Data leakage protection in cloud applications

• US 9,705,759 B2
• Filed: 02/23/2012
• Issued: 07/11/2017
• Est. Priority Date: 02/28/2011
• Status: Active Grant

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Liu, Xiao Xi, Huang, He Yuan, Hu, Qi, Zhang, Guan Qun
• Primary Examiner(s): Gee, Jason K
• Application Number:
  US13/403,397
• Publication Number:
  US 20120222110A1
• Time in Patent Office: 1,965 Days
• Field of Search: 726 22
• CPC Class Codes: H04L 43/028 by filtering
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00
• CPC Class Codes: H04W 4/60 Subscription-based services using application servers or record carriers, e.g. SIM application toolkits

Abstract

A computer-implemented method for data leakage protection is disclosed. A monitoring template corresponding to the cloud application is selected based upon communication between a user and a cloud application and from a plurality of monitoring templates. A monitor is generated using the selected monitoring template. Identifying information of content shared between the user and the cloud application is obtained using the generated monitor. Data about the shared content for security analysis is obtained according to the identifying information of the shared content.

Claims

1. A computer-implemented method within a data leakage protection hardware system positioned separate from and between a client and a cloud application, comprising:

receiving, from the client, a communication between the client and the cloud application;

selecting, from a plurality of monitoring templates and based upon the communication, a monitoring template corresponding to the cloud application;

receiving, from the cloud application, a response to the communication;

generating, using the selected monitoring template, a monitor;

revising the received response to include the monitor; and

forwarding the revised response to the client.

2. The method of claim 1, wherein

the monitor includes monitor codes configured to record input of shared content into a predetermined field within the response.

3. The method of claim 2, wherein

the monitor code is configured to be loaded by the client before codes contained in the received response.

4. The method of claim 2, wherein

the monitor codes are configured to perform an action based upon a specified event.

5. The method of claim 4, wherein

the specified event is an initiation of an operation to communicate the shared content.

6. The method of claim 4, wherein

the action includes at least one of

encrypting a sharing file,

adding a watermark to the sharing file, and

canceling an operation associated with the specified event.

7. The method of claim 1, wherein

the monitor is configured to:

capture an identifier of shared content, and

communicate the identifier of the shared content to an analyzer separate from the data leakage protection hardware system.

8. The method of claim 1, wherein

the analyzer is associated with an enterprise within which the client operates.

9. A data leakage protection hardware system positioned separate from and between a client and a cloud application, comprising:

a computer hardware processor configured to initiate the following operations;

receiving, from the client, a communication between the client and the cloud application;

selecting, from a plurality of monitoring templates and based upon the communication, a monitoring template corresponding to the cloud application;

receiving, from the cloud application, a response to the communication;

generating, using the selected monitoring template, a monitor;

revising the received response to include the monitor; and

forwarding the revised response to the client.

10. The data leakage protection hardware system of claim 9, wherein

the monitor includes monitor codes configured to record input of shared content into a predetermined field within the response.

11. The data leakage protection hardware system of claim 10, wherein

the monitor code is configured to be loaded by the client before codes contained in the received response.

12. The data leakage protection hardware system of claim 10, wherein

the monitor codes are configured to perform an action based upon a specified event.

13. The data leakage protection hardware system of claim 9, wherein

the monitor is configured to:

capture an identifier of shared content, and

communicate the identifier of the shared content to an analyzer separate from the data leakage protection hardware system.

14. The data leakage protection hardware system of claim 9, wherein

the analyzer is associated with an enterprise within which the client operates.

15. A computer program product, comprising

a computer usable hardware storage device having computer usable program code stored therein,

the computer usable program code, which when executed by a data leakage protection hardware system positioned separate from and between a client and a cloud application, causes the data leakage protection hardware system to perform:

receiving, from the client, a communication between the client and the cloud application;

selecting, from a plurality of monitoring templates and based upon the communication, a monitoring template corresponding to the cloud application;

receiving, from the cloud application, a response to the communication;

generating, using the selected monitoring template, a monitor;

revising the received response to include the monitor; and

forwarding the revised response to the client.

16. The computer program product of claim 15, wherein

the monitor includes monitor codes configured to record input of shared content into a predetermined field within the response.

17. The computer program product of claim 16, wherein

the monitor code is configured to be loaded by the client before codes contained in the received response.

18. The computer program product of claim 16, wherein

the monitor codes are configured to perform an action based upon a specified event.

19. The computer program product of claim 15, wherein

the monitor is configured to:

capture an identifier of shared content, and

communicate the identifier of the shared content to an analyzer separate from the data leakage protection hardware system.

20. The computer program product of claim 15, wherein

the analyzer is associated with an enterprise within which the client operates.