Systems and methods for a cryptographic file system layer
AssigneeSecurity First Innovations, LLC
InventorsMark S. O'Hare, Rick L Orsini, Roger S. Davenport
Life of this patent
Estimating the term…
Abstract
The systems and methods disclosed herein transparently provide data security using a cryptographic file system layer that selectively intercepts and modifies (e.g., by encrypting) data to be stored in a designated directory. The cryptographic file system layer can be used in combination with one or more cryptographic approaches to provide a server-based secure data solution that makes data more secure and accessible, while eliminating the need for multiple perimeter hardware and software technologies.
Claims20
A method for use in a computer system including an application layer, a cryptographic file system layer and a file system layer having one or more first directory locations each designated as a secure directory and one or more second directory locations each not designated as the secure directory, the method comprising:
- receiving a write command to write a data file in the file system layer;
- obtaining a destination directory location associated with the write command;
- determining whether the destination directory location is one of the one or more first directory locations or one of the one or more second directory locations;
- in response to determining that the destination directory location is the one of the one or more first directory locations:
- intercepting the write command by the cryptographic file system layer, wherein the intercepting is transparent to a user of the computer system;
- after intercepting, modifying, by the cryptographic file system layer, the data file to generate a modified data file;
- and
- storing the modified data file in the destination directory location;
- in response to determining that the destination directory location is the one of the one or more second directory locations:
- storing the data file in the destination directory location.
A method for use in a computer system including an application layer, a cryptographic file system layer and a file system layer having one or more first directory locations each designated as a secure directory and one or more second directory locations each not designated as the secure directory, the method comprising:
- receiving a read command to read a data file stored in the file system layer;
- obtaining a destination directory location associated with the read command;
- determining whether the destination directory location is one of the one or more first directory locations or one of the one or more second directory locations;
- in response to determining that the destination directory location is the one of the one or more first directory locations:
- intercepting the read command by the cryptographic file system layer, wherein the intercepting is transparent to a user of the computer system;
- after intercepting, retrieving a modified data file from the destination directory location;
- modifying, by the cryptographic file system layer, the modified data file to generate the data file;
- and
- in response to determining that the destination directory location is the one of the one or more second directory locations:
- retrieving the data file from the destination directory location.
A computer system comprising:
- a processor;
- an application layer;
- a cryptographic file system layer;
- and
- a file system layer having one or more first directory locations each designated as a secure directory and one or more second directory locations each not designated as the secure directory;
- the processor configured to:
- receive a write command to write a data file in the file system layer;
- obtain a destination directory location associated with the write command;
- determine whether the destination directory location is one of the one or more first directory locations or one of the one or more second directory locations;
- in response to determining that the destination directory location is the one of the one or more first directory locations:
- intercept the write command by the cryptographic file system layer, wherein the intercepting is transparent to a user of the computer system;
- after intercepting, modify, by the cryptographic file system layer, the data file to generate a modified data file;
- and
- store the modified data file in the destination directory location;
- in response to determining that the destination directory location is the one of the one or more second directory locations:
- store the data file in the destination directory location.
Dependencies are inferred from the claim text.