Secure and scalable detection of preselected data embedded in electronically transmitted messages

• US 20100332481A1
• Filed: 09/18/2002
• Published: 12/30/2010
• Est. Priority Date: 09/18/2002
• Status: Active Grant

• Current Assignee: CA, Inc. (d/b/a CA Technologies) (Broadcom, Inc.)
• Original Assignee: Symantec Corporation (NortonLifeLock Inc.)
• Inventors: Rowney, Kevin T.
• Granted Patent: US 8,661,498 B2
• Time in Patent Office: Days
• US Class Current: 707/747
• CPC Class Codes: G06F 16/242 Query formulation
• CPC Class Codes: G06F 21/606 by securing the transmission between two devices or processes
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00

Abstract

A method and apparatus for detecting preselected data embedded in electronically transmitted messages is described. In one embodiment, the method comprises monitoring messages electronically transmitted over a network for embedded preselected data and performing content searches on the messages to detect the presence of the embedded preselected data using an abstract data structure derived from the preselected data.

Claims

1. A method comprising:

identifying, by a message monitoring system (MMS), an abstract data structure derived from preselected data to be protected from traveling across a network, the abstract data structure not revealing data elements of the preselected data to be protected;

performing, by the MMS, content searches on a plurality of messages electronically transmitted to reach a respective destination over the network, the content searches to be performed to determine whether one or more of the plurality of searched messages contain at least a portion of the preselected data to be protected using the abstract data structure that does not reveal the data elements of the preselected data; and

causing a searched message of the plurality of searched messages from reaching the respective destination in response to a determination that the searched message contains at least a portion of the preselected data to be protected.

2. The method defined in claim 1 wherein the preselected data comprises database data.

3. The method defined in claim 1 wherein the abstract data structure comprises an index.

4. The method defined in claim 3 wherein the index does not include a copy of the preselected data.

5. The method defined in claim 3 wherein the index comprises a relative placement of elements in a database in relation to other elements in the database.

6. The method defined in claim 3 wherein the index comprises a hash table derived from string values of the cells of database data.

7. The method defined in claim 3 wherein the index comprises a row number, column number and type of column associated with a fragment within the database.

8. The method defined in claim 1 further comprising:

creating, by a policy management system (PMS), the abstract data structure based on the preselected data extracted from the database.

9. The method defined in claim 8 wherein creating the abstract data structure based on the preselected data extracted from a database comprises:

querying a database; and

extracting at least one copy of the preselected data from the database.

10. The method defined in claim 8 wherein creating the abstract data structure comprises:

storing a row number, column number, and data type indicator for each cell in a database table into a hash table; and

sorting the hash table based on a predefined order into a collision list.

11. The method defined in claim 10 wherein the order comprises ascending lexicographic order.

12. The method defined in claim 1 wherein performing content searches on the plurality of messages electronically transmitted to reach a respective destination over the network using the abstract data structure that does not reveal the data elements comprises:

parsing individual lines of text in one of the plurality of messages to parse the one message into individual words;

applying a hash function to each of the individual words in a line to generate individual hash table collision lists for each of the individual words on each of the individual lines; and

identifying data sets within the individual hash table collision lists with common row numbers and distinct column numbers as preselected data.

13. The method defined in claim 1 wherein the preselected data comprises proprietary information selected based on a policy.

14. The method defined in claim 13 further comprising accepting user input specifying the policy.

15. The method defined in claim 14 wherein accepting user input specifying the policy comprises receiving information on a graphical user interface.

16. The method defined in claim 13 wherein the policy includes a specification of the data and a network location of the data.

17. The method defined in claim 16 wherein the specification of the data comprises a table name.

18. The method defined in claim 16 wherein the specification of the data comprises a database identifier.

19. The method defined in claim 16 wherein the network location comprises an IP address of a server.

20. The method defined in claim 19 wherein the network location comprises a server identifier.

21. The method defined in claim 1 wherein monitoring messages occurs at a plurality of exit points of the network.

22. The method defined in claim 1 further comprising:

periodically querying a database by a policy management system (PMS);

extracting copies of database data that is to be protected; and

deriving an abstract data structure based on extracted data and its location in the database.

23. The method defined in claim 1 further comprising receiving the abstract data structure by the message monitoring system.

24. The method defined in claim 1 further comprising:

preventing escape of messages containing preselected database content.

25. The method defined in claim 1 further comprising:

logging messages that contain database content.

26. The method defined in claim 1 further comprising:

reporting violations of the policy.

27. The method defined in claim 1 further comprising:

intercepting one or more messages; and

re-routing one or more messages to a new destination.

28. A preselected data protection system comprising:

a policy management computer system to set a policy identifying preselected data to be protected from traveling across a network and to derive an abstract data structure from the preselected data to be protected, the abstract data structure not revealing data elements of the preselected data to be protected; and

a message monitoring computer system to implement the policy by

performing content searches on a plurality of messages electronically transmitted to reach a respective destination over the network, the content searches to be performed to determine whether one or more of the plurality of searched messages contain at least a portion of the preselected data to be protected using the abstract data structure that does not reveal the data elements of the preselected data; and

preventing a searched message of the plurality of searched messages from reaching the respective destination in response to a determination that the searched message contains at least a portion of the preselected data to be protected.

29. The system defined in claim 28 wherein the policy includes a specification of the data and a network location of the data.

30. The system defined in claim 29 wherein the specification of the data comprises a table name.

31. The system defined in claim 29 wherein the specification of the data comprises a database identifier.

32. The system defined in claim 29 wherein the network location comprises an IP address of a server.

33. The system defined in claim 32 wherein the network location comprises a server identifier.

34. The system defined in claim 32 wherein the network location comprises a file name of columnar-formatted data.

35. The system defined in claim 28 wherein the policy management system and the message monitoring system are incorporated into the same physical system.

36. The system defined in claim 28 wherein the policy management system and the message monitoring system are incorporated into the same logical system.

37. The system defined in claim 28 wherein the policy management system and the message monitoring system do not reside on the same local area network (LAN).

38. The system defined in claim 28 wherein the policy management system and the message monitoring system reside on two distinct LANs coupled together via the Internet.

39. A computer-readable storage medium that provides instructions, which when executed on a processor causes the processor to perform a method comprising:

identifying an abstract data structure derived from preselected data to be protected from traveling across a network, the abstract data structure not revealing data elements of the preselected data to be protected;

performing content searches on a plurality of messages electronically transmitted to reach a respective destination over the network, the content searches to be performed to determine whether one or more of the plurality of searched messages contain at least a portion of the preselected data to be protected using the abstract data structure that does not reveal the data elements of the preselected data; and

causing a searched message of the plurality of searched messages from reaching the respective destination in response to a determination that the searched message contains at least a portion of the preselected data to be protected.