Confidential Content Search Engine

• US 20080235196A1
• Filed: 05/30/2008
• Published: 09/25/2008
• Est. Priority Date: 01/20/2006
• Status: Active Grant

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Broussard, Scott J., Spring, Eduardo N., Wrobel, Anthony W., Kwong, Tony C.
• Granted Patent: US 9,262,727 B2
• Time in Patent Office: Days
• US Class Current: 707/3
• CPC Class Codes: G06F 21/6245 Protecting personal data, e.g. for financial or medical purposes
• CPC Class Codes: G06F 2221/2101 Auditing as a secondary aspect
• CPC Class Codes: G06Q 10/00 Administration; Management

Abstract

A security compliance search engine is provided for searching one or more client computing devices for items of information that meet a security criteria identifying items of information containing confidential content. Results of the search are provided to an analysis engine for determining if the items of information identified by the search are being maintained in accordance with a security policy for ensuring the confidentiality of the confidential content. Results of the analysis may be used to generate a report or log and to generate a notification to the client computing device identifying any violations of the security policy and possible solutions for bringing the item of information into compliance with the security policy. In addition, an administrator may be notified of any violations so that corrective action may be taken.

Claims

1. A method, in a data processing system, for searching a client computing device to identify items of information containing confidential information, comprising:

retrieving one or more security search rules setting forth one or more security criteria for identifying items of information that contain confidential information;

performing a security search of a client computing device to identify at least one item of information meeting the one or more security criteria;

retrieving search results of the security search, wherein the search results of the security search contain the at least one item of information that meets the one or more security criteria;

analyzing the search results to determine if the at least one item of information meets security policy compliance requirements; and

generating a report based on results of the analysis of the search results, wherein the security policy compliance requirements identify requirements for maintaining items of information that contain confidential information in a confidential state.

2. The method of claim 1, wherein the one or more security criteria comprises at least one of particular character strings indicative of confidential information, data flags indicative of confidential information, particular parameters associated with items of information indicative of confidential information, file system settings associated with items of information indicative of confidential information, file usage patterns indicative of confidential information, or file name patterns indicative of confidential information.

3. The method of claim 1, wherein the item of information is at least one of an electronic mail, an electronic file, and electronic objects in an object oriented environment, an electronic document, or an electronic image.

4. The method of claim 1, wherein the data processing system is a server computing device, and wherein the security search is performed on a plurality of client computing devices associated with the server computing device.

5. The method of claim 4, further comprising:

retrieving information from a client computing device database identifying one or more client computing devices on which to perform the security search.

6. The method of claim 1, wherein the data processing system is the client computing device.

7. The method of claim 1, wherein performing a security search of a client computing device to identify at least one item of information meeting the one or more security criteria comprises:

installing a client agent on the client computing device; and

executing the client agent on the client computing device, wherein the client agent uses the retrieved one or more security rules to perform the security search of the client computing device.

8. The method of claim 1, wherein retrieving search results of the security search includes gathering characteristic information associated with the at least one item of information, wherein the characteristic information includes at least one of an identity of the at least one item of information, the search criteria met by the at least one item of information, or information identifying a protection mechanism currently applied to the at least one item of information.

9. The method of claim 8, wherein analyzing the search results to determine if the at least one item of information meets security policy compliance requirements comprises:

identifying one or more security policies in a security policy database that are to be applied to the at least one item of information, based on the characteristic information gathered for the at least one item of information.

10. The method of claim 1, wherein generating a report based on results of the analysis of the search results comprises providing a notification to the client computing device indicating a violation of the security policy compliance requirements and a solution for placing the at least one item of information in compliance with the security policy compliance requirements.

12. The computer program product of claim 1, wherein the one or more security criteria comprises at least one of particular character strings indicative of confidential information, data flags indicative of confidential information, particular parameters associated with items of information indicative of confidential information, file system settings associated with items of information indicative of confidential information, file usage patterns indicative of confidential information, or file name patterns indicative of confidential information.

11. A computer program product comprising a computer useable medium having a computer readable program, wherein the computer readable program, when executed on a computing device, causes the computing device to:

retrieve one or more security search rules setting forth one or more security criteria for identifying items of information that contain confidential information;

perform a security search of a client computing device to identify at least one item of information meeting the one or more security criteria;

retrieve search results of the security search, wherein the search results of the security search contain the at least one item of information that meets the one or more security criteria;

analyze the search results to determine if the at least one item of information meets security policy compliance requirements; and

generate a report based on results of the analysis of the search results, wherein the security policy compliance requirements identify requirements for maintaining items of information that contain confidential information in a confidential state.

13. The computer program product of claim 11, wherein the item of information is at least one of an electronic mail, an electronic file, and electronic objects in an object oriented environment, an electronic document, or an electronic image.

14. The computer program product of claim 11, wherein the computer readable program causes the computing device to perform a security search of a client computing device to identify at least one item of information meeting the one or more security criteria by:

installing a client agent on the client computing device; and

executing the client agent on the client computing device, wherein the client agent uses the retrieved one or more security rules to perform the security search of the client computing device.

15. The computer program product of claim 11, wherein the computer readable program causes the computing device to retrieve search results of the security search by gathering characteristic information associated with the at least one item of information, wherein the characteristic information includes at least one of an identity of the at least one item of information, the search criteria met by the at least one item of information, or information identifying a protection mechanism currently applied to the at least one item of information.

16. The computer program product of claim 15, wherein the computer readable program causes the computing device to analyze the search results to determine if the at least one item of information meets security policy compliance requirements by:

identifying one or more security policies in a security policy database that are to be applied to the at least one item of information, based on the characteristic information gathered for the at least one item of information.

17. The computer program product of claim 11, wherein the computer readable program causes the computing device to generate a report based on results of the analysis of the search results by providing a notification to the client computing device indicating a violation of the security policy compliance requirements and a solution for placing the at least one item of information in compliance with the security policy compliance requirements.

18. A system for searching a client computing device to identify items of information containing confidential information, comprising:

a processor;

a memory coupled to the processor; and

a storage device coupled to the processor, wherein the memory comprises computer executable instructions which, when executed by the processor, causes the processor to;

retrieve, from the storage device, one or more security search rules setting forth one or more security criteria for identifying items of information that contain confidential information;

perform a security search of a client computing device to identify at least one item of information meeting the one or more security criteria;

retrieve search results of the security search, wherein the search results of the security search contain the at least one item of information that meets the one or more security criteria;

analyze the search results to determine if the at least one item of information meets security policy compliance requirements; and

generate a report based on results of the analysis of the search results, wherein the security policy compliance requirements identify requirements for maintaining items of information that contain confidential information in a confidential state.

19. The system of claim 18, wherein the processor performs a security search of a client computing device to identify at least one item of information meeting the one or more security criteria by:

installing a client agent on the client computing device; and

executing the client agent on the client computing device, wherein the client agent uses the retrieved one or more security rules to perform the security search of the client computing device.

20. The system of claim 18, wherein the processor:

retrieves search results of the security search by gathering characteristic information associated with the at least one item of information, wherein the characteristic information includes at least one of an identity of the at least one item of information, the search criteria met by the at least one item of information, or information identifying a protection mechanism currently applied to the at least one item of information, and

identifies one or more security policies in a security policy database that are to be applied to the at least one item of information, based on the characteristic information gathered for the at least one item of information.