Method for allowing data classification in inflexible software development environments

• US 10,438,015 B2
• Filed: 01/20/2016
• Issued: 10/08/2019
• Est. Priority Date: 01/21/2015
• Status: Active Grant

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Israel Research And Development (2002) Ltd (Microsoft Corporation)
• Inventors: Eldar, Yuval, Oz, Roee
• Primary Examiner(s): Gee, Jason K
• Application Number:
  US14/908,611
• Publication Number:
  US 20170316220A1
• Time in Patent Office: 1,357 Days
• CPC Class Codes: G06F 21/16 Program or content traceability, e.g. by watermarking
• CPC Class Codes: G06F 21/602 Providing cryptographic facilities or services
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: G06F 21/6245 Protecting personal data, e.g. for financial or medical purposes
• CPC Class Codes: G06F 21/82 Protecting input, output or interconnection devices
• CPC Class Codes: G06F 2221/031 Protect user input by software means
• CPC Class Codes: G06F 2221/2141 Access rights, e.g. capability lists, access control lists, access tables, access matrices
• CPC Class Codes: G06F 3/04886 by partitioning the display area of the touch-screen or the surface of the digitising tablet into independently controllable areas, e.g. virtual keyboards or menus
• CPC Class Codes: G06F 8/61 Installation
• CPC Class Codes: G06F 8/70 Software maintenance or management

Abstract

System and method for enabling data modification, classification and enforcement of IRM capabilities in standard isolated software applications is disclosed, according to which an add-on code is installed on the terminal device of a user that runs the standard application. The add-on code is adapted to interact with the virtual keyboard used by the standard application, to form a custom virtual keyboard to which the features of classifying data item(s) and/or of modifying the content of the data item are added, without changing the natural environment, the user is normally used to. Then a custom virtual keyboard that includes a designed UI interfacing objects is created, for adding inputs that are associated with classification and modification in the data item in the form of a hidden tag to the content of the data item.

Claims

1. A method for enabling data modification, classification, and enforcement of information rights management (IRM) capabilities in standard isolated software applications using a custom virtual keyboard, comprising:

installing add-on code on a terminal device of a user that runs the standard application, the add-on code being adapted to interact with a virtual keyboard used by the standard application and enables classifying a data item and/or of modifying the content of the data item are added, without changing the natural environment of the standard application that the user is normally used to;

executing the add-on code and creating a custom virtual keyboard which interacts with the standard application through operating system (OS) keyboard services, the custom virtual keyboard reading a configuration file that comprises classification policy rules to be enforced on the data item, the policy rules limiting the operations which can be performed with the data item, the custom virtual keyboard including custom user interface (UI) objects that enable user input associated with classification and, based on received user input, the custom virtual keyboard enabling modification of the data item in the form of a hidden tag added to the content of the data item; and

embedding a dedicate code into inherent code of the virtual keyboard that tracks the characters that the user inputs and detects keywords or strings of the typed data item that are indicative that the content of the data item should be classified.

2. A method according to claim 1, further comprising upon consuming the classified or modified data item by the standard application, seeking said hidden tag and making a decision regarding further processing of said data item, according to a predetermined protection policy.

3. A method according to claim 1, further comprising rebounding data items for which no hidden tag is found back to the sender, along with a request for classification.

4. A method according to claim 1, further comprising automatically encrypting the data item, in response to its classification.

5. A method according to claim 1, wherein the interfacing objects are virtual buttons, checkboxes and icons for providing inputs that are associated with classification and modification in the data item.

6. A method according to claim 1, wherein modifications in the content of the data item include adding a disclaimer, adding invisible marking tagging characters/objects, content marking, watermarking or hidden signatures.

7. A method according to claim 1, wherein the hidden tag is a character having a transparent font presented at the bottom of the message body.

8. A method according to claim 1, wherein the protection policy includes blocking one or more operations that can be made with the classified data item.

9. A method according to claim 1, further comprising:

a) showing an accessibility button hovering over input areas on screen;

b) allowing the user clicking said accessibility button using a UI which allows said user to select an appropriate classification for his composed content and adding visible or hidden markings to the composed content, based on his selection.

10. A method according to claim 1, wherein a security product is used to enforce a desired security policy by allowing a secured data item to reach its destination only after said security product runs a security policy, based on the classification made.

11. A method according to claim 10, wherein the security product is selected from the group of:

a Cloud Access Security Broker (CASB);

a Data Loss Prevention module (DLP);

a mail server policy.

12. A method according to claim 10, wherein the security policy includes encryption, tagging or blocking operations.

13. A system for enabling data modification, classification and enforcement of information rights management (IRM) capabilities in standard isolated software applications, comprising:

a user'"'"'s terminal device that runs a standard application, on which an add-on code is installed, the add-on code being adapted to interact with a virtual keyboard used by the standard application and enables classifying a data item and/or modifying the content of the data item without changing the natural environment of the standard application that the user is normally used to;

a user interface (UI) for displaying a custom virtual keyboard which interacts with the standard application through operating system (OS) keyboard services, the custom virtual keyboard reading a configuration file that comprises classification policy rules to be enforced on the data item, the policy rules limiting the operations which can be performed with the data item, the custom virtual keyboard including custom user interface (UI) objects that enable user input for classifying the data item by allowing the user to enter input that is associated with classification and modification of the data item in the form of a hidden tag that is added to the content of the data item, wherein dedicated code is embedded into inherent code of the virtual keyboard that tracks the characters that the user inputs and detects keywords or strings of the typed data item that are indicative that the content of the data item should be classified; and

a computerized device running a security module, for seeking the hidden tag and making a decision regarding further processing of said data item, according to a predetermined protection policy.

14. A system according to claim 13, in which further processing of the data item includes converting said data item into a secured data item, before being consumed by a user or destination.

15. A system according to claim 13, in which the security module includes a dedicated code adapted to:

a) track the characters that the user inputs and detect keywords or strings of the typed data item that are indicative that the content of the data item should be classified;

b) rebound data items for which no hidden tag is found back to the sender, along with a request for classification.