Idps access-controlled and encrypted file system design

A system for providing access control and file encryption for a file system, the system comprising:

• at least one processor;
• and
• at least one memory coupled to the at least one processor, the at least one memory having stored therein instructions which, when executed by any set of the one or more processors, perform a process including:
• managing, with a resource management module of a computing system, a storage container;
• hosting, with the resource management module, a virtual file system including a plurality of files representing data on the storage container;
• accessing, with an access control and encryption module of a computing system, the virtual file system;
• generating, with the access control and encryption module, a plurality of application containers each associated with a respective user and including a list of files of the file system and a list of processes authorized for the respective user;
• encrypting, with the access control and encryption module, each of the files of the virtual file system with a respective file encryption key;
• receiving, with the access control and encryption module, a request from a user to access a selected file in the virtual file system;
• denying, with the access control and encryption module, the request if the selected file is not listed in the application container associated with the user;
• decrypting, with the access control and encryption module, the selected file if the selected file is listed in the container application associated with the user;
• and
• outputting, with the access control and encryption module, the selected file to the user after decrypting the selected file.

A computing system implemented method for providing access control and file encryption for a file system, the method comprising:

• providing a storage container, the storage container including data;
• providing a virtual file system, the virtual file system including a plurality of files, the files representing subsets of the data in the storage container;
• defining two or more application containers, each of the application containers including a list of processes mapped to a set of one or more files of the plurality of files in the virtual file system;
• for each application container, defining privileged user access rules, the privileged user access rules controlling access to the one or more files in that application container by privileged users;
• generating privileged user access rules data representing the defined privileged user access rules;
• for each application container, assigning an application key specific to that application container;
• for each file associated with an application container, assigning a file encryption key specific to that file
• for each file encryption key, generating file specific encryption key data representing respective file encryption keys;
• encrypting the file encryption key data for each file;
• for each application container, encrypting the data in each of the files of the virtual file system associated with that application container with the specific file encryption key data representing the file encryption key specific to that file;
• receiving a request for access to data in a virtual file by a user;
• determining the process associated with the request for access to data in a virtual file by the user application;
• determining if the process is mapped to the virtual file in the application container containing the requested data;
• if the process is mapped to the virtual file in the application container containing the requested data, accessing the privileged user access rules data to determine if the user can be denied access to the requested virtual file in the application container containing the requested data;
• if the process is mapped to the virtual file in the application container containing the requested data, and the user cannot be denied access to the requested virtual file in the application container containing the requested data, decrypting the specific file encryption key data for the virtual file containing the requested data;
• and
• using the decrypted specific file encryption key data for the application container containing the requested data to provide the user access to the requested data.

A computing system implemented method for providing access control and data entity encryption for a data management system, the method comprising:

• managing, with a resource management module of a computing system, a storage container;
• hosting, with the resource management module, a data management system including a plurality of data entities representing data on the storage container;
• accessing, with an access control and encryption module of a computing system, the data management system;
• generating, with the access control and encryption module, a plurality of application containers each associated with a respective user and including a list of data entities of the data entity system and a list of processes authorized for the respective user;
• encrypting, with the access control and encryption module, each of the data entities of the data management system with a respective data entity encryption key;
• receiving, with the access control and encryption module, a request from a user to access a selected data entity in the data management system;
• denying, with the access control and encryption module, the request if the selected data entity is not listed in the application container associated with the user;
• decrypting, with the access control and encryption module, the selected data entity if the selected data entity is listed in the container application associated with the user;
• and
• outputting, with the access control and encryption module, the selected data entity to the user after decrypting the selected data entity.