Systems, methods and media for selective decryption of files containing sensitive data

摘要

Systems, methods and media are provided for selective decryption of files. One method includes monitoring a secure file storage area including at least one file using a selective decryption process associated with the secure file storage area. Content of each of the at least one file is protected with an encryption. The method also includes detecting a request by an application program for one of the at least one file. The method further includes determining whether the application program needs to access the content of the requested file. The method also includes, when it is determined that the application program does not need to access the content of the requested file, allowing the application program to access the file content without decrypting the encryption.

主权项

1. A method, comprising:
monitoring a secure file storage area including at least one file using a selective decryption process associated with the secure file storage area, wherein content of each of the at least one file is protected with an encryption; detecting a request by an application program for one of the at least one file; determining whether the application program needs to access at least a part of the content of the requested file; when it is determined that the application program does not need to access the at least a part of the content of the requested file, allowing the application program to access the content of the requested file without decrypting the encryption; and when it is determined that the application program does need to access the at least a part of the content of the requested file:
decrypting the encryption,allowing the application program to access the decrypted file content,detecting a write-request by the application program for writing the decrypted file content to an unsecure location outside of the secure file storage area, andre-encrypting the decrypted file content using the selective decryption process before the file content is written to the unsecure location, wherein the re-encryption of the decrypted file content is performed such that the application program is not aware of the re-encryption of the decrypted file content.