# US 10,503,418 B2 · System and method to secure a computer system by selective control of write access to a data storage medium > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 10,503,418 B2 - Document ID: US10503418B2 - Status: Granted - Kind: B2 - Application number: 15/421,984 - Filed: 2017-02-01 - Published: 2017-05-25 - Granted: 2019-12-10 - Earliest claimed: 2005-12-01 - Assignees: Drive Sentry Limited - Applicants: Drive Sentry Limited - Inventors: John Safa - Web page: https://patentgrep.com/patent/US10503418B2 ## CPC - G06F 3/0622: {in relation to access} - G06F 3/0659: {Command handling arrangements, e.g. command buffers, queues, command scheduling} - G06F 3/0676: {Magnetic disk device} - G06F 21/52: during program execution, e.g. stack integrity {; Preventing unwanted data erasure; Buffer overflow} - G06F 21/554: {involving event detection and direct action} - G06F 21/564: {by virus signature recognition} - H04L 63/101: {Access control lists [ACL]} - G06F 2221/2115: Third party - G06F 2221/2141: Access rights, e.g. capability lists, access control lists, access tables, access matrices - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract A system and method of securing a computer system by controlling write access to a storage medium by monitoring an application; detecting an attempt by the application to write data to said storage medium; interrogating a rules database in response to said detection; and permitting or denying write access to the storage medium by the application in dependence on said interrogation. ## Claims ### Claim 1 In a computer comprising a storage medium and an application running on said computer in conjunction with an operating system that manages access to a data storage device, a method of controlling write access to said data storage device by said application comprising: using the computer operating a detection process in a secure mode access an attempt by the running application to write data to said data storage device; retrieving from computer memory a permission data value result from a database comprised of data elements encoding either at least one permission value associated with the application or a value representing that no permission value for the application is present in the database; and controlling write access by the running application to store data to the data storage device in dependence on said retrieved permission result. ### Claim 2 (depends on 1) The method of claim 1 further comprising: inspecting the data that the application is attempting to store to determine if said data designates a file type; inspecting said data to determine if said data is of a type consistent with the designated file type; and further controlling write access by the running application to the storage medium in dependence on the result of the inspecting result. ### Claim 3 (depends on 2) The method of claim 2 with the additional step of receiving into said computer at least one data value that logically relates at an least one application name to an at least one file type. ### Claim 4 (depends on 1) The method of claim 1 where the permission value is a value that is independent of a directory location where the application is attempting to write data. ### Claim 5 (depends on 1) The method of claim 1 further comprising: determining that the permission value encodes the condition that no permission value for the application is present in the database; and prompting a user of the computer to input a data value that is a permission value to apply to the attempted write access by the running application. ### Claim 6 (depends on 1) The method of claim 1 in wherein the permission value encodes one of at least two levels, the at least two levels comprised of at least two of: first level in which no write access is allowed, a second level in which full write access is allowed, and a third level in which write access is only allowed to write data of at least one of a specified file type. ### Claim 7 (depends on 1) The method of claim 1 where the permission values are stored in a data structure that pre-exists the installation of the running application on the computer that executes the method. ### Claim 8 (depends on 1) The method of claim 1 where write access by the running application is prevented as a result of determining that no permission value corresponding to the running application is stored in the database. ### Claim 9 (depends on 1) The method of claim 1 with the further step of: generating a prompt on a user interface on said computer requesting a response from a user, accepting such response, and using such accepted response to generate a permission value, and updating the database to store the accepted response as a permission value associated with the running application. ### Claim 10 (depends on 9) The method of claim 9 further comprising: displaying on the user interface a number of possible responses to the prompt, the possible responses comprising a first response for allowing write access, a second response for blocking write access and a third response for allowing write access of a specific file type. ### Claim 11 (depends on 9) The method of claim 9 displaying on the user interface selections representing a plurality of further actions, the further actions comprised of: storing the chosen response in the database and receiving input representing an input selection of one of the further actions. ### Claim 12 (depends on 1) The method of claim 1 with the additional step of: in response to determining that no permission value associated with the running application is stored in the database, transmitting a request for the permission value to a remote computer operatively connected to the computer running the application by means of a data network; and receiving into said computer at least one additional permission value and storing said at least one additional permission value entry into the database stored on said computer. ### Claim 13 (depends on 1) The method of claim 1 where the controlling step blocks write access by the running application if the data to be stored is a portable executable file. ### Claim 14 (depends on 1) The method of claim 1 further comprising the step of automatically uploading at least one permission value associated with said running application from said computer to an additional computer over a data communications network. ### Claim 15 (depends on 1) The method of claim 1 further comprising the step of: in response to determining that a required permission value is not stored in the database, downloading from an additional computer over a data communications network at least one permission value and storing that value in the database. ### Claim 16 (depends on 1) The method of claim 1 where the database is stored on a remote server operatively connected to said computer by means of a data communication network. ### Claim 17 (depends on 1) The method of claim 1 further comprising: determining if the permission value has been tampered with, and in dependence, on the determination that the permission value has been tampered with, blocking write access by the running application and ignoring the permission value. ### Claim 18 (depends on 1) The method of claim 1 further comprising: receiving a permission value from a database stored on a remote server operatively connected to said computer by means of a data communication network in response to a query from said computer automatically generated as a result of a determination that said database does not contain a permission value corresponding to said running application, said received rule derived from data received by the remote server from a plurality of remote computers, said data received by the remote server comprising data input by a corresponding plurality of users encoding a permission value for said application. ### Claim 19 A computer system for controlling write access to a first data storage device by at least one application running on a first computer system operatively connected to said first data storage device comprising: The first data storage device; A first rules database stored on the first computer system comprised of at least one application identifier data value and at least one corresponding permission data value; An interceptor module operating a process on the first computer system in a secure mode that is configured by logic to monitor file system access on the first computer system by the at least one application operating distinct from the interceptor process, where such logic is configured to detect, a write access attempt to the first data storage device by the at least one running application, the interceptor module is further adapted by logic to control the write access to the first data storage device by retrieving a permission value corresponding to the at least one application attempting the write access to the first data storage device and using the retrieved permission value to determine whether to permit or prevent such write access to the first data storage device. ### Claim 20 (depends on 19) The computer system of claim 19 where the first rule database is encrypted. ### Claim 21 (depends on 19) The computer system of claim 19 further comprising a manager module operating on the first computer system that is operatively connected over one or more computer networks to a second rule database stored on a second computer system comprised of at least one application identifier data value and at least one corresponding permission data value where the manager module is configured by logic to automatically update the contents of the second rule database incrementally by transmitting data over a data network from the first rule database to the second rule database. ### Claim 22 (depends on 21) The computer system of claim 21 where the second rule database stored on a second computer system is operatively connected over one or more computer networks to a corresponding plurality of manager modules operating on a plurality of corresponding computer systems comprised of corresponding rule databases and each of the plurality of manager modules is adapted by logic to update its corresponding rule database by receiving data transmitted from the second rule database. ### Claim 23 (depends on 21) The computer system of claim 21 further comprising an input and output interface module that is configured by logic to receive as user input a permission value into the first computer system and the first computer system automatically transmitting that input permission value to the second rule database on the second computer system. ### Claim 24 (depends on 21) The computer system of claim 21 where the first rule database is further comprised of permission values that, when used by the interceptor module, cause the interceptor module to perform at least one of the operations: allow write access to the first data storage device, block write access to the first data storage device, allow write access to a specified file type on the first data storage device. ### Claim 25 (depends on 24) The computer system of claim 24 where the specified file type is an executable file type and the corresponding permission value denies write access to the first data storage device to store the executable file type. ### Claim 26 (depends on 21) The computer system of claim 21 where the first database is further comprised of at least one signature value corresponding to the at least one application identifier. ### Claim 27 (depends on 21) The computer system of claim 21 where the first database is further comprised of at least one file type value corresponding to the at least one application identifier. ### Claim 28 (depends on 19) The computer system of claim 19 further comprising an input and output interface module that is adapted by logic to enable a user of the first computer system to input data into the first computer system that the interface module uses to modify the first rule database. ### Claim 29 A method of controlling write access to a data storage device by an application running in application space on a first computer comprising: receiving at a server computer from a plurality second computers operatively connected to the server by means of a data network, a corresponding plurality of permission values associated with the application operating on the first computer; storing said permission values; generating an output permission value for the application in dependence on the stored permission values; receiving at said server computer from the first computer operatively connected to the server by means of a data network, a request for a permission value associated with the application running on the first computer as a result of a process monitoring write access requests by the application on the first computer detecting an attempt by the application to write data to the data storage device, interrogating a local database of permission values and failing to locate a permission value associated with the application in the local database; selecting the stored permission value in response to receiving the request; and transmitting to said first computer the output permission value derived from the plurality of received permission values to the first computer over the data network in order to cause the monitoring process operating on the first computer to permit or deny write access by the application to the data storage device in dependence on the transmitted output permission value. ### Claim 30 (depends on 29) The method of claim 29 where the output permission value has at least two states, one of which denies permission for the application to write to the storage medium. ### Claim 31 (depends on 29) The method of claim 29 where the output permission value designates permission to write at least one specified data file type. ### Claim 32 (depends on 29) The method of claim 29 where the output transmitted permission value is transmitted with a signature associated with the application.