Detection and prevention of sensitive information leaks

Patent metadata

Field	Value
Publication number	US-9734343-B2
Application number	US-201414546422-A
Country	US
Kind code	B2
Filing date	Nov 18, 2014
Priority date	Feb 26, 2014
Publication date	Aug 15, 2017
Grant date	Aug 15, 2017

Abstract

Examples of techniques for detecting and preventing sensitive information leaks are described herein. In one example, a method for detection of sensitive information leaks includes computing, via a processor, a set of rules that identify sensitive information, and sending, via the processor, the set of rules to a dispatcher application using a protocol. The method can also include detecting, via the processor, that at least one data block of the transmitted data matches the set of rules, and executing, via the processor, a corrective action in response to detecting that at least one of the transmitted data blocks matches the set of rules.

First claim

What is claimed is:

1. A method for detection and prevention of sensitive information leaks, comprising:
identifying an event of one or more data blocks in a predetermined secure portion of a database being accessed by a device;
computing, via a processor, a first set of rules to identify sensitive information in the one or more data blocks that are accessed by the device and executing a first data leaks application based on the first set of rules that identify the sensitive information using one or more predetermined patterns, and wherein the sensitive information includes transaction data from a source point of sale device;
sending, via the processor, the first set of rules and event-specific parameters to a dispatcher application, wherein the event-specific parameters identify the event of the one or more data blocks being accessed by comprising an identifier of the source point of sale device, an identifier of a transport protocol being used for transmitting the one or more data blocks by the device, an identifier of a process that is transmitting the one or more data blocks, an identifier of a user that is transmitting the one or more data blocks, and a timestamp associated with the access of the one or more data blocks;
detecting, via the processor, that at least one data block from the data blocks is being transmitted based on the event-specific parameters; and
in response to the first data leaks application being unable to identify the sensitive information from the at least one data block being transmitted, generating, via the processor, a second data leaks application by populating a predefined template with the event-specific parameters, and sending the template to the second data leaks application, wherein the second data leaks application executes based on a second set of rules, distinct from the first data leaks application.

2. The method of claim 1 , executing a corrective action in response to detecting that the at least one data block matches the second set of rules of the second data leaks application, wherein the corrective action comprises preventing the at least one data block from being sent to an external computing device.

3. The method of claim 1 , wherein the first se of rules and the event-specific parameters are sent using a predetermined protocol.

4. The method of claim 3 ,
wherein the second data leaks application is generated with a stream computing platform, the second data leaks application comprising a second filter, distinct from a first filter of the first data leaks application, and wherein a filter determines a portion of the transmitted data to monitor for sensitive information based on the event-specific parameters.

5. The method of claim 1 , comprising:
detecting a filter and a detection algorithm for the identification of the sensitive information;
detecting that the first data leaks application is to be updated based on the filter and the detection algorithm; and
updating the first data leaks application to identify the sensitive information with the filter and the detection algorithm.

6. The method of claim 3 , wherein the predetermined protocol enables the transmission of the event-specific parameters between at least two computing devices.

7. The method of claim of claim 4 , wherein the filter comprises a regular expression, an algorithm, algorithm parameters or any combination thereof.

8. The method of claim 1 , wherein the protocol event-specific parameters further include an identifier of a transaction associated with the sensitive information.

9. The method of claim 8 , wherein the event-specific parameters further include an identifier of a user associated with the transaction corresponding to the sensitive information.

10. A computer program product for detection and prevention of sensitive information, the computer program product comprising a computer readable storage medium having program code embodied therewith, the program code executable by a processing circuit to perform a method comprising:
identifying an event of one or more data blocks in a predetermined secure portion of a database being accessed by a device;
computing, via the processing circuit, a first set of rules to identify sensitive information in the one or more data blocks that are accessed by the device and executing a first data leaks application based on the first set of rules that identify the sensitive information using one or more predetermined patterns, and wherein the sensitive information includes transaction data from a source point of sale device;
sending, via the processing circuit, the first set of rules and event-specific parameters to a dispatcher application, wherein the event-specific parameters identify the event of the one or more data blocks being accessed by comprising an identifier of the source point of sale device, an identifier of a transport protocol being used for transmitting the one or more data blocks by the device, an identifier of a process that is transmitting the one or more data blocks, an identifier of a user that is transmitting the one or more data blocks, and a timestamp associated with the access of the one or more data blocks;
detecting, via the processing circuit, that at least one data block from the data blocks is being transmitted based on the event-specific parameters; and
upon detecting that the first data leaks application is unable to identify the sensitive information from the at least one data block being transmitted, generating, via the processing circuit, a second data leaks application by populating a predefined template with the event-specific parameters, and sending the template to the second data leaks application, wherein the second data leaks application executes based on a second set of rules, distinct from the first data leaks application.

11. The computer program product of claim 10 , executing a corrective action in response to detecting that the at least one data block matches the second set of rules of the second data leaks application, wherein the corrective action comprises preventing the at least one data block from being sent to an external computing device.

12. The computer program product of claim 10 , wherein the first set of rules and the event-specific parameters sent using a predetermined protocol.

13. The computer program product of claim 12 , wherein generating the second data leaks application comprises generating a second filter that is distinct from a first filter of the first data leaks application, wherein a filter determines a portion of the transmitted data to monitor for sensitive information based on the event-speific parameters.

Assignees

• IBM

Inventors

• Galil Guy
• Gorelik Leonid
• Pyasik Alexander
• Sofer Oded
• Yulevich Yifat

Classifications

• G06F21/6245

  Protecting personal data, e.g. for financial or medical purposes · CPC title

• G06F21/60 Primary

  Protecting data · CPC title

• G06F21/552 Primary

  involving long-term monitoring or reporting · CPC title