Secure data redaction and masking in intercepted data interactions

Patent metadata

Field	Value
Publication number	US-10057287-B2
Application number	US-201514837104-A
Country	US
Kind code	B2
Filing date	Aug 27, 2015
Priority date	Nov 25, 2014
Publication date	Aug 21, 2018
Grant date	Aug 21, 2018

Abstract

A method for modifying intercepted data interactions is provided in the illustrative embodiments. At a security application executing in a security data processing system, an intercepted packet of data arranged according to a protocol is received from an intercepting agent executing in an intercepting data processing system. A security policy is applied to the intercepted packet. In an instruction according to a coding grammar, a modification of the intercepted packet is encoded. The instruction is suited for the encoding under a circumstance of the modifying. The instruction is sent to the intercepting agent. The intercepting agent at the intercepting data processing system performs the modification according to the security policy and independently of the protocol.

First claim

What is claimed is:

1. A method for modifying intercepted data, the method comprising:
receiving, at a security application executing in a security data processing system from an intercepting agent executing in an intercepting data processing system, an intercepted packet of data arranged according to a protocol;
applying, by the security data processing system, a security policy to the intercepted packet to determine whether data of the intercepted packet is non-compliant with a set of security policies;
receiving, by the security data processing system, an indication of a network condition and a plurality of coding grammars, the indication of the network condition including a network traffic throughput metric;
selecting, by the security data processing system, a selected coding grammar from the plurality of coding grammars based, at least in part, upon the network traffic throughput metric, wherein the selected coding grammar comprises a representation of a combination of an operation and a data fragment, the combination being positioned at a position in the intercepted packet;
responsive to a determination that data of the intercepted packet is non-compliant with the set of security policies, generating using a processor and a memory by the security data processing system and according to the selected coding grammar, an instruction designed to cause a modification of the intercepted packet to make a revised packet that is compliant with the set of security policies; and
sending the instruction from the security data processing system to the intercepting agent.

2. The method of claim 1 , further comprising:
determining whether the network condition exceeds a threshold, wherein the generating and the sending are responsive to the determining being negative, the network condition being present in a data network used in a data communication between the security data processing system and the intercepting data processing system.

3. The method of claim 1 , further comprising:
receiving an indication of a system condition, the system condition being present in the intercepting data processing system;
determining whether the system condition exceeds a threshold, wherein the generating and the sending are responsive to the determining being negative.

4. The method of claim 1 , further comprising:
receiving an indication of a system condition, the system condition being present in the security data processing system;
determining whether the system condition exceeds a threshold, wherein the generating and the sending are responsive to the determining being affirmative.

5. The method of claim 1 , further comprising:
receiving, at the security application from the intercepting agent, a second intercepted packet of data arranged according to the protocol;
evaluating that a system condition in the intercepting data processing system prevents performing a second modification in the second intercepted packet at the intercepting data processing system; and
performing, responsive to the evaluating, the modification according to a second security policy at the security data processing system.

6. The method of claim 1 , further comprising:
selecting the coding grammar from a plurality of coding grammars applicable to the intercepted packet;
instructing the intercepting agent to use the coding grammar in decoding the instruction to perform the modification according to the security policy.

7. The method of claim 6 , the instructing comprising:
using a coding scheme to encode the instruction such that the coding scheme is indicative of the coding grammar used to encode the instruction.

8. The method of claim 6 , further comprising:
comparing a size of a first instruction according to a first coding grammar and a size of a second instruction according to a second coding grammar, wherein the first instruction and the second instruction are each sufficient to perform the modification at the intercepting data processing system; and
selecting the smaller of the first instruction and the second instruction as the instruction and the corresponding coding grammar as the coding grammar.

9. The method of claim 8 , further comprising:
concluding that a network condition in a data network data network used in a data communication between the security data processing system and the intercepting data processing system is within a tolerance level of a threshold for the network condition, wherein the comparing and the selecting the smaller of the first instruction and the second instruction are responsive to the concluding.

10. The method of claim 6 , further comprising:
comparing a first complexity metric of a first instruction according to a first coding grammar and a second complexity metric of a second instruction according to a second coding grammar, wherein the first instruction and the second instruction are each sufficient to perform the modification at the intercepting data processing system; and
selecting, responsive to the first complexity metric being smaller than the second complexity metric, the first instruction as the instruction and the first coding grammar as the coding grammar.

11. The method of claim 1 , further comprising:
determining a complexity metric of a complexity of the modification of the intercepted protocol packet;
determining whether the complexity metric exceeds a threshold, wherein the encoding and the sending are responsive to the determining being negative.

12. The method of claim 1 , further comprising:
analyzing the protocol packet to select the security policy, wherein the applying the security policy to the intercepted protocol packet comprises validating data of the protocol packet according to the security policy.

Assignees

• IBM

Inventors

• Rodniansky Leonid

Classifications

• H04L67/322

  Electricity · mapped topic

• H04L63/166 Primary

  at the transport layer · CPC title

• H04L63/0245

  Filtering by information in the payload · CPC title

• H04L69/06

  Notations for structuring of protocol data, e.g. abstract syntax notation one [ASN.1] · CPC title

• H04L63/20 Primary

  for managing network security; network security policies in general (filtering policies H04L63/0227) · CPC title