Method and apparatus for detecting policy violations in a data repository having an arbitrary data schema

• US 8,255,370 B1
• Filed: 06/24/2011
• Issued: 08/28/2012
• Est. Priority Date: 03/28/2008
• Status: Active Grant

• Current Assignee: CA, Inc. (d/b/a CA Technologies) (Broadcom, Inc.)
• Original Assignee: Symantec Corporation (NortonLifeLock Inc.)
• Inventors: Zoppas, Michel, Hermann, Jeremy, O'Raghallaigh, Conal, Bothwell, Eric, Fontana, Alexander
• Primary Examiner(s): Corrielus, Jean M
• Application Number:
  US13/168,926
• Time in Patent Office: 431 Days
• Field of Search: 707/694, 707/783, 707/785, 707/784, 707/786, 726/26, 726/35, 726/1, 726/3, 726/14, 709/223, 709/230
• US Class Current: 707/694
• CPC Class Codes: G06F 16/24565 Triggers; Constraints
• CPC Class Codes: G06F 21/10 Protecting distributed programs or content, e.g. vending or licensing of copyrighted material protection in video systems or pay television H04N7/16 ; Digital rights management [DRM]
• CPC Class Codes: G06F 21/554 involving event detection and direct action
• CPC Class Codes: G06F 21/556 involving covert channels, i.e. data leakage between processes inhibiting the analysis of circuitry or operation with measures against power attack G06F21/755
• CPC Class Codes: G06F 21/577 Assessing vulnerabilities and evaluating computer system security
• CPC Class Codes: G06F 21/6209 to a single file or object, e.g. in a secure envelope, encrypted and accessed using a key, or with access control rules appended to the object itself
• CPC Class Codes: G06F 2221/2141 Access rights, e.g. capability lists, access control lists, access tables, access matrices

Abstract

A method and apparatus for scanning structured data from a data repository having an arbitrary data schema and for applying a policy to the data of the data repository are described. In one embodiment, the structured data is converted to unstructured text data to allow a schema-independent policy to be applied to the text data in order to detect a policy violation in the data repository regardless of the data schema used by the data repository.

Claims

1. A computer-implemented method, comprising:

identifying, by a computer system, structured data stored in a data repository having an arbitrary data schema, the arbitrary data schema of the data repository being unknown;

scanning the structured data of the data repository;

converting the structured data into text data; and

applying a schema-independent policy to the converted text data to detect confidential information stored in the data repository regardless of the arbitrary data schema of the structured data, wherein the schema-independent policy is a data loss prevention policy, and wherein a policy violation is triggered when the converted text data contains confidential information.

2. The method of claim 1, wherein applying the data loss prevention policy comprises detecting confidential data that is otherwise hidden in the data repository due to the arbitrary data schema of the data repository.

3. The method of claim 1, wherein scanning the structured data comprises identifying the structured data as containing one of text, numbers, or binary data, and wherein converting the structured data comprises converting the text, numbers, or binary data into text data.

4. The method of claim 1, wherein scanning the structured data further comprises:

analyzing the arbitrary data schema to determine logical units of data of the data repository;

reading the structured data by the logical units of data; and

generating a message containing the converted text data that is read from the data repository.

5. The method of claim 1, wherein scanning the structured data further comprises:

querying the data repository to derive the arbitrary data schema of the data repository;

reading data from the data repository according to the derived data schema; and

generating a message containing the converted text data that is read from the data repository.

6. The method of claim 5, further comprising sending the message to a detection engine to detect whether there is a policy violation in the message by applying the schema-independent policy to the converted text data of the message.

7. The method of claim 5, further comprising receiving user input concerning the data repository to which to apply the policy.

8. The method of claim 7, wherein receiving the user input comprises at least one of a connect string that includes information about how to connect to the data repository, credentials for the data repository, or vendor information for the data repository from the user.

9. The method of claim 7, further comprising receiving a query from the user to query specific information from the data repository.

10. The method of claim 1, wherein the data repository is a database, and wherein scanning the structured data comprises:

connecting to the database using a connect string;

query a set of table names of the database;

for each table, read column names of table;

for each table, identify each column in database as one of text, numbers, or binary data; and

for each row in the table, read all cells in that row.

11. The method of claim 10, further comprising:

for each row in the table, constructing a text block containing the column names, text of cells that are in text, text representation of cells that are numbers;

for each row in the table, creating a message containing the constructed text block and the binary data from each cell containing binary data, if any; and

for each row in the table, sending the message to a detection engine that detects whether there is a policy violation in the message by applying the policy to the converted text data of the message.

12. The method of claim 11, wherein creating the message further comprises converting the cell containing binary data into text data, and wherein the converted text data remains associated with the message.

13. The method of claim 1, further comprising reporting the policy violation when detected, wherein reporting the policy violation comprises identifying a location of the structured data that triggered the policy violation.

14. An apparatus, comprising:

a data repository having an arbitrary data schema; and

a scan agent, coupled to the data repository, to access data stored in the data repository, to derive the arbitrary data schema of the data repository, the arbitrary data schema of the data repository being unknown, to scan the data of the data repository, and to convert the data of the data repository into text data to allow application of a schema-independent policy to the converted text data of the data repository to detect confidential data stored in the data repository regardless of the arbitrary data schema of the structured data, wherein the schema-independent policy is a data loss prevention policy, and wherein a policy violation is triggered when the converted text data contains confidential information.

15. The apparatus of claim 14, wherein the scan agent is further to identify the data as containing one of text, numbers, or binary data, and to convert the text, numbers, or binary data into text data, and to generate a message containing the converted text data and send the message to a detection engine to detect whether the message contains confidential data.

16. The apparatus of claim 14, further comprising the detection engine, coupled to the scan agent, to apply the data loss prevention policy to the converted text data of the message to detect whether the message contains confidential data, wherein the data loss prevention policy is a schema-independent policy.

17. A computer-readable storage medium having instructions stored thereon that when executed by a computer cause the computer to perform a method, comprising:

identifying, by a computer system, structured data stored in a data repository having an arbitrary data schema, the arbitrary data schema of the data repository being unknown;

scanning the structured data of the data repository;

converting the structured data into text data; and

applying a schema-independent policy to the converted text data to detect confidential information stored in the data repository regardless of the arbitrary data schema of the structured data, wherein the schema-independent policy is a data loss prevention policy, and wherein a policy violation is triggered when the converted text data contains confidential data.

18. The computer-readable storage medium of claim 17, wherein applying the data loss prevention policy comprises detecting confidential data that is otherwise hidden in the data repository due to the arbitrary data schema of the data repository.