Decrypting Files for Data Leakage Protection in an Enterprise Network

• US 20140344573A1
• Filed: 07/21/2014
• Published: 11/20/2014
• Est. Priority Date: 12/28/2012
• Status: Active Grant

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Tsai, Ya Hsuan, Yu, Ying-Hung, Hariharan, Mahadevan
• Granted Patent: US 9,727,739 B2
• Time in Patent Office: Days
• US Class Current: 713/165
• CPC Class Codes: G06F 11/1458 Management of the backup or restore process
• CPC Class Codes: G06F 16/137 Hash-based content-based indexing of textual data G06F16/31
• CPC Class Codes: G06F 16/162 Delete operations erasing in storage systems G06F3/0652
• CPC Class Codes: G06F 16/1756 based on delta files
• CPC Class Codes: G06F 16/182 Distributed file systems
• CPC Class Codes: G06F 16/1873 Versioning file systems, temporal file systems, e.g. file system supporting different historic versions of files
• CPC Class Codes: G06F 16/20 of structured data, e.g. relational data
• CPC Class Codes: G06F 21/10 Protecting distributed programs or content, e.g. vending or licensing of copyrighted material protection in video systems or pay television H04N7/16 ; Digital rights management [DRM]
• CPC Class Codes: G06F 21/50 Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
• CPC Class Codes: G06F 21/60 Protecting data
• CPC Class Codes: G06F 21/606 by securing the transmission between two devices or processes
• CPC Class Codes: H04L 63/0227 Filtering policies mail message filtering H04L51/212
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00

Abstract

Techniques are provided for decrypting an encrypted file within an enterprise network. The techniques include identifying by a password collecting module a password entered during a the encryption procedure performed at a terminal and storing the password: receiving an encrypted file by a data leakage protection (DLP) module; and attempting to decrypt the encrypted file with the password by the DLP module.

Claims

1. A method, comprising;

monitoring an application executed at a terminal;

monitoring a procedure performed with a predetermined application executed at the terminal; and

identifying a password entered by users for a file encryption procedure performed with the predetermined application.

2. The method of claim 1, wherein the identifying further comprises identifying meta data of the password.

3. The method of claim 1, further comprising:

receiving an encrypted file from the terminal; and

decrypting the encrypted file with the password.

4. The method of claim 3, wherein the decrypting is performed in a real-time manner.

5. The method of claim 3, wherein the receiving an encrypted file further comprises identifying meta data of the encrypted file, wherein the decrypting further comprises selecting the password by determining that meta data of the encrypted file matches at leas a portion of meta data of the password.

6. The method of claim 3, wherein the decrypting comprises decrypting the encrypted file with multiple passwords obtained by executing the method of claim 1 two or more times.

7. The method of claim 6, wherein the receiving an encrypted file further comprises identifying meta data of the encrypted file, wherein the decrypting further comprises determining priority given to attempting to decrypt with each password according to meta data of the multiple passwords obtained by executing the method of claim 2 several times.

8. The method of claim 6, wherein the receiving an encrypted file further comprises identifying meta data of the encrypted file, wherein the decrypting further comprises determining a degree of match between meta data of the encrypted file and meta data of the multiple passwords obtained by executing the method of claim 2 several times, so as to determine priority given to a decryption performed with each password.