Using bit arrays in incremental scanning of content for sensitive data

• US 8,670,146 B1
• Filed: 04/24/2013
• Issued: 03/11/2014
• Est. Priority Date: 07/30/2010
• Status: Active Grant

• Current Assignee: CA, Inc. (d/b/a CA Technologies) (Broadcom, Inc.)
• Original Assignee: Symantec Corporation (NortonLifeLock Inc.)
• Inventors: Van Couvering, David
• Primary Examiner(s): Dehkordy, Saeid Ebrahimi
• Application Number:
  US13/869,740
• Time in Patent Office: 321 Days
• Field of Search: 358/1.15
• US Class Current: 358/1.15
• CPC Class Codes: G06Q 10/10 Office automation; Time management

Abstract

A method for incremental scanning of documents may include identifying documents to be scanned for sensitive information according to at least one data loss prevention (DLP) policy, the documents being associated with a bit array. The method may further include generating a key of a documents and applying, for each document, a set of functions to the key of the document, where outputs of the functions map the key to positions in the bit array. The method further includes identifying a subset of the positions in the bit array that correspond to the outputs of the functions in the set of functions, the subset of the positions to indicate whether the document has been scanned.

Claims

1. A method comprising:

identifying, by a processing device, a plurality of documents to be scanned for sensitive information according to at least one data loss prevention (DLP) policy, the plurality of documents being associated with a bit array;

generating a key of a document of the plurality of documents;

for the document, applying a set of functions to the key of the document, wherein outputs of the functions in the set of functions map the key to positions in the bit array; and

identifying a subset of the positions in the bit array that correspond to the outputs of the functions in the set of functions, the subset of the positions to indicate whether the document has been scanned.

2. The computer-implemented method of claim 1, further comprising:

updating the bit array to indicate that the document has been scanned after scanning the document for sensitive information.

3. The computer-implemented method of claim 2, wherein the computer system is one of a plurality of scanning servers.

4. The computer-implemented method of claim 3, further comprising:

sending the updated bit array to a controller for distribution to one or more of the plurality of scanning servers.

5. The computer-implemented method of claim 1, further comprising:

when values of all of the subset of the positions in the array indicate that the document has already been scanned, refraining from scanning the document; and

when a value of at least one of the subset of the positions in the array indicates that the document has not yet been scanned, scanning the document for sensitive information according to the DLP policy.

6. The computer-implemented method of claim 1, wherein the key is generated based on at least one of a file path, a modification date or a size of the document.

7. The computer-implemented method of claim 1, wherein the set of functions is a set of hash functions.

8. The computer-implemented method of claim 1, further comprising:

determining whether the plurality of documents is associated with a bit array; and

when the plurality of documents is not associated with a bit array, creating a bit array and associating the plurality of documents with the created bit array.

9. The computer-implemented method of claim 1, further comprising:

creating a new bit array for the plurality of documents associated with an existing bit array;

updating the new bit array to identify documents in the plurality of documents that have been scanned for sensitive information; and

replacing the existing bit array with the new bit array.

10. The computer-implemented method of claim 1, further comprising:

determining that the existing bit array is full;

creating a new bit array for the plurality of documents;

chaining the new bit array to the existing bit array;

when values of all of the subset of the positions in the new array indicate that the document has already been scanned, refraining from scanning the document; and

updating the new bit array to identify that the document has been scanned after scanning the document for sensitive information.

11. A non-transitory computer readable storage medium that provides instructions, which when executed by a processing device cause the processing device to perform operations comprising:

identifying, by a computer system, a plurality of documents to be scanned for sensitive information according to at least one data loss prevention (DLP) policy, the plurality of documents being associated with a bit array;

generating a key of a document of the plurality of documents;

for the document, applying a set of functions to the key of the document, wherein outputs of the functions in the set of functions map the key to positions in the bit array; and

identifying a subset of the positions in the bit array that correspond to the outputs of the functions in the set of functions, the subset of the positions to indicate whether the document has been scanned.

12. The non-transitory computer readable storage medium of claim 11, the operations further comprising:

updating the bit array to indicate that the document has been scanned after scanning the document for sensitive information.

13. The non-transitory computer readable storage medium of claim 11, wherein the key is generated based on at least one of a file path, a modification date or a size of the document, the operations further comprising:

when values of all of the subset of the positions in the array indicate that the document has already been scanned, refraining from scanning the document; and

when a value of at least one of the subset of the positions in the array indicates that the document has not yet been scanned, scanning the document for sensitive information according to the DLP policy.

14. The non-transitory computer readable storage medium of claim 11, the operations further comprising:

creating a new bit array for the plurality of documents associated with an existing bit array;

updating the new bit array to identify documents in the plurality of documents that have been scanned for sensitive information; and

replacing the existing bit array with the new bit array.

15. The non-transitory computer readable storage medium of claim 11, the operations further comprising:

determining that the existing bit array is full;

creating a new bit array for the plurality of documents;

chaining the new bit array to the existing bit array;

when values of all of the subset of the positions in the new array indicate that the document has already been scanned, refraining from scanning the document; and

updating the new bit array to identify that the document has been scanned after scanning the document for sensitive information.

16. A system comprising:

a memory; and

a processing device coupled to the memory, the processing device to;

identify a plurality of documents to be scanned for sensitive information according to at least one data loss prevention (DLP) policy, the plurality of documents being associated with a bit array;

generate a key of a document of the plurality of documents;

for the document, apply a set of functions to the key of the document, wherein outputs of the functions in the set of functions map the key to positions in the bit array; and

identify a subset of the positions in the bit array that correspond to the outputs of the functions in the set of functions, the subset of the positions to indicate whether the document has been scanned.

17. The system of claim 16, wherein the processing device further to:

update the bit array to indicate that the document has been scanned after scanning the document for sensitive information.

18. The system of claim 16, wherein the key is generated based on at least one of a file path, a modification date or a size of the document, and the processing device further to:

when values of all of the subset of the positions in the array indicate that the document has already been scanned, refrain from scanning the document; and

when a value of at least one of the subset of the positions in the array indicates that the document has not yet been scanned, scan the document for sensitive information according to the DLP policy.

19. The system of claim 16, wherein the processing device further to:

create a new bit array for the plurality of documents associated with an existing bit array;

update the new bit array to identify documents in the plurality of documents that have been scanned for sensitive information; and

replace the existing bit array with the new bit array.

20. The system of claim 16, wherein the processing device further to:

determine that the existing bit array is full;

create a new bit array for the plurality of documents;

chain the new bit array to the existing bit array;

when values of all of the subset of the positions in the new array indicate that the document has already been scanned, refrain from scanning the document; and

update the new bit array to identify that the document has been scanned after scanning the document for sensitive information.