Personal computing device-based mechanism to detect preselected data

• US 8,751,506 B2
• Filed: 09/27/2011
• Issued: 06/10/2014
• Est. Priority Date: 05/06/2003
• Status: Active Grant

• Current Assignee: CA, Inc. (d/b/a CA Technologies) (Broadcom, Inc.)
• Original Assignee: Symantec Corporation (NortonLifeLock Inc.)
• Inventors: Rowney, Kevin T., Wolfe, Michael R., Gopalakrishnan, Mythili, Fridman, Vitall A.
• Primary Examiner(s): Mofiz, Apu
• Assistant Examiner(s): DAYE, CHELCIE L
• Application Number:
  US13/246,774
• Publication Number:
  US 20120016884A1
• Time in Patent Office: 987 Days
• Field of Search: 707/3, 707/711, 707/747, 707/694, 709/225, 709/229
• US Class Current: 707/747
• CPC Class Codes: G06F 16/24568 Data stream processing; Continuous queries
• CPC Class Codes: G06F 21/554 involving event detection and direct action
• CPC Class Codes: G06Q 10/107 Computer-aided management of electronic mailing [e-mailing]

Abstract

A method and apparatus for detecting pre-selected data stored on a personal computing device is described. In one embodiment, contents of data storage media of a personal computing device are searched for pre-selected sensitive data. In one embodiment, if at least a portion of the pre-selected sensitive data is detected, a notification of the detection of the pre-selected data is sent to a system via a network. In another embodiment, if at least a portion of pre-selected sensitive data is detected, the access to this data is blocked.

Claims

1. A method comprising:

identifying, by a client device, an index of database data to be protected, the database data comprising sensitive data elements and the index comprising positional information identifying relative placement of the sensitive data elements of the database data in relation to other sensitive data elements of the database data, wherein the index does not reveal the sensitive data elements of the database data, and wherein one or more entries in the index comprise a row number of a cell in the database data and a pre-generated hash or encryption of a sensitive data element in the cell in the database data;

determining, by the client device, whether at least a portion of the database data is possibly contained within information content; and

in response to determining that a portion of the database data is possibly contained within the information content, performing, by the client device, a search of the information content for at least a portion of the database data using the index, wherein performing the search of the information content comprises;

searching the index to identify entries in the index that comprise pre-generated hashes or encryptions of the sensitive data elements that correspond to hashes or encryptions of content fragments from the information content;

determining one or more groups of content fragments, wherein at least one group comprises content fragments associated with hashes or encryptions that correspond to pre-generated hashes or encryptions of entries in the index comprising a same row number; and

determining that the received information content contains at least a portion of the database data if any group satisfies at least one criterion.

2. The method of claim 1, wherein the at least one criterion comprises a quantity threshold that is satisfied if any group comprises a quantity of content fragments that meets or exceeds the quantity threshold.

3. The method of claim 1, wherein each entry in the index further comprises a column number of the cell, and wherein the at least one criterion comprises a threshold that is satisfied if any group comprises content fragments from a number of different columns that meets or exceeds the threshold.

4. The method of claim 1, wherein determining the groups of content fragments comprises:

parsing individual lines of text in the information content into the content fragments, wherein each content fragment is one of a word or a phrase; and

for each individual line of text, performing the following;

generating hashes of each of the content fragments in the line;

comparing the hashes of the content fragments in the line to the pre-generated hashes to identify matching entries of the index; and

arranging the content fragments in the line into the groups based on row numbers associated with the matching entries.

5. The method of claim 1, wherein the database data is maintained in at least one of a spreadsheet or a flat file, the method further comprising:

determining that a portion of the information content matches a portion of the database data; and

sending, to a server, a notification of the detection of the portion of the database data in the information content.

6. The method of claim 1, wherein determining that a portion of the database data is possibly contained within the information content comprises:

searching a body of the information content for an expression comprising a predefined format using a search rule that defines the predefined format, wherein the expression comprising the predefined format is any one of an account number, a social security number, a credit card number, a phone number, a postal code, an email address, a currency amount, or a driver'"'"'s license number; and

determining that a region surrounding the expression may contain a portion of the database data, wherein the region surrounding the expression comprises a quantity of contiguous data fragments before the expression and a quantity of contiguous data fragments after the expression.

7. The method of claim 1, wherein the information content is a document stored on a storage medium of the client device.

8. The method of claim 1, wherein the index contains copies of at least some common strings and numbers from the database data.

9. The method of claim 1, wherein determining that a portion of the database data is possibly contained within the information content comprises determining that the information content comprises a sequence of content fragments that resembles column-formatted data.

10. The method of claim 1, wherein determining that a portion of the database data is possibly contained within the information content comprises determining that a word distribution in the information content resembles a statistical pattern that indicates a possible containment of the database data.

11. A non-transitory computer readable storage medium including instructions that, when executed by a processing device, cause the processing device to perform operations comprising:

identifying, by the processing device, an index of database data to be protected, the database data comprising sensitive data elements, the index comprising positional information identifying relative placement of the sensitive data elements of the database data in relation to other sensitive data elements of the database data, wherein the index does not reveal the sensitive data elements of the database data, and wherein one or more entries in the index comprise a row number of a cell of the database data and a pre-generated hash or encryption of a sensitive data element in the cell of the database data;

determining, by the processing device, whether at least a portion of the database data is possibly contained within information content; and

in response to determining that a portion of the database data is possibly contained within the information content, performing, by the processing device, a search of the information content for at least a portion of the database data using the index, wherein performing the search of the information content comprises;

searching the index to identify entries in the index that comprise pre-generated hashes or encryptions of the sensitive data elements that correspond to hashes or encryptions of content fragments from the information content;

determining one or more groups of content fragments, wherein at least one group comprises content fragments associated with hashes or encryptions that correspond to pre-generated hashes or encryptions of entries in the index comprising a same row number; and

determining that the received information content contains at least a portion of the database data if any group satisfies at least one criterion.

12. The non-transitory computer readable storage medium of claim 11, wherein the at least one criterion comprises a quantity threshold that is satisfied if any group comprises a quantity of content fragments that meets or exceeds the quantity threshold.

13. The non-transitory computer readable storage medium of claim 11, wherein each entry in the index further comprises a column number of the cell, and wherein the at least one criterion comprises a threshold that is satisfied if any group comprises content fragments from a number of different columns that meets or exceeds the threshold.

14. The non-transitory computer readable storage medium of claim 11, wherein determining the groups of content fragments comprises:

parsing individual lines of text in the information content into the content fragments, wherein each content fragment is one of a word or a phrase; and

for each individual line of text, performing the following;

generating hashes of each of the content fragments in the line;

comparing the hashes of the content fragments in the line to the pre-generated hashes to identify matching entries of the index; and

arranging the content fragments in the line into the groups based on row numbers associated with the matching entries.

15. The non-transitory computer readable storage medium of claim 11, wherein determining that a portion of the database data is possibly contained within the information content comprises determining that the information content comprises a sequence of content fragments that resembles column-formatted data.

16. A computing device comprising:

a memory to store instructions for protecting database data; and

a processing device, coupled to the memory, to execute the instructions, wherein the processing device is to;

identify an index of database data, the database data comprising sensitive data elements, the index comprising positional information identifying relative placement of the sensitive data elements of the database data in relation to other sensitive data elements of the database data, wherein the index does not reveal the sensitive data elements of the database data, and wherein one or more entries in the index comprise a row number of a cell in the database data and a pre-generated hash or encryption of a sensitive data element in the cell;

determine whether at least a portion of the database data is possibly contained within information content; and

in response to determining that a portion of the database data is possibly contained within the information content, perform a search of the information content for at least a portion of the database data using the index, wherein performing the search of the information content comprises;

searching the index to identify entries in the index that comprise pre-generated hashes or encryptions of the sensitive data elements that correspond to hashes or encryptions of content fragments from the information content;

determining one or more groups of content fragments, wherein at least one group comprises content fragments associated with hashes or encryptions that correspond to pre-generated hashes or encryptions of entries in the index comprising a same row number; and

determining that the received information content contains at least a portion of the database data if any group satisfies at least one criterion.