# US 12,008,131 B2 · Systems and methods for a cryptographic file system layer > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 12,008,131 B2 - Document ID: US12008131B2 - Status: Granted - Kind: B2 - Application number: 18/099,212 - Filed: 2023-01-19 - Published: 2023-05-25 - Granted: 2024-06-11 - Earliest claimed: 2013-02-13 - Assignees: Security First Innovations, LLC - Applicants: Security First Innovations, LLC - Inventors: Mark S. O'Hare; Rick L Orsini; Roger S. Davenport - Web page: https://patentgrep.com/patent/US12008131B2 ## CPC - G06F 21/6227: {where protection concerns the structure of data, e.g. records, types, queries} - G06F 21/6218: {to a system of files or objects, e.g. local or distributed file system or database} - H04L 9/085: {Secret sharing or secret splitting, e.g. threshold schemes} - H04L 9/065: {Encryption by serially and continuously modifying data stream elements, e.g. stream cipher systems, RC4, SEAL or A5/3} - H04L 9/3226: {using a predetermined code, e.g. password, passphrase or PIN (network architectures or network communication protocols for supporting authentication of entities using passwords in a packet data network H04L63/083)} - H04L 9/3234: {involving additional secure or trusted devices, e.g. TPM, smartcard, USB or software token (network architectures or network communication protocols for supporting authentication of entities using an additional device in a packet data network H04L63/0853)} - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract The systems and methods disclosed herein transparently provide data security using a cryptographic file system layer that selectively intercepts and modifies (e.g., by encrypting) data to be stored in a designated directory. The cryptographic file system layer can be used in combination with one or more cryptographic approaches to provide a server-based secure data solution that makes data more secure and accessible, while eliminating the need for multiple perimeter hardware and software technologies. ## Claims ### Claim 1 A method for use in a computer system including an application layer, a cryptographic file system layer and a file system layer having one or more first directory locations each designated as a secure directory and one or more second directory locations each not designated as the secure directory, the method comprising: receiving a write command to write a data file in the file system layer; obtaining a destination directory location associated with the write command; determining whether the destination directory location is one of the one or more first directory locations or one of the one or more second directory locations; in response to determining that the destination directory location is the one of the one or more first directory locations: intercepting the write command by the cryptographic file system layer, wherein the intercepting is transparent to a user of the computer system; after intercepting, modifying, by the cryptographic file system layer, the data file to generate a modified data file; and storing the modified data file in the destination directory location; in response to determining that the destination directory location is the one of the one or more second directory locations: storing the data file in the destination directory location. ### Claim 2 (depends on 1) The method of claim 1, wherein the write command is initiated by the application layer and destined for the file system layer when intercepted by the cryptographic file system layer. ### Claim 3 (depends on 1) The method of claim 1, wherein modifying the data file to generate the modified data file includes encrypting the data file to generate an encrypted data file. ### Claim 4 (depends on 1) The method of claim 1, wherein modifying the data file to generate the modified data file includes adding redundant bits to the data file. ### Claim 5 (depends on 1) The method of claim 1, wherein modifying the data file to generate the modified data file includes splitting the data file into a plurality of data file portions. ### Claim 6 (depends on 5) The method of claim 5, wherein modifying the data file to generate the modified data file includes encrypting each of the plurality of data file portions to generate a plurality of encrypted data file portions. ### Claim 7 (depends on 6) The method of claim 6, wherein storing the modified data file in the destination directory location includes sending one of the plurality of encrypted data file portions to a geographically dispersed location. ### Claim 8 A method for use in a computer system including an application layer, a cryptographic file system layer and a file system layer having one or more first directory locations each designated as a secure directory and one or more second directory locations each not designated as the secure directory, the method comprising: receiving a read command to read a data file stored in the file system layer; obtaining a destination directory location associated with the read command; determining whether the destination directory location is one of the one or more first directory locations or one of the one or more second directory locations; in response to determining that the destination directory location is the one of the one or more first directory locations: intercepting the read command by the cryptographic file system layer, wherein the intercepting is transparent to a user of the computer system; after intercepting, retrieving a modified data file from the destination directory location; modifying, by the cryptographic file system layer, the modified data file to generate the data file; and in response to determining that the destination directory location is the one of the one or more second directory locations: retrieving the data file from the destination directory location. ### Claim 9 (depends on 8) The method of claim 8, wherein the read command is initiated by the application layer and destined for the file system layer when intercepted by the cryptographic file system layer. ### Claim 10 (depends on 8) The method of claim 8, wherein modifying the modified data file to generate the data file includes decrypting the modified data file. ### Claim 11 (depends on 8) The method of claim 8, wherein modifying the modified data file to generate the data file includes removing redundant bits from the modified data file. ### Claim 12 (depends on 8) The method of claim 8, wherein retrieving the modified data file includes retrieving a plurality of data file portions, and modifying the modified data file to generate the data file includes assembling the plurality of data file portions into the data file. ### Claim 13 (depends on 12) The method of claim 12, wherein modifying the modified data file to generate the data file includes decrypting each of the plurality of data file portions to generate a plurality of decrypted data file portions. ### Claim 14 (depends on 12) The method of claim 12, wherein retrieving the modified data file in the destination directory location includes receiving one of the plurality of data file portions from a geographically dispersed location. ### Claim 15 A computer system comprising: a processor; an application layer; a cryptographic file system layer; and a file system layer having one or more first directory locations each designated as a secure directory and one or more second directory locations each not designated as the secure directory; the processor configured to: receive a write command to write a data file in the file system layer; obtain a destination directory location associated with the write command; determine whether the destination directory location is one of the one or more first directory locations or one of the one or more second directory locations; in response to determining that the destination directory location is the one of the one or more first directory locations: intercept the write command by the cryptographic file system layer, wherein the intercepting is transparent to a user of the computer system; after intercepting, modify, by the cryptographic file system layer, the data file to generate a modified data file; and store the modified data file in the destination directory location; in response to determining that the destination directory location is the one of the one or more second directory locations: store the data file in the destination directory location. ### Claim 16 (depends on 15) The computer system of claim 15, wherein the write command is initiated by the application layer and destined for the file system layer when intercepted by the cryptographic file system layer. ### Claim 17 (depends on 15) The computer system of claim 15, wherein modifying the data file to generate the modified data file includes encrypting the data file to generate an encrypted data file. ### Claim 18 (depends on 15) The computer system of claim 15, wherein modifying the data file to generate the modified data file includes adding redundant bits to the data file. ### Claim 19 (depends on 15) The computer system of claim 15, wherein modifying the data file to generate the modified data file includes splitting the data file into a plurality of data file portions and encrypting each of the plurality of data file portions to generate a plurality of encrypted data file portions, and wherein storing the modified data file in the destination directory location includes sending one of the plurality of encrypted data file portions to a geographically dispersed location. ### Claim 20 (depends on 15) The computer system of claim 15, wherein the processor is further configured to: receive a read command to read the data file in the file system layer; obtain the destination directory location associated with the read command; determining whether the destination directory location is the one of the one or more first directory locations or the one of the one or more second directory locations; in response to determining that the destination directory location is the one of the one or more first directory locations: intercepting the read command by the cryptographic file system layer, wherein the intercepting is transparent to the user of the computer system; after intercepting, retrieving the modified data file from the destination directory location; modifying, by the cryptographic file system layer, the modified data file to generate the data file; and in response to determining that the destination directory location is the one of the one or more second directory locations: retrieving the data file from the destination directory location.