Systems, methods and media for selective decryption of files containing sensitive data

An apparatus, comprising:

• one or more interfaces configured to provide communication with at least one computing device over a network;
• a secure file storage area including at least one file;
• and
• a processor, in communication with the secure file storage area and the one or more interfaces, configured to run a selective encryption module stored in memory that is configured to:
• monitor the secure file storage area, wherein content of each of the at least one file is protected with an encryption;
• detect a request by an application program for one of the at least one file;
• determine whether the application program needs to access at least a part of the content of the requested file;
• when it is determined that the application program does not need to access the at least a part of the content of the requested file, allowing the application program to access the content of the requested file without decrypting the encryption;
• and
• when it is determined that the application program does need to access the at least a part of the content of the requested file:
• decrypt the encryption,
• allow the application program to access the decrypted file content,
• detect a write-request by the application program for writing the decrypted file content to an unsecure location outside of the secure file storage area, and
• re-encrypt the decrypted file content before the file content is written to the unsecure location, wherein the re-encryption of the decrypted file content is performed such that the application program is not aware of the re-encryption of the decrypted file content.

A non-transitory computer readable medium having executable instructions operable to cause an apparatus to:

• monitor a secure file storage area that is coupled to the apparatus and includes at least one file, wherein content of each of the at least one file is protected with an encryption;
• detect a request by an application program for one of the at least one file;
• determine whether the application program holds an access privilege for accessing the requested file;
• when it is determined that the application program holds the access privilege for accessing the requested file, further determine whether the application program needs to access at least a part of the content of the requested file by checking a list of application programs that need to access the content of the requested file;
• when it is determined that the application program is not in the list, allow the application program to access the content of the requested file by providing a copy of the requested file to the application program without decrypting the encryption;
• when it is determined that the application program is included in the list:
• decrypt the encryption,
• allow the application program to access the decrypted file content,
• detect a write-request by the application program for writing the decrypted file content to an unsecure location outside of the secure file storage area, and
• re-encrypt the decrypted file content before the file content is written to the unsecure location in a way that the application program is unaware of the re-encryption of the decrypted file content;
• and
• when it is determined that the application program does need to access the at least a part of the content of the requested file:
• decrypt the encryption,
• allow the application program to access the decrypted file content,
• detect a second write-request by the application program for writing the decrypted file content to a second unsecure location outside of the secure file storage area, and
• re-encrypt the decrypted file content using the selective decryption process before the file content is written to the second unsecure location, wherein the re-encryption of the decrypted file content is performed such that the application program is not aware of the re-encryption of the decrypted file content.