information about a program capable of accessing said resource to be protected in an access permission management table; if an access request to access said resource to be protected is received, acquiring identification information about a request source program which has outputted said access request; determining whether access to said resource to be protected is permitted or not based on whether the identification information about said request source program has been registered in said access permission management table or not; and if access to said resource to be protected is permitted, processing data in said resource to be protected in response to said access request.
registering identification information about a program capable of accessing said resource to be protected in an access permission management table;
if an access request to access said resource to be protected is received, acquiring identification information about a request source program which has outputted said access request;
An apparatus for protecting data stored in a resource to be protected, said apparatus comprising: identification information registering means for registering identification information about a program capable of accessing said resource to be protected in an access permission management table; identification information acquiring means for, if an access request to access said resource to be protected is received, acquiring identification information about a request source program which has outputted said access request; access permission/inhibition determining means for determining whether access to said resource to be protected is permitted or not based on whether the identification information about said request source program has been registered in said access permission management table or not; and data processing means for, if access to said resource to be protected is permitted, processing data in said resource to be protected in response to said access request.
identification information registering means for registering identification information about a program capable of accessing said resource to be protected in an access permission management table;
identification information acquiring means for, if an access request to access said resource to be protected is received, acquiring identification information about a request source program which has outputted said access request;
access permission/inhibition determining means for determining whether access to said resource to be protected is permitted or not based on whether the identification information about said request source program has been registered in said access permission management table or not; and
data processing means for, if access to said resource to be protected is permitted, processing data in said resource to be protected in response to said access request.
A computer-readable recording medium storing therein a data protection program for protecting data stored in a resource to be protected, said data protection program being readable by a computer, said data protection program enabling said computer to carry out a processing sequence comprising: registering identification information about a program capable of accessing said resource to be protected in an access permission management table; if an access request to access said resource to be protected is received, acquiring identification information about a request source program which has outputted said access request; determining whether access to said resource to be protected is permitted or not based on whether the identification information about said request source program has been registered in said access permission management table or not; and if access to said resource to be protected is permitted, processing data in said resource to be protected in response to said access request.
Ref US20180102902A1: Claims:
A method for managing access to a plurality of data files stored on at least one storage module in a computer system using a data protection module installed on the computer system, the method comprising: identifying, by the data protection module, a plurality of protected data files in the plurality of data files stored on the at least one storage module, wherein the plurality of data files stored on the at least one storage module includes the plurality of protected data files and a plurality of unprotected data files, and wherein each protected data file in the plurality of protected data files is stored on the at least one storage module in an encrypted format; associating each of the protected data files stored on the at least one storage module with a protected file identifier; receiving, by the data protection module, a file access request from a requesting process instance operating on the computer system, wherein the file access request includes file identifying information corresponding to a particular data file in the plurality of data files; identifying, by the data protection module, the particular data file from the file identifying information; determining, by the data protection module, that the particular data file is one of the protected data files by identifying the associated protected file identifier; determining, by the data protection module, an authorization level of the requesting process instance based on a process authorization level of a corresponding process determ
[Truncated to input limit]