Method and apparatus for protecting sensitive information in a log file

• US 20030212899A1
• Filed: 05/09/2002
• Published: 11/13/2003
• Est. Priority Date: 05/09/2002
• Status: Active Grant

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Curtis, Bryce Allen
• Granted Patent: US 7,475,260 B2
• Time in Patent Office: Days
• US Class Current: 713/200
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: G06Q 20/389 Keeping log of transactions for guaranteeing non-repudiation of a transaction

Abstract

A method, apparatus, and computer instructions for protecting sensitive data in a log file. Data is logged into a file. The data in the log file is in a protected state and the data is never written to the log file in an unprotected fashion. Prior to the data being logged into the file, the data is parsed for specific data meeting predetermined criteria. The specific data is selectively protected with a security measure while leaving a remainder of the log file unprotected by the security measure. The viewer or program used to access the data in the log file is responsible for unprotecting or allowing the data to be viewed if the appropriate key is provided.

Claims

1. A method in a data processing system for protecting sensitive data in a log file, the method comprising the computer implemented steps of:

logging data into a file;

parsing the file for specific data meeting predetermined criteria; and

selectively protecting the specific data with a security measure while leaving a remainder of the log file unprotected by the security measure.

2. The method of claim 1, wherein the protecting step occurs prior to the logging step.

3. The method of claim 1, wherein the specific data includes at least one of a password, a user identification, a social security number, and a registration number.

4. The method of claim 1, wherein the selectively protecting step comprises:

preventing a display of the specific data on a display device, while the remainder of the log file is displayed on the display device.

5. The method of claim 4, wherein the preventing step includes:

removing the specific data from display on the display device.

6. The method of claim 1, wherein the preventing step includes:

replacing the specific data with other text on the display device.

7. The method of claim 1, wherein the selectively protecting step comprises:

encrypting the specific data to form encrypted data while the remainder of the log file is unencrypted.

8. The method of claim 7, wherein the selectively protecting step further comprises:

preventing a display of the encrypted data in an unencrypted form if a key to decrypt the data is absent when displaying the log file.

9. The method of claim 1, wherein the method is implemented using at least one Java class.

10. The method of claim 1, wherein the specific data is identified using tags.

11. The method of claim 1, wherein the specific data is identified as being associated with at least one selected variable.

12. The method of claim 1, wherein the specific data is identified as being at least one of a word, a set of words, and a sentence.

13. A data processing system for protecting sensitive data in a log file, the data processing system comprising:

a bus system;

a communications unit connected to the bus system;

a memory connected to the bus system, wherein the memory includes a set of instructions; and

a processing unit connected to the bus system, wherein the processing unit executes the set of instructions to log data into a file;

parse the file for specific data meeting predetermined criteria; and

selectively protect the specific data with a security measure while leaving a remainder of the log file unprotected by the security measure.

14. A data processing system for protecting sensitive data in a log file, the method comprising the computer implemented steps of:

logging means for logging data into a file;

parsing means for parsing the file for specific data meeting predetermined criteria; and

protecting means for selectively protecting the specific data with a security measure while leaving a remainder of the log file unprotected by the security measure.

15. The data processing system of claim 14, wherein the protecting means occurs prior to the logging step.

16. The data processing system of claim 14, wherein the specific data includes at least one of a password, a user identification, a social security number, and a registration number.

17. The data processing system of claim 14, wherein the selectively protecting means comprises:

preventing means for preventing a display of the specific data on a display device, while the remainder of the log file is displayed on the display device.

18. The data processing system of claim 17, wherein the preventing means includes:

removing means for removing the specific data from display on the display device.

19. The data processing system of claim 14, wherein the preventing means includes:

replacing means for replacing the specific data with other text on the display device.

20. The data processing system of claim 14, wherein the selectively protecting means comprises:

encrypting means for encrypting the specific data to form encrypted data while the remainder of the log file is unencrypted.

21. The data processing system of claim 20, wherein the preventing means is a first prevention means and wherein the selectively protecting means further includes:

second preventing means for preventing a display of the encrypted data in an unencrypted form if a key to decrypt the data is absent when displaying the log file.

22. A computer program product in a computer readable medium for protecting sensitive data in a log file, the computer program product comprising:

first instructions for logging data into a file;

second instructions for parsing the file for specific data meeting predetermined criteria; and

third instructions for selectively protecting the specific data with a security measure while leaving a remainder of the log file unprotected by the security measure.

23. The computer program product of claim 22, wherein the third instructions are executed prior to the first instructions.

24. The computer program product of claim 22, wherein the third instructions comprise:

sub-instructions for preventing a display of the specific data on a display device, while the remainder of the log file is displayed on the display device.

25. The computer program product of claim 22, wherein the sub-instructions include:

instructions for removing the specific data from display on the display device.

26. The computer program product of claim 25, wherein the sub-instructions include:

instructions for replacing the specific data with other text on the display device.

27. The computer program product of claim 22, wherein the third instructions comprise:

sub-instructions for encrypting the specific data to form encrypted data while the remainder of the log file is unencrypted.

28. The computer program product of claim 22, wherein the third instructions further comprise:

sub-instructions for preventing a display of the encrypted data in an unencrypted form if a key to decrypt the data is absent when displaying the log file.