Privacy protection during insider threat monitoring

• US 10,318,729 B2
• Filed: 08/02/2017
• Issued: 06/11/2019
• Est. Priority Date: 07/26/2017
• Status: Active Grant

• Current Assignee: Forcepoint LLC
• Original Assignee: Forcepoint LLC
• Inventors: Ford, Richard A., Shirey, Christopher B., Knepher, Jonathan B., Troyansky, Lidror
• Primary Examiner(s): Schwartz, Darren B
• Application Number:
  US15/667,054
• Publication Number:
  US 20190034660A1
• Time in Patent Office: 678 Days
• CPC Class Codes: G06F 11/3072 where the reporting involves data filtering, e.g. pattern matching, time or event triggered, adaptive or policy-based reporting
• CPC Class Codes: G06F 11/3438 monitoring of user actions tracking the activity of the user H04L67/535
• CPC Class Codes: G06F 21/552 involving long-term monitoring or reporting
• CPC Class Codes: G06F 21/577 Assessing vulnerabilities and evaluating computer system security
• CPC Class Codes: G06F 21/602 Providing cryptographic facilities or services
• CPC Class Codes: G06F 21/6245 Protecting personal data, e.g. for financial or medical purposes
• CPC Class Codes: G06F 21/6254 by anonymising data, e.g. decorrelating personal data from the owner's identification
• CPC Class Codes: G06F 21/84 output devices, e.g. displays or monitors
• CPC Class Codes: G06F 2201/86 Event-based monitoring
• CPC Class Codes: G06F 2221/031 Protect user input by software means
• CPC Class Codes: G06F 2221/032 Protect output to user by software means
• CPC Class Codes: G06F 2221/034 Test or assess a computer or a system
• CPC Class Codes: H04L 2209/16 Obfuscation or hiding, e.g. involving white box
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00
• CPC Class Codes: H04L 63/1425 Traffic logging, e.g. anomaly detection
• CPC Class Codes: H04L 63/1433 Vulnerability analysis
• CPC Class Codes: H04L 63/1441 Countermeasures against malicious traffic countermeasures against attacks on cryptographic mechanisms H04L9/002
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04L 67/025 for remote control or remote monitoring of applications
• CPC Class Codes: H04L 67/141 Setup of application sessions admission control or resource allocation in data switching networks H04L47/70
• CPC Class Codes: H04L 67/146 : Markers for unambiguous identification of a particular session, e.g. session cookie or URL-encoding
• CPC Class Codes: H04L 67/289 : Intermediate processing functionally located close to the data consumer application, e.g. in same machine, in same home or in same sub-network
• CPC Class Codes: H04L 67/306 : User profiles
• CPC Class Codes: H04L 67/535 : Tracking the activity of the user network monitoring arrangements H04L43/00; recording of computer activity G06F11/34

Abstract

A method, system and computer-usable medium are disclosed for performing a privacy operation, comprising: monitoring user behavior via a data stream collector, the data stream collector capturing data streams resulting from user/device interactions between a user and a corresponding endpoint device; determining whether the data streams resulting from user/device interactions include sensitive personal information; obfuscating the sensitive personal information, the obfuscating preventing unauthorized viewing of the sensitive personal information; and, presenting the sensitive personal information as a sensitive personal information token indicating the data streams include sensitive personal information.

Claims

1. A computer-implementable method for performing a privacy operation, comprising:

monitoring user behavior via an Input/output collector, the Input/output collector capturing user/device interactions between a user and a device;

determining whether the user/device interactions include sensitive personal information;

obfuscating the sensitive personal information, the obfuscating preventing viewing of the sensitive personal information;

presenting the sensitive personal information as a sensitive personal information indication, the sensitive personal information indication indicating the user/device interactions include sensitive personal information;

offering the user an opportunity to enroll user sensitive personal information in a privacy protection system;

enrolling the user sensitive personal information in the privacy protection system, the enrolling preventing display of sensitive personal information to a security administrator via a company security system, the company security system comprising an insider threat monitoring system; and

,

presenting a sensitive personal information indication via the company security system, the sensitive personal information indication informing the security administrator that sensitive personal information was entered by the user.

2. The method of claim 1, wherein:

the obfuscating comprises storing the sensitive personal information via a one way function, the one way function preventing access to the sensitive personal information.

3. The method of claim 2, wherein:

the data stream collector comprises a keystroke collector; and

,

the monitoring comprises collecting keystrokes resulting from user/device interactions, the keystrokes corresponding to the sensitive personal information being added to the one way function.

4. The method of claim 1, further comprising:

capturing a context associated with the data streams resulting from user/device interactions between a user and a corresponding endpoint device; and

,

presenting the context along with the sensitive personal information token.

5. The method of claim 1, further comprising:

developing sensitive personal information obfuscation policies; and

,

using the sensitive personal information obfuscation policies to determine whether the user/device interactions include sensitive personal information and which sensitive personal information to obfuscate.

6. A system comprising:

a processor;

a data bus coupled to the processor; and

a non-transitory, computer-readable storage medium embodying computer program code, the non-transitory, computer-readable storage medium being coupled to the data bus, the computer program code interacting with a plurality of computer operations and comprising instructions executable by the processor and configured for;

monitoring user behavior via an Input/output collector, the Input/output collector capturing user/device interactions between a user and a device;

determining whether the user/device interactions include sensitive personal information;

obfuscating the sensitive personal information, the obfuscating preventing viewing of the sensitive personal information;

presenting the sensitive personal information as a sensitive personal information indication, the sensitive personal information indication indicating the user/device interactions include sensitive personal information;

offering the user an opportunity to enroll user sensitive personal information in a privacy protection system;

enrolling the user sensitive personal information in the privacy protection system, the enrolling preventing display of sensitive personal information to a security administrator via a company security system, the company security system comprising an insider threat monitoring system; and

,

presenting a sensitive personal information indication via the company security system, the sensitive personal information indication informing the security administrator that sensitive personal information was entered by the user.

7. The system of claim 6, wherein:

the obfuscating comprises storing the sensitive personal information via a one way function, the one way function preventing access to the sensitive personal information.

8. The system of claim 7, wherein:

the data stream collector comprises a keystroke collector; and

,

the monitoring comprises collecting keystrokes resulting from user/device interactions, the keystrokes corresponding to the sensitive personal information being added to the one way function.

9. The system of claim 6, wherein:

capturing a context associated with the data streams resulting from user/device interactions between a user and a corresponding endpoint device; and

,

presenting the context along with the sensitive personal information token.

10. The system of claim 6, wherein the instructions executable by the processor are further configured for:

developing sensitive personal information obfuscation policies; and

,

using the sensitive personal information obfuscation policies to determine whether the data streams resulting from user/device interactions include sensitive personal information and which sensitive personal information to obfuscate.

11. A non-transitory, computer-readable storage medium embodying computer program code, the computer program code comprising computer executable instructions configured for:

monitoring user behavior via an Input/output collector, the Input/output collector capturing user/device interactions between a user and a device;

determining whether the data streams resulting from user/device interactions include sensitive personal information;

obfuscating the sensitive personal information, the obfuscating preventing viewing of the sensitive personal information;

presenting the sensitive personal information as a sensitive personal information indication, the sensitive personal information indication indicating the user/device interactions include sensitive personal information;

offering the user an opportunity to enroll user sensitive personal information in a privacy protection system;

enrolling the user sensitive personal information in the privacy protection system, the enrolling preventing display of sensitive personal information to a security administrator via a company security system, the company security system comprising an insider threat monitoring system; and

,

presenting a sensitive personal information indication via the company security system, the sensitive personal information indication informing the security administrator that sensitive personal information was entered by the user.

12. The non-transitory, computer-readable storage medium of claim 11, wherein:

the obfuscating comprises storing the sensitive personal information via a one way function, the one way function preventing access to the sensitive personal information.

13. The non-transitory, computer-readable storage medium of claim 12, wherein:

the data stream collector comprises a keystroke collector; and

,

the monitoring comprises collecting keystrokes resulting from user/device interactions, the keystrokes corresponding to the sensitive personal information being added to the one way function.

14. The non-transitory, computer-readable storage medium of claim 11, wherein the computer executable instructions are further configured for:

capturing a context associated with the data streams resulting from user/device interactions between a user and a corresponding endpoint device; and

,

presenting the context along with the sensitive personal information token.

15. The non-transitory, computer-readable storage medium of claim 11, wherein:

developing sensitive personal information obfuscation policies; and

,

using the sensitive personal information obfuscation policies to determine whether the user/device interactions include sensitive personal information and which sensitive personal information to obfuscate.

16. The non-transitory, computer-readable storage medium of claim 11, wherein the computer executable instructions are deployable to a client system from a server system at a remote location.

17. The non-transitory, computer-readable storage medium of claim 11, wherein the computer executable instructions are provided by a service provider to a user on an on-demand basis.