SYSTEM AND METHOD FOR ADDING CONTEXT TO PREVENT DATA LEAKAGE OVER A COMPUTER NETWORK

• US 20080307489A1
• Filed: 01/30/2008
• Published: 12/11/2008
• Est. Priority Date: 02/02/2007
• Status: Active Grant

• Current Assignee: Forcepoint LLC
• Original Assignee: Forcepoint LLC
• Inventors: Hubbard, Daniel Lyle
• Granted Patent: US 8,938,773 B2
• Time in Patent Office: Days
• US Class Current: 726/1
• CPC Class Codes: H04L 51/212 using filtering or selective blocking
• CPC Class Codes: H04L 63/0245 Filtering by information in the payload
• CPC Class Codes: H04L 63/107 wherein the security policies are location-dependent, e.g. entities privileges depend on current location or allowing specific operations only from locally connected terminals
• CPC Class Codes: H04L 63/123 received data contents, e.g. message integrity

Abstract

Systems and methods for adding context to prevent data leakage over a computer network are disclosed. Data is classified and contextual information of the data is determined. A transmission policy is determined in response to the classification and contextual information. The data is either transmitted or blocked in response to the classification and the contextual information

Claims

1. A system for preventing the unauthorized transmission of data over a computer network, the system comprising:

a data source having data and in communication with the network;

a network gateway in communication with the network; and

a destination in communication with the network;

wherein the network gateway is configured to determine a transmission policy in response to the type of data and contextual information of the data.

2. The system of claim 1 wherein the contextual information comprises sender contextual information of the data source.

3. The system of claim 1 wherein the contextual information comprises destination contextual information of the destination.

4. The system of claim 1 wherein the contextual information comprises sender contextual information of the data source and destination contextual information of the destination.

5. The system of claim 4 wherein the sender contextual information is an IP address of the data source, a user name or a group of users.

6. The system of claim 4 wherein the destination contextual information is an IP address of the destination, a network of the destination or a category of the destination.

7. The system of claim 4 wherein the transmission policy transmits the data or blocks transmission of the data.

8. The system of claim 7 wherein the transmission policy further comprises reporting that the data source is attempting to transmit data.

9. The system of claim 1 wherein the data source is an electronic device.

10. The system of claim 9 wherein the electronic device is selected from the group consisting of:

a PDA;

a computer; and

a cell phone.

11. The system of claim 1 wherein the computer network is the Internet.

12. The system of claim 1 wherein the network gateway comprises a classification module for determining the type of data.

13. The system of claim 1 wherein the network gateway comprises a context information module for determining the contextual information.

14. The system of claim 1 wherein the network gateway comprises a policy/reporting module for generating the transmission policy.

15. The system of claim 1 wherein the network gateway comprises an enforcement module for transmitting or blocking transmission of the data in response to the transmission policy.

16. The system of claim 1 wherein the network gateway comprises:

a classification module for determining the type of data;

a context information module for determining the contextual information;

a policy/reporting module for generating the transmission policy; and

an enforcement module for transmitting or blocking transmission of the data in response to the transmission policy.

17. A method of preventing an unauthorized transmission of data over a computer network, the method comprising the steps of;

classifying the data;

determining contextual information of the data; and

determining a transmission policy for the data in response to the classification of the data and contextual information of the data.

18. The method of claim 17 further comprising the step of transmitting the data or blocking the data in response to the transmission policy.

19. The method of claim 18 wherein the step of transmitting the data or blocking the data is performed by an enforcement module.

20. The method of claim 17 wherein the step of classifying the data comprises determining the type of data.

21. The method of claim 17 wherein the step of determining the contextual information of the data comprises determining sender contextual information.

22. The method of claim 21 wherein the sender contextual information comprises an IP address of the sender, a user name of the sender or a group name of the user.

23. The method of claim 17 wherein the step of determining the contextual information of the data comprises determining destination contextual information.

24. The method of claim 23 wherein the destination contextual information comprises an IP address of the destination, a network of the destination or a category of the destination.

25. The method of claim 17 wherein the step of determining the contextual information of the data comprises determining destination contextual information and sender contextual information.

26. The method of claim 17 further comprising the step of reporting that the data is to be transmitted.

27. The method of claim 17 wherein the step of classifying the data is performed by a classification module.

28. The method of claim 17 wherein the step of determining the contextual information of the data is performed by a context information module.

29. The method of claim 17 wherein the step of determining a transmission policy for the data is performed by a policy/reporting module.

30. The method of claim 17 further comprising the step of sending the data to a network gateway prior to classifying the data.

31. The method of claim 30 wherein the step of sending the data is performed with an electronic device connected to a network.

32. The method of claim 31 wherein the electronic device is selected from the group consisting of:

a PDA;

a computer; and

a cell phone.

33. The method of claim 31 wherein the network is the Internet.