Data-centric Security
The technical foundation of data-centric security is a file format that carries its protection conditions inside the file itself. This page describes that format and how files are verified and recovered.
Limits of existing approaches
Classification labels easily removed or changed
Conventional classification labels are written in document properties or file names, where they can easily be removed or changed.
Repository encryption that decrypts everything at once
With full-disk or repository-level encryption, all stored files are decrypted as soon as access is granted.
Tampering that is hard to detect
When attributes exist only in document metadata, changes made with an editing tool are hard to tell apart.
Comparison with existing approaches
This summarizes general tendencies and may differ for individual products.
Self-protecting file format
A protected file holds the encrypted content, security attributes such as level, compartment, and distribution control, and integrity information together in a single file.
Because the security attributes are not looked up in a separate database or storage location, they are not separated from the content even when the file is copied or sent outside.
File-level encryption separated from access rights
The key that encrypts the content is released only when the user's clearance satisfies the file's security attributes.
File possession and access rights are separated, so even if a file leaks, its content is not revealed to anyone without clearance.
Signature-based integrity verification
The issuer's digital signature is recorded with the security attributes and the content. When a file is opened, the signature is verified to identify files whose level was lowered without authorization or whose content was altered.
Large files are verified in parts, so changes can be detected without re-verifying the whole file.
Self-recovery from damage
A power loss or an interrupted write during saving can damage part of a file.
A protected file keeps spare recovery information inside itself, and when damage is detected, it uses that information to return to a readable state.
Assurances
Alignment with the Zero Trust Data pillar
Addresses the Data pillar among the seven pillars of the US Department of Defense Zero Trust Strategy.
Classification, marking, and access control at the data level are handled within the file format.
Try JOLDISK for free
