METHOD AND A SYSTEM FOR INFORMATION IDENTIFICATION

• US 20110264637A1
• Filed: 06/30/2011
• Published: 10/27/2011
• Est. Priority Date: 04/02/2003
• Status: Abandoned Application

• Current Assignee: Forcepoint LLC
• Original Assignee: PortAuthority Technologies, Inc. (Forcepoint LLC)
• Inventors: PELED, Ariel, TROYANSKY, Lidror, CARNY, Ofir
• Application Number:
  US13/172,998
• Publication Number:
  US 20110264637A1
• Time in Patent Office: Days
• US Class Current: 707/698
• CPC Class Codes: G06F 7/02 Comparing digital values G06F7/06, G06F7/22, G06F7/38 take precedence

Abstract

A method for detecting an information item within an information sequence obtained from a digital medium, said information item comprising any one of a specified set of prestored information items, comprising: transforming each of the set of prestored information items into a respective representation, in accordance with a predetermined transformation format; transforming the information sequence obtained from the digital medium, in accordance with the transformation format; and determining the presence of one or more of the prestored information items within the transformed information sequence, utilizing the respective representation, wherein the information items are divided into sets, and applying a security policy that depends on the number of detected information items that belong to the same set.

Claims

1. A method for detecting an information item within an information sequence obtained from a digital medium, said information item comprising any one of a specified set of prestored information items, comprising:

transforming each of said set of prestored information items into a respective representation, in accordance with a predetermined transformation format;

transforming said information sequence obtained from said digital medium, in accordance with said transformation format;

determining the presence of one or more of said prestored information items within said transformed information sequence, utilizing said respective representation, wherein said information items are divided into sets, applying a security policy upon the detection of said information item in said information sequence, and wherein said security policy depends on the number of detected information items that belong to the same set.

2. A method according to claim 1 wherein each of said sets comprises information items associated with a single individual.

3. A method according to claim 1, wherein a type of said information item comprises one of a group of types comprising:

a word, a phrase, a number, a credit-card number, a social security number, a name, an address, an email address, and an account number.

4. A method according to claim 1, wherein said information sequence is provided over a digital traffic channel.

5. A method according to claim 4, wherein said digital traffic channel comprises one of a group of channels comprising:

email, instant messaging, peer-to-peer network, fax, and a local area network.

6. A method according to claim 1, wherein said information sequence comprises the body of an email, or wherein said information sequence comprises an email attachment.

7. A method according to claim 1, further comprising retrieving said information sequence from a digital storage medium.

8. A method for detecting an information item within an information sequence obtained from a digital medium, said information item comprising any one of a specified set of prestored information items, comprising:

transforming each of said set of prestored information items into a respective representation, in accordance with a predetermined transformation format;

transforming said information sequence obtained from said digital medium, in accordance with said transformation format;

determining the presence of one or more of said prestored information items within said transformed information sequence, utilizing said respective representation, wherein said information item comprises a sequence of sub-items, wherein said sub-items are separated by delimiters, the delimiters being resilient to reordering of the sub-items, wherein said transforming comprises;

applying a first hashing function to assign a respective preliminary hash value to each sub-item within said information item; and

applying a second hashing function to assigning a global hash value to said preliminary hash values of said sub-items,

wherein said information sequence comprises at least two sub-sequences, and wherein said determining comprises;

applying said first hashing function to assign a respective preliminary hash value to each of said sub-sequences;

applying said second hashing function to at least one of said preliminary hash values to assign a global hash value to at least one of said sub-sequences; and

comparing said global hash value to hash values of said sub-sequences, wherein said second hash function is invariant to reordering of at least two of said sub-sequences within a respective sub-item.

9. A method according to claim 8, wherein a sub-item comprises one of a group comprising:

a word, a number, and a character string.

10. A method according to claim 8, wherein said determining comprises using a state machine operable to detect said sequence of delimited sub-items within said information sequence.

11. A method according to claim 8, wherein said determining comprises:

applying said first hashing function to assign a respective preliminary hash value to each of said sub-sequences;

applying said second hashing function to at least one of said preliminary hash values to assign a global hash value to at least one of said sub-sequences; and

comparing said global hash value to hash values of said sub-sequences.

12. A method according to claim 11, wherein said sub-sequences comprise one of a group comprising:

a word, a number, and a character string.

13. A method according to claim 11, wherein said plurality of sub-sequences comprises a plurality of ordered combinations of sub-sequences within said data sequence.

14. A method according to claim 12, wherein said plurality of series comprises a plurality of combinations of sub-sequences within said data sequence.

15. A method according to claim 8, further comprising checking whether said delimited segment was previously stored, and continuing said detection process only if the current delimited segment was previously stored.

16. A method according to claim 8, wherein a type of said information item comprises one of a group of types comprising:

a word, a phrase, a number, a credit-card number, a social security number, a name, an address, an email address, and an account number.

17. A method according to claim 8, wherein said information sequence is provided over a digital traffic channel.

18. A method according to claim 17, wherein said digital traffic channel comprises one of a group of channels comprising:

email, instant messaging, peer-to-peer network, fax, and a local area network.

19. A method according to claim 8, wherein said information sequence comprises the body of an email, or wherein said information sequence comprises an email attachment.

20. A method according to claim 8, further comprising retrieving said information sequence from a digital storage medium.

21. A method for detecting an information item within an information sequence obtained from a digital medium, said information item comprising any one of a specified set of prestored information items, comprising:

transforming each of said set of prestored information items into a respective representation, in accordance with a predetermined transformation format;

transforming said information sequence obtained from said digital medium, in accordance with said transformation format;

determining the presence of one or more of said prestored information items within said transformed information sequence, utilizing said respective representation,

further comprising applying a policy upon the detection of said information item in said information sequence, wherein said policy is a security policy, said security policy comprises at least one of the following group of security policies;

blocking transmission, logging a record of said detection and detection details, and reporting said detection and detection details.

22. An apparatus for detecting an information item within an information sequence, said information item being any one of a specified set of data items, comprising:

a preprocessor, for transforming said information item into a representation, in accordance with a transformation format;

a scanner, for scanning said information sequence to identify sub-sequences; and

a comparator associated with said preprocessor and said scanner, for comparing said representation to said sub-sequences to determine the presence of said specified information item within said information sequence; and

a non-existence module comprising;

an encoder, for encoding said sub-sequences and said data item with an encoding function to respective integers, each of said integers being no greater than the size of said array; and

an array setter associated with said encoder, for setting indicators in an array of indicators in accordance with said encoded sub-sequences; and

a status checker associated with said encoder and said array setter, for determining the status of an indicator corresponding to said data item.

23. The apparatus of claim 22, wherein said array of indicators is associated with a respective encoding function for encoding a data item into an integer no greater than the size of said respective array.

24. The apparatus of claim 23, wherein each member of said list is encodable with said respective encoding function;

and wherein

a corresponding indicator is settable for each of said encoded members;

said specified data item is encodable with each of said encoding functions; and

the apparatus being configured to determine for each of said encoded data items, the status of the corresponding indicator in said array.

25. A method for determining the absence of a specified data item from a list of data items, comprising:

providing a plurality of initialized arrays of indicators, each of said arrays being associated with a respective encoding function for encoding a data item into an integer no greater than the size of said respective array;

for each of said arrays, performing;

encoding each member of said list with said respective encoding function; and

setting a corresponding indicator for each of said encoded members;

encoding said specified data item with each of said encoding functions; and

for each of said encoded data items, determining the status of the corresponding indicator in said respective array.

26. A method according to claim 25, wherein the size of each of said arrays is greater than the number of items in said list.

27. A method according to claim 25, wherein at least one of said encoding functions comprises a hashing function.

28. A method according to claim 25, wherein a data item comprises a string of alphanumeric characters.