Method and apparatus for detecting leakage of sensitive information

• US 8,127,360 B1
• Filed: 06/29/2006
• Issued: 02/28/2012
• Est. Priority Date: 06/29/2006
• Status: Active Grant

• Current Assignee: CA, Inc. (d/b/a CA Technologies) (Broadcom, Inc.)
• Original Assignee: Symantec Corporation (NortonLifeLock Inc.)
• Inventors: Wilhelm, Jeffrey, Nachenberg, Carey
• Primary Examiner(s): ARMOUCHE, HADI S
• Application Number:
  US11/477,231
• Time in Patent Office: 2,070 Days
• Field of Search: 726/11, 726/25, 726/22, 713/156, 713/172, 713/191, 713/194
• US Class Current: 726/25
• CPC Class Codes: G06F 21/552 involving long-term monitoring or reporting

Abstract

A method and apparatus for preventing leakage of sensitive information from a computer is described. The method includes identifying data entered into the computer system as sensitive data, tainting the sensitive data with at least one taint bit to form a tainted data, tracking the tainted data within the computer system and identifying at least one condition that compromises the security of the tainted data. The system is a computer system including taint analysis software for identifying data entered into the computer system as sensitive data, tainting the sensitive data with at least one taint bit to form a tainted data, tracking the tainted data within the computer system and identifying at least one condition that compromises the security of the tainted data.

Claims

1. A method for detecting leakage of sensitive information from a computer system comprising:

identifying data entered into the computer system as sensitive data;

tracking access to the sensitive data within the computer system, in the event the access is associated with a system egress point;

identifying, in response to access associated with the system egress point, at least one condition that compromises the security of the sensitive data, wherein the at least one condition comprises access by an unauthorized process to sensitive data; and

taking an appropriate action to protect the sensitive data in view of the at least one condition, wherein the appropriate action comprises at least one of terminating the application obfuscating the sensitive data, terminating the application that did not have focus of the sensitive data at time of input into the computer system that is processing the sensitive data, terminating the application with a non-visible window that is processing the sensitive data, terminating the hidden process that is processing the sensitive data, or blocking at least one communication port of the computer system.

2. The method of claim 1 wherein the tracking step further comprises tainting the sensitive data to facilitate tracking.

3. The method of claim 2 wherein said tainting step further comprises storing at least one taint bit in a shadow memory to identify the sensitive data as tainted data.

4. The method of claim 1 wherein the at least one condition that compromises the security of the tainted data comprises:

access by an unauthorized application that attempts to transmit any subset of the sensitive data out of the computer system, obfuscation of the sensitive data by an application, an application that did not have focus of the sensitive data at time of input into the computer system is processing the sensitive data; and

a hidden process is processing the sensitive data.

5. The method of claim 1 wherein sensitive information comprises at least one of a user name, a password, an account name, an account number, a checking account number, a savings account number, a credit card number, automatic teller machine (ATM) card information, a bank account number, a routing number, a personal identification number (PIN), a social security number, or any information entered into a secure socket website.

6. The method of claim 3 wherein the at least one taint bit associates the tainted data with at least one application software.

7. The method of claim 3 wherein the at least one taint bit associates the tainted data with at least one application software that had focus at time of data entry into the computer system.

8. The method of claim 3 wherein the at least one taint bit indicates a type of data.

9. The method of claim 1 wherein the step of identifying further comprises at least one of matching a character string to another character string of known sensitive data, or matching the entered data to a pattern of sensitive data.

20. The method of claim 1, wherein the at least one condition that compromises the security of the tainted data comprises an application with a nonvisible window is processing the sensitive data.

21. The method of claim 1, wherein identifying further comprises matching a URL address to a known URL address for receiving sensitive data.

10. A non-transitory computer-readable medium having stored thereon a plurality of instructions, the plurality of instructions including instructions which, when executed by a processor, cause the processor to perform a method comprising:

identifying data entered into the computer system as sensitive data;

tracking access to the sensitive data within the computer system, in the event the access is associated with a system egress point; and

identifying, in response to access associated with the system egress point, at least one condition that compromises the security of the sensitive data, wherein the at least one condition comprises access by an unauthorized process to sensitive data; and

taking an appropriate action to protect the sensitive data in view of the at least one condition, wherein the appropriate action comprises at least one of terminating the application obfuscating the sensitive data, terminating the application that did not have focus of the sensitive data at time of input into the computer system that is processing the sensitive data, terminating the application with a non-visible window that is processing the sensitive data, terminating the hidden process that is processing the sensitive data, or blocking at least one communication port of the computer system.

11. The non-transitory computer-readable medium of claim 10 wherein the method performed by the processor further comprises tainting the sensitive data to facilitate tracking.

12. The non-transitory computer-readable medium of claim 11 wherein the method performed by the processor further comprises storing at least one taint bit in a shadow memory to identify the sensitive data as tainted data.

13. The non-transitory computer-readable medium of claim 10 wherein the method performed by the processor further comprises identifying performed by the processes further comprises matching a character string to another character string of known sensitive data, matching a URL address to a known URL address for receiving sensitive data and matching the entered data to a pattern of sensitive data.

14. A system for preventing leakage of sensitive information from a computer system comprising:

a processor;

a memory storing taint analysis software; and

the taint analysis software configured to;

identify data entered into the computer system as sensitive data;

track access to the sensitive data within the computer system, in the event the access is associated with a system egress point;

identify, in response to access associated with the system egress point, at least one condition that compromises the security of the sensitive data, wherein the at least one condition comprises access by an unauthorized process to sensitive data; and

perform an appropriate action to protect the sensitive data in view of the at least one condition, wherein the appropriate action comprises at least one of;

terminating the application obfuscating the sensitive data, terminating the application that did not have focus of the sensitive data at time of input into the computer system that is processing the sensitive data, terminating the application with a non-visible window that is processing the sensitive data, terminating the hidden process that is processing the sensitive data, or blocking at least one communication port of the computer system.

15. The system of claim 14 wherein the taint analysis software taints the sensitive data to form tainted data and to facilitate tracking.

16. The system of claim 14 further comprising a taint processor for tainting the sensitive data in response to a request from the taint analysis software.

17. The system of claim 16 wherein the taint processor provides a taint status in response to a second request from the taint analysis software.

18. The system of claim 17 wherein the taint processor manages a shadow memory within the memory to store the at least one taint bit.

19. The system of claim 17, wherein identifying data entered into the computer system as sensitive data comprises determining that the entered data matches a pattern of sensitive financial data.