Unobtrusive protection for large-scale data breaches utilizing user-specific data object access budgets

• US 9,674,201 B1
• Filed: 12/29/2015
• Issued: 06/06/2017
• Est. Priority Date: 12/29/2015
• Status: Active Grant

• Current Assignee: Imperva Incorporated (Thales SA)
• Original Assignee: Imperva Incorporated (Thales SA)
• Inventors: Mantin, Itsik, Margel, Shiri, Shulman, Amichai
• Primary Examiner(s): Pyzocha, Michael
• Application Number:
  US14/983,423
• Publication Number:
  US 20170187718A1
• Time in Patent Office: 525 Days
• CPC Class Codes: G06F 21/62 Protecting access to data via a platform, e.g. using keys or access control rules
• CPC Class Codes: H04L 63/0209 Architectural arrangements, e.g. perimeter networks or demilitarized zones
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/102 Entity profiles
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 63/1441 Countermeasures against malicious traffic countermeasures against attacks on cryptographic mechanisms H04L9/002
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04W 12/082 using revocation of authorisation
• CPC Class Codes: H04W 12/084 using delegated authorisation, e.g. open authorisation [OAuth] protocol
• CPC Class Codes: H04W 12/088 using filters or firewalls

Abstract

Techniques for unobtrusively protecting against large-scale data breaches over time are described. A security gateway coupled between clients and servers receives data object (DO) access requests from the clients on behalf of users of an enterprise. Each of the users is allocated a budget for each of one or more time periods. The security gateway determines an access cost for each DO access request based on characteristics of the DO request, where lower access costs are indicative expected DO access consumption for users of the enterprise, and charges the determined access cost against the budget for that user corresponding to the time period when the DO access request was received. Alert messages are transmitted based on different ones of the users exceeding their budget(s), and the transmission of the DO access requests to the data object servers is not prevented.

Claims

1. A method in a security gateway for unobtrusively protecting against large-scale data breaches over time, wherein the security gateway is communicatively coupled between a plurality of client end stations and one or more servers that store and serve a plurality of files, the method comprising:

receiving, at the security gateway from one or more of the plurality of client end stations during one or more time periods, a plurality of file access requests sent on behalf of a plurality of users belonging to an enterprise, wherein the plurality of file access requests seek access to one or more of the plurality of files stored by the one or more servers, wherein each of the plurality of file access requests includes an immutable identifier of one of the files, wherein each of the plurality of users is allocated a budget for each of the one or more time periods;

for each file access request of the plurality of file access requests, performing the following;

determining an access cost for the file access request based on characteristics of the file access request, wherein lower access costs are indicative of file access requests that are part of expected file access consumption for the plurality of users belonging to the enterprise, and

charging the determined access cost against the budget for that user corresponding to the one of the one or more time periods when the file access request was received; and

transmitting alert messages, but not preventing either a transmission of the plurality of file access requests to the one or more servers or further but different security-related analysis of the plurality of file access requests by the security gateway, based on different ones of the plurality of users exceeding their respective budgets.

2. The method of claim 1, wherein the access costs determined for two different ones of the plurality of file access requests that seek access to a same one of the plurality of files and that were sent on behalf of a same one of the plurality of users are different.

3. The method of claim 1, wherein the access costs determined for two different ones of the plurality of file access requests that seek access to a same one of the plurality of files and that were sent on behalf of two different ones of the plurality of users are different.

4. The method of claim 1, wherein at least one of the determined access costs is zero.

5. The method of claim 1, wherein, for at least one of the file access requests, one of the characteristics of that file access request that the determined access cost is based upon is which of the plurality of users on whose behalf that file access request was sent.

6. The method of claim 5, wherein another of the characteristics of that file access request that the determined access cost is based upon is an identity of a creator or owner of the requested file.

7. The method of claim 1, wherein, for at least one of the file access requests, one of the characteristics of that file access request that the determined access cost is based upon is a time the file access request was received at the security gateway.

8. The method of claim 1, wherein, for at least one of the file access requests, one of the characteristics of that file access request that the determined access cost is based upon is an identifier of the client end station that transmitted that file access request.

9. The method of claim 1, wherein, for at least one of the file access requests, one of the characteristics of that file access request that the determined access cost is based upon is some or all of a relative or absolute path of the requested file.

10. The method of claim 1, wherein at least one of the alert messages is transmitted to either:

a manager of the user having the exceeded budget;

or

a security administrator of the enterprise.

11. The method of claim 1, wherein at least one of the alert messages is transmitted responsive to an end of one of the one or more time periods as opposed to being transmitted at the exceeding of one of the budgets.

12. The method of claim 1, wherein:

at least two of the alert messages are transmitted responsive to a budget of a user of a time period being exceeded;

a first of the at least two alert messages is sent after receipt of one of the file access requests causing the budget to be exceeded; and

a second of the at least two alert messages is sent at an end of the time period.

13. The method of claim 1, wherein at least one of the alert messages is sent responsive to one of the plurality of users exceeding their respective budget for multiple time periods.

14. The method of claim 1, further comprising performing, by the security gateway, additional logging for future file access requests sent on behalf of one or more of the plurality of users that exceed their respective budgets.

15. The method of claim 1, wherein the one or more time periods includes at least two time periods that at least partially overlap.

16. The method of claim 15, wherein the one or more time periods include a first time period and a second time period, wherein the first time period is larger than the second time period and overlaps all of the second time period, wherein each of the plurality of users is allocated a first budget for the first time period and a second budget for the second time period, and wherein the first budget is different than the second budget.

17. The method of claim 16, wherein one of the alert messages is transmitted responsive to, for one of the plurality of users, the first budget being exceeded despite the second budget not being exceeded.

18. A security gateway comprising:

one or more processors; and

a non-transitory computer readable medium storing instructions which, when executed by the one or more processors, cause the security gateway to perform operations for unobtrusively protecting against large-scale data breaches over time, wherein the security gateway is to be communicatively coupled between a plurality of client end stations and one or more servers that store and serve a plurality of files, the operations comprising;

receiving, from one or more of the plurality of client end stations during one or more time periods, a plurality of file access requests sent on behalf of a plurality of users belonging to an enterprise, wherein the plurality of file access requests seek access to one or more of the plurality of files stored by the one or more servers, wherein each of the plurality of file access requests includes an immutable identifier of one of the files, wherein each of the plurality of users is allocated a budget for each of the one or more time periods;

for each file access request of the plurality of file access requests, performing the following;

determining an access cost for the file access request based on characteristics of the file access request, wherein lower access costs are indicative of file access requests that are part of expected file access consumption for the plurality of users belonging to the enterprise, and

charging the determined access cost against the budget for that user corresponding to the one of the one or more time periods when the file access request was received; and

transmitting alert messages, but not preventing either a transmission of the plurality of file access requests to the one or more servers or further but different security-related analysis of the plurality of file access requests by the security gateway, based on different ones of the plurality of users exceeding their respective budgets.

19. The security gateway of claim 18, wherein the access costs determined for two different ones of the plurality of file access requests that seek access to a same one of the plurality of files and that were sent on behalf of a same one of the plurality of users are different.

20. The security gateway of claim 18, wherein the access costs determined for two different ones of the plurality of file access requests that seek access to a same one of the plurality of files and that were sent on behalf of two different ones of the plurality of users are different.

21. The security gateway of claim 18, wherein at least one of the determined access costs is zero.

22. The security gateway of claim 18, wherein, for at least one of the file access requests, one of the characteristics of that file access request that the determined access cost is based upon is which of the plurality of users on whose behalf that file access request was sent.

23. The security gateway of claim 22, wherein another of the characteristics of that file access request that the determined access cost is based upon is an identity of a creator or owner of the requested file.

24. The security gateway of claim 18, wherein, for at least one of the file access requests, one of the characteristics of that file access request that the determined access cost is based upon is a time that the file access request was received at the security gateway.

25. The security gateway of claim 18, wherein, for at least one of the file access requests, one of the characteristics of that file access request that the determined access cost is based upon is an identifier of the client end station that transmitted that file access request.

26. The security gateway of claim 18, wherein, for at least one of the file access requests, one of the characteristics of that file access request that the determined access cost is based upon is some or all of a relative or absolute path of the requested file.

27. The security gateway of claim 18, wherein at least one of the alert messages is transmitted to either:

a manager of the user having the exceeded budget;

or

a security administrator of the enterprise.

28. The security gateway of claim 18, wherein at least one of the alert messages is transmitted responsive to an end of one of the one or more time periods as opposed to being transmitted at the exceeding of one of the budgets.

29. The security gateway of claim 18, wherein:

at least two of the alert messages are transmitted responsive to a budget of a user of a time period being exceeded;

a first of the at least two alert messages is sent after receipt of one of the file access requests causing the budget to be exceeded; and

a second of the at least two alert messages is sent at an end of the time period.

30. The security gateway of claim 18, wherein at least one of the alert messages is sent responsive to one of the plurality of users exceeding their respective budget for multiple time periods.

31. The security gateway of claim 18, wherein the operations further comprise performing, additional logging for future file access requests sent on behalf of one or more of the plurality of users that exceed their respective budgets.

32. The security gateway of claim 18, wherein the one or more time periods includes at least two time periods that at least partially overlap.

33. The security gateway of claim 32, wherein the one or more time periods include a first time period and a second time period, wherein the first time period is larger than the second time period and overlaps all of the second time period, wherein each of the plurality of users is allocated a first budget for the first time period and a second budget for the second time period, and wherein the first budget is different than the second budget.

34. The security gateway of claim 33, wherein one of the alert messages is transmitted responsive to, for one of the plurality of users, the first budget being exceeded despite the second budget not being exceeded.