Methods and systems for preventing transmission of sensitive data from a remote computer device

• US 9,959,417 B2
• Filed: 06/22/2015
• Issued: 05/01/2018
• Est. Priority Date: 11/18/2008
• Status: Active Grant

• Current Assignee: Freedom Solutions Group, LLC
• Original Assignee: Workshare Technology Incorporated
• Inventors: More, Scott, Beyer, Ilya
• Primary Examiner(s): NGUYEN, TRONG H
• Application Number:
  US14/745,656
• Publication Number:
  US 20150286831A1
• Time in Patent Office: 1,044 Days
• CPC Class Codes: G06F 21/554 involving event detection and direct action
• CPC Class Codes: G06F 21/62 Protecting access to data via a platform, e.g. using keys or access control rules
• CPC Class Codes: G06F 21/6245 Protecting personal data, e.g. for financial or medical purposes
• CPC Class Codes: H04L 51/212 using filtering or selective blocking
• CPC Class Codes: H04L 63/083 using passwords cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources

Abstract

A technique for preventing selected sets of data words from unauthorized transmission out of the secure perimeter of a computer system is disclosed. A set of security rules is applied to an outgoing data message and if one of the set of rules is triggered, at least a portion of the message is transmitted to a central server that is within the secure perimeter, for scanning by another set of security rules. The central server then sends a security command back to the remote device, which executes the security command before transmitting the outgoing message out of the secure perimeter of the computer system.

Claims

1. A computer system secured against unauthorized external communications of data items from an egress point of the system, the system comprising:

a memory;

a central server;

at least one remote device connected to the central server by a data network, wherein the remote device is authorized to communicate with the central server using the data network, the remote device comprised of a local data scanning component, wherein the local data scanning component is configured by logic to inspect data comprising content of an outgoing message stored on the remote device to determine if the outgoing message is comprised of data indicating a message destination accessed through the egress point and in dependence on the determination and prior to permitting transmission of the outgoing message, scan the data comprising the content of the outgoing message using a first at least one security rule stored locally on the remote device and in case of the scan resulting in triggering said first at least one security ride, transmit a portion of the data comprising the content of the outgoing message to the central server;

wherein the central server is further comprised of a security component that is adapted by logic to receive the transmitted portion of the data comprising the content of the outgoing message, determine a security action by scanning the received transmitted portion of the data comprising the content of the outgoing message using a second at least one security rule stored on the central server and transmit, to the remote device, data representing a command encoding the determined security action, wherein the remote device is further configured by logic to execute the determined security action on the outgoing message prior to permitting transmission of the outgoing message through the egress point.

2. The system of claim 1, wherein the first at least one security rule is a data structure encoding a logical test for determining whether a predetermined set of words is present within the outgoing message.

3. The system of claim 1, wherein the first at least one security rule is a data structure encoding a logical test for determining whether a subset of a predetermined set of words is present within the outgoing message, said subset being selected by utilizing a heuristic engine that applies a heuristic word selection rule.

4. The system of claim 3, wherein the heuristic word selection rule is comprised of:

skipping over a first word from a plurality of words when the first word matches a first stop word of a plurality of stop words.

5. The system of claim 3, wherein the heuristic word selection rule is comprised of:

skipping over a second word from a plurality of words when the second word has a word-length that is shorter than a first word-length of a shortest registered entity of a plurality of compressed registered entities.

6. The system of claim 3, wherein the heuristic word selection rule is comprised of:

skipping over a third word from a plurality of words when the third word has a word-length that is longer than a second word-length of a longest registered entity of a plurality of compressed registered entities.

7. The system of claim 1, wherein the local data scanning component is further configured by logic to convert a portion of the outgoing message into a canonical format prior to running the scan, wherein the canonical format causes the local data scanning component to be impervious to differences in digital format and character encoding.

8. The system of claim 1, wherein the first at least one security rule corresponds to either at least one corresponding word or at least one corresponding data type that is to be secured from unauthorized transmission.

9. The system of claim 1, wherein the determined security action is comprised of:

preventing the portion of the data comprising the content of the outgoing message from being disclosed through the egress point.

10. The system of claim 1, wherein the local data scanning component is further configured by logic to scan the outgoing message using the first at least one security rule to identify a set of at least one word of a predetermined set of words, wherein the portion of the data comprising the content of the outgoing message transmitted to the central server is the identified set of at least one word;

wherein the security component of the central server is further configured by logic to reduce a possibility that the identified set of at least one word is comprised of a false positive, and

wherein the central server is further configured by logic to automatically generate an acknowledgement message encoding whether each of the at least one word comprising the identified set of at least one word matches the second at least one security rule stored on the central server, transmit the acknowledgement message to the remote device; and

wherein the remote device is further configured by logic to perform the determined security action on the outgoing message before the outgoing message is transmitted through the egress point.

11. The system of claim 10, wherein the second at least one security rule stored on the central server encodes a logical condition dependent on one or more of an entity type associated with the portion of the data comprising the content of the outgoing message;

a location of the portion of the data comprising the content of the outgoing message within a particular document;

a data type associated with the portion of the data comprising the content of the outgoing message or an origin information of a particular document.

12. The system of claim 10, wherein the determined security action includes one or more of:

preventing the portion of the data comprising the content of the outgoing message from being transmitted through the egress point;

logging transmission of the portion of the data comprising the content of the outgoing message as a security violation;

requiring a password from a user to allow the portion of the data comprising the content of the outgoing message to be disclosed;

blocking access by a user who transmitted the portion of the data comprising the content of the outgoing message to a user of the remote device;

transmitting a security alert;

or

integration of the portion of the data comprising the content of the outgoing message with rights management information.

13. The system of claim 1, wherein the determined security action is comprised of:

logging transmission of the portion of the data comprising the content of the outgoing message as a security violation.

14. The system of claim 1, wherein the determined security action is comprised of:

requiring a password from a user to allow the portion of the data comprising the content of the outgoing message to be transmitted.

15. The system of claim 1, wherein the determined security action is comprised of:

blocking access by a user who transmitted the portion of the data comprising the content of the outgoing message to a user of the remote device.

16. The system of claim 1, wherein the determined security action is comprised of:

transmitting a security alert.

17. The system of claim 1, wherein the determined security action is comprised of:

integration of the portion of the data comprising the content of the outgoing message with rights management information.

18. A method executed by a computer system comprised of a central server and a remote computer connected to the central server by a data network, to secure the system against unauthorized external communications of data items from an egress point of the system, said method comprising:

using the remote computer to automatically inspect data comprising content of an outgoing message stored on the remote computer to determine if the outgoing message is comprised of data indicating a message destination accessed through the egress point and in dependence on the determination and prior to permitting transmission of the outgoing message, scan the data comprising the content of the outgoing message using a first at least one security rule stored locally on the remote computer and in case of the scan resulting in triggering said first at least one security rule, transmit a portion of the data comprising the content of the outgoing message data to the central server;

using the central server to receive the transmitted portion of the data comprising the content of the outgoing message, determine a security action by scanning the received transmitted portion of the data comprising the content of the outgoing message using a second at least one security rule stored on the central server and transmit, to the remote computer, data representing a command encoding the determined security action; and

using the remote computer to execute the determined security action on the outgoing message prior to permitting transmission of the outgoing message through the egress point.

19. The method of claim 18, wherein the first at least one security rule is a data structure encoding a logical test for determining whether a predetermined set of words is present within the outgoing message.

20. The method of claim 18, wherein the first at least one security rule is a data structure encoding a logical test for determining whether a subset of a predetermined set of words is present within the outgoing message, said subset being selected by utilizing a heuristic engine that applies a heuristic word selection rule.

21. The method of claim 20, wherein the heuristic word selection rule is comprised of one or more of:

skipping over a first word from a plurality of words when the first word matches a first stop word of a plurality of stop words;

skipping over a second word from a plurality of words when the second word has a word-length that is shorter than a first word-length of a shortest registered entity of a plurality of compressed registered entities;

or

skipping over a third word from a plurality of words when the third word has a word-length that is longer than a second word-length of a longest registered entity of a plurality of compressed registered entities.

22. The method of claim 18, further comprising:

using the remote computer to convert a portion of the outgoing message into a canonical format prior to running the scan, wherein the canonical format causes the remote computer to be impervious to differences in digital format and character encoding when the scan is run.

23. The method of claim 18, wherein the first at least one security rule corresponds to at least one corresponding entity word that is to be secured from unauthorized transmission.

24. The method of claim 18, wherein the determined security action includes one or more of:

preventing the portion of the data comprising the content of the outgoing message from being transmitted through the egress point;

logging transmission of the portion of the data comprising the content of the outgoing message as a security violation;

requiring a password from a user to allow the portion of the data comprising the content of the outgoing message to be transmitted;

blocking access by a user who transmitted the portion of the data comprising the content of the outgoing message to a user of the remote computer;

transmitting a security alert;

or

integration of the portion of the data comprising the content of the outgoing message with rights management information.

25. The method of claim 18, further comprising:

using the remote computer to scan the outgoing message using the first at least one security rule to identify a set of at least one word of a predetermined set of words, wherein the portion of the data comprising the content of the outgoing message transmitted to the central server is the identified set of at least one word;

using the central server to automatically generate an acknowledgement message encoding whether each of the at least one word in the identified set of at least one word matches a second at least one security rule stored on the central server, and

transmit the acknowledgement message to the remote computer; and

using the remote computer to perform the determined security action on the outgoing message before the outgoing message is transmitted through the egress point.

26. The method of claim 25, wherein the second at least one security rule stored on the central server encodes a logical condition dependent on one or more of an entity type associated with the portion of the data comprising the content of the outgoing message;

a location of the portion of the data comprising the content of the outgoing message within a particular document;

a data type associated with the portion of the data comprising the content of the outgoing message or an origin information of a particular document.

27. The method of claim 25, wherein the determined security action includes one or more of:

preventing the portion of the data comprising the content of the outgoing message from being transmitted through the egress point;

logging transmission of the portion of the data comprising the content of the outgoing message as a security violation;

requiring a password from a user to allow the portion of the data comprising the content of the outgoing message to be disclosed;

blocking access by a user who transmitted the portion of the data comprising the content of the outgoing message to a user of the remote computer;

transmitting a security alert;

or

integration of the portion of the data comprising the content of the outgoing message with rights management information.