DATA LEAK PROTECTION

• US 20140007246A1
• Filed: 06/28/2012
• Published: 01/02/2014
• Est. Priority Date: 06/28/2012
• Status: Active Grant

• Current Assignee: Fortinet Inc.
• Original Assignee: Fortinet Inc.
• Inventors: Xie, Michael, Nelson, Michael D.
• Granted Patent: US 9,319,417 B2
• Time in Patent Office: Days
• US Class Current: 726/26
• CPC Class Codes: G06F 16/9535 Search customisation based on user profiles and personalisation
• CPC Class Codes: G06F 21/16 Program or content traceability, e.g. by watermarking
• CPC Class Codes: H04L 2209/608 Watermarking
• CPC Class Codes: H04L 63/0236 Filtering by address, protocol, port number or service, e.g. IP-address or URL
• CPC Class Codes: H04L 63/0245 Filtering by information in the payload
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/0876 based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint
• CPC Class Codes: H04L 63/105 Multiple levels of security
• CPC Class Codes: H04L 63/12 Applying verification of the received information cryptographic mechanisms or cryptographic arrangements for data integrity or data verification H04L9/32
• CPC Class Codes: H04L 63/123 received data contents, e.g. message integrity
• CPC Class Codes: H04L 9/0643 Hash functions, e.g. MD5, SHA, HMAC or f9 MAC

Abstract

Methods and systems for Data Leak Prevention (DLP) in an enterprise network are provided. According to one embodiment a data leak protection method is provided. A network device receives information regarding a watermark filtering rule, including a sensitivity level and an action to be applied to files observed by the network device matching the watermark filtering rule. The network device scans a file attempted to be passed through the network device by locating a watermark embedded within the file and comparing a sensitivity level associated with the watermark to the sensitivity level of the watermark filtering rule. If the sensitivity levels match, then the network device performs the action specified by the watermark filtering rule.

Claims

1. A data leak protection method comprising:

receiving, by a network device, information regarding a watermark filtering rule, including a sensitivity level and an action to be applied to files observed by the network device matching the watermark filtering rule;

scanning, by the network device, a file attempted to be passed through the network device, by locating a watermark embedded within the file and comparing a sensitivity level associated with the watermark to the sensitivity level of the watermark filtering rule; and

if the comparing results in a match, then performing, by the network device, the action specified by the watermark filtering rule.

2. The method of claim 1, wherein the information regarding the watermark filtering rule includes a company identifier.

3. The method of claim 1, further comprising, prior to said scanning, a separate client program, embedding the watermark into the file responsive to the file being identified as a file to be protected.

4. The method of claim 3, further comprising receiving, by the separate client program, watermark content, including information regarding a sensitivity level of the file and a company identifier.

5. The method of claim 4, further comprising:

identifying, by the separate client program, a file type of the file; and

wherein said embedding the watermark into the file is based upon the file type.

6. The method of claim 4, further comprising generating, by the separate client program, the watermark based on the watermark content.

7. The method of claim 6, wherein the watermark comprises a hash value or a message digest of the watermark content.

8. The method of claim 6, wherein the watermark comprises a plain text representation of the watermark content.

9. The method of claim 1, wherein the sensitivity level is selected from a group comprising critical sensitivity, high sensitivity, medium sensitivity, and low sensitivity.

10. The method of claim 1, wherein the network device comprises a gateway.

11. The method of claim 5, wherein the file type is one of a text document, a Portable Document Format (PDF) document, a Microsoft Windows Office document, an open office document, and a Macintosh OS document.

12. The method of claim 1, wherein the action specified by the watermark filtering rule comprises blocking the file at the network device.

13. The method of claim 1, wherein the action specified by the watermark filtering rule comprises passing the file through the network device.

14. The method of claim 1, wherein the file is attached to an electronic mail (email) message or is being transferred via a file transfer protocol from a source device to a destination device.

15. The method of claim 14, wherein the action specified by the watermark filtering rule comprises logging information regarding one or more of a user associated with the source device, an Internet Protocol (IP) address associated with the source device, a time, a date and an interface of the network device on which the file was received.

16. A non-transitory program storage device readable by a network device, tangibly embodying a program of instructions executable by one or more computer processors of the network device to perform a method of data leak protection, the method comprising:

receiving information regarding a watermark filtering rule, including a sensitivity level and an action to be applied to files observed by the network device matching the watermark filtering rule;

scanning a file attempted to be passed through the network device, by locating a watermark embedded within the file and comparing a sensitivity level associated with the watermark to the sensitivity level of the watermark filtering rule; and

if the comparing results in a match, then performing, by the network device, the action specified by the watermark filtering rule.

17. The program storage device of claim 16, wherein the information regarding the watermark filtering rule includes a company identifier.

18. The program storage device of claim 16, wherein prior to said scanning, a separate client program, embeds the watermark into the file responsive to the file being identified as a file to be protected.

19. The program storage device of claim 18, wherein the separate client program, receives watermark content, including information regarding a sensitivity level of the file and a company identifier.

20. The program storage device of claim 19, wherein the separate client program:

identifies a file type of the file; and

embeds the watermark into the file is based upon the file type.

21. The program storage device of claim 19, wherein the separate client program generates the watermark based on the watermark content.

22. The program storage device of claim 21, wherein the watermark comprises a hash value or a message digest of the watermark content.

23. The program storage device of claim 21, wherein the watermark comprises a plain text representation of the watermark content.

24. The program storage device of claim 16, wherein the sensitivity level is selected from a group comprising critical sensitivity, high sensitivity, medium sensitivity, and low sensitivity.

25. The program storage device of claim 16, wherein the network device comprises a gateway.

26. The program storage device of claim 20, wherein the file type is one of a text document, a Portable Document Format (PDF) document, a Microsoft Windows Office document, an open office document, and a Macintosh OS document.

27. The program storage device of claim 16, wherein the action specified by the watermark filtering rule comprises blocking the file at the network device.

28. The program storage device of claim 16, wherein the action specified by the watermark filtering rule comprises passing the file through the network device.

29. The program storage device of claim 16, wherein the file is attached to an electronic mail (email) message or is being transferred via a file transfer protocol from a source device to a destination device.

30. The program storage device of claim 29, wherein the action specified by the watermark filtering rule comprises logging information regarding one or more of a user associated with the source device, an Internet Protocol (IP) address associated with the source device, a time, a date and an interface of the network device on which the file was received.