Patent ID: 8555404

Claim:
A method of authorizing a file system action on a computer, the method steps comprising: intercepting a file system action attempt indicating an action by a process on an object; determining an identifier for the process; using the identifier to determine a program file representing instructions being executed by the process; determining a network connectivity state of the computer, wherein at least one entry in an authorization policy designates an authorization of a particular action for the program file based on the network connectivity state and a type of action associated with the particular action, and wherein a network connectivity state parameter includes an attribute associated with whether the computer is connected to a wired network or a wireless network; determining whether the action is authorized or not based on the authorization policy, wherein the authorization policy includes the network connectivity state parameter, a program file parameter, an object parameter, and an attempted action parameter; allowing the action by the process to proceed when the action is authorized, as indicated by the authorization policy; and responding when a determination is made that the action is not authorized, wherein said responding comprises a first mode and a second mode, when in the first mode the action is blocked and an alert is generated, the alert including the type of action and the network connectivity state at the time the action was attempted, and when in the second mode the action is allowed to proceed and an alert is generated.