Personal computing device -based mechanism to detect preselected data

• US 20040225645A1
• Filed: 06/27/2003
• Published: 11/11/2004
• Est. Priority Date: 05/06/2003
• Status: Active Grant

• Current Assignee: CA, Inc. (d/b/a CA Technologies) (Broadcom, Inc.)
• Original Assignee: Symantec Corporation (NortonLifeLock Inc.)
• Inventors: Wolfe, Michael R., Ansanelli, Joseph, Rowney, Kevin T., Gopalakrishnan, Mythili, Fridman, Vitali A.
• Granted Patent: US 8,041,719 B2
• Time in Patent Office: Days
• US Class Current: 707/3
• CPC Class Codes: G06F 16/24568 Data stream processing; Continuous queries
• CPC Class Codes: G06F 21/554 involving event detection and direct action
• CPC Class Codes: G06Q 10/107 Computer-aided management of electronic mailing [e-mailing]

Abstract

A method and apparatus for detecting pre-selected data stored on a personal computing device is described. In one embodiment, contents of data storage media of a personal computing device are searched for pre-selected sensitive data. In one embodiment, if at least a portion of the pre-selected sensitive data is detected, a notification of the detection of the pre-selected data is sent to a system via a network. In another embodiment, if at least a portion of pre-selected sensitive data is detected, the access to this data is blocked.

Claims

1. A method comprising:

searching contents of a plurality of data storage media of a personal computing device for pre-selected sensitive data; and

if at least a portion of the pre-selected sensitive data is detected, sending a notification of detection of the pre-selected sensitive data to a system via a network.

2. The method of claim 1 further comprising:

if at least a portion of the pre-selected sensitive data is detected, preventing access to the detected data.

3. The method of claim 1 wherein the content is searched periodically.

4. The method of claim 1 wherein the content is searched when the personal computing device is disconnected from the network.

5. The method of claim 4 wherein sending a notification comprises:

upon detecting the pre-selected sensitive data, creating a message containing the notification of the detection of the pre-selected sensitive data;

placing the message in a transmission queue; and

transmitting the message to the system after the personal computing device is re-connected to the system.

6. The method of claim 1 further comprising:

receiving instructions defining a scope of a search for the personal computing device from the system.

7. The method of claim 1 wherein searching contents of a plurality of data storage media within a personal computing device comprises:

receiving an abstract data structure associated with the pre-selected sensitive data; and

utilizing the abstract data structure when searching the contents of the plurality of data storage media of the personal computing device for the pre-selected sensitive data.

8. The method of claim 1 wherein searching contents of a plurality of data storage media of the personal computing device comprises monitoring one or more specific data operations for presence of at least a portion of the pre-selected sensitive data.

9. The method of claim 8 wherein at least one of the one or more specific data operations is selected from the group consisting of a file-read, a file-write, a file-update, a read from a removable media device, a write to a removable media device, and access of data stored on any of the plurality of data storage media by a program running on the personal computing device.

10. The method of claim 1 wherein the pre-selected sensitive data has a tabular format.

11. The method of claim 1 wherein the pre-selected sensitive data is capable of being re-structured into a tabular format based on relationships among elements of the pre-selected sensitive data.

12. The method of claim 1 wherein the pre-selected sensitive data is maintained by an organization in at least one of a spreadsheet, a flat file, and a database.

13. The method of claim 12 wherein the abstract data structure comprises a tuple-storage structure derived from the pre-selected data.

14. The method of claim 13 wherein the abstract data structure comprises a plurality of tuples, each of the plurality of tuples including a row numbers of a data item in a corresponding cell of a tabular structure of the pre-selected data.

15. The method of claim 14 wherein each of the plurality of tuples additionally includes a column number and optionally a column type of the data item in the corresponding cell.

16. The method of claim 1 wherein the plurality of data storage media is selected from the group consisting of a main memory, a static memory, and a mass storage memory.

17. The method of claim 1 wherein searching contents of a plurality of data storage media comprises:

searching content of each volatile storage device within the plurality of data storage media; and

searching content of each persistent storage device within the plurality of data storage media.

18. The method of claim 17 further comprising detecting use of the pre-selected data by an application running on the personal computing device.

19. The method of claim 17 further comprising:

identifying the application using the pre-selected data; and

reporting the identified application.

20. An apparatus comprising:

means for searching contents of a plurality of data storage media of a personal computing device for pre-selected sensitive data; and

means for sending a notification of detection of the pre-selected sensitive data to a system via a network if at least a portion of the pre-selected sensitive data is detected.

21. The apparatus of claim 20 wherein the content is searched periodically.

22. The apparatus of claim 20 wherein the content is searched when the personal computing device is disconnected from the network.

23. The apparatus of claim 20 wherein means for sending a notification comprises:

means for creating a message containing the notification of the detection of the pre-selected sensitive data upon detecting the pre-selected sensitive data;

means for placing the message in a transmission queue; and

means for transmitting the message to the system after the personal computing device is re-connected to the system.

24. The apparatus of claim 20 further comprising:

means for receiving instructions defining a scope of a search for the personal computing device from the system.

25. The apparatus of claim 20 wherein means for searching contents of a plurality of data storage media of the personal computing device comprises means for monitoring one or more specific data operations for presence of at least a portion of the pre-selected sensitive data.

26. The apparatus of claim 25 wherein at least one of the one or more specific data operations is selected from the group consisting of a file-read, a file-write, a file-update, a read from a removable media device, a write to a removable media device, and access of data stored on any of the plurality of data storage media by a program running on the personal computing device.

27. The apparatus of claim 20 wherein the plurality of data storage media is selected from the group consisting of a main memory, a static memory, and a mass storage memory.

28. The apparatus of claim 20 wherein means for searching contents of a plurality of data storage media comprises:

means for searching content of each volatile storage device within the plurality of data storage media; and

means for searching content of each persistent storage device within the plurality of data storage media.

29. The apparatus of claim 28 further comprising means for detecting use of the pre-selected data by an application running on the personal computing device.

30. The apparatus of claim 28 further comprising:

means for identifying the application using the pre-selected data; and

means for reporting the identified application.

31. A personal computing device comprising:

a plurality of storage media storing various data; and

at least one processor coupled to the plurality of storage media, at least one processor executing a set of instructions which cause the processor to search contents of the plurality of data storage media for pre-selected sensitive data, and to send a notification of detection of the pre-selected sensitive data to a system via a network if at least a portion of the pre-selected sensitive data is detected.

32. A computer readable medium that provides instructions, which when executed on a processor cause the processor to perform a method comprising:

searching contents of a plurality of data storage media of a personal computing device for pre-selected sensitive data; and

if at least a portion of the pre-selected sensitive data is detected, sending a notification of detection of the pre-selected sensitive data to a server via a network.