Back to results
US 10,540,509 B2Granted
File-type whitelisting
AssigneeCisco Technology, Inc.
InventorsOded Ashkenazi, Moshe Kravchik, Arie Haenel, Benyamin Hirschberg
Life of this patent
Estimating the term…
Abstract
In one embodiment, a method for protecting a file is implemented on a computing device and includes: intercepting a file-access request from an application-process for the file; searching a whitelist for a whitelist entry associated with the application-process and a file-type for the file, where the whitelist entry indicates that the application-process is allowed to access files of the file-type, and upon determining according to the searching that the application-process is allowed to perform the file-access request, allowing the application-process to access the file according to the file-access request.
Claims20
A system comprising:
- a hardware processor;
- a whitelist comprising whitelisted application-processes allowed to perform file-access requests according to file-types of protected data files from among a multiplicity of the protected data files;
- and
- a ransomware blocker executable by the hardware processor and adapted to:
- intercept a particular file-access request from a requesting application-process to an operating system before said operating system receives and acts on said particular file-access request, wherein said particular file-access request is associated with accessing a particular protected data file from among said multiplicity of the protected data files;
- based on a lookup in said whitelist, determine whether said requesting application-process is allowed to perform said particular file-access request;
- upon determining in accordance with said lookup that said requesting application-process is allowed to perform said particular file-access request, allowing said requesting application-process to access said particular protected data file according to said particular file-access request;
- and
- upon determining in accordance with said lookup that said requesting application-process is not allowed to perform said particular file-access request:
- providing a prompt requesting authorization of said particular file-access request;
- receiving a user input response to said prompt;
- upon determining that said user input response indicates said authorization of said particular file-access request, caching a copy of said particular protected data file, and then allowing said requesting application-process to access said particular protected data file according to said particular file-access request;
- upon determining that said user input response does not indicate said authorization of said file-access request, preventing said application-process from accessing said particular protected data file;
- and
- updating said whitelist in accordance with said user input response, wherein said updating comprises tracking said user input response associated with said requesting application-process.
12 more elements
A method for protecting a file, the method implemented on a computing device and comprising:
- intercepting a file-access request from an application-process to an operating system for said file before said operating system receives and acts on said file-access request;
- searching a whitelist for a whitelist entry associated with said application-process and a file-type for said file;
- upon determining according to said searching that said application-process is allowed to perform said file-access request, allowing said application-process to access said file according to said file-access request;
- and
- upon determining according to said searching that said application-process is not allowed to perform said file-access request:
- providing a prompt requesting authorization of said file-access request;
- receiving a user input response to said prompt;
- upon determining that said user input response indicates said authorization of said file-access request, caching a copy of said file, and then allowing said application-process to access said file according to said file-access request;
- upon determining that said user input response does not indicate said authorization of said file-access request, preventing said application-process from accessing said file;
- and
- updating said whitelist in accordance with said user input response, wherein said updating comprises tracking said user input response associated with said application-process and said file-type.
8 more elements
One or more non-transitory computer readable storage media encoded with instructions that, when executed by a processor, cause the processor to perform operations, comprising:
- intercepting a file-access request from an application-process to an operating system for a file before said operating system receives and acts on said file-access request;
- searching a whitelist for a whitelist entry associated with said application-process and a file-type for said file, wherein said whitelist entry indicates that said application-process is allowed to access files of said file-type;
- upon determining according to said searching that said application-process is allowed to perform said file-access request, allowing said application-process to access said file according to said file-access request;
- and
- upon determining according to said searching that said application-process is not allowed to perform said file-access request:
- providing a prompt requesting authorization of said file-access request;
- receiving a user input response to said prompt;
- upon determining that said user input response indicates said authorization of said file-access request, caching a copy of said file, updating said whitelist in accordance with said user input response, tracking said user input response associated with said application-process, and then allowing said application-process to access said file according to said file-access request;
- upon determining that said user input response does not indicate said authorization of said file-access request, preventing said application-process from accessing said file;
- and
- updating said whitelist in accordance with said user input response, wherein said updating comprises tracking said user input response associated with said application-process and said file-type.
8 more elements
Dependencies are inferred from the claim text.