Data leak protection

Patent metadata

Field	Value
Publication number	US-10237282-B2
Application number	US-201815859705-A
Country	US
Kind code	B2
Filing date	Jan 1, 2018
Priority date	Jun 28, 2012
Publication date	Mar 19, 2019
Grant date	Mar 19, 2019

Abstract

Methods and systems for Data Leak Prevention (DLP) in an enterprise network are provided. According to one embodiment, a network security device maintains a filter database containing multiple filtering rules. Each filtering rule specifies a watermark value, a set of network services for which the filtering rule is active and an action to be taken. Network traffic directed to a destination residing outside of an enterprise network, associated with a particular network service and containing a file is received. A watermark value embedded within the file is identified. When there exists a filtering rule specifying a matching watermark value and for which the filtering rule is active for the particular network service, the action specified by the filtering rule is performed.

First claim

What is claimed is:

1. A data leak protection method comprising:
maintaining, by a network security device protecting an enterprise network, a filter database containing a plurality of filtering rules, wherein each filtering rule of the plurality of filtering rules specifies a watermark value, a set of network services for which the filtering rule is active and an action to be taken by the network security device, wherein the network services comprise one or more of a web-based electronic mail (email) service, Simple Mail Transfer Protocol (SMTP), Internet Message Access Protocol (IMAP), Post Office Protocol 3 (POP3), an instant messaging program, a file sharing service and a device synchronization service;
receiving, by the network security device, network traffic originated within the enterprise network, wherein the network traffic is directed to a destination residing outside of the enterprise network, is associated with a particular network service and contains a file;
identifying, by the network security device, a watermark value embedded within the file;
determining, by the network security device, whether there exists a filtering rule of the plurality of filtering rules specifying a watermark value matching the watermark value embedded within the file and for which the filtering rule is active for the particular network service; and
when said determining is affirmative, then performing, by the network security device, the action specified by the filtering rule.

2. The method of claim 1 , wherein the action includes one or more of (i) logging information associated with observation of the file, (ii) blocking the file, (iii) quarantining a user associated with the file, (iv) quarantining an Internet Protocol (IP) address associated with a sender of the file and (v) quarantining an interface of the network security device through which the file was received.

3. The method of claim 1 , wherein the watermark value comprises a result of a hash function or a message-digest algorithm performed on a watermark payload including one or more of information specifying a user with which the file is associated, information specifying a company with which the file is associated and information specifying a sensitivity level of the file.

4. The method of claim 3 , wherein the hash function comprises a Fowler-Noll-Vo hash function.

5. The method of claim 3 , wherein the result of the hash function or the message-digest algorithm is further converted to Base-64 encoding.

6. The method of claim 3 , further comprising, prior to said receiving, embedding, by a separate client program, the watermark value into the file responsive to the file being identified as one that is to be protected.

7. The method of claim 6 , wherein the separate client program comprises a command-line client program that receives as an input parameter\ one or more of a name of the file, a company identifier and the sensitivity level.

8. The method of claim 6 , wherein the separate client program comprises a command-line client program that receives as an input parameter one or more of a name of a directory in which the file resides within a file system, a company identifier and the sensitivity level.

9. The method of claim 6 , further comprising identifying, by the separate client program, a file type of the file, and wherein said embedding the watermark value into the file is based upon the file type.

10. The method of claim 9 , wherein:
when the file type indicates the file is a Portable Document Format (PDF) file, then said embedding the watermark value into the file includes inserting the watermark value within a watermark section immediately before a last cross reference table found within the file; and
when the file type indicates the file comprises a zip file containing extensible markup language (XML) files, then embedding the watermark value into the file includes adding the watermark value as a new property tag.

11. A non-transitory program storage device readable by a network security device protecting an enterprise network, embodying a program of instructions executable by one or more computer processors of the network security device to perform a method of data leak protection, the method comprising:
maintaining a filter database containing a plurality of filtering rules, wherein each filtering rule of the plurality of filtering rules specifies a watermark value, a set of network services for which the filtering rule is active and an action to be taken by the network security device, wherein the network services comprise one or more of a web-based electronic mail (email) service, Simple Mail Transfer Protocol (SMTP), Internet Message Access Protocol (IMAP), Post Office Protocol 3 (POP3), an instant messaging program, a file sharing service and a device synchronization service;
receiving network traffic originated within the enterprise network, wherein the network traffic is directed to a destination residing outside of the enterprise network, is associated with a particular network service and contains a file;
identifying a watermark value embedded within the file;
determining whether there exists a filtering rule of the plurality of filtering rules specifying a watermark value matching the watermark value embedded within the file and for which the filtering rule is active for the particular network service; and
when said determining is affirmative, then performing the action specified by the filtering rule.

12. The non-transitory program storage device of claim 11 , wherein the action includes one or more of (i) logging information associated with observation of the file, (ii) blocking the file, (iii) quarantining a user associated with the file, (iv) quarantining an Internet Protocol (IP) address associated with a sender of the file and (v) quarantining an interface of the network security device through which the file was received.

13. The non-transitory program storage device of claim 11 , wherein the watermark value comprises a result of a hash function or a message-digest algorithm performed on a watermark payload including one or more of information specifying a user with which the file is associated, information specifying a company with which the file is associated and information specifying a sensitivity level of the file.

14. The non-transitory program storage device of claim 13 , wherein the hash function comprises a Fowler-Noll-Vo hash function.

15. The non-transitory program storage device of claim 13 , wherein the result of the hash function or the message-digest algorithm is further converted to Base-64 encoding.

16. The non-transitory program storage device of claim 13 , wherein the watermark value was inserted into the file responsive to the file being identified as one that is to be protected.

17. The non-transitory program storage device of claim 16 , wherein the watermark value was inserted into the file by a command-line client program that receives as an input parameter one or more of a name of the file, a company identifier and the sensitivity level.

18. The non-transitory program storage device of claim 16 , wherein the watermark value was inserted into the file by a command-line client program that receives as an input parameter one or more of a name of a directory in which the file resides within a file system, a company identifier and the sensitivity level.

19. The non-transitory program storage device of claim 16 , wherein the watermark value was inserted into the file based on a file type of the file.

20. The non-tran

Assignees

• Fortinet Inc

Inventors

• Nelson Michael D
• Xie Michael

Classifications

• H04L63/0876

  based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint · CPC title

• H04L63/0428

  wherein the data content is protected, e.g. by encrypting or encapsulating the payload · CPC title

• G06F17/30867

  Physics · mapped topic

• H04L2209/608

  Watermarking · CPC title

• H04L63/123

  received data contents, e.g. message integrity · CPC title