Method and system for forensic data tracking

• US 9,565,200 B2
• Filed: 09/14/2015
• Issued: 02/07/2017
• Est. Priority Date: 09/12/2014
• Status: Active Grant

• Current Assignee: Quick Vault, Inc. (d/b/a CloudVault)
• Original Assignee: Quick Vault, Inc. (d/b/a CloudVault)
• Inventors: Heuss, Michael Royd, Bacastow, Steven V.
• Primary Examiner(s): Korsak, Oleg
• Application Number:
  US14/853,464
• Publication Number:
  US 20160080397A1
• Time in Patent Office: 512 Days
• US Class Current: 1/1
• CPC Class Codes: G06F 21/552 involving long-term monitoring or reporting
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 63/105 Multiple levels of security
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00
• CPC Class Codes: H04L 63/1433 Vulnerability analysis
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

The present invention relates to a method and system for tracking the movement of data elements as they are shared and moved between authorized and unauthorized devices and among authorized and unauthorized users.

Claims

1. A forensic computing platform deployed as a cloud control server which comprises an analytic component, a reporting component, an alert component, a business logic component, a policy database, a user database, a meta database and a settings database;

the forensic computing platform further comprising at least one endpoint that comprises a deployed software agent, the deployed software agent comprising modules to detect, classify, delete, encrypt, and redact data stored on the at least one endpoint, the forensic computing platform causing the following steps to occur when executing computer instructions stored in a memory of the cloud control server;

receiving from the deployed software agent on the at least one endpoint a meta log associated with a first file comprising data, the meta log containing a first file name, data element tags comprising indicators that data fields or data types are included in the first file, and one or more of a date created, deleted, or modified, a user name, and an endpoint ID;

storing the meta log in the cloud control server of the forensic computing platform;

analyzing the data of the first file based on a configured setting and criteria;

determining, based on the indicators of the data element tags, that a data classification associated with the data is inappropriate for the first file; and

reporting the result of the analysis and determination to an authorized system administrator.

2. The forensic computing platform of claim 1, wherein the indicators of the data element tags specify the data types that include one or more of a person'"'"'s name, a specific phone number, a social security number, a number that represents a credit card number, a patient record ID, and a diagnosis code.

3. The forensic computing platform of claim 1, further performing the step of encoding hidden fields to produce an encoded file, the encoded file operable to transmit tracking information back to the forensic computing platform.

4. The forensic computing platform of claim 3, wherein the forensic computing platform is further operable to store meta logs comprising tracking information into the meta database of the forensic computing platform;

wherein the meta logs are fed into the reporting component of the forensic computing platform;

wherein the meta logs may be read by the analytic component of the forensic computing platform to determine patterns of data use;

wherein the patterns of use constitute rule violations or deviations from normal behavior.

5. The forensic computing platform of claim 3, wherein encoded data elements enable tracking a movement of the encoded file;

wherein encoding may be an invisible graphic element in the encoded file;

wherein the invisible graphic element can include an embedded URL which includes an address of the forensic computing platform and one or more parameters including a unique token that explicitly identifies the encoded file.

6. The forensic computing platform of claim 5, wherein each time the encoded file is subsequently opened on the same or a different end point, the encoding attempts to connect to the forensic computing platform using an IP address within the embedded URL.

7. The forensic computing platform of claim 6, wherein upon a successful connection to the forensic computing platform, a server within the forensic computing platform logs one or more of a date, a time, a file name, an IP address of the end point associated with the tracking information.

8. The forensic computing platform of claim 1, wherein the deployed software agent on the at least one endpoint performs the following steps:

detect a new or changed file on the at least one endpoint;

evaluate the contents of the new or changed file that is detected on the at least one endpoint;

determine a data classification of the new or changed file; and

remediate the new or changed file when the determined data classification is inappropriate for the at least one endpoint, the remediation being one of encrypt, delete or redact information within the new or changed file.

9. The forensic computing platform of claim 8, wherein the deployed software agent further comprises a state configuration component operable to disable the deployed software agent on the at least one endpoint if it has received a command from the cloud control server of the forensic computing platform to do so.

10. The forensic computing platform of claim 8, wherein the deployed software agent further comprises a file traversal and parsing logic operable to traverse a file system of the endpoint that comprises the deployed agent and extract information about each file in the file system.

11. The forensic computing platform of claim 8, wherein the deployed software agent further comprises a database storage component operable to control communications to and from a local database comprised on the endpoint.

12. The forensic computing platform of claim 9, wherein the state configuration component is further operable to launch a thread to perform file traversal and parsing and manage the thread when its services are no longer needed.

13. The forensic computing platform of claim 10, wherein the file traversal and parsing logic:

traverses the file system from a given starting point;

descends into all directories; and

detects and reports information about each file discovered therein that matches a search criteria.

14. The forensic computing platform of claim 13, wherein the search criteria can include one or more of a volume, a folder, a file type, and a file name that can be used to identify specific files on the deployed endpoint.

15. The forensic computing platform of claim 13, wherein the file traversal and parsing logic reports information including a file name, a creation date, permissions, an ownership, a size, and a modification date for each detected file, as well as a computed hash of contents of each file.

16. The forensic computing platform of claim 15, wherein the computed hash is a unique hash value for the file and wherein the unique hash value is added to properties associated with the file in accordance with configuration requirements.

17. The forensic computing platform of claim 8, wherein the deployed software agent is further operable to create an encoded file with tracking embodiments wherein the encoding is comprised of hidden fields and is operable to transmit tracking information within a tracking message back to the forensic computing platform.

18. The forensic computing platform of claim 17, wherein the tracking message is further comprised of one or more of an encoded file ID, an IP address, a MAC address, user information, a hardware serial number, operating system data, a cookie, and a locally stored object.