Abstract: A system and method protects security of data. The data is packaged together with one or more permissions that designate what actions are allowed with respect to the data. The package can be opened when there is approval for doing so and the allowed permissions are maintained. The data is stored within a vault and there are a number of available security procedures that prevent the unauthorized access of the data.

Abstract: A System for providing data security in a first device driver operably installed in a computer operating system having a layered plurality of device drivers (81, 82, 83, 84) for accessing data in a data storage device. The first device driver detects an I/O request, and determines whether the first device driver is functionally uppermost in the layered plurality of device drivers. If the first device driver is functionally uppermost in the layered plurality of device drivers, the method performs the I/O request (80) in the first device driver. If the device driver is not functionally uppermost in the layered plurality of device drivers, the method denies the I/O request in the first device driver, and allows the I/O request to be performed by the next lowest-level driver in the layered plurality of device drivers.

Abstract: A registry monitoring method particularly applicable to a system (100) in which protected data is transmitted to a recipient computer. The method comprises requesting a handle for a registry key to a calling process, requesting a registry key value for the handle, modifying and deleting keys and values of protected data locations, and obtaining security clearance to complete the requests by checking secured process lists and rejection lists. Also included are a registry monitoring system, a secured data transmission system including registry monitorings, a machine-readable medium comprising a program to monitor a registry (110), and a computer configured to monitor a registry (110).

Abstract: A system and method for communicating a package of information. The system comprises a machine readable medium having information packaging software that generates a computer executable file (FIG. 1, 14) comprising a package of information. The packet information comprises the file of data and encryption software. The system communicates the package of information over a network (FIG. 1, 16) that is in communication with a machine readable medium. A client computer system (FIG. 1, 17) in communication with the network is adapted to receive the package of information and execute the computer executable. The computer system has a client permissions database (FIG. 1, 20) and a vault adapted to receive the package of information.

Abstract: A method for providing data security in a device driver for accessing data. The device driver detects a file system request, completes the file system request, and receives return information from the file system request. The device driver further determines whether the file system request is for a tag file associated with a secured file; and if so, modifies the return information to reflect a file attribute of the secured file.

Abstract: A file system security driver and vault method and system particularly applicable to a system in which protected data is segregated from other data, which allows for back-channeling of file data in order to ensure that files created by applications using secured data do not cause data leaks of secure data. In a preferred embodiment, a file system security driver is a driver resident on the kernel level which monitors file system requests and allows limited access to files resident on the vault and creation of files within the vault when necessary.

Abstract: A shared memory blocking method and particularly applicable to a system in which protected data is transmitted to a recipient computer. The method comprises reserving a memory page for a requesting application, committing a memory page to the requesting application's address space, which call may be made by the process providing the page reserve call or by a subsequent process, and providing security checks to complete the requests. The security checks include determining whether the process is secured by consulting a secured process list and determining whether the page is shared by consulting a shared memory list. Further disclosed are a computer readable medium and computer programmed to block shared memory, shared memory blocking system and secured data transmission system.

Abstract: The state of a media device is identified by monitoring file system calls. A determination is made whether or not a file system call originated from a specified high level application. In one implementation, the high level application writes to a monitored media device in order to perform a flushing process to securely delete inactive data.