Decrypting files for data leakage protection in an enterprise network

• US 10,607,016 B2
• Filed: 07/24/2017
• Issued: 03/31/2020
• Est. Priority Date: 12/28/2012
• Status: Active Grant

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Tsai, Ya Hsuan, Yu, Ying-Hung, Mahadevan, Hariharan
• Primary Examiner(s): Zarrineh, Shahriar
• Application Number:
  US15/657,850
• Publication Number:
  US 20180018467A1
• Time in Patent Office: 981 Days
• Field of Search: 713165
• CPC Class Codes: G06F 11/1458 Management of the backup or restore process
• CPC Class Codes: G06F 16/137 Hash-based content-based indexing of textual data G06F16/31
• CPC Class Codes: G06F 16/162 Delete operations erasing in storage systems G06F3/0652
• CPC Class Codes: G06F 16/1756 based on delta files
• CPC Class Codes: G06F 16/182 Distributed file systems
• CPC Class Codes: G06F 16/1873 Versioning file systems, temporal file systems, e.g. file system supporting different historic versions of files
• CPC Class Codes: G06F 16/20 of structured data, e.g. relational data
• CPC Class Codes: G06F 21/10 Protecting distributed programs or content, e.g. vending or licensing of copyrighted material protection in video systems or pay television H04N7/16 ; Digital rights management [DRM]
• CPC Class Codes: G06F 21/50 Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
• CPC Class Codes: G06F 21/60 Protecting data
• CPC Class Codes: G06F 21/606 by securing the transmission between two devices or processes
• CPC Class Codes: H04L 63/0227 Filtering policies mail message filtering H04L51/212
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00

Abstract

Techniques are provided for decrypting an encrypted file within an enterprise network. The techniques include identifying by a password collecting module a password entered during a file encryption procedure performed at a terminal and storing the password; receiving an encrypted file by a data leakage protection (DLP) module; and attempting to decrypt the encrypted file with the password by the DLP module.

Claims

1. A method for providing data leak protection (DLP), comprising:

determining, by a processor, that a predetermined application executing at a terminal is in the process of transmitting an encrypted file from the terminal; and

in response to determining that the encrypted file is being transmitted from the terminal, identifying, by the processor, a password that decrypts the encrypted file;

decrypting, by the processor, the encrypted file to generate a decrypted file;

determining, by the processor, that the decrypted file is a file subject to DLP;

in response to determining that the decrypted file is a file subject to DLP, preventing, by the processor, the transmitting of the file from the terminal;

identifying meta data of the encrypted file, wherein the decrypting further comprises selecting the password by determining that meta data of the encrypted file matches at least a portion of meta data of the password; and

identifying meta data of the encrypted file, wherein the decrypting further comprises determining a degree of match between meta data of the encrypted file and meta data of the multiple passwords obtained by comparing meta data associated with the encrypted file with meta data associated with the password several times, so as to determine priority given to a decryption performed with each of the multiple passwords.

2. The method of claim 1, further comprising generating a list of passwords associated with the predetermined application, wherein the identifying the password comprises selecting the password from the list of passwords.

3. The method of claim 2, further comprising storing in conjunction with the list a number of times each password on the list has been employed, wherein the selecting the password from the list is based upon the number of times each password has been employed.

4. The method of claim 1, further comprising storing a first password entered during a first file encryption procedure performed at the terminal, wherein the identifying the password comprises selecting the first password.

13. The method of claim 1, the determining that the decrypted file is a file subject to DLP comprising checking for confidential content in the decrypted file.

5. An apparatus for providing data leak protection (DLP), comprising:

a processor;

a non-transitory, computer-readable medium coupled to the processor; and

logic, stored on the computer-readable medium and executed on the processor, for;

determining that a predetermined application executing at a terminal is in the process of transmitting an encrypted file from the terminal; and

in response to determining that the encrypted file is being transmitted from the terminal, identifying a password that decrypts the encrypted file;

decrypting the encrypted file to generate a decrypted file;

determining that the decrypted file is a file subject to DLP;

in response to determining that the decrypted file is a file subject to DLP, preventing the transmitting of the file from the terminal;

identifying meta data of the encrypted file, wherein the decrypting further comprises selecting the password by determining that meta data of the encrypted file matches at least a portion of meta data of the password; and

identifying meta data of the encrypted file, wherein the decrypting further comprises determining a degree of match between meta data of the encrypted file and meta data of the multiple passwords obtained by comparing meta data associated with the encrypted file with meta data associated with the password several times, so as to determine priority given to a decryption performed with each of the multiple passwords.

6. The apparatus of claim 5, the logic further comprising logic for generating a list of passwords associated with the predetermined application, wherein the identifying the password comprises selecting the password from the list of passwords.

7. The apparatus of claim 6, the logic further comprising logic for storing in conjunction with the list a number of times each password on the list has been employed, wherein the selecting the password from the list is based upon the number of times each password has been employed.

8. The apparatus of claim 5, the logic further comprising logic for storing a first password entered during a first file encryption procedure performed at the terminal, wherein the identifying the password comprises selecting the first password.

14. The apparatus of claim 5, the logic for determining that the decrypted file is a file subject to DLP comprising checking for confidential content in the decrypted file.

9. A computer programming product for providing data leak protection (DLP), comprising:

a non-transitory, computer-readable medium; and

logic, stored on the computer-readable medium for execution on a processor, for;

determining, by the processor, that a predetermined application executing at a terminal is in the process of transmitting an encrypted file from the terminal; and

,

in response to determining that the encrypted file is being transmitted from the terminal, identifying, by the processor, a password that decrypts the encrypted file;

decrypting, by the processor, the encrypted file to generate a decrypted file;

determining, by the processor, that the decrypted file is a file subject to DLP;

in response to determining that the decrypted file is a file subject to DLP, preventing, by the processor, the transmitting of the file from the terminal;

identifying meta data of the encrypted file, wherein the decrypting further comprises selecting the password by determining that meta data of the encrypted file matches at least a portion of meta data of the password; and

identifying meta data of the encrypted file, wherein the decrypting further comprises determining a degree of match between meta data of the encrypted file and meta data of the multiple passwords obtained by comparing meta data associated with the encrypted file with meta data associated with the password several times, so as to determine priority given to decryption performed with each of the multiple passwords.

10. The computer programming product of claim 9, the logic further comprising logic for generating a list of passwords associated with the predetermined application, wherein the identifying the password comprises selecting the password from the list of passwords.

11. The computer programming product of claim 10, the logic further comprising logic fur storing in con unction with the list a number of times each password on the list has been employed, wherein the selecting the password from the list is based upon the number of times each password has been employed.

12. The computer programming product of claim 9, the logic further comprising logic for storing a first password entered during a first file encryption procedure performed at the terminal, wherein the identifying the password comprises selecting the first password.

15. The computer programming product of claim 9, the logic for determining that the decrypted file is a file subject to DLP comprising checking for confidential content in the decrypted file.