Enterprise level data management

• US 9,904,685 B2
• Filed: 01/27/2010
• Issued: 02/27/2018
• Est. Priority Date: 09/09/2009
• Status: Active Grant

• Current Assignee: Varonis Systems, Inc.
• Original Assignee: Varonis Systems, Inc.
• Inventors: Korkus, Ohad, Faitelson, Yakov, Kretzer-Katzir, Ophir, Bass, David
• Primary Examiner(s): Truong, Cam-Y
• Application Number:
  US12/673,691
• Publication Number:
  US 20120221550A1
• Time in Patent Office: 2,953 Days
• Field of Search: 707722
• CPC Class Codes: G06F 16/13 File access structures, e.g. distributed indices arrangements of input from, or output to, record carriers G06F3/06
• CPC Class Codes: G06F 16/245 Query processing
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: G06F 2221/2101 Auditing as a secondary aspect
• CPC Class Codes: G06F 2221/2141 Access rights, e.g. capability lists, access control lists, access tables, access matrices
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources

Abstract

A system for identifying data of interest from among a multiplicity of data elements residing on multiple platforms in an enterprise, the system including background data characterization functionality characterizing the data of interest at least by at least one content characteristic thereof and at least one access metric thereof, the at least one access metric being selected from data access permissions and actual data access history and near real time data matching functionality selecting the data of interest by considering only data elements which have the at least one content characteristic thereof and the at least one access metric thereof from among the multiplicity of data elements.

Claims

1. A network system comprising:

one or more client computers connected to one or more servers in an enterprise via network;

a background data characterizer, executed on a computer, to receive a query from a human operator via the network, wherein the query comprising at least one user data access permissions metric specified by said human operator and at least one content based data characteristic specified by said human operator, said user is different from said human operator and

to responsive to said query received from said human operator being operative for;

identifying a data subset for content based on said at least one user data access permissions metric specified by said human operator, of said data subset; and

characterizing data of interest at least by said at least one content based data characteristic and according to said at least one user data access permissions metric specified by said human operator;

near real time data matching functionality, executed by the computer, for selecting said data of interest by considering only data elements which have both said at least one content based data characteristic and said at least one user data access permissions metric from among multiplicity of data elements; and

a search functionality, executed by the computer, for automatically redefining a field of search in accordance with said at least one data access permissions metric multiple times, wherein the multiplicity of data elements includes data element status monitoring functionality, noting the current status of data elements that have been modified, added or removed in accordance with changes in said at least one data access permissions metric, wherein said at least one data access permissions metric is a dynamic metric which changes over time during operation of the enterprise, wherein said near real time data matching functionality comprises a background field of search definition and an automatic field of search redefinition, wherein said selecting the data of interest by considering only data elements which have said at least one content characteristic and said at least one data access permissions metric from among said multiplicity of data elements includes;

searching for data elements which have said at least one content characteristic;

automatically redefining, by the computer, said field of search in accordance with said at least one data access permissions metric multiple times and searching within said field of search multiple times, wherein said at least one data access permissions metric is different at least some of said multiple times;

identifying data elements from among said multiplicity of data elements in accordance with said at least one data access permissions metric, the data of interest from among a multiplicity of data elements being stored in said multiple platforms in said enterprise;

combining results of said searching and said identifying data elements, wherein the results of said searching being ordered at least in accordance with at least one data access permissions metric related prioritization characteristic; and

providing the ordered results to the client computer via the network.

2. The system according to claim 1, wherein said searching and said identifying are performed by separate entities.

3. A computer-implemented method for identifying data of interest from among a multiplicity of data elements residing on multiple platforms in an enterprise, the method comprising:

a background data characterizer, executed on a computer, to receive a query from a human operator via a network, wherein the query comprising at least one user data access permissions metric specified by said human operator and at least one content based data characteristic specified by said human operator, said user is different from said human operator; and

responsive to said query received from said human operator;

identifying, by the computer, a data subset for content based on said at least one user data access permissions metric specified by said operator, of said data subset; and

characterizing, by the background characterizer executed, by the computer, data of interest at least by said at least one content based data characteristic and according to said at least one user data access permissions metric specified by said human operator; and

selecting, by near real time data matching functionality executed by the computer, the data of interest by considering only data elements which have both said at least one content based data characteristic and said at least one user data access permissions metric from among said multiplicity of data elements, said near real time data matching functionality comprising a background field of search definition and an automatic field of search redefinition and search functionality operative to automatically redefine said field of search in accordance with said at least one data access permissions metric multiple times, and said multiplicity of data elements including data element status monitoring functionality, noting the current status of data elements that have been modified, added or removed in accordance with changes in said at least one data access permissions metric, wherein said at least one data access permissions metric is a dynamic metric which changes over time during operation of the enterprise, and

said selecting the data of interest by considering only data elements which have said at least one content characteristic thereof and said at least one data access permissions metric thereof from among said multiplicity of data elements including;

searching, by the computer, for data elements which have said at least one content characteristic;

automatically redefining, by the computer, the field of search in accordance with said at least one data access permissions metric multiple times and searching within the field of search multiple times, wherein said at least one data access permissions metric is different at least some of said multiple times;

identifying, by the computer, data elements from among said multiplicity of data elements in accordance with said at least one data access permissions metric;

combining, by the computer, results of said searching for data elements and said identifying data elements, wherein the results of said searching being ordered at least in accordance with said at least one data access permissions metric related prioritization characteristic; and

providing the ordered results to a user computer via the network.

4. The method according to claim 3, wherein said selecting the data of interest by considering only data elements which have said at least one content characteristic and said at least one data access permissions metric from among said multiplicity of data elements includes:

separately from said searching for data elements which have said at least one content characteristic.

5. The method according to claim 4, wherein said searching and said identifying are performed by separate entities.