Systems and methods for data loss prevention while preserving privacy

• US 9,740,877 B2
• Filed: 09/22/2015
• Issued: 08/22/2017
• Est. Priority Date: 09/22/2015
• Status: Active Grant

• Current Assignee: Google LLC (Alphabet Inc.)
• Original Assignee: Google Inc. (Alphabet Inc.)
• Inventors: Medvedev, Ivan
• Primary Examiner(s): Zecher, Dede
• Assistant Examiner(s): Savenkov, Vadim
• Application Number:
  US14/862,086
• Publication Number:
  US 20170083717A1
• Time in Patent Office: 700 Days
• Field of Search: None
• CPC Class Codes: G06F 21/602 Providing cryptographic facilities or services
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: G06F 21/6245 Protecting personal data, e.g. for financial or medical purposes
• CPC Class Codes: G07C 9/00309 operated with bidirectional data transmission between data carrier and locks
• CPC Class Codes: H04L 5/16 Half-duplex systems; Simplex/duplex switching; Transmission of break signals non-automatically inverting the direction of transmission
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/0478 applying multiple layers of encryption, e.g. nested tunnels or encrypting the content with a first key and then with at least a second key cryptographic mechanisms or cryptographic arrangements using a plurality of keys or algorithms H04L9/14
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 63/1466 Active attacks involving interception, injection, modification, spoofing of data unit addresses, e.g. hijacking, packet injection or TCP sequence number attacks
• CPC Class Codes: H04L 7/033 using the transitions of the received signal to control the phase of the synchronising-signal-generating means, e.g. using a phase-locked loop
• CPC Class Codes: H04L 9/14 using a plurality of keys or algorithms
• CPC Class Codes: H04L 9/302 involving the integer factorization problem, e.g. RSA or quadratic sieve [QS] schemes
• CPC Class Codes: H04W 12/02 Protecting privacy or anonymity, e.g. protecting personally identifiable information [PII]
• CPC Class Codes: H04W 12/12 Detection or prevention of fraud
• CPC Class Codes: H04W 12/122 Counter-measures against attacks; Protection against rogue devices
• CPC Class Codes: H04W 56/001 Synchronization between nodes

Abstract

Systems and methods for data loss prevention while preserving privacy are described, including receiving a data communication originating from an online account of a user device associated with the enterprise; performing an analysis to determine that the data communication is a candidate data leakage, based on a context of the data communication; encrypting the data communication, and providing the host-encrypted data communication to a software agent at the enterprise; receiving a software agent-encrypted database of enterprise communication and the host-encrypted data communication, re-encrypted by the software agent; decrypting a host-encrypted aspect of the re-encrypted data communication to generate a software agent-encrypted data communication; performing a matching operation to determine whether a match exists between the encrypted database of information and the software agent-encrypted data communication; if the match exists, reporting the match to the software agent; and if the match does not exist, the host taking an action.

Claims

1. A computer-implemented method of detecting data leakage, the method comprising:

receiving, at a host external to a firewall of an enterprise, a data communication originating from an online account of a user device associated with the enterprise;

the host performing an analysis to determine that the data communication is a candidate data leakage, based on a context of the data communication;

the host encrypting the data communication and providing the host-encrypted data communication to a software agent at the enterprise;

in response to receiving the host-encrypted data communication, and by using a common encryption key, the software agent encrypting a database of enterprise information and re-encrypting the host-encrypted data communication;

providing the software agent-encrypted database of enterprise information and the re-encrypted data communication to the host;

the host decrypting a host-encrypted aspect of the re-encrypted data communication to generate a software agent-encrypted data communication;

performing a matching operation to determine whether a match exists between the encrypted database of information and the software agent-encrypted data communication;

the host configured to report the match to the software agent, and the software agent configured to take a first action, when the match is determined to exist; and

the host configured to take a second action when the match is determined to not exist.

2. The computer-implemented method of claim 1, wherein the software agent at the enterprise is not provided with a key used by the host encrypting the data communication originating from the online account, and the host is not provided with the common encryption key of the software agent.

3. The computer-implemented method of claim 1, wherein the performing the matching operation comprises applying a set intersection algorithm.

4. The computer-implemented method of claim 1, wherein the host partially encrypts the data communication, and leaves an unencrypted portion of the data communication as cleartext, and provides the partially encrypted data communication and the cleartext to the software agent.

5. The computer-implemented method of claim 1, further comprising the software agent adding noise into the encrypted database and sends the encrypted database with the noise to the host.

6. The computer-implemented method of claim 1, wherein the host performing the analysis to determine that the data communication is the candidate data leakage comprises the application of a Bloom filter to determine that the data communication is the candidate data leakage.

7. The computer-implemented method of claim 1, further comprising the software agent re-ordering values in the host-encrypted data communication during the re-encryption of the host-encrypted data communication.

8. The computer-implemented method of claim 1, wherein the first action by the software agent comprises at least one of includes deleting the data communication, quarantining the data communication, and sending the data communication to a recipient with an alert.

9. The computer-implemented method of claim 1, wherein the second action by the host comprises not providing a report to the software agent.

10. A computer-implemented method of detecting data leakage at a host external to a firewall of an enterprise, the method comprising:

receiving, a data communication originating from an online account of a user device associated with the enterprise;

performing an analysis to determine that the data communication is a candidate data leakage, based on a context of the data communication;

encrypting the data communication, and providing the host-encrypted data communication to a software agent at the enterprise;

receiving a software agent-encrypted database of enterprise information and the host-encrypted data communication, re-encrypted by the software agent;

decrypting a host-encrypted aspect of the re-encrypted data communication to generate a software agent-encrypted data communication;

performing a matching operation to determine whether a match exists between the encrypted database of information and the software agent-encrypted data communication;

reporting the match to the software agent when the match is determined to exist; and

the host configured to take an action when the match is determined to not exist.

11. The computer-implemented method of claim 10, wherein the performing the matching operation comprises applying a set intersection algorithm.

12. The computer-implemented method of claim 10, wherein the host partially encrypts the data communication, and leaves an unencrypted portion of the data communication as cleartext, and provides the partially encrypted data communication and the cleartext to the software agent.

13. The computer-implemented method of claim 10, wherein the host performing the analysis to determine that the data communication is the candidate data leakage comprises the application of a Bloom filter to determine that the data communication is the candidate data leakage.

14. A computer-implemented method of detecting data leakage from an enterprise having a software agent, the method comprising:

receiving, from a host external to a firewall of the enterprise, a host-encrypted data communication that originated from an online account of a user device associated with the enterprise;

using a common encryption key, encrypting a database of enterprise information and re-encrypting the host-encrypted data communication;

providing the encrypted database of enterprise information and the re-encrypted data communication to the host;

receiving a report from the host indicative of a match existing between the encrypted database of information and the re-encrypted data communication; and

taking a first action when the match is determined to exist between the encrypted database of information and the re-encrypted data communication.

15. The computer-implemented method of claim 14, wherein the software agent at the enterprise is not provided with a key used by the host encrypting the data communication originating from the online account, and the host is not provided with the common encryption key of the software agent.

16. The computer-implemented method of claim 14, further comprising the software agent adding noise into the encrypted database and sends the encrypted database with the noise to the host.

17. The computer-implemented method of claim 14, further comprising the software agent re-ordering values in the host-encrypted data communication during the re-encryption of the host-encrypted data communication.

18. The computer-implemented method of claim 14, wherein the first action by the software agent comprises at least one of includes deleting the data communication, quarantining the data communication, and sending the data communication to a recipient with an alert, and wherein the first action is not taken when the match is determined to not exist between the encrypted database of information and the re-encrypted data communication.

19. A system for detecting data leakage at a host external to a firewall of an enterprise, the system comprising:

the host external to the firewall of the enterprise including a hardware processor and having executable instructions stored on a computer-readable medium, the instructions at the host comprising,

receiving, a data communication originating from an online account of a user device associated with the enterprise;

performing an analysis to determine that the data communication is a candidate data leakage, based on a context of the data communication;

encrypting the data communication, and providing the host-encrypted data communication to a software agent at the enterprise;

receiving a software agent-encrypted database of enterprise information and the host-encrypted data communication, re-encrypted by the software agent;

decrypting a host-encrypted aspect of the re-encrypted data communication to generate a software agent-encrypted data communication;

performing a matching operation to determine whether a match exists between the encrypted database of information and the software agent-encrypted data communication;

the match is capable of being reported to the software agent when the match is determined to exist; and

the software agent is configured to take a first action when the match is determined to exist; and

the enterprise including a hardware processor and having executable instructions stored on a computer-readable medium

receiving, from the host external to a firewall of the enterprise, the host-encrypted data communication;

using a common encryption key, encrypting a database of enterprise information and re-encrypting the host-encrypted data communication, and providing the software agent-encrypted database and the re-encrypted data communication to the host;

receiving a report from the host indicative of the match existing between the encrypted database of information and the software agent-encrypted data communication; and

taking a second action.

20. The system of claim 19, wherein the software agent at the enterprise is not provided with a key used by the host encrypting the data communication originating from the online account, and the host is not provided with the common encryption key of the software agent.