Detecting policy violations in information content containing data in a character-based language

• US 8,065,739 B1
• Filed: 03/28/2008
• Issued: 11/22/2011
• Est. Priority Date: 03/28/2008
• Status: Active Grant

• Current Assignee: CA, Inc. (d/b/a CA Technologies) (Broadcom, Inc.)
• Original Assignee: Symantec Corporation (NortonLifeLock Inc.)
• Inventors: Bruening, Oskar, Fridman, Vitali
• Primary Examiner(s): Smithers; Matthew
• Application Number:
  US12/079,719
• Time in Patent Office: 1,334 Days
• Field of Search: 707/756, 707/760
• US Class Current: 726/26
• CPC Class Codes: G06F 21/6227 where protection concerns the structure of data, e.g. records, types, queries

Abstract

A method and apparatus for detecting policy violations in information content containing data in a character-based language is described. In one embodiment, the method includes identifying a policy for protecting source data having a tabular format. The source data contains one or more data fragments in the character-based language. The method further includes receiving information content having at least a portion in the character-based language, and determining whether any part of the information content, including the portion in the character-based language, violates the policy.

Claims

1. A computer-implemented method comprising:

identifying a policy for protecting source data having a tabular format, the source data containing one or more data fragments in a character-based language, wherein the character-based language does not provide visual delimiters between words in the one or more data fragments;

receiving information content having at least a first portion in the character-based language; and

determining whether any part of the information content, including the first portion in the character-based language, violates the policy.

2. The method of claim 1 wherein:

the first portion of the information content does not include identifiable delimiters between tokens; and

the data fragments in the source data are separable into tokens based on the tabular data structure.

3. The method of claim 1 wherein the character-based language is any one of the Japanese language or the Chinese language.

4. The method of claim 1 wherein determining whether any part of the information content, including the first portion in the character-based language, violates the policy further comprises:

generating a first set of tokens from the first portion of the information content using an abstract data structure derived from the source data;

generating a second set of tokens from an information content portion in a word-based language using natural delimiters; and

determining whether the first and second sets of tokens include fragments from any one or more rows from the source data.

5. The method of claim 4 wherein:

the abstract data structure is created to provide an index of the source data, the index comprising signatures of data fragments within the source data; and

creating the abstract data structure comprises

identifying a plurality of tokens within the source data based on the tabular format,

for each token in a word-based language, creating a signature of a relevant token, and adding the signature to the abstract data structure, and

for each token in the character-based language, creating a token delimiter indicator and a signature of a relevant token, and adding the token delimiter indicator and the signature to the abstract data structure.

6. The method of claim 5 wherein generating a first set of tokens from the first portion of the information content using the abstract data structure comprises:

finding a token candidate in the first portion of the information content using a token delimiter indicator from a corresponding token identified in the abstract data structure;

generating a signature of the token candidate;

comparing the signature of the token candidate with a signature of the corresponding token from the abstract data structure; and

adding the token candidate to the first set of tokens if the signature of the token candidate matches the signature of the corresponding token from the abstract data structure.

7. The method of claim 5 wherein the token delimiter indicator comprises a value of a first character of the relevant token and the length of the relevant token.

8. The method of claim 7 further comprising:

maintaining all token delimiter indicators as an index with an index key being a value of a first character.

9. The method of claim 1 further comprising:

upon receiving the information content, converting character encodings associated with the information content into a Unicode standard.

10. The method of claim 5 further comprising:

prior to creating the abstract data structure, converting character encodings associated with the source data into a Unicode standard.

11. A computer-implemented method comprising:

identifying source data to be protected, the source data having a tabular format, the source data comprising one or more fragments in a character-based language, wherein the character-based language does not provide visual delimiters between words in the one or more fragments;

creating an abstract data structure from the source data, wherein creating the abstract data structure comprises;

identifying a plurality of tokens within the source data based on the tabular format,

creating a signature for each of the plurality of tokens, and

for each token in the character-based language, creating a token delimiter indicator; and

providing the abstract data structure to a data monitoring system to detect violations of one or more policies in information content containing data in the character-based language, the one or more policies being defined to protect the source data.

12. The method of claim 11 wherein the token delimiter indicator comprises a value of a first character of the relevant token and the length of the relevant token.

13. The method of claim 12 further comprising:

maintaining all token delimiter indicators as an index with an index key being a value of a first character.

14. The method of claim 11 wherein the character-based language is any one of the Japanese language or the Chinese language.

15. A system comprising:

a natural language identifier to receive information content having at least a first portion in a character-based language; and

a data monitoring component, coupled with the natural language identifier, to identify a policy for protecting source data having a tabular format, the source data containing one or more data fragments in the character-based language, wherein the character-based language does not provide visual delimiters between words in the one or more data fragments, and to determine whether any part of the information content, including the first portion in the character-based language, violates the policy.

16. The system of claim 15 wherein the data monitoring component comprises:

a tokenizer to generate a first set of tokens from the first portion of the information content using an abstract data structure derived from the source data, and to generate a second set of tokens from an information content portion in a word-based language using natural delimiters; and

a search engine, coupled to the tokenizer, to determine whether the first and second sets of tokens include fragments from any one or more rows from the source data.

17. The system of claim 16 further comprising a policy management system component, coupled to the data monitoring component, to create the abstract data structure by

identifying a plurality of tokens within the source data based on the tabular format,

for each token in a word-based language, creating a signature of a relevant token, and adding the signature to the abstract data structure, and

for each token in the character-based language, creating a token delimiter indicator and a signature of a relevant token, and adding the token delimiter indicator and the signature to the abstract data structure.

18. The system of claim 17 wherein the token delimiter indicator comprises a value of a first character of the relevant token and the length of the relevant token.

19. The system of claim 15 further comprising:

a Unicode converter, coupled to the natural language identifier, to convert character encodings associated with the information content into a Unicode standard.

20. A non-transitory computer readable storage medium that provides instructions, which when executed on a processing system cause the processing system to perform a method comprising:

identifying a policy for protecting source data having a tabular format, the source data containing one or more data fragments in a character-based language, wherein the character-based language does not provide visual delimiters between words in the one or more data fragments;

receiving information content having at least a first portion in the character-based language; and

determining whether any part of the information content, including the first portion in the character-based language, violates the policy.

21. The non-transitory computer readable storage medium of claim 20 wherein determining whether any part of the information content, including the first portion in the character-based language, violates the policy further comprises:

generating a first set of tokens from the first portion of the information content using an abstract data structure derived from the source data;

generating a second set of tokens from an information content portion in a word-based language using natural delimiters; and

determining whether the first and second sets of tokens include fragments from any one or more rows from the source data.

22. The non-transitory computer readable storage medium of claim 21 wherein:

the abstract data structure is created to provide an index of the source data, the index comprising signatures of data fragments within the source data; and

creating the abstract data structure comprises

identifying a plurality of tokens within the source data based on the tabular format,

for each token in a word-based language, creating a signature of a relevant token, and adding the signature to the abstract data structure, and

for each token in the character-based language, creating a token delimiter indicator and a signature of a relevant token, and adding the token delimiter indicator and the signature to the abstract data structure.

23. The non-transitory computer readable storage medium of claim 22 wherein generating a first set of tokens from the first portion of the information content using the abstract data structure comprises:

finding a token candidate in the first portion of the information content using a token delimiter indicator from a corresponding token identified in the abstract data structure;

generating a signature of the token candidate;

comparing the signature of the token candidate with a signature of the corresponding token from the abstract data structure; and

adding the token candidate to the first set of tokens if the signature of the token candidate matches the signature of the corresponding token from the abstract data structure.

24. The non-transitory computer readable storage medium of claim 23 wherein the token delimiter indicator comprises a value of a first character of the relevant token and the length of the relevant token.

25. The non-transitory computer readable storage medium of claim 20 wherein the method further comprises:

upon receiving the information content, converting character encodings associated with the information content into a Unicode standard.