Secure data storage

A data storage device providing secure data storage for a software application executed by an operating system in a computer system including at least one processor and memory operably coupled to the at least one processor, the data storage device comprising:

• instructions that, when executed on the computer system, cause the computer system to implement:
• a file system operation interceptor that detects requests for file system operations in respect of data for the software application;
• a file system operation analyzer that is responsive to the file system operation interceptor and that analyzes an intercepted file system operation request to identify attributes associated with the file system operation that are independent of user attributes;
• a comparator that compares the attributes with a predefined security policy definition defining circumstances in which application data can be cryptographically processed, wherein the security policy definition includes a definition of one or more criteria for permitting the file system operation and the comparing includes determining if the attributes associated with the requested file system operation satisfy the one or more criteria, such that access control for the data is administered on a per-application basis;
• and
• a cryptographic unit that performs at least one or data encryption or data decryption using one or more cryptographic functions;
• wherein the cryptographic unit is operable in response to the comparator to perform an encryption operation or a decryption operation on the data and effect performance of the requested file system operation by the operating system.

A non-transitory computer-readable storage element storing a computer program comprising computer program code to, when loaded into a computer system and executed thereon:

• in response to a request for a file system operation in respect of data for the software application, the request identified by a file system operation interceptor executing on the computer system:
• identifying attributes associated with the requested file system operation that are independent of user attributes;
• retrieving a security policy definition defining circumstances in which application data can be cryptographically processed;
• comparing the attributes and the security policy definition, wherein the security policy definition includes a definition of one or more criteria for permitting the file system operation and the comparing includes determining if the attributes associated with the requested file system operation satisfy the one or more criteria;
• and
• responsive to the comparison, performing a cryptographic operation and the file system operation on the data, such that access control for the data is administered on a per-application basis.