Method, apparatus, and system for data protection

• US 9,984,241 B2
• Filed: 08/26/2015
• Issued: 05/29/2018
• Est. Priority Date: 03/12/2013
• Status: Active Grant

• Current Assignee: Huawei Technologies Co., Ltd. (Huawei Investment & Holding Co., Ltd.)
• Original Assignee: Huawei Technologies Co., Ltd. (Huawei Investment & Holding Co., Ltd.)
• Inventors: Jin, Wei
• Primary Examiner(s): Lynch, Sharon
• Application Number:
  US14/835,822
• Publication Number:
  US 20150363600A1
• Time in Patent Office: 1,007 Days
• CPC Class Codes: G06F 21/606 by securing the transmission between two devices or processes
• CPC Class Codes: G06F 21/62 Protecting access to data via a platform, e.g. using keys or access control rules
• CPC Class Codes: G06F 21/6245 Protecting personal data, e.g. for financial or medical purposes
• CPC Class Codes: H04L 51/212 using filtering or selective blocking
• CPC Class Codes: H04L 63/0281 Proxies
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00
• CPC Class Codes: H04L 67/564 Enhancement of application control based on intercepted application data

Abstract

A method, an apparatus, and a system for data protection. A specific solution is: a proxy server receives outgoing data from a user terminal, where the outgoing data carries an identifier of a user; acquires a user grade and a credit value of the user from a credit server according to the identifier, where the credit value is a violation percentage of historical outgoing data of the user; sends the outgoing data, the user grade, and the credit value to a DLP server so that the DLP server inspects security of the outgoing data according to the user grade and the credit value, and further generates a message including an inspection result; and receives, from the DLP server, the message including the inspection result and uses a policy corresponding to the inspection result to process the outgoing data. The present invention is used during a protection process of outgoing data.

Claims

1. A data loss prevention (DLP) server deployed in a local area network of an enterprise, the DLP server comprising:

a receiver configured to receive outgoing data, a user grade, and a credit value from a proxy server deployed at a border between the local area network and an external network, wherein the outgoing data is sent by a user in the enterprise to the external network and carries an identifier of the user,

wherein the user grade is determined based on an administrative grade of the user, a department of the user, a job category of the user, or a probability that the user is exposed to internal sensitive data of the enterprise, wherein the user grade comprises one or more of;

an exempted from inspection grade, an inspection grade corresponding to an inspection algorithm for inspecting the outgoing data, or an outgoing permission prohibition grade, and

wherein the credit value is a violation percentage of historical outgoing data of the user calculated based on a number of times that historical outgoing data of the user passes a security inspection and a number of times that historical outgoing data of the user fails the security inspection;

a processor coupled to the receiver;

a memory coupled to the processor and configured to store instructions that when executed by the processor cause the DLP server to;

inspect security of the outgoing data based on the user grade and the credit value, wherein inspecting security of the outgoing data when the user grade comprises the inspection grade comprises;

selecting the inspection algorithm based on a specific grade of the inspection grade;

restoring the outgoing data based on a preset restoration policy; and

using the inspection algorithm to inspect restored outgoing data with reference to the credit value; and

generate a message comprising an inspection result, wherein the inspection result comprises either a pass or a fail; and

a transmitter configured to send, to the proxy server, the message comprising the inspection result.

2. The DLP server of claim 1, wherein when the user grade comprises the inspection grade, the inspection grade further comprises a simple inspection grade or a strict inspection grade.

3. The DLP server of claim 2, wherein the number of times that historical outgoing data of the user passes the security inspection and the number of times that historical outgoing data of the user fails the security inspection are stored in a credit server, and wherein the transmitter is further configured to send the message comprising the inspection result to the credit server after the message comprising the inspection result is sent to the proxy server.

4. The DLP server of claim 1, wherein the instructions further cause the DLP server to:

skip inspection of the security of the outgoing data and generate a message indicating that the security inspection passes when the user grade is the exempted from inspection grade; and

skip inspection of the security of the outgoing data and generate a message indicating that the security inspection fails when the user grade is the outgoing permission prohibition grade.

5. The DLP server of claim 4, wherein the number of times that historical outgoing data of the user passes the security inspection and the number of times that historical outgoing data of the user fails the security inspection are stored in a credit server, and wherein the transmitter is further configured to send the message comprising the inspection result to the credit server after the message comprising the inspection result is sent to the proxy server.

6. The DLP server of claim 1, wherein the number of times that historical outgoing data of the user passes the security inspection and the number of times that historical outgoing data of the user fails the security inspection are stored in a credit server, and wherein the transmitter is further configured to send the message comprising the inspection result to the credit server after the message comprising the inspection result is sent to the proxy server.

7. The DUD server of claim 1, wherein the number of times that historical outgoing data of the user passes the security inspection and the number of times that historical outgoing data of the user fails the security inspection are stored in a credit server, and wherein the transmitter is further configured to send the message comprising the inspection result to the credit server after the message comprising the inspection result is sent to the proxy server.

8. The DLP server of claim 1, wherein the outgoing data, the user grade, and the credit value is sent from the proxy server using Internet Content Adaptation Protocol (ICAP) when the outgoing data is Web data, and wherein the user grade and the credit value are carried in an extended ICAP header field.

9. A data protection method implemented by a data loss prevention (DLP) server deployed in a local area network of an enterprise, the method comprising:

receiving outgoing data, a user grade, and a credit value from a proxy server that deployed at a border between the local area network and an external network, wherein the outgoing data is sent by a user in the enterprise to the external network and carries an identifier of the user, wherein the user grade is determined based on an administrative grade of the user, a department of the user, a job category of the user, or a probability that the user is exposed to internal sensitive data of the enterprise, wherein the user grade comprises one or more of;

an exempted from inspection grade, an inspection grade corresponding to an inspection algorithm for inspecting the outgoing data, or an outgoing permission prohibition grade, and

wherein the credit value is a violation percentage of historical outgoing data of the user calculated based on a number of times that historical outgoing data of the user passes the security inspection and a number of times that historical outgoing data of the user fails the security inspection;

inspecting security of the outgoing data based on the user grade and the credit value, wherein inspecting the security of the outgoing data when the user grade comprises the inspection grade comprises;

selecting the inspection algorithm based on a specific grade of the inspection grade;

restoring the outgoing data based on a preset restoration policy; and

using the inspection algorithm to inspect restored outgoing data with reference to the credit value;

generating a message comprising an inspection result, wherein the inspection result comprises either a pass or a fail; and

sending, to the proxy server, the message comprising the inspection result.

10. The method of claim 9, wherein the inspection grade comprises a simple inspection grade or a strict inspection grade.

11. The method of claim 9, wherein inspecting the security of the outgoing data comprises:

skipping inspecting the security of the outgoing data and generating a message indicating that the security inspection passes when the user grade is the exempted from inspection grade; and

skipping inspecting the security of the outgoing data and generating a message indicating that the security inspection fails when the user grade is an outgoing permission prohibition grade.

12. The method of claim 9, wherein the number of times that historical outgoing data of the user passes the security inspection and the number of times that historical outgoing data of the user fails the security inspection are stored in a credit server, and wherein the method further comprises sending the message comprising the inspection result to the credit server after the message comprising the inspection result is sent to the proxy server.

13. The method of claim 9, wherein the outgoing data, the user grade, and the credit value is sent from the proxy server using Internet Content Adaptation Protocol (ICAP) when the outgoing data is Web data, and wherein the user grade and the credit value are carried in an extended ICRP header field.