# US 12,223,071 B2 · Protecting device and protecting method

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 12,223,071 B2
- Document ID: US12223071B2
- Status: Granted
- Kind: B2
- Application number: 17/059,139
- Filed: 2019-05-28
- Published: 2021-07-15
- Granted: 2025-02-11
- Earliest claimed: 2018-05-30
- Assignees: Nippon Telegraph and Telephone Corporation
- Applicants: Nippon Telegraph and Telephone Corporation
- Inventors: Kazumi Kinoshita; Takeshi Nagayoshi; Kimihiro Yamakoshi
- Web page: https://patentgrep.com/patent/US12223071B2

## CPC

- G06F 21/575: {Secure boot}
- G06F 21/6218: {to a system of files or objects, e.g. local or distributed file system or database}
- G06F 16/1727: {Details of free space management performed by the file system (saving storage space on storage systems G06F3/0608; management of blocks in storage devices G06F3/064)}
- G06F 21/6209: {to a single file or object, e.g. in a secure envelope, encrypted and accessed using a key, or with access control rules appended to the object itself}
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)

## Abstract

A protection device includes a memory, and processing circuitry coupled to the memory and configured to acquire a list of file paths of predetermined protection target files, and perform an operation of protecting data of a file corresponding to a file path included in the list.

## Claims

### Claim 1

A protection device comprising:
a memory; and
processing circuitry coupled to the memory and configured to:
acquire a list of file paths of predetermined protection target files, wherein the predetermined protection target files are immutable and are prevented from deletion; and
perform an operation of protecting data of a file corresponding to a file path included in the list, wherein
the processing circuitry is further configured to:
detect deletion of a link to the file,
query the list for the file path to the file,
determine the file as among the predetermined protection target files according to the list based on the file path of the file,
restore, in response to the determination of the file as among the predetermined protection target file based on the file path of the file, the link to the file, and
detect access by a process to the file, wherein the access includes a request to opening the file,
in response to the detecting access to the file, acquire a combination of the file path of the accessed file and the file path of an execution file of the process of an access source, and
deny the request to opening the file when the file path of the accessed file path exists in the list while the file path of the execution file does not exist in the list.

### Claim 2 (depends on 1)

The protection device according to claim 1, wherein the processing circuitry is further configured to protect the data of the file by opening the file.

### Claim 3 (depends on 1)

The protection device according to claim 1, wherein the processing circuitry is further configured to:
acquire the list at a timing at which the protection device is started, and
perform the operation of protecting the data at a timing at which the list is acquired.

### Claim 4 (depends on 1)

The protection device according to claim 1, wherein the processing circuitry is further configured to:
detect that access is being made to the file,
determine whether to allow the access, based on the file path of the file and a process that is making the access, and
stop the access if determining not to allow the access.

### Claim 5 (depends on 1)

The protection device according to claim 1 further comprising
wherein access to the file is granted if the file path of the accessed file does not exist in
the process whitelist.

### Claim 6

A protection method comprising:
acquiring a list of file paths of predetermined protection target files, wherein the predetermined protection target files are immutable and are prevented from deletion; and
performing an operation of protecting data of a file corresponding to a file path included in the list, by processing circuitry;
detecting deletion of a link to the file;
querying the list for the file path to the file,
determining the file as among the predetermined protection target files according to the list based on the file path of the file;
restoring, in response to the determination of the file as among the predetermined protection target files based on the file path of the file, the link to the file; and
detecting access by a process to the file, wherein the access includes a request to opening the file when the file path of the accessed file path exists in the list while the file path of the execution file does not exist in the list;
in response to the detection access to the file, acquiring a combination of the file path of the accessed file and the file path of an execution file of the process of an access source; and
denying the request to opening the file.

### Claim 7 (depends on 6)

The protection method according to claim 6 further comprising wherein access to the file is granted if a combination of the file path of the accessed file and the file path of an execution file of the process of an access source is in a process whitelist.