File transfer security system and method

This application is related to China patent application 200910306609.0 (filed Sep. 4, 2009), the full disclosure of which is incorporated herein by reference.

1. Technical Field

Embodiments of the present disclosure relate to systems and methods of data transmission, and particularly to a file transfer security system and method.

2. Description of Related Art

File servers, such as file transfer protocol (FTP) servers, are widely accessed via the Internet. Upon logging onto a file server, a user is often able to manipulate files stored therein, including uploading, downloading, deleting, and modifying files. If unrestricted, such operations often cause security issues, such as when confidential or sensitive data is accessed without authority.

FIG. 1 is a block diagram of one embodiment of a file transfer security system.

FIG. 2 is a block diagram of one embodiment of a file transfer securing unit of FIG. 1 comprising function modules.

FIG. 3 is a flowchart of one embodiment of a file transfer security method implementing a system such as, for example, that of FIG. 1 .

All of the processes described below may be embodied in, and fully automated via, functional code modules executed by one or more general purpose computers or processors. The code modules may be stored in any type of computer-readable medium or other computer storage device. Some or all of the methods may alternatively be embodied in specialized computer hardware.

FIG. 1 is a block diagram of one embodiment of a file transfer security system 10 . The system 10 may include an application server 11 , at least one client computer 12 , and a file server 13 . The application server 11 is connected to the client computer 12 over an intranet 14 . The application server 11 is further connected to the file server 13 over an extranet 15 , such as the Internet. In one embodiment, the file server 13 is a file transfer protocol (FTP) server that provides file transfer services applying FTP. The file transfer services may include uploading, downloading, deleting, and modifying files. The client computer 12 sends file transfer requests to the file server 13 to request file transfer services.

In one embodiment, the application server 11 may include a file transfer securing unit 110 , a storage system 111 , and at least one processor 112 . One or more computerized codes of the file transfer securing unit 110 may be stored in the storage system 111 and be executed by the at least one processor 112 . The file transfer securing unit 110 may determine whether the file transfer requests sent from the client computer 12 are approvable before the client computer 12 exchanges or manipulates files in the file server 13 .

FIG. 2 is a block diagram of one embodiment of the file transfer securing unit 110 of FIG. 1 comprising function modules. In one embodiment, the file transfer securing unit 110 includes an interception module 200 , an analysis module 210 , a notification module 220 , a receiving module 230 , and an execution module 240 .

The interception module 200 is operable to intercept a file transfer request sent from the client computer 12 to the FTP server 13 , and record relevant information of the request. The relevant information of the file transfer request can include a user ID, a request time, an IP address of the client computer 12 , a file name, and a file size. Files to be uploaded with the file transfer request can also be intercepted.

The analysis module 210 is operable to analyze the relevant information of the file transfer request to assess the need for examination of the file transfer request.

The notification module 220 is operable to notify an auditor to examine the file transfer request and award approval or rejection thereof, such as by e-mails, in one embodiment. The auditor may be selected according to the user ID.

The receiving module 230 is operable to receive an examination result from the auditor. The receiving module 230 may generate a user interface, such as a webpage, by which the auditor can examine the file transfer request. In another embodiment, the examination result can be returned by e-mails or short message service (SMS) text messages. The receiving module 230 may provide an accompanying file to be uploaded to the auditor as part of the request for examination.

The execution module 240 is operable to execute file operations according to the examination result. The execution module 240 may execute file operations corresponding to the file transfer request via the extranet 15 upon approval thereof. If the file transfer request is rejected, the execution module 240 informs the client computer 12 of the file transfer failure.

FIG. 3 is a flowchart of one embodiment of a file transfer security method implementing a system such as, for example, that of FIG. 1 . Depending on the embodiments, additional blocks may be added, others removed, and the ordering of the blocks may be changed.

In block S 301 , the interception module 200 intercepts a file transfer request from the client computer 12 to the FTP server 13 , and records relevant information thereof. The file transfer request may target upload, download, deletion, or modification of files. Relevant information of the file transfer request includes, for example, a user ID, a request time, an IP address of the client computer 12 , a file name, and a file size, all of which are here registered by recording module 200 . It is to be noted that the interception module 200 may intercept a file to be uploaded accompanying the file request.

In block S 302 , the analysis module 210 analyzes the relevant information of the file transfer request, such as the file name, to assess the need for examination of the file transfer request.

In block S 303 , the notification module 220 notifies an auditor to examine the file transfer request and award approval or rejection thereof, in one embodiment, by e-mails. Depending on the embodiment, the auditor may be selected according to other relevant information of the file transfer request, such as the user ID or IP address of the client computer 12 . The notification module 220 may notify the auditor to determine the file transfer request by other means, such as a short message service (SMS) text message.

In block S 304 , the receiving module 230 receives an examination result from the auditor. In one embodiment, the receiving module 230 may generate a user interface, such as a webpage, by which the auditor examines the file transfer request. For example, the receiving module 230 can sort the relevant information of the file transfer request according to the request time. A webpage with the sorted relevant information is generated and made available. In another embodiment, the receiving module 230 may receive the examination result from the auditor by e-mails or SMS text messages. The receiving module 230 may make the file to be uploaded available to the auditor while a file request for uploading the file is determined.

In block S 305 , the execution module 240 executes file operations according to the examination result. In one example, the execution module 240 transfers a file to be uploaded to the file server 13 via the extranet 15 if a file request for uploading the file is approved. Otherwise, if the file request for uploading the file is rejected, the execution module 240 informs the client computer 12 of the file upload failure. In another example, the execution module 240 deletes a file from the file server 13 if a file request for deleting the file is approved. Otherwise, if the file request for deleting the file is rejected, the execution module 240 informs the client computer 12 of the file deletion failure.

Although certain inventive embodiments of the present disclosure have been specifically described, the present disclosure is not to be construed as being limited thereto. Various changes or modifications may be made to the present disclosure without departing from the scope and spirit of the present disclosure.