Confidential content search engine

• US 9,262,727 B2
• Filed: 05/30/2008
• Issued: 02/16/2016
• Est. Priority Date: 01/20/2006
• Status: Expired due to Fees

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Broussard, Scott J., Kwong, Tony C. Jr., Spring, Eduardo N., Wrobel, Anthony W. Jr.
• Primary Examiner(s): Pwu, Jeffrey
• Assistant Examiner(s): Woldemariam, Nega
• Application Number:
  US12/130,148
• Publication Number:
  US 20080235196A1
• Time in Patent Office: 2,818 Days
• Field of Search: 713/282, 713/289, 726/26, 726/27, 726/28, 726/29, 726/30
• US Class Current: 1/1
• CPC Class Codes: G06F 21/6245 Protecting personal data, e.g. for financial or medical purposes
• CPC Class Codes: G06F 2221/2101 Auditing as a secondary aspect
• CPC Class Codes: G06Q 10/00 Administration; Management

Abstract

A security compliance search engine is provided for searching one or more client computing devices for items of information that meet a security criteria identifying items of information containing confidential content. Results of the search are provided to an analysis engine for determining if the items of information identified by the search are being maintained in accordance with a security policy for ensuring the confidentiality of the confidential content. Results of the analysis may be used to generate a report or log and to generate a notification to the client computing device identifying any violations of the security policy and possible solutions for bringing the item of information into compliance with the security policy. In addition, an administrator may be notified of any violations so that corrective action may be taken.

Claims

1. A method, in a server data processing system, for searching a client computing device to identify items of information containing confidential information, comprising:

installing a client agent on the client computing device wherein the client agent, when executed by the client computing device, retrieves one or more security search rules from a security search rules database setting forth one or more security criteria for identifying items of information that contain confidential information and performs a security search of an information storage at a client computing device to identify at least one item of information meeting the one or more security criteria;

retrieving search results of the security search from the client agent, wherein the search results of the security search contain the at least one item of information that meets the one or more security criteria;

retrieving one or more security policies from a security policy database, wherein the one or more security policies set forth security policy compliance requirements that identify requirements for maintaining items of information that contain confidential information in a confidential state;

wherein retrieving search results of the security search includes gathering characteristic information associated with the at least one item of information, wherein the characteristic information includes at least one of an identity of the at least one item of information, the search criteria met by the at least one item of information, or information identifying a protection mechanism currently applied to the at least one item of information;

analyzing the search results to determine if the at least one item of information is maintained in a confidential state in the information storage in accordance with the security policy compliance requirements of the one or more security policies; and

generating a report based on results of the analysis of the search results, wherein responsive to a given item of information within the at least one item of information violating security policy compliance requirements of a given security policy, the report provides a notification to the client computing device indicating a violation of the given security policy and provides a solution for placing the given item of information in compliance with the given security policy; and

transmitting the report to the client computing device.

2. The method of claim 1, wherein the one or more security criteria comprises at least one of particular character strings indicative of confidential information, data flags indicative of confidential information, particular parameters associated with items of information indicative of confidential information, file system settings associated with items of information indicative of confidential information, file usage patterns indicative of confidential information, or file name patterns indicative of confidential information.

3. The method of claim 1, wherein the item of information is at least one of an electronic mail, an electronic file, an electronic object in an object oriented environment, an electronic document, or an electronic image.

4. The method of claim 1, wherein the security search is performed on a plurality of client computing devices associated with the server computing device.

5. The method of claim 4, further comprising:

retrieving information from a client computing device database identifying one or more client computing devices on which to perform the security search.

6. The method of claim 1, wherein analyzing the search results to determine if the at least one item of information meets security policy compliance requirements comprises:

identifying one or more security policies in a security policy database that are to be applied to the at least one item of information, based on the characteristic information gathered for the at least one item of information.

7. A computer program product comprising a computer useable medium having a computer readable program, wherein the computer readable program, when executed on a server computing device, causes the server computing device to:

installing a client agent on the client computing device wherein the client agent, when executed by the client computing device, retrieves one or more security search rules from a security search rules database setting forth one or more security criteria for identifying items of information that contain confidential information and performs a security search of an information storage at a client computing device to identify at least one item of information meeting the one or more security criteria;

retrieving search results of the security search from the client agent, wherein the search results of the security search contain the at least one item of information that meets the one or more security criteria;

retrieving one or more security policies from a security policy database, wherein the one or more security policies set forth security policy compliance requirements that identify requirements for maintaining items of information that contain confidential information in a confidential state;

wherein retrieving search results of the security search includes gathering characteristic information associated with the at least one item of information, wherein the characteristic information includes at least one of an identity of the at least one item of information, the search criteria met by the at least one item of information, or information identifying a protection mechanism currently applied to the at least one item of information;

analyzing the search results to determine if the at least one item of information is maintained in a confidential state in the information storage in accordance with the security policy compliance requirements of the one or more security policies; and

generating a report based on results of the analysis of the search results, wherein responsive to a given item of information within the at least one item of information violating security policy compliance requirements of a given security policy, the report provides a notification to the client computing device indicating a violation of the given security policy and provides a solution for placing the given item of information in compliance with the given security policy; and

transmitting the report to the client computing device.

8. The computer program product of claim 7, wherein the one or more security criteria comprises at least one of particular character strings indicative of confidential information, data flags indicative of confidential information, particular parameters associated with items of information indicative of confidential information, file system settings associated with items of information indicative of confidential information, file usage patterns indicative of confidential information, or file name patterns indicative of confidential information.

9. The computer program product of claim 7, wherein the item of information is at least one of an electronic mail, an electronic file, an electronic object in an object oriented environment, an electronic document, or an electronic image.

10. The computer program product of claim 7, wherein the computer readable program causes the server computing device to retrieve search results of the security search by gathering characteristic information associated with the at least one item of information, wherein the characteristic information includes at least one of an identity of the at least one item of information, the search criteria met by the at least one item of information, or information identifying a protection mechanism currently applied to the at least one item of information.

11. The computer program product of claim 10, wherein the computer readable program causes the server computing device to analyze the search results to determine if the at least one item of information meets security policy compliance requirements by:

identifying one or more security policies in a security policy database that are to be applied to the at least one item of information, based on the characteristic information gathered for the at least one item of information.

12. The computer program product of claim 7, wherein the security search is performed on a plurality of client computing devices associated with the server computing device.

13. The computer program product of claim 12, wherein the computer readable program causes the server computing device to retrieve information from a client computing device database identifying one or more client computing devices on which to perform the security search.

14. A server data processing system for searching a client computing device to identify items of information containing confidential information, comprising:

A processor;

A memory coupled to the processor; and

A storage device coupled to the processor, wherein the memory comprises computer executable instructions which, when executed by the processor, causes the processor to;

installing a client agent on the client computing device wherein the client agent, when executed by the client computing device, retrieves one or more security search rules from a security search rules database setting forth one or more security criteria for identifying items of information that contain confidential information and performs a security search of an information storage at a client computing device to identify at least one item of information meeting the one or more security criteria;

retrieving search results of the security search from the client agent, wherein the search results of the security search contain the at least one item of information that meets the one or more security criteria;

retrieving one or more security policies from a security policy database, wherein the one or more security policies set forth security policy compliance requirements that identify requirements for maintaining items of information that contain confidential information in a confidential state;

wherein retrieving search results of the security search includes gathering characteristic information associated with the at least one item of information, wherein the characteristic information includes at least one of an identity of the at least one item of information, the search criteria met by the at least one item of information, or information identifying a protection mechanism currently applied to the at least one item of information;

analyzing the search results to determine if the at least one item of information is maintained in a confidential state in the information storage in accordance with the security policy compliance requirements of the one or more security policies; and

generating a report based on results of the analysis of the search results, wherein responsive to a given item of information within the at least one item of information violating security policy compliance requirements of a given security policy, the report provides a notification to the client computing device indicating a violation of the given security policy and provides a solution for placing the given item of information in compliance with the given security policy; and

transmitting the report to the client computing device.

15. The system of claim 14, wherein the processor:

retrieves search results of the security search by gathering characteristic information associated with the at least one item of information, wherein the characteristic information includes at least one of an identity of the at least one item of information, the search criteria met by the at least one item of information, or information identifying a protection mechanism currently applied to the at least one item of information, and

identifies one or more security policies in a security policy database that are to be applied to the at least one item of information, based on the characteristic information gathered for the at least one item of information.

16. The system of claim 14, wherein the one or more security criteria comprises at least one of particular character strings indicative of confidential information, data flags indicative of confidential information, particular parameters associated with items of information indicative of confidential information, file system settings associated with items of information indicative of confidential information, file usage patterns indicative of confidential information, or file name patterns indicative of confidential information.

17. The system of claim 14, wherein the item of information is at least one of an electronic mail, an electronic file, an electronic object in an object oriented environment, an electronic document, or an electronic image.

18. The system of claim 14, wherein the security search is performed on a plurality of client computing devices associated with the server computing device.

19. The system of claim 18, wherein the processor retrieves information from a client computing device database identifying one or more client computing devices on which to perform the security search.