System, method, and computer program product for preventing image-related data loss

• US 8,199,965 B1
• Filed: 08/17/2007
• Issued: 06/12/2012
• Est. Priority Date: 08/17/2007
• Status: Active Grant

• Current Assignee: McAfee, LLC
• Original Assignee: McAfee, Inc. (McAfee, LLC)
• Inventors: Basavapatna, Prasanna Ganapathi, Chebiyyam, Gopi Krishna
• Primary Examiner(s): Park, Chan S
• Assistant Examiner(s): Bitar, Nancy
• Application Number:
  US11/840,831
• Time in Patent Office: 1,761 Days
• Field of Search: 382/166, 382/244, 705/3, 705/9, 370/230, 370/468, 726/1, 713/166
• US Class Current: 382/100
• CPC Class Codes: G06F 21/554 involving event detection and direct action
• CPC Class Codes: G06F 21/6209 to a single file or object, e.g. in a secure envelope, encrypted and accessed using a key, or with access control rules appended to the object itself
• CPC Class Codes: G06F 21/6245 Protecting personal data, e.g. for financial or medical purposes
• CPC Class Codes: G06F 2221/2101 Auditing as a secondary aspect
• CPC Class Codes: G06V 30/10 Character recognition
• CPC Class Codes: G06V 30/224 of printed characters having additional code marks or containing code marks
• CPC Class Codes: H04L 51/08 Annexed information, e.g. attachments
• CPC Class Codes: H04L 51/212 using filtering or selective blocking
• CPC Class Codes: H04L 63/0245 Filtering by information in the payload
• CPC Class Codes: H04L 63/04 for providing a confidential data exchange among entities communicating through data packet networks
• CPC Class Codes: H04L 67/06 specially adapted for file transfer, e.g. file transfer protocol [FTP]

Abstract

A system, method, and computer program product are provided for preventing data loss associated with an image. In use, an image is identified, and it is determined whether the image includes predetermined data. In addition, an action is performed based on the determination, for preventing data loss.

Claims

1. A method, comprising:

identifying an image that was provided as an attachment in an e-mail message;

performing an optical character recognition (OCR) procedure on textual data included in the image;

determining whether the image includes predetermined data by comparing a portion of the image to a portion of the predetermined data; and

performing an action based on the determination, wherein the action includes quarantining the image and preventing a subsequent e-mail message, which attaches the image, from propagating in a network based on identifying the portion of the image as being associated with confidential information.

2. The method of claim 1, wherein the image is identified in response to communication of the image over a network.

3. The method of claim 1, wherein the image is stored on a device.

4. The method of claim 1, wherein the image is identified during a system scan.

5. The method of claim 1, wherein the action includes preventing communication of a screenshot, if it is determined that the screenshot includes the predetermined data.

6. The method of claim 1, wherein the action includes at least one of:

notifying an administrator;

notifying a management team;

notifying a sender of the image; and

notifying a recipient of the image.

7. The method of claim 1, wherein the predetermined data includes textual data.

8. The method of claim 1, wherein the determining includes extracting textual data from the image.

9. The method of claim 1, wherein the determining includes fingerprinting textual data extracted from the image.

10. The method of claim 1, wherein the determining includes comparing data extracted from the image against the predetermined data.

11. The method of claim 1, wherein the image is determined to include the predetermined data, if data extracted from the image matches the predetermined data.

12. The method of claim 1, wherein the identifying, determining, and performing are performed at a gateway.

13. The method of claim 1, wherein the identifying, determining, and performing are performed at a mail server.

14. The method of claim 1, wherein the identifying, determining, and performing are performed at a web server.

15. The method of claim 1, wherein the identifying, determining, and performing are performed at a file transfer protocol server.

19. The method of claim 1, wherein the action includes allowing communication of the image, if it is determined that the image does not include the predetermined data.

20. The method of claim 1, wherein an analyzer is utilized for identifying the image.

16. A computer program product embodied on a non-transitory computer readable medium for performing operations, comprising:

identifying an image that was provided as an attachment in an e-mail message;

performing an optical character recognition (OCR) procedure on textual data included in the image;

determining whether the image includes predetermined data by comparing a portion of the image to a portion of the predetermined data; and

performing an action based on the determination, wherein the action includes quarantining the image and preventing a subsequent e-mail message, which attaches the image, from propagating in a network based on identifying the portion of the image as being associated with confidential information.

17. A system, comprising:

a processor, wherein the system is configured for;

identifying an image that was provided as an attachment in an e-mail message;

performing an optical character recognition (OCR) procedure on textual data included in the image;

determining whether the image includes predetermined data by comparing a portion of the image to a portion of the predetermined data; and

performing an action based on the determination, wherein the action includes quarantining the image and preventing a subsequent e-mail message, which attaches the image, from propagating in a network based on identifying the portion of the image as being associated with confidential information.

18. The system of claim 17, further comprising memory coupled to the processor via a bus.