Data leak protection system, method and apparatus

• US 20060179040A1
• Filed: 02/08/2005
• Published: 08/10/2006
• Est. Priority Date: 02/08/2005
• Status: Active Grant

• Current Assignee: LinkedIn Corporation (Microsoft Corporation)
• Original Assignee: International Business Machines Corporation
• Inventors: Kaminsky, David L., Rjaibi, Walid, Lightstone, Sam S., Bird, Paul M.
• Granted Patent: US 7,827,608 B2
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: G06F 16/217 Database tuning G06F16/2282 takes precedence; database performance monitoring G06F11/3409
• CPC Class Codes: G06F 16/2455 Query execution
• CPC Class Codes: G06F 21/6227 where protection concerns the structure of data, e.g. records, types, queries

Abstract

A method, system and apparatus for data leak prevention. An information system, such as a database system, which has been configured for data leak protection in accordance with the present invention can include an IDS coupled to the information system and a data leak protection system configured to apply a data leak protection policy for result sets produced by the information system in response to a database query. The data leak protection policy can include a listing of data shapes and corresponding remedial measures. The data leak protection policy further can include consideration for metrics produced by the IDS.

Claims

1. An information system configured for data leak protection comprising:

an intrusion detection system (IDS) coupled to the information system; and

,

a data leak protection system configured to apply a data leak protection policy for result sets produced by the information system in response to a query.

2. The system of claim 1, wherein said data leak protection policy comprises a listing of data shapes and corresponding remedial measures.

3. The system of claim 1, wherein said data leak protection policy further comprises consideration for metrics produced by said IDS.

4. The system of claim 2, wherein said data shapes are stateless functions of data included in each of said result sets.

5. The system of claim 2, wherein said data shapes are stateful functions of data included across multiple ones of said result sets.

6. The system of claim 1, wherein the information system is a database system.

7. A data leak protection method comprising the step of limiting a response to a database query based upon the shape of a result set produced by said database query, metrics produced by an intrusion detection system (IDS) for said database query, and a data leak protection policy specifying a set of limitations for a corresponding set of shapes and metrics.

8. The method of claim 7, wherein said limiting step comprises the steps of:

receiving a result set produced by a database query;

characterizing a shape of said result set;

comparing said shape to pre-specified shapes to identify a matching shape;

retrieving a remedial measure corresponding to said matching shape; and

, applying said remedial measure.

9. The method of claim 8, wherein said characterizing step comprises the step of processing at least one of a stateless function for data in said result, a stateful function for data in multiple result sets, a stateful function for said metrics produced by said IDS, and a stateless function for said metrics produced by said IDS.

10. The method of claim 8, wherein said applying step comprises the step of quashing said result set.

11. The method of claim 8, wherein said applying step comprises the step of returning said result set in its entirety.

12. The method of claim 8, wherein said applying step comprises the step of pruning said result set.

13. The method of claim 8, wherein said applying step comprises the step of disconnecting a user issuing said database query.

14. A machine readable storage having stored thereon a computer program for data leak protection, the computer program comprising a routine set of instructions which when executed by a machine causes the machine to perform the step of limiting a response to a database query based upon the shape of a result set produced by said database query, metrics produced by an intrusion detection system (IDS) for said database query, and a data leak protection policy specifying a set of limitations for a corresponding set of shapes and metrics.

15. The machine readable storage of claim 14, wherein said limiting step comprises the steps of:

receiving a result set produced by a database query;

characterizing a shape of said result set;

comparing said shape to pre-specified shapes to identify a matching shape;

retrieving a remedial measure corresponding to said matching shape; and

,

applying said remedial measure.

16. The machine readable storage of claim 15, wherein said characterizing step comprises the step of processing at least one of a stateless function for data in said result, a stateful function for data in multiple result sets, a stateful function for said metrics produced by said IDS, and a stateless function for said metrics produced by said IDS.

17. The machine readable storage of claim 15, wherein said applying step comprises the step of quashing said result set.

18. The machine readable storage of claim 15, wherein said applying step comprises the step of returning said result set in its entirety.

19. The machine readable storage of claim 15, wherein said applying step comprises the step of pruning said result set.

20. The machine readable storage of claim 15, wherein said applying step comprises the step of disconnecting a user issuing said database query.