Techniques for preventing large-scale data breaches utilizing differentiated protection layers
First Claim
1. A method in a security gateway for preventing large-scale data breaches, wherein the security gateway is communicatively coupled between a plurality of client end stations and one or more servers that store and serve a plurality of files, the method comprising:
- receiving, at the security gateway from one or more of the plurality of client end stations, a plurality of file access requests seeking access to files of the plurality of files stored by the one or more servers, wherein each of the plurality of file access requests includes an immutable identifier of one of the files, wherein the plurality of files have been divided into a first subset that are currently classified as active files and a second subset that are currently classified as inactive files, wherein the current classification of the plurality of files into active files and inactive files is based upon a likelihood of further legitimate access to the files;
determining, for each of the plurality of file access requests, whether the requested file is one of the first subset of the plurality of files that are currently classified as active files and thus is not in the second subset of the plurality of files that are currently classified inactive files, wherein the first subset includes less than fifty percent of the plurality of files, and wherein the second subset includes greater than fifty percent of the plurality of files;
for those of the plurality of file access requests requesting files determined to be in the first subset of the plurality of files that are currently classified as active files, subjecting those file access requests to a first protection layer including a first set of zero or more protection mechanisms; and
for those of the plurality of file access requests involving files determined to not be in the first subset of the plurality of files that are currently classified as active files, subjecting those file access requests to a second protection layer including a second set of one or more protection mechanisms, wherein the first protection layer is more permissive than the second protection layer in that certain file access requests that would be deemed acceptable if submitted to the first protection layer would not be deemed acceptable if submitted to the second protection layer, and in that all file access requests that would be deemed acceptable if submitted to the second protection layer would be deemed acceptable if submitted to the first protection layer, whereby large-scale data breaches are efficiently prevented without disruption to legitimate file access requests.
5 Assignments
0 Petitions
Accused Products
Abstract
Techniques related to preventing large-scale data breaches utilizing differentiated data object (DO) protection layers are described. A security gateway placed within a communication path between client end stations and servers receives DO access requests from the client end stations. The DOs are divided into a first subset that are currently classified as active and a second subset that are currently classified as inactive based upon a likelihood of further legitimate access to the DOs. Those of the DO access requests for DOs determined to be in the first subset are subjected to a first protection layer utilizing zero or more protection mechanisms. Those of the plurality of DO access requests for DOs not in the first subset are subjected to a second protection layer utilizing one or more protection mechanisms. Large-scale data breaches are efficiently prevented without disruption to legitimate DO access requests.
65 Citations
38 Claims
-
1. A method in a security gateway for preventing large-scale data breaches, wherein the security gateway is communicatively coupled between a plurality of client end stations and one or more servers that store and serve a plurality of files, the method comprising:
-
receiving, at the security gateway from one or more of the plurality of client end stations, a plurality of file access requests seeking access to files of the plurality of files stored by the one or more servers, wherein each of the plurality of file access requests includes an immutable identifier of one of the files, wherein the plurality of files have been divided into a first subset that are currently classified as active files and a second subset that are currently classified as inactive files, wherein the current classification of the plurality of files into active files and inactive files is based upon a likelihood of further legitimate access to the files; determining, for each of the plurality of file access requests, whether the requested file is one of the first subset of the plurality of files that are currently classified as active files and thus is not in the second subset of the plurality of files that are currently classified inactive files, wherein the first subset includes less than fifty percent of the plurality of files, and wherein the second subset includes greater than fifty percent of the plurality of files; for those of the plurality of file access requests requesting files determined to be in the first subset of the plurality of files that are currently classified as active files, subjecting those file access requests to a first protection layer including a first set of zero or more protection mechanisms; and for those of the plurality of file access requests involving files determined to not be in the first subset of the plurality of files that are currently classified as active files, subjecting those file access requests to a second protection layer including a second set of one or more protection mechanisms, wherein the first protection layer is more permissive than the second protection layer in that certain file access requests that would be deemed acceptable if submitted to the first protection layer would not be deemed acceptable if submitted to the second protection layer, and in that all file access requests that would be deemed acceptable if submitted to the second protection layer would be deemed acceptable if submitted to the first protection layer, whereby large-scale data breaches are efficiently prevented without disruption to legitimate file access requests. - View Dependent Claims (2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16, 17, 18, 19)
-
-
20. A security gateway comprising:
-
one or more processors; and a non-transitory computer readable medium storing instructions which, when executed by the one or more processors, cause the security gateway to perform operations for preventing large-scale data breaches, wherein the security gateway is to be communicatively coupled between a plurality of client end stations and one or more servers that store and serve a plurality of files, the operations comprising; receiving, from one or more of the plurality of client end stations, a plurality of file access requests seeking access to files of the plurality of files stored by the one or more servers, wherein each of the plurality of file access requests includes an immutable identifier of one of the files, wherein the plurality of files have been divided into a first subset that are currently classified as active files and a second subset that are currently classified as inactive files, wherein the current classification of the plurality of files into active files and inactive files is based upon a likelihood of further legitimate access to the files; determining, for each of the plurality of file access requests, whether the requested file is one of the first subset of the plurality of files that are currently classified as active files and thus is not in the second subset of the plurality of files that are currently classified inactive files, wherein the first subset includes less than fifty percent of the plurality of files, and wherein the second subset includes more than fifty percent of the plurality of files; for those of the plurality of file access requests requesting files determined to be in the first subset of the plurality of files that are currently classified as active files, subjecting those file access requests to a first protection layer including a first set of zero or more protection mechanisms; and for those of the plurality of file access requests involving files determined to not be in the first subset of the plurality of files that are currently classified as active files, subjecting those file access requests to a second protection layer including a second set of one or more protection mechanisms, wherein the first protection layer is more permissive than the second protection layer in that certain file access requests that would be deemed acceptable if submitted to the first protection layer would not be deemed acceptable if submitted to the second protection layer, and in that all file access requests that would be deemed acceptable if submitted to the second protection layer would be deemed acceptable if submitted to the first protection layer, whereby large-scale data breaches are efficiently prevented without disruption to legitimate file access requests. - View Dependent Claims (21, 22, 23, 24, 25, 26, 27, 28, 29, 30, 31, 32, 33, 34, 35, 36, 37, 38)
-
Specification