Methods and systems for enforcing, by a kernel driver, a usage restriction associated with encrypted data

A method of providing a restricted set of application programming interfaces comprising:

• decrypting, by a secure object information reader executing on a computing device, an encrypted data object using information associated with the encrypted data object, the information received from an access control management system and including at least one usage restriction;
• intercepting, by a kernel driver executing on the computing device, from a user of the computing device, a request to access the decrypted data object;
• identifying, by the kernel driver, a process associated with the decrypted data object in a file type association mapping;
• launching, by the kernel driver, the identified process on the computing device into a protected memory space;
• intercepting, by the kernel driver, a request from the identified process for a type of access to the decrypted data object;
• retrieving, by the kernel driver, from the information received from the access control management system, the at least one usage requirement;
• identifying, by the kernel driver, in the retrieved at least one usage requirement, an operation a user of the computing device is authorized to execute;
• determining, by the kernel driver, based on the identified authorized operation in the retrieved at least one usage requirement, that the at least one usage restriction permits the type of access requested;
• and
• providing, by the kernel driver, to the process, an application programming interface with which to access the decrypted data object.

A method of providing a restricted set of application programming interfaces comprising:

• decrypting, by a secure object information reader executing on a computing device, an encrypted data object using information associated with the encrypted data object, the information received from an access control management system and including at least one usage restriction;
• intercepting, by a kernel driver executing on the computing device, from a user of the computing device, a request to access the decrypted data object;
• identifying, by the kernel driver, a process associated with the decrypted data object in a file type association mapping;
• launching, by the kernel driver, the identified process on the computing device into a protected memory space;
• intercepting, by the kernel driver, a request from the identified process for a type of access to the decrypted data object;
• retrieving, by the kernel driver, from the information received from the access control management system, the at least one usage requirement;
• determining, by the kernel driver, using the retrieved at least one usage requirement, that the at least one usage restriction does not permit the type of access;
• and
• rejecting, by the kernel driver, the process request for access.