# US 10,482,277 B2 · Security application for data security formatting, tagging and control > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 10,482,277 B2 - Document ID: US10482277B2 - Status: Granted - Kind: B2 - Application number: 15/712,700 - Filed: 2017-09-22 - Published: 2018-01-11 - Granted: 2019-11-19 - Earliest claimed: 2015-09-24 - Assignees: Tangoe US, Inc. - Applicants: Jaan Leemet; Paul Schmidt - Inventors: Jaan Leemet; Paul Schmidt - Web page: https://patentgrep.com/patent/US10482277B2 ## CPC - G06F 21/6218: {to a system of files or objects, e.g. local or distributed file system or database} - G06F 16/116: {Details of conversion of file system types or formats} - G06F 21/6227: {where protection concerns the structure of data, e.g. records, types, queries} - G06F 21/80: in storage media based on magnetic or optical technology, e.g. disks with sectors (preventing unauthorised reproduction or copying of disc-type recordable media G11B20/00) - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract A security program installed or in communication with a computer is provided. The security program is configured to intercept disk (I/O) operations that read/write from/to disk. This allows the security program to confirm and control access to data based on security rules. Further, the security program can categorize data based on security rules and then format and store data on disk in a format that prevents access by application(s) of the computer. The security program is further configured to re-format data to be accessible by the application in a format accessible by the application(s) when a request to access the data complies with security rules. ## Claims ### Claim 1 A system for formatting data records based on security rules, the system comprising: a computer and a storage accessible by said computer, the storage having a plurality of data records stored thereon in a first format, the first format associated with an application, wherein each of the plurality of data records is a file such that the file is formatted in the first format; a security application executing on said computer and intercepting disk input and output (I/O) operations between said computer and said storage; said security application identifying a content of a data record of said plurality of data records based on a content identifier associated with one or more of: a keyword, a user identifier and a device identifier; said security application tagging said data record with a tag based on the content identifier and a security rule, the security rule indicative of permissions or restrictions or combinations thereof associated with access to the data record based on the content identifier; wherein said data record includes at least two sections, a first section contains the tag and a second section contains the content of the data record, said security application converting the second section of the data record to a second format wherein when in the second format, the second section is not accessible by the application, such that the data record in the second format is the content thereof in the second format in its entirety; the data record is stored on said storage in the second format such that when said security application intercepts a disk operation to access the data record via the application, said security application compares the tag to the security rule and converts the data record to the first format if the disk operation complies with the security rule based on the tag, such that the data record is accessible as the file formatted in the first format; wherein the tag is accessible from the first section of said data record when said second section is in the second format. ### Claim 2 (depends on 1) The system of claim 1 wherein the security application prevents transmission of the data record over a network based on the tag and the security rule. ### Claim 3 (depends on 1) The system of claim 1 wherein when the disk operation complies with the security rule and the second section of the data record is converted to the first format, the second section of the data record is available in the first format from a Random Access Memory of said computer. ### Claim 4 (depends on 1) The system of claim 1 wherein the first format is compatible with a format selected from the group consisting of: .doc, .docx, .pdf, .jpg, .jpeg, .tiff, and .png. ### Claim 5 (depends on 1) The system of claim 1 wherein the second format is an encryption. ### Claim 6 (depends on 1) The system of claim 1 wherein the security rule is further associated with at least one user such that the permission, restriction or combination thereof applies to the at least one user. ### Claim 7 (depends on 1) The system of claim 1 wherein the permission or restriction is based on a keyword associated with the data record. ### Claim 8 A system for converting data to a first format for secure access to the data comprising: a computer and a storage accessible by said computer, the storage having a plurality of data records stored thereon in a first format, the first format associated with an application, wherein each of the plurality of data records including at least two sections, a first section of a data record of said plurality of data records containing a tag associated with a content identifier and a security rule and a second section of the data record containing a content of the data record, wherein the security rule indicative of permissions or restrictions or combinations thereof associated with access to the data record based on the content identifier; a security application executing on said computer and intercepting disk input and output (I/O) operations between said computer and said storage; said security application converting the second section of the data record to a second format wherein when in the second format, the second section is not accessible by the application, such that the data record in the second format is the content thereof in the second format in its entirety; said security application intercepting a disk operation to access the data record via the application; said security application comprising the tag to a security rule and further converting the second section of the data record to the first format if the disk operation complies with the security rule based on the tag such that the data record is accessible as the file formatted in the first format; wherein the tag is accessible from the first section of said data record when the second section of said data record is in the second format. ### Claim 9 (depends on 8) The system of claim 8 wherein the data record is accessible in the first format from a Random Access Memory of said computer. ### Claim 10 (depends on 8) The system of claim 8 wherein the first format is selected from the group consisting of: .doc, .docx, .pdf, .jpg, .jpeg, .tiff, and .png. ### Claim 11 (depends on 8) The system of claim 8 wherein the second format is an encryption. ### Claim 12 (depends on 8) The system of claim 8 wherein the security rule is associated with at least one user such that a permission, restriction or combination thereof applies to the at least one user. ### Claim 13 (depends on 8) The system of claim 8 wherein tag is indicative of a keyword, a user identifier, a device identifier or combinations thereof of the second section of the data record. ### Claim 14 (depends on 8) The system of claim 8 further comprising: said security application intercepting a second disk operation to save the data record and said security application identifying the content of the data record based on one or more of: a keyword, a user identifier and a device identifier; said security application tagging said data record with a second tag based on the identification of the content and based on a security rule, the security rule indicative of permissions or restrictions or combinations thereof associated with access to the data record based on the content; said security application converting the data record to the second format. ### Claim 15 (depends on 14) The system of claim 14 wherein when the data record is accessible in the first format via the application, user interface functions which allow capture or copying of at least part of the data record are restricted from access to the data record.