Intelligent security analysis and enforcement for data transfer

Patent metadata

Field	Value
Publication number	US-9787717-B2
Application number	US-201715403269-A
Country	US
Kind code	B2
Filing date	Jan 11, 2017
Priority date	May 9, 2014
Publication date	Oct 10, 2017
Grant date	Oct 10, 2017

Abstract

An approach is provided for managing a message in a transfer from a computer. A level of security protecting the transfer of the data is determined. The level of security is determined to satisfy or not satisfy a threshold level. If the level of security satisfies the threshold level, the computer is connected and the message is transferred using the level of security. If the level of security does not satisfy the threshold level, then based on the level of security, an action to change the level of security is determined so that the changed level of security satisfies the threshold level. The action changes a method of network layer encryption for the transfer and/or a protocol specifying whether application layer encryption is utilized for the transfer. The action is executed to connect the computer and transfer the message using the changed level of security.

First claim

What is claimed is:

1. A method of managing a message being transferred from a computer, the method comprising the steps of:
the computer determining a level of security protecting a transfer of data in the message via a network, the level of security indicated by (1) a first setting of the computer that specifies that a first or a second method of encryption at a network layer is applied by a corresponding wireless access point that provides access to the network for the transfer of the data, the first method of encryption having a strength of encryption that is stronger than a strength of encryption of the second method of encryption and (2) a second setting of an application that specifies that a first or a second protocol at an application layer is utilized for the transfer of the data, the application initiating the transfer of the data, the first protocol having encryption at the application layer, and the second protocol having no encryption at the application layer;
the computer determining whether the level of security satisfies a threshold level;
if the level of security does not satisfy the threshold level, based at least in part on the level of security, the computer determining an action to change the level of security so that the changed level of security satisfies the threshold level, the action to change the level of security including a change to the first setting but no change to the second setting, a change to the second setting but no change to the first setting, or changes to the first and second settings, and in response, executing the action to connect the computer and transfer the message using the changed level of security indicated by the change in the first setting, the change in the second setting, or the changes in the first and second settings; and
if the level of security satisfies the threshold level, the computer connecting and the computer transferring the message using the level of security.

2. The method of claim 1 , further comprising the steps of:
the computer receiving a rule that specifies a level of sensitivity of the data; and
based at least in part on the level of sensitivity, the computer determining the level of security does not satisfy the threshold level, wherein the step of determining the action to change the level of security is based in part on the level of sensitivity.

3. The method of claim 2 , wherein the step of determining the action is based at least in part on the rule that further specifies (1) an address of a source of the data; (2) an address of a destination of the data; (3) the application initiating the transfer of the data via the network; (4) content of the data; (5) the first or second method of encryption that is applied by the corresponding wireless access point that provides access to the network for the transfer of the data or a condition in which no method of encryption is applied by the network; and (6) the first protocol having the encryption at the application layer and is utilized for the transfer of the data.

4. The method of claim 3 , further comprising the steps of:
the computer scanning the content of the data after the transfer of the data is initiated but before the data has passed through the network;
based on the scanned content, the computer identifying a type of the data; and
based on the identified type of data, the computer determining the level of sensitivity of the data,
wherein the step of determining the action is based on a rule that associates the action with the identified type of the data.

5. The method of claim 2 , wherein the step of determining the action includes the steps of:
determining that (1) the first protocol having the encryption at the application layer is not available or (2) the first method of encryption at the network layer is not available and the first method of encryption satisfies the threshold level; and
in response to the step of determining that the first protocol or the first method of encryption is not available, pausing traffic for the application until the first protocol or the first method of encryption becomes available, or shutting down the application and subsequently starting the application in response to the first protocol or the first method of encryption becoming available.

6. The method of claim 2 , wherein the rule is (i) manually defined by a user of the computer prior to the step of determining the action or (ii) imported within a rule set generated by a person or organization other than the user prior to the step of determining the action.

7. The method of claim 1 , wherein the step of determining the action to change the level of security is based in part on the application that initiated the transfer of the data.

8. The method of claim 1 , wherein the step of determining whether the level of security satisfies the threshold level includes determining that the level of security does not satisfy the threshold level, and in response, the computer notifying a user of the computer of the action.

9. The method of claim 1 , wherein the step of determining whether the level of security satisfies the threshold level includes determining that the level of security does not satisfy the threshold level, and in response, the computer prompting the user to send an acceptance of the action, and in response to a receipt of the acceptance, the computer executing the action to change the level of security and subsequently connecting the computer to the network and transferring the message using the changed level of security.

10. A computer program product for managing a message being transferred from a computer, the computer program product comprising:
one or more computer-readable storage devices and program instructions stored on the one or more storage devices, the program instructions, when executed by a processor cause the processor to:
determine a level of security protecting a transfer of data in the message via a network, the level of security indicated by (1) a first setting of the computer that specifies that a first or a second method of encryption at a network layer is applied by a corresponding wireless access point that provides access to the network for the transfer of the data, the first method of encryption having a strength of encryption that is stronger than a strength of encryption of the second method of encryption and (2) a second setting of the application that specifies that a first or a second protocol at an application layer is utilized for the transfer of the data, the application initiating the transfer of the data, the first protocol having encryption at the application layer, and the second protocol having no encryption at the application layer;
determine whether the level of security satisfies a threshold level;
if the level of security does not satisfy the threshold level, based at least in part on the level of security, determine an action to change the level of security so that the changed level of security satisfies the threshold level, the action to change the level of security including a change to the first setting but no change to the second setting, a change to the second setting but no change to the first setting, or changes to the first and second settings, and in response, execute the action to connect the computer and transfer the message using the changed level of security indicated by the change in the first setting, the change in the second setting, or the changes in the first and second settings; and
if the level of security satisfies the threshold level, connect the computer and transfer the message using the level of security.

11. The computer program product of claim 10 , wherein the program instructions, when executed

Assignees

• IBM

Inventors

• Abuelsaad Kelly
• Deluca Lisa Seacat
• Jang Soobaek
• Krook Daniel C

Classifications

• G06F21/606 Primary

  by securing the transmission between two devices or processes · CPC title

• H04L63/0428

  wherein the data content is protected, e.g. by encrypting or encapsulating the payload · CPC title

• H04L63/164

  at the network layer · CPC title

• H04L63/205

  involving negotiation or determination of the one or more network security mechanisms to be used, e.g. by negotiation between the client and the server or between peers or by selection according to the capabilities of the entities involved (negotiation of communication capabilities H04L69/24) · CPC title

• H04L63/168 Primary

  above the transport layer · CPC title