Data management utilizing access and content information

• US 8,601,592 B2
• Filed: 05/03/2010
• Issued: 12/03/2013
• Est. Priority Date: 09/09/2009
• Status: Active Grant

• Current Assignee: Varonis Systems, Inc.
• Original Assignee: Varonis Systems, Inc.
• Inventors: Faitelson, Yakov, Korkus, Ohad, Kretzer-Katzir, Ophir, Bass, David
• Primary Examiner(s): Song, Hosuk
• Application Number:
  US12/772,450
• Publication Number:
  US 20110060916A1
• Time in Patent Office: 1,310 Days
• Field of Search: 713189-193, 707/661, 707/E17.05, 707/783, 707/665, 707/659, 707/705, 707/708, 707790-791, 707/821, 726 26- 30
• US Class Current: 726/26
• CPC Class Codes: G06F 16/13 File access structures, e.g. distributed indices arrangements of input from, or output to, record carriers G06F3/06
• CPC Class Codes: G06F 16/245 Query processing
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: G06F 2221/2101 Auditing as a secondary aspect
• CPC Class Codes: G06F 2221/2141 Access rights, e.g. capability lists, access control lists, access tables, access matrices
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources

Abstract

A system for operating an enterprise computer network including multiple disparate clients, data elements and computer resources, the system including monitoring and collection functionality for providing continuously updated metadata relating to at least one of actual access, access permissions and content of the data elements and operating functionality utilizing the continuously updated metadata provided by the monitoring and collection functionality for functions other than reporting the at least one of actual access, access permissions and content or recommending changes in the access permissions.

Claims

1. A system for operating an enterprise computer network including multiple disparate clients, data elements and computer resources, said system comprising:

a processor having the following functionalities;

monitoring and collection functionality for providing and storing continuously updated metadata relating to at least one of actual access, access permissions and content of all of said data elements; and

classifying functionality operable, responsive to said storing, for utilizing said stored continuously updated metadata provided by said monitoring and collection functionality to classify at least a subset of said data elements upon which functions other than reporting said at least one of actual access, access permissions and content or recommending changes in said access permissions are executed.

2. A system according to claim 1 and wherein said functions other than actual access reporting include archiving.

3. A system according to claim 1 and wherein said functions other than actual access reporting include encrypting.

4. A system according to claim 1 and wherein said system resides on a computer server which is connected to an enterprise level network to which is connected a multiplicity of computers and storage devices.

5. A system according to claim 1 and wherein said computer resources include hardware resources and software resources.

6. A system for operating an enterprise computer network including multiple disparate clients, data elements and computer resources, said system comprising:

a processor having the following functionalities;

monitoring and collection functionality for providing and storing continuously updated metadata relating to actual access, access permissions and content of all of said data elements; and

classifying functionality operable, responsive to said storing, for utilizing said stored continuously updated metadata provided by said monitoring and collection functionality to classify at least a subset of said data elements and to recommend archiving of said at least subset of said data elements.

7. A system according to claim 6 and wherein said system also comprises a backup storage facility connected to said enterprise computer network.

8. A system according to claim 6 and wherein said system also comprises a remote storage facility connected to said enterprise computer network.

9. A system according to claim 6 and wherein said system also comprises a secure storage facility connected to said enterprise computer network.

10. A system according to claim 6 and wherein said computer resources include hardware resources and software resources.

11. A system according to claim 7 and wherein every day said system copies any of said data elements actually accessed by any user on said day to said backup storage facility.

12. A system according to claim 7 and wherein said system copies any of said data elements whose content indicates that they are confidential, are owned by a sensitive unit in said enterprise or are accessible by authorized individuals in said enterprise to said backup storage facility on a daily basis.

13. A system according to claim 7 and wherein said system copies any of said data elements marked with recommendations for changes in access permissions thereto to said backup storage facility on a daily basis.

14. A system according to claim 8 and wherein said system migrates to said remote storage facility any of said data elements that have recommendations for changes in access permissions thereto.

15. A system according to claim 8 and wherein said system migrates to said remote storage facility any of said data elements that have not been accessed for a first predetermined time period.

16. A system according to claim 8 and wherein said system migrates to said remote storage facility any of said data elements that have not been accessed for a first predetermined time period and that contain content indicating that they are confidential, are owned by a sensitive unit in said enterprise or are accessible by authorized individuals in said enterprise.

17. A system according to claim 8 and wherein said system migrates to said remote storage facility any of said data elements that have not been migrated to said remote storage facility for a second predetermined time period.

18. A system according to claim 8 and wherein said system migrates to said remote storage facility any of said data elements that have not been migrated to said remote storage facility for a second predetermined time period and that contain content indicating that they are confidential, are owned by a sensitive unit in said enterprise or are accessible by authorized individuals in said enterprise.

19. A system according to claim 9 and wherein said system migrates to said secure storage facility any of said data elements that contain personal identity information or sensitive information.

20. A system according to claim 6 and wherein when a user initiates a migration of data elements to a new storage device, the system recommends that all data elements actually accessed by any specified user or group of users, be migrated to said new storage device.

21. A system according to claim 7 and wherein at various times the system recommends that all data elements actually accessed by any specified user or group of users, be replicated to said backup storage facility.

22. A system according to claim 7 and wherein said system replicates to said backup storage facility any of said data elements whose content indicates that they are relevant to predetermined subjects.

23. A system according to claim 6 and wherein said system resides on a computer server which is connected to an enterprise level network to which is connected a multiplicity of computers and storage devices.

24. A system according to claim 23 and wherein an associated archiving system resides on a server other than said computer server.

25. A system for operating an enterprise computer network including multiple disparate clients, data elements and computer resources, said system comprising:

a processor having the following functionalities;

monitoring and collection functionality for providing and storing continuously updated metadata relating to actual access, access permissions and content of all of said data elements; and

classifying functionality operable, responsive to said storing, for utilizing said stored continuously updated metadata provided by said monitoring and collection functionality to classify at least a subset of said data elements and to recommend encrypting said at least subset of said data elements.

26. A system according to claim 25 and wherein for each individual data element of said data elements, at predetermined time intervals said system:

compiles a list of users having access permissions to said each individual data element;

compares said list of users to a predetermined list of authorized users, each of said authorized users being authorized to access confidential enterprise information;

labels said each individual data element that may be accessed by any of said authorized users as a confidential data element; and

encrypts said confidential data elements.

27. A system according to claim 25 and wherein for each individual data element of said data elements, at predetermined time intervals said system:

compiles a list of users actually having accessed said each individual data element;

compares said list of users to a predetermined list of authorized users, each of said authorized users being authorized to access confidential enterprise information;

labels said each individual data element that has been accessed by any of said authorized users as a confidential data element; and

encrypts said confidential data elements.

28. A system according to claim 25 and wherein for each individual data element of said data elements, at predetermined time intervals said system:

searches said each individual data element for the appearance of any of a predetermined list of confidential information related terms;

labels said each individual data element that contains any of said predetermined list of confidential information related terms as a confidential data element; and

encrypts said confidential data elements.

29. A system according to claim 25 and wherein said computer resources include hardware resources and software resources.

30. A system according to claim 25 and wherein said system resides on a computer server which is connected to an enterprise level network to which is connected a multiplicity of computers and storage devices.

31. A system according to claim 30 and wherein an associated encryption system resides on a server other than said computer server.

32. A method for operating an enterprise computer network including multiple disparate clients, data elements and computer resources, said method comprising using at least one server for:

monitoring, collecting and storing continuously updated metadata relating to at least one of actual access, access permissions and content of all of said data elements; and

responsive to said storing, utilizing said stored continuously updated metadata for classifying at least a subset of said data elements upon which functions other than reporting said at least one of actual access, access permissions and content or recommending changes in said access permissions are executed.

33. A method according to claim 32 and wherein said functions other than actual access reporting include archiving.

34. A method according to claim 32 and wherein said functions other than actual access reporting include encrypting.

35. A method according to claim 32 and wherein said computer resources include hardware resources and software resources.

36. A method for operating an enterprise computer network including multiple disparate clients, data elements and computer resources, said method comprising using at least one server for:

monitoring, collecting and storing continuously updated metadata relating to actual access, access permissions and content of all of said data elements; and

responsive to said storing, utilizing said stored continuously updated metadata to classify at least a subset of said data elements and to recommend archiving of said at least subset of said data elements.

37. A method according to claim 36 and wherein said method also comprises providing a backup storage facility connected to said enterprise computer network.

38. A method according to claim 36 and wherein said method also comprises providing a remote storage facility connected to said enterprise computer network.

39. A method according to claim 36 and wherein said method also comprises providing a secure storage facility connected to said enterprise computer network.

40. A method according to claim 36 and wherein said computer resources include hardware resources and software resources.

41. A method according to claim 37 and wherein every day any of said data elements actually accessed by any user on said day are copied to said backup storage facility.

42. A method according to claim 37 and wherein any of said data elements whose content indicates that they are confidential, are owned by a sensitive unit in said enterprise or are accessible by authorized individuals in said enterprise are copied to said backup storage facility on a daily basis.

43. A method according to claim 37 and wherein any of said data elements marked with recommendations for changes in access permissions thereto are copied to said backup storage facility on a daily basis.

44. A method according to claim 38 and wherein any of said data elements that have recommendations for changes in access permissions thereto are migrated to said remote storage facility.

45. A method according to claim 38 and wherein any of said data elements that have not been accessed for a first predetermined time period are migrated to said remote storage facility.

46. A method according to claim 38 and wherein any of said data elements that have not been accessed for a first predetermined time period and that contain content indicating that they are confidential, are owned by a sensitive unit in said enterprise or are accessible by authorized individuals in said enterprise are migrated to said remote storage facility.

47. A method according to claim 38 and wherein any of said data elements that have not been migrated to said remote storage facility for a second predetermined time period are migrated to said remote storage facility.

48. A method according to claim 38 and wherein any of said data elements that have not been migrated to said remote storage facility for a second predetermined time period and that contain content indicating that they are confidential, are owned by a sensitive unit in said enterprise or are accessible by authorized individuals in said enterprise are migrated to said remote storage facility.

49. A method according to claim 39 and wherein any of said data elements that contain personal identity information or sensitive information are migrated to said secure storage facility.

50. A method according to claim 36 and wherein when a user initiates a migration of data elements to a new storage device, all data elements actually accessed by any specified user or group of users are recommended to be migrated to said new storage device.

51. A method according to claim 37 and wherein at various times all data elements actually accessed by any specified user or group of users are recommended to be replicated to said backup storage facility.

52. A method according to claim 37 and wherein any of said data elements whose content indicates that they are relevant to predetermined subjects are replicated to said backup storage facility.

53. A method for operating an enterprise computer network including multiple disparate clients, data elements and computer resources, said method comprising using at least one server for:

monitoring, collecting and storing continuously updated metadata relating to actual access, access permissions and content of all of said data elements; and

responsive to said storing, utilizing said stored continuously updated metadata to classify at least a subset of said data elements and to recommend encrypting said at least subset of said data elements.

54. A method according to claim 53 and wherein for each individual data element of said data elements, at predetermined time intervals:

a list of users having access permissions to said each individual data element is compiled;

said list of users is compared to a predetermined list of authorized users, each of said authorized users being authorized to access confidential enterprise information;

said each individual data element that may be accessed by any of said authorized users is labeled as a confidential data element; and

said confidential data elements are encrypted.

55. A method according to claim 53 and wherein for each individual data element of said data elements, at predetermined time intervals:

a list of users actually having accessed said each individual data element is compiled;

said list of users is compared to a predetermined list of authorized users, each of said authorized users being authorized to access confidential enterprise information;

said each individual data element that has been accessed by any of said authorized users is labeled as a confidential data element; and

said confidential data elements are encrypted.

56. A method according to claim 53 and wherein for each individual data element of said data elements, at predetermined time intervals:

said each individual data element is searched for the appearance of any of a predetermined list of confidential information related terms;

said each individual data element that contains any of said predetermined list of confidential information related terms is labeled as a confidential data element; and

said confidential data elements are encrypted.

57. A method according to claim 53 and wherein said computer resources include hardware resources and software resources.