APPARATUS, SYSTEMS, AND METHODS FOR MANAGING DATA SECURITY

• US 20150074744A1
• Filed: 09/11/2013
• Published: 03/12/2015
• Est. Priority Date: 09/11/2013
• Status: Active Grant

• Current Assignee: Ivanti, Inc. (Ivanti Software, Inc.)
• Original Assignee: Appsense Incorporated
• Inventors: MCLEAN, Ian James, DELIVETT, Paul
• Granted Patent: US 9,215,251 B2
• Time in Patent Office: Days
• US Class Current: 726/1
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04W 12/033 of the user plane, e.g. user's traffic
• CPC Class Codes: H04W 12/068 using credential vaults, e.g. password manager applications or one time password [OTP] applications
• CPC Class Codes: H04W 12/126 Anti-theft arrangements, e.g. protection against subscriber identity module [SIM] cloning

Abstract

Disclosed embodiments of a data protection mechanism can provide secure data management. In particular, the disclosed embodiments provide secure data management mechanisms that can control transfer of data items so that contents of protected data items are not accessible to non-authorized parties. For example, the disclosed system can prevent an application from storing a protected file using a new file name. As another example, the disclosed system can prevent an application from sending a protected file to another computing device over a communication network.

Claims

1. An apparatus comprising:

non-transitory memory configured to store computer readable instructions of a module and a security status table, wherein the security status table comprises at least one identifier of protected data items that are subject to a security policy;

a processor in communication with the memory, configured to run the module stored in the memory, wherein the module is configured to;

detect a transfer of a first data item to a destination device, wherein the transfer of the first data item is initiated by an application running on the apparatus;

determine a first identifier of the first data item;

determine that the security status table comprises the first identifier of the first data item, indicating that the first data item is a protected data item; and

cause the security policy to be applied to the first data item to prevent non-authorized access to the first data item.

2. The apparatus of claim 1, wherein the module is configured to operate a hash function on at least a portion of the first data item to determine the identifier of the first data item.

3. The apparatus of claim 2, wherein the hash function is a message digest function.

4. The apparatus of claim 1, wherein the module is configured to:

receive a second data item from cloud storage over a communication network, wherein the second data item is a protected data item;

determine a second identifier of the second data item; and

store the second identifier of the second data item in the security status table.

5. The apparatus of claim 1, wherein the module is configured to prevent the transfer of the first data item to apply the security policy.

6. The apparatus of claim 1, wherein the destination device comprises a local storage medium of the apparatus, and wherein the transfer of the first data item is initiated as a part of a storage operation of the first data item.

7. The apparatus of claim 1, wherein the destination device comprises a computing device in communication with the apparatus over a communication network.

8. The apparatus of claim 1, wherein the module is configured to:

detect a transfer of a second data item to the destination device;

determine that a size of the second data item is smaller than a predetermined size of data needed to determine an identifier of a data item;

detect a transfer of a third data item to the destination device;

merge the second data item and the third data item to form a fourth data item;

determine a second identifier of the fourth data item;

determine that the security status table comprises the second identifier, indicating that the second data item and the third data item are protected data items; and

cause the security policy to be applied to the second data item and the third data item to prevent non-authorized access to the second data item and the third data item.

9. The apparatus of claim 1, wherein the module is configured to:

retrieve the first data item from the destination device of the transfer; and

cause the destination device to restore to a state prior to receiving the first data item.

10. The apparatus of claim 9, wherein the module is configured to cause the destination device to restore data over which the first data item was stored.

14. The method of claim 10, further comprising:

receiving, at the computing device, a second data item from cloud storage over a communication network, wherein the second data item is a protected data item;

determining, at the computing device, a second identifier of the second data item; and

storing, by the computing device, the second identifier of the second data item in the security status table.

15. The method of claim 10, wherein applying the security policy comprises preventing the transfer of the first data item to the destination device.

16. The method of claim 10, further comprising:

detecting, at the computing device, a transfer of a second data item to the destination device;

determining, at the computing device, that a size of the second data item is smaller than a predetermined size of data needed to determine an identifier of a data item;

detecting, at the computing device, a transfer of a third data item to the destination device;

merging, at the computing device, the second data item and the third data item to form a fourth data item;

determining, at the computing device, a second identifier of the fourth data item;

determining, at the computing device, that the security status table comprises the second identifier, indicating that the second data item and the third data item are protected data items; and

causing, by the computing device, the security policy to be applied to the second data item and the third data item to prevent non-authorized access to the second data item and the third data item.

11. A method comprising:

maintaining, at a computing device, a security status table, wherein the security status table comprises at least one identifier of protected data items that are subject to a security policy;

detecting, at the computing device, a transfer of a first data item to a destination device, wherein the transfer of the first data item is initiated by an application running on the computing device;

determining, at the computing device, a first identifier of the first data item;

determining, at the computing device, that the security status table comprises the first identifier of the first data item, indicating that the first data item is a protected data item; and

causing, by the computing device, the security policy to be applied to the first data item to prevent non-authorized access to the first data item.

12. The method of claim 11, wherein determining the first identifier of the first data item comprises operating a hash function on at least a portion of the first data item.

13. The method of claim 12, wherein the hash function is a message digest function.

17. A non-transitory computer readable medium having executable instructions operable to cause a computing device to:

maintain a security status table that comprises at least one identifier of protected data items that are subject to a security policy;

detect a transfer of a first data item to a destination device, wherein the transfer of the first data item is initiated by an application running on the computing device;

determine a first identifier of the first data item;

determine that the security status table comprises the first identifier of the first data item, indicating that the first data item is a protected data item; and

cause the security policy to be applied to the first data item to prevent non-authorized access to the first data item.

18. The non-transitory computer readable medium of claim 17, further comprising executable instructions operable to cause the computing device to operate a hash function on at least a portion of the first data item to determine the first identifier of the first data item.

19. The non-transitory computer readable medium of claim 17, further comprising executable instructions operable to cause the computing device to:

receive a second data item from cloud storage over a communication network, wherein the second data item is a protected data item;

determine a second identifier of the second data item; and

store the second identifier of the second data item in the security status table.

20. The non-transitory computer readable medium of claim 17, further comprising executable instructions operable to cause the computing device to:

retrieve the first data item from the destination device of the transfer; and

cause the destination device to restore to a state prior to receiving the first data item.