Methods and systems for preventing unauthorized disclosure of secure information using image fingerprinting

• US 8,620,020 B2
• Filed: 10/24/2012
• Issued: 12/31/2013
• Est. Priority Date: 11/20/2008
• Status: Active Grant

• Current Assignee: Freedom Solutions Group, LLC
• Original Assignee: Workshare Technology Incorporated
• Inventors: More, Scott
• Primary Examiner(s): Allison, Andrae S
• Application Number:
  US13/659,817
• Publication Number:
  US 20130051609A1
• Time in Patent Office: 433 Days
• Field of Search: 382/100, 382/101, 382/176, 382/190, 382/286, 382/294, 707/698, 705/58, 705/406, 380/55, 380/202, 713/176
• US Class Current: 382/100
• CPC Class Codes: G06V 10/462 Salient features, e.g. scale invariant feature transforms [SIFT]

Abstract

The present invention provides methods and systems to protect an organization'"'"'s secure image information from unauthorized disclosure. In one embodiment, methods and systems to generate image fingerprints are provided. The fingerprints are generated for each feature point of an image data. Because the fingerprints take into account the neighborhood features around each feature point, the image fingerprints are robust against derivative images where the original image may have been altered. Methods and systems to maintain a fingerprint database for an organization'"'"'s secure image data is also provided. In one embodiment, client fingerprints are generated for image data that a user intends to transmit outside of the organization. In some embodiments, suitable security actions are initiated if any of the client fingerprints match any of the fingerprints in the fingerprint database.

Claims

1. A computer-implemented method for preventing unauthorized disclosure of secure information, the computer-implemented method comprising:

storing a plurality of registered fingerprints for secure images of a given organization, wherein each fingerprint of the plurality of registered fingerprints is generated using point vectors computed from feature points identified from each secure image;

receiving a first image that a user desires to transmit outside of the given organization;

generating a first set of fingerprints for the first image, wherein each fingerprint of the first set of fingerprints is generated using point vectors computed from feature points identified from the first image;

determining whether any of the first set of fingerprints is identical to any of the plurality of registered fingerprints; and

taking a security action when any of the first set of fingerprints is identical to any of the plurality of registered fingerprints,

wherein the generation of each fingerprint of the first set of fingerprints includes;

selecting a first feature point in the first image;

selecting a plurality of neighborhood feature points closest in distance to the first feature point, wherein a least distant feature point, measured relative to the first feature point, of the plurality of neighborhood feature points is designated as an anchor point;

generating the plurality of point vectors, each point vector computed based on distance and angle between the particular neighborhood feature point and the first feature point, wherein the distance and angle are computed relative to the anchor point; and

aggregating the plurality of point vectors to generate a fingerprint corresponding to the first feature point.

2. The computer-implemented method for preventing unauthorized disclosure of secure information as recited in claim 1, wherein the plurality of point vectors for a particular feature point are computed based on distance and angle between the particular feature point and a predetermined number of neighboring feature points closest to the particular feature point.

3. The computer-implemented method for preventing unauthorized disclosure of secure information as recited in claim 1, wherein the security action includes at least one of:

preventing the first image from being disclosed;

logging the event as a security violation;

requiring a password from the user to allow the first image to be disclosed;

blocking the user'"'"'s access to the first image;

sending out a security alert;

or

integration of the first image with rights management information.

4. The computer-implemented method for preventing unauthorized disclosure of secure information as recited in claim 1, the computer-implemented method further comprising creating a fingerprint database for the given organization, wherein the fingerprint database comprises the plurality of registered fingerprints for secure images of the given organization.

5. The computer-implemented method for preventing unauthorized disclosure of secure information as recited in claim 1, wherein the first image is at least one of:

an image contained in an electronic mail;

an image contained in a file attached to an electronic mail; and

an image that is transferred using a computer'"'"'s output device.

6. The computer-implemented method for preventing unauthorized disclosure of secure information as recited in claim 1, wherein the generation of each fingerprint of the first set of fingerprints is identical to the generation of each registered fingerprint of the plurality of registered fingerprints.

7. A system to prevent unauthorized disclosure of secure information outside a given organization, the computer-implemented system comprising:

a processor;

a memory;

a processing component configured to;

receive a first image that a user desires to transmit outside of the given organization;

generate a first set of fingerprints for the first image, wherein each fingerprint of the first set of fingerprints is generated using point vectors computed from feature points identified from the first image;

determine whether any of the first set of fingerprints is identical to any of a plurality of registered fingerprints stored in a fingerprint database communicably coupled to the system;

wherein the fingerprint database comprises at least a portion of the plurality of registered fingerprints for secure images of the given organization; and

wherein each fingerprint of the plurality of registered fingerprints is generated using point vectors computed from feature points identified from each secure image; and

take a security action when any of the first set of fingerprints is identical to any of the plurality of registered fingerprints,

wherein, in the generation of each fingerprint of the first set of fingerprints, the processing component is further configured to;

select a first feature point in the first image;

select a plurality of neighborhood feature points closest in distance to the first feature point, wherein a least distant feature point, measured relative to the first feature point, of the plurality of neighborhood feature points is designated as an anchor point;

generate the plurality of point vectors, each point vector computed based on distance and angle between the particular neighborhood feature point and the first feature point, wherein the distance and angle are computed relative to the anchor point; and

aggregate the plurality of point vectors to generate a fingerprint corresponding to the first feature point.

8. The system to prevent unauthorized disclosure of secure information as recited in claim 7, wherein the point vectors for a particular feature point are computed based on distance and angle between the particular feature point and a predetermined number of neighboring feature points closest to the particular feature point.

9. The system to prevent unauthorized disclosure of secure information as recited in claim 7, wherein the security action includes at least one of:

preventing the first image from being disclosed;

logging the event as a security violation;

requiring a password from the user to allow the first image to be disclosed;

blocking the user'"'"'s access to the first image;

sending out a security alert;

or

integration of the first image with rights management information.

10. The system to prevent unauthorized disclosure of secure information as recited in claim 7, wherein the first image is at least one of:

an image contained in an electronic mail;

an image contained in a file attached to an electronic mail; and

an image that is transferred using a computer'"'"'s output device.

11. The system to prevent unauthorized disclosure of secure information as recited in 7, wherein the fingerprint database is a lightweight secure fingerprint database locally available at the site of an egress point through which the user my transmit information outside of the organization.

12. The system to prevent unauthorized disclosure of secure information as recited in 7, wherein the generation of each fingerprint of the first set of fingerprints is identical to the generation of each registered fingerprint of the plurality of registered fingerprints.

13. A computer-implemented method for preventing unauthorized disclosure of secure information, the computer-implemented method comprising:

storing a plurality of registered fingerprints for secure images of a given organization, wherein each of the plurality of registered fingerprints is generated using a plurality of point vectors computed from feature points identified from each secure image;

receiving a first image that a user desires to transmit outside of the given organization;

generating a first set of fingerprints for the first image, wherein the generation of each fingerprint of the first set of fingerprints is identical to the generation of each registered fingerprint of the plurality of registered fingerprints;

determining whether any of the first set of fingerprints is identical to any of the plurality of registered fingerprints; and

taking a security action when the first fingerprint is identical to any of the plurality of secure text fingerprints,

wherein the generation of each fingerprint of the first set of fingerprints includes;

selecting a first feature point in the first image;

identifying a plurality of neighborhood feature points closest in distance to the first feature point, wherein the plurality of neighborhood feature points closest in distance to the first feature point includes a P-neighborhood, the P-neighborhood including P number of neighborhood feature points closest in distance to the first feature point;

generating the plurality of point vectors, each point vector computed based on distance and angle between a particular neighborhood feature point and the first feature point; and

aggregating the plurality of point vectors to generate a fingerprint corresponding to the first feature point; and

designating as an anchor point a least distant feature point, the least distant feature point being a specific feature point closest to the first feature point within the P-neighborhood.

14. The computer-implemented method for preventing unauthorized disclosure of secure information as recited in claim 13, wherein the security action includes at least one of:

preventing the first image from being disclosed;

logging the event as a security violation;

requiring a password from the user to allow the first image to be disclosed;

blocking the user'"'"'s access to the first image;

sending out a security alert;

or

integration of the first image with rights management information.

15. The computer-implemented method for preventing unauthorized disclosure of secure information as recited in claim 13, the computer-implemented method further comprising creating a fingerprint database for the given organization, wherein the fingerprint database comprises the plurality of registered fingerprints for secure images of the given organization.

16. The computer-implemented method for preventing unauthorized disclosure of secure information as recited in claim 13, wherein the first image is at least one of:

an image contained in an electronic mail;

an image contained in a file attached to an electronic mail; and

an image that is transferred using a computer'"'"'s output device.

17. The computer-implemented method for preventing unauthorized disclosure of secure information as recited in claim 13, wherein the determination of whether any of the first set of fingerprints is identical to any of the plurality of registered fingerprints further includes transmitting data across a network to a remote server.