Abstract: A method prevents unauthorized access to user data files on a computing device. The device receives a request from an application to open a data file (including file name path). The device determines whether the path corresponds to a designated storage location for user data files and determines whether access to the data file has previously been granted for the application. When the file is a user file with no permission for the application, the device uses a volition table to determine whether access volition has been asserted for the data file by the application within a preceding predefined period of time. When access volition has been asserted, the device permits the application to access the data file. When access volition has not been asserted, the device displays a user interface box prompting a user to decide whether or not to grant the application access to the data file.

Abstract: Methods, systems, and devices for parsing text are described herein. A method of securing executable files is performed at a computing device having one or more processors and memory. The memory stories one or more programs configured for execution by the one or more processors. The computing device obtains source text that comprises a disassembled executable file and identifies, via a general parser module, the syntax of the source text by performing a recursive descent parsing of the source text. The device generates an abstract syntax tree (AST) for the source text based on the identified syntax and generates a transformed AST from the generated AST by replacing one or more system calls with respective protected system functions. The device also generates a secured executable file by assembling the transformed AST.

Abstract: The various implementations described herein include methods and devices for preventing unauthorized access to files and networks. In one aspect, a method includes installing a first application at a computing device, the first application designated as writing to user files. Installing the first application includes: (i) storing application data files for the first application within a first portion of the memory, where files stored in the first portion are designated as read-only for the first application; and (ii) allocating a second portion of the memory for user data files to be used by the first application. The method further includes installing a second application at the computing device, the second application designated as writing to application data files. Installing the second application includes: (i) allocating a third portion of the memory for prototype writable application data files; and (ii) allocating a fourth portion of the memory for network-based data access.

Abstract: The various implementations described herein include methods and systems of data governance. In one aspect, a method of purging backup data includes obtaining a database table having a corresponding data policy and generating an encrypted version of the database table by applying an encryption key, including encrypting at least a portion of the database table. The method further includes identifying an expiration date for the encryption key based on the data policy, and storing the encryption key, the expiration date, and an encryption identifier for the encryption key in an encryption table. The method also includes receiving a command to back up the database table and, in response to the command, generating a backup of the encrypted version of the database table. The method further includes storing the backup and, when a current date is at least the expiration date for the encryption key, deleting the encryption key.

Abstract: An automatic physical-layout designer for a database-management system determines the database's physical layout from a set of training queries, the database's logical design, and a parameter k that indicates how many storage nodes can be lost without losing access to any of the data. The designer lays the database out as a column store such that the stored columns constitute redundant projections on the system's different storage nodes. It repeatedly identifies a projection, whose addition to the design will result in the greatest performance improvement for the training queries. In doing so, it takes into account the different compression formats to which the different projections lend themselves. When a projection has been identified as one to be added, it is added on one node, and k projections having the same columns are added to other nodes. The designer continues thus adding projections until a space budget has been reached.

Abstract: An automatic physical-layout designer for a database-management system determines the database's physical layout from a set of training queries, the database's logical design, and a parameter k that indicates how many storage nodes can be lost without losing access to any of the data. The designer lays the database out as a column store such that the stored columns constitute redundant projections on the system's different storage nodes. It repeatedly identifies a projection, whose addition to the design will result in the greatest performance improvement for the training queries. In doing so, it takes into account the different compression formats to which the different projections lend themselves. When a projection has been identified as one to be added, it is added on one node, and k projections having the same columns are added to other nodes. The designer continues thus adding projections until a space budget has been reached.