Method and system to audit physical copy data leakage

• US 8,341,734 B1
• Filed: 06/27/2008
• Issued: 12/25/2012
• Est. Priority Date: 06/27/2008
• Status: Active Grant

• Current Assignee: CA, Inc. (d/b/a CA Technologies) (Broadcom, Inc.)
• Original Assignee: Symantec Corporation (NortonLifeLock Inc.)
• Inventors: Hernacki, Brian, Sobel, William E.
• Primary Examiner(s): Perungavoor, Venkat
• Application Number:
  US12/215,582
• Time in Patent Office: 1,642 Days
• Field of Search: None
• US Class Current: 726/21
• CPC Class Codes: G06F 16/24 Querying
• CPC Class Codes: G06F 21/556 involving covert channels, i.e. data leakage between processes inhibiting the analysis of circuitry or operation with measures against power attack G06F21/755
• CPC Class Codes: G06F 2221/2101 Auditing as a secondary aspect

Abstract

A document handling device receives a user request to perform a task on document data. The document data is associated with an electronic document to be converted by the document-handling device into a non-digital form (e.g., paper), or with a physical document received by the document-handling device in a non-digital form. The document handling device or a server determines whether the requested task violates a data loss prevention policy, and records, in an audit trail, information identifying the requested task and the digital data, and an indication of whether the requested task violates the data loss prevention policy.

Claims

1. A computer-implemented method comprising:

receiving, by a document handling device, a request to perform a task on document data, the document data being associated with one or more physical documents received by the document handling device in a non-digital form; and

in response to the document handling device receiving the request, performing the following;

converting, by the document handling device or a server computing device, the document data into text using optical image recognition (OCR);

determining, by the document handling device or the server computing device, whether the requested task violates a data loss prevention policy, the converted text being used when determining whether the requested task violates the data loss prevention policy; and

recording, in an audit trail, information identifying the requested task and the document data, and an indication of whether the requested task violates the data loss prevention policy.

2. The method of claim 1 wherein the document handling device is any one of a copy machine, a fax machine, a scan machine, and a printer.

3. The method of claim 1 further comprising:

sending the document data to a persistent queue of the document handling device upon receiving the request to perform the task on the document data.

4. The method of claim 1 further comprising:

examining the document data to find one or more characteristics of a use-restricted document, the one or more characteristics being used when determining whether the requested task violates a data loss prevention policy.

5. The method of claim 1 further comprising:

determining whether to allow the requested task to proceed depending on whether the requested task violates the data loss prevention policy.

6. The method of claim 1 further comprising:

allowing the requested task to proceed prior to determining whether the requested task violates the data loss prevention policy.

7. The method of claim 6 wherein:

the information identifying the requested task and the document data is recorded in the audit trail prior to determining whether the requested task violates a data loss prevention policy;

a determination as to whether the requested task violates the data loss prevention policy is performed based on the information recorded in the audit trail; and

the indication of whether the requested task violates the data loss prevention policy is recorded in the audit trail after determining whether the requested task violates the data loss prevention policy.

8. The method of claim 1 further comprises:

identifying a user requesting the task; and

recording an identifier of the user in the audit trail.

9. The method of claim 1 wherein a determination as to whether the requested task violates the data loss prevention policy is performed by the document handling device.

10. The method of claim 1 wherein a determination as to whether the requested task violates the data loss prevention policy is performed, at least in part, by the server computing device.

11. The method of claim 1 wherein the audit trail is maintained in the document handling device or in the server computing device.

12. The method of claim 1 wherein the data loss prevention policy requires at least one of the following evaluations concerning the requested task:

whether an underlying operation of the requested task is allowed to be performed;

whether a user is allowed to send the document data to a requested destination;

whether the document data is allowed to be produced in a requested form;

whether a requested recipient is allowed to receive the document data; and

whether a user is allowed to obtain a requested number of copies associated with the document data.

13. A document handling device comprising:

a memory to store instructions for a data loss prevention (DLP) system comprising a queue manager, an optical image recognition (OCR) module, a policy violation prevention agent and an audit trail;

a processing device, coupled to the memory, to execute the instructions;

the queue manager, executed by the processing device, to receive a request to perform a task on document data, the document data being associated with one or more physical documents received by the document handling device in a non-digital form;

the OCR module, executed by the processing device, to convert an image associated with the document data into text;

the policy violation prevention agent, executed by the processing device, to cause a determination to be made as to whether the requested task violates a data loss prevention policy, wherein the policy violation prevention agent is to use the converted text when determining whether the requested task violates the data loss prevention policy; and

the audit trail, maintained by the processing device, to store information identifying the requested task and the document data, and an indication of whether the requested task violates the data loss prevention policy.

14. The device of claim 13 further comprising:

a queue, maintained by the processing device, to store the document data and the requested task.

15. The device of claim 13 further comprising:

a document converter, executed by the processing device, to examine the document data for one or more characteristics of a use-restricted document.

16. A non-transitory computer readable storage medium that provides instructions, which when executed on a processing system of a document handling device cause the processing system to perform a method comprising:

receiving, by the processing system of the document handling device, a request to perform a task on document data, the document data being associated with one or more electronic documents to be converted by the document handling device into a non-digital form or with one or more physical documents received by the document handling device in a non-digital form;

determining whether the requested task violates a data loss prevention policy based on at least one of analysis by the processing system of the document handling device or information received from a server; and

recording, in an audit trail, information identifying the requested task and the document data, and an indication of whether the requested task violates the data loss prevention policy.

17. The non-transitory computer readable storage medium of claim 16 wherein the document handling device is any one of a copy machine, a fax machine, a scan machine, and a printer.

18. A non-transitory computer readable storage medium that provides instructions that, when executed on a processing system of a document handling device, cause the processing system to perform a method comprising:

receiving, by the processing system of the document handling device, a request to perform a task on document data, the document data being associated with one or more physical documents received by the document handling device in a non-digital form;

converting, by the processing system or by a server computing device, the document data into text using optical image recognition (OCR); and

determining, by the processing system or by the server computing device, whether the requested task violates a data loss prevention policy, the converted text being used when determining whether the requested task violates the data loss prevention policy.

19. The non-transitory computer readable storage medium of claim 18, the method further comprising:

recording, in an audit trail, information identifying the requested task and the document data, and an indication of whether the requested task violates the data loss prevention policy.

20. A system comprising:

a memory; and

a processor coupled with the memory to;

receive a request to perform a task on document data with a document handling device, the document data being associated with one or more electronic documents to be converted by the document handling device into a non-digital form or with one or more physical documents received by the document handling device in a non-digital form;

determine whether the requested task violates a data loss prevention policy, wherein a determination as to whether the requested task violates the data loss prevention policy is performed by at least one of the document handling device and a server; and

record, in an audit trail, information identifying the requested task and the document data, and an indication of whether the requested task violates the data loss prevention policy.

21. The device of claim 20, wherein the processor is further to examine the document data to find one or more characteristics of a use-restricted document, the one or more characteristics being used when determining whether the requested task violates a data loss prevention policy.