PERSONAL COMPUTING DEVICE-BASED MECHANISM TO DETECT PRESELECTED DATA

• US 20120016884A1
• Filed: 09/27/2011
• Published: 01/19/2012
• Est. Priority Date: 05/06/2003
• Status: Active Grant

• Current Assignee: CA, Inc. (d/b/a CA Technologies) (Broadcom, Inc.)
• Original Assignee: Symantec Corporation (NortonLifeLock Inc.)
• Inventors: Rowney, Kevin T., Wolfe, Michael R., Gopalakrishnan, Mythili, Fridman, Vitall A.
• Granted Patent: US 8,751,506 B2
• Time in Patent Office: Days
• US Class Current: 707/747
• CPC Class Codes: G06F 16/24568 Data stream processing; Continuous queries
• CPC Class Codes: G06F 21/554 involving event detection and direct action
• CPC Class Codes: G06Q 10/107 Computer-aided management of electronic mailing [e-mailing]

Abstract

A method and apparatus for detecting pre-selected data stored on a personal computing device is described. In one embodiment, contents of data storage media of a personal computing device are searched for pre-selected sensitive data. In one embodiment, if at least a portion of the pre-selected sensitive data is detected, a notification of the detection of the pre-selected data is sent to a system via a network. In another embodiment, if at least a portion of pre-selected sensitive data is detected, the access to this data is blocked.

Claims

1. A method comprising:

identifying, by a client device, an index derived from preselected data having a tabular structure, wherein the index defines the tabular structure of the preselected data and comprises positional information identifying relative placement of data elements of the preselected data in relation to other data elements of the preselected data, and wherein the index does not reveal sensitive data elements of the preselected data;

determining, by the client device, whether at least a portion of the preselected data having the tabular structure is possibly contained within information content; and

in response to determining that a portion of the preselected data is possibly contained within the information content, performing, by the client device, a search of the information content for at least a portion of the preselected data using the index derived from the preselected data.

2. The method of claim 1, wherein entries in the index comprise a pre-generated hash or encryption of a cell in the preselected data and a row number of the cell, and wherein performing the search of the information content comprises searching the index to identify entries in the index that include pre-generated hashes or encryptions of the preselected data that correspond to hashes or encryptions of content fragments from the information content.

3. The method of claim 2, further comprising:

determining groups of content fragments, wherein each group comprises content fragments associated with hashes or encryptions that correspond to pre-generated hashes or encryptions of entries in the abstract data structure having a same row number; and

determining that the received information content contains at least a portion of the preselected data if any group satisfies at least one criterion.

4. The method of claim 3, wherein the at least one criterion comprises a quantity threshold that is satisfied if any group includes a quantity of content fragments that meets or exceeds the quantity threshold.

5. The method of claim 3, wherein each entry in the index further comprises a column number of the cell, and wherein the at least one criterion comprises a threshold that is satisfied if any group includes content fragments from a number of different columns that meets or exceeds the threshold.

6. The method of claim 3, wherein determining the groups of content fragments comprises:

parsing individual lines of text in the information content into the content fragments, wherein each content fragment is one of a word or a phrase; and

for each individual line of text, performing the following;

generating hashes of each of the content fragments in the line;

comparing the hashes of the content fragments in the line to the pre-generated hashes to identify matching entries of the index; and

arranging the content fragments in the line into the groups based on row numbers associated with the matching entries.

7. The method of claim 1, wherein the preselected data is maintained in at least one of a spreadsheet, a flat file or a database, the method further comprising:

determining that a portion of the information content matches a portion of the preselected data; and

sending, to a server, a notification of the detection of the portion of the preselected data in the information content.

8. The method of claim 1, wherein determining that a portion of the preselected data is possibly contained within the information content comprises:

searching a body of the information content for an expression having a predefined format using a search rule that defines the predefined format, wherein the expression having the predefined format is any one of an account number, a social security number, a credit card number, a phone number, a postal code, an email address, a currency amount, or a driver'"'"'s license number; and

determining that a region surrounding the expression may contain a portion of the embedded pre-selected data, wherein the region surrounding the expression comprises a quantity of contiguous data fragments before the expression and a quantity of contiguous data fragments after the expression.

9. The method of claim 1, wherein the information content is a document stored on a storage medium of the client device.

10. The method of claim 1, wherein the index contains copies of at least some common strings and numbers from the preselected data.

11. The method of claim 1, wherein determining that a portion of the preselected data is possibly contained within the information content comprises determining that the information content includes a sequence of content fragments that resembles column-formatted data.

12. The method of claim 1, wherein determining that a portion of the preselected data is possibly contained within the information content comprises determining that a word distribution in the information content resembles a statistical pattern that indicates a possible containment of the preselected data.

13. A computer readable storage medium including instructions that, when executed by a processing device, cause the processing device to perform a method comprising:

identifying, by the processing device, an index derived from preselected data having a tabular structure, wherein the index defines the tabular structure of the preselected data and comprises positional information identifying relative placement of data elements of the preselected data in relation to other data elements of the preselected data, and wherein the index does not reveal sensitive data elements of the preselected data;

determining, by the processing device, whether at least a portion of the preselected data having the tabular structure is possibly contained within information content; and

in response to determining that a portion of the preselected data is possibly contained within the information content, performing, by the processing device, a search of the information content for at least a portion of the preselected data using the index derived from the preselected data.

14. The computer readable storage medium of claim 13, wherein entries in the index comprise a pre-generated hash or encryption of a cell in the preselected data and a row number of the cell, and wherein performing the search of the information content comprises searching the index to identify entries in the index that include pre-generated hashes or encryptions of the preselected data that correspond to hashes or encryptions of content fragments from the information content.

15. The computer readable storage medium of claim 14, the method further comprising:

determining groups of content fragments, wherein each group comprises content fragments associated with hashes or encryptions that correspond to pre-generated hashes or encryptions of entries in the abstract data structure having a same row number; and

determining that the received information content contains at least a portion of the preselected data if any group satisfies at least one criterion.

16. The computer readable storage medium of claim 15, wherein the at least one criterion comprises a quantity threshold that is satisfied if any group includes a quantity of content fragments that meets or exceeds the quantity threshold.

17. The computer readable storage medium of claim 15, wherein each entry in the index further comprises a column number of the cell, and wherein the at least one criterion comprises a threshold that is satisfied if any group includes content fragments from a number of different columns that meets or exceeds the threshold.

18. The computer readable storage medium of claim 15, wherein determining the groups of content fragments comprises:

parsing individual lines of text in the information content into the content fragments, wherein each content fragment is one of a word or a phrase; and

for each individual line of text, performing the following;

generating hashes of each of the content fragments in the line;

comparing the hashes of the content fragments in the line to the pre-generated hashes to identify matching entries of the index; and

arranging the content fragments in the line into the groups based on row numbers associated with the matching entries.

19. The computer readable storage medium of claim 13, wherein determining that a portion of the preselected data is possibly contained within the information content comprises determining that the information content includes a sequence of content fragments that resembles column-formatted data.

20. A computing device comprising:

a memory to store instructions for protecting preselected data having a tabular structure; and

a processor, coupled to the memory, to execute the instructions, wherein the processor is configured by the instructions to;

identify an index derived from preselected data having a tabular structure, wherein the index defines the tabular structure of the preselected data and comprises positional information identifying relative placement of data elements of the preselected data in relation to other data elements of the preselected data, and wherein the index does not reveal sensitive data elements of the preselected data;

determine whether at least a portion of the preselected data having the tabular structure is possibly contained within information content; and

in response to determining that a portion of the preselected data is possibly contained within the information content, perform a search of the information content for at least a portion of the preselected data using the index derived from the preselected data.