METHODS, SYSTEMS AND COMPUTER PROGRAM PRODUCTS FOR DATA PROTECTION BY POLICING PROCESSES ACCESSING ENCRYPTED DATA

摘要

The described embodiments relate to data protection methods, systems, and computer program products. A process-based encrypted data access policing system is proposed based on methods of encrypted data file management, process authentication and authorization, Trojan detection for authorized processes, encryption key generation and caching, and encrypted- file cache management. The process-based encrypted data access policing system may be implemented as a kernel level file system filter and a user- mode filter companion application, which polices the reading/writing of encrypted data in either a server system or an endpoint computer and protects data from data breaches and known or unknown attacks including ransomware and/or phishing attacks.