DATA LEAKAGE PROTECTION IN CLOUD APPLICATIONS

• US 20120222110A1
• Filed: 02/23/2012
• Published: 08/30/2012
• Est. Priority Date: 02/28/2011
• Status: Active Grant

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: HUANG, HE YUAN, LIU, XIAO XI, HU, QI, ZHANG, GUAN QUN
• Granted Patent: US 9,705,759 B2
• Time in Patent Office: Days
• US Class Current: 726/22
• CPC Class Codes: H04L 43/028 by filtering
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00
• CPC Class Codes: H04W 4/60 Subscription-based services using application servers or record carriers, e.g. SIM application toolkits

Abstract

A computer-implemented method for data leakage protection is disclosed. A monitoring template corresponding to the cloud application is selected based upon communication between a user and a cloud application and from a plurality of monitoring templates. A monitor is generated using the selected monitoring template. Identifying information of content shared between the user and the cloud application is obtained using the generated monitor. Data about the shared content for security analysis is obtained according to the identifying information of the shared content.

Claims

1. A computer-implemented method for data leakage protection, comprising:

selecting, based upon communication between a user and a cloud application and from a plurality of monitoring templates, a monitoring template corresponding to the cloud application;

generating, using the selected monitoring template, a monitor;

obtaining, using the generated monitor, identifying information of content shared between the user and the cloud application; and

obtaining, according to the identifying information of the shared content, data about the shared content for security analysis.

2. The method of claim 1, wherein the monitor is configured to obtain information pertaining to a receiver of the content.

3. The method of claim 1, further comprising:

providing, according to the security analysis, interactive options, wherein

the interactive options include at least one of

encrypting the sharing file,

adding a watermark, and

canceling an operation.

4. The method of claim 1, further comprising:

intercepting the communication between the user and the cloud application to obtain identifying information of the cloud application; and

comparing the obtained identifying information of the cloud application with identifying information contained each of the plurality of monitoring templates.

5. The method of claim 4, wherein the intercepting includes obtaining session information about the user and the cloud application.

6. The method of claim 1, wherein

the method is performed within a proxy server.

7. The method of claim 6, wherein

the shared content is stored locally to the cloud application.

8. The method of claim 7, wherein

the monitor obtains a link address of the shared content.

9. The method of claim 6, wherein

the shared content is stored within the proxy server.

10. A computer-hardware system for data leakage protection, comprising:

a processor, wherein the processor is configured to initiate and/or perform;

selecting, based upon communication between a user and a cloud application and from a plurality of monitoring templates, a monitoring template corresponding to the cloud application;

generating, using the selected monitoring template, a monitor;

obtaining, using the generated monitor, identifying information of content shared between the user and the cloud application; and

obtaining, according to the identifying information of the shared content, data about the shared content for security analysis.

11. The system of claim 10, wherein

the monitor is configured to obtain information pertaining to a receiver of the content.

12. The system of claim 10, wherein the processor is further configured to initiate and/or perform:

providing, according to the security analysis, interactive options, wherein

the interactive options include at least one of

encrypting the sharing file,

adding a watermark, and

canceling an operation.

13. The system of claim 10, wherein the processor is further configured to initiate and/or perform:

intercepting the communication between the user and the cloud application to obtain identifying information of the cloud application; and

comparing the obtained identifying information of the cloud application with identifying information contained each of the plurality of monitoring templates.

14. The system of claim 13, wherein

the intercepting includes obtaining session information about the user and the cloud application.

15. The system of claim 10, wherein

the computer-hardware system is a proxy server.

16. The system of claim 15, wherein

the shared content is stored locally to the cloud application.

17. The system of claim 16, wherein

the monitor obtains a link address of the shared content.

18. The system of claim 15, wherein

the shared content is stored within the proxy server.

19. A computer program product comprising a computer usable storage medium having stored therein computer usable program code for data leakage protection, the computer usable program code, which when executed by a computer hardware system, causes the computer hardware system to perform:

selecting, based upon communication between a user and a cloud application and from a plurality of monitoring templates, a monitoring template corresponding to the cloud application;

generating, using the selected monitoring template, a monitor;

obtaining, using the generated monitor, identifying information of content shared between the user and the cloud application; and

obtaining, according to the identifying information of the shared content, data about the shared content for security analysis.

20. The computer program product of claim 19, wherein

the monitor is configured to obtain information pertaining to a receiver of the content.