Secure and scalable detection of preselected data embedded in electronically transmitted messages

• US 9,515,998 B2
• Filed: 01/08/2014
• Issued: 12/06/2016
• Est. Priority Date: 09/18/2002
• Status: Active Grant

• Current Assignee: CA, Inc. (d/b/a CA Technologies) (Broadcom, Inc.)
• Original Assignee: Symantec Corporation (NortonLifeLock Inc.)
• Inventors: Rowney, Kevin T.
• Primary Examiner(s): AVERY, JEREMIAH L
• Application Number:
  US14/150,639
• Publication Number:
  US 20140208421A1
• Time in Patent Office: 1,063 Days
• US Class Current: 1/1
• CPC Class Codes: G06F 16/242 Query formulation
• CPC Class Codes: G06F 21/606 by securing the transmission between two devices or processes
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00

Abstract

A method and apparatus for detecting preselected data embedded in electronically transmitted messages is described. In one embodiment, the method comprises monitoring messages electronically transmitted over a network for embedded preselected data and performing content searches on the messages to detect the presence of the embedded preselected data using an abstract data structure derived from the preselected data.

Claims

1. A computer-implemented method comprising:

identifying, by a policy management system comprising a first processor, data to be protected based on a security policy, wherein the data comprises tabular-formatted data comprising a plurality of cells;

deriving, by the policy management system, an abstract data structure from the identified data by generating an entry of the abstract data structure for a first cell of the plurality of cells of the tabular-formatted data based on a placement of the first cell in relation to the plurality of cells, wherein the entry comprises a row number of the first cell, a column number of the first cell, and a data type indicator associated with the first cell, and wherein the abstract data structure does not reveal sensitive data elements of the data; and

sending, by the policy management system, the abstract data structure and information regarding the security policy over a network to a message monitoring system comprising a second processor, to enable the message monitoring system to perform content searches on a plurality of messages electronically transmitted to reach respective destinations, the content searches to be performed based on the security policy to determine whether one or more of the plurality of searched messages contains at least a portion of the data to be protected using the entry of the abstract data structure for the first cell of the plurality of cells of the tabular-formatted data.

2. The method of claim 1, wherein the first cell of the data comprises data elements, and wherein deriving the abstract data structure comprises:

generating a hash code of a data element from the first cell; and

adding the hash code to the entry in the abstract data structure.

3. The method of claim 2, wherein deriving the abstract data structure further comprises:

generating an additional entry in the abstract data structure for an additional cell of the plurality of cells, the additional entry comprising a row number of the additional cell, a column number of the additional cell and a data type indicator associated with the additional cell;

determining that a data element from the additional cell is a string that is used by other cells; and

adding the data element from the additional cell to the additional entry.

4. The method of claim 2, further comprising:

generating entries in the abstract data structure for the plurality of cells of the tabular-formatted data; and

sorting the entries in a predetermined order.

5. The method of claim 1, wherein the data comprises data from a database, the method further comprising:

periodically querying the database to identify changes in the data; and

deriving a new abstract data structure based on the identified changes.

6. The method of claim 1, wherein the abstract data structure contains no copies of any data elements of the data to be protected.

7. The method of claim 1, wherein the abstract data structure comprises an index.

8. The method of claim 1, wherein the abstract data structure comprises a relative placement of data elements in a database in relation to other data elements in the database.

9. A non-transitory computer-readable storage medium that provides instructions that, when executed by a first processor of a policy management system, causes the policy management system to perform operations comprising:

identifying, by the policy management system, data to be protected based on a security policy, wherein the data comprises tabular-formatted data comprising a plurality of cells;

deriving, by the policy management system, an abstract data structure from the identified data by generating an entry of the abstract data structure for a first cell of the plurality of cells, wherein the entry comprises a row number of the first cell, a column number of the first cell, and a data type indicator associated with the first cell, and wherein the abstract data structure does not reveal sensitive data elements of the data; and

sending, by the policy management system, the abstract data structure and information regarding the security policy over a network to a message monitoring system comprising a second processor, to enable the message monitoring system to perform content searches on a plurality of messages electronically transmitted to reach respective destinations, the content searches to be performed based on the security policy to determine whether one or more of the plurality of searched messages contains at least a portion of the data to be protected using the entry of the abstract data structure for the first cell of the plurality of cells o the tabular-formatted data.

10. The non-transitory computer-readable storage medium of claim 9, wherein the first cell of the data comprises data elements, and wherein deriving the abstract data structure comprises:

generating a hash code of a data element from the first cell; and

adding the hash code to the entry in the abstract data structure.

11. The non-transitory computer-readable storage medium of claim 10, wherein deriving the abstract data structure further comprises:

generating an additional entry in the abstract data structure for an additional cell of the plurality of cells, the additional entry comprising a row number of the additional cell, a column number of the additional cell and a data type indicator associated with the additional cell;

determining that a data element from the additional cell is a string that is used by other cells; and

adding the data element from the additional cell to the additional entry.

12. The non-transitory computer-readable storage medium of claim 10, the operations further comprising:

generating entries in the abstract data structure for the plurality of cells of the tabular-formatted data; and

sorting the entries in a predetermined order.

13. The non-transitory computer-readable storage medium of claim 10, wherein the data comprises data from a database, the method further comprising:

periodically querying the database to identify changes in the data; and

deriving a new abstract data structure based on the identified changes.

14. The non-transitory computer-readable storage medium of claim 10, wherein the abstract data structure contains no copies of any data elements of the data to be protected.

15. The non-transitory computer-readable storage medium of claim 10, wherein the abstract data structure comprises an index.

16. The non-transitory computer-readable storage medium of claim 10, wherein the abstract data structure comprises a relative placement of data elements in a database in relation to other data elements in the database.

17. A policy management system comprising:

a memory; and

a first processor operatively coupled to the memory, the first processor configured to;

identify data to be protected based on a security policy, wherein the data comprises tabular-formatted data comprising a plurality of cells;

derive an abstract data structure from the identified data by generating an entry of the abstract data structure for a first cell of the plurality of cells of the tabular-formatted data based on a placement of the first cell in relation to the plurality of cells, wherein the entry comprises a row number of the first cell, a column number of the first cell, and a data type indicator associated with the first cell, and wherein the abstract data structure does not reveal sensitive data elements of the data; and

send the abstract data structure and information regarding the security policy over a network to a message monitoring system comprising a second processor, to enable the message monitoring system to perform content searches on a plurality of messages electronically transmitted to reach respective destinations, the content searches to be performed based on the security policy to determine whether one or more of the plurality of searched messages contains at least a portion of the data to be protected using the entry of the abstract data structure for the first cell of the plurality of cells of the tabular-formatted data.

18. The system of claim 17, wherein the first cell of the data comprises data elements, and wherein the processor is further configured to:

generate a hash code of a data element from the first cell; and

add the hash code to the entry in the abstract data structure.