Systems and methods of securing network-accessible peripheral devices

Patent metadata

Field	Value
Publication number	US-9990506-B1
Application number	US-201514672715-A
Country	US
Kind code	B1
Filing date	Mar 30, 2015
Priority date	Mar 30, 2015
Publication date	Jun 5, 2018
Grant date	Jun 5, 2018

Abstract

In one embodiment, a method is performed by a computer system. The method includes accessing information related to enterprise usage of a plurality of network-accessible peripheral devices and identifying, from the information, discrete content-imaging events that occurred on the plurality of network-accessible peripheral devices. In addition, the method includes determining particular users associated with the discrete content-imaging events on a per-event basis and determining particular content to which the discrete content-imaging events relate on a per-event basis. Further, the method includes abstracting correlated data related to the discrete content-imaging events into a standardized format, the correlated data comprising data related to the particular users and the particular content, the standardized format enabling expression of the discrete content-imaging events by user and by type of content-imaging activity.

First claim

What is claimed is:

1. A method comprising, by a computer system:
accessing information related to enterprise usage of a plurality of network-accessible peripheral devices;
identifying, from the information, discrete content-imaging events that occurred on the plurality of network-accessible peripheral devices;
determining particular users associated with the discrete content-imaging events on a per-event basis;
determining information related to particular times when the discrete content-imaging events are deemed to have occurred on a per-event basis;
identifying particular content that was imaged as a result of the discrete content-imaging events on a per-event basis;
accessing stored content-based classifications of the particular content on a per-event basis, wherein the stored content-based classifications comprise topics of the particular content;
correlating the topics of the particular content to a plurality of user contexts on a per-event basis, wherein each user context of the plurality of user contexts is defined by a distinct combination of at least one of the particular users and at least one of the particular times;
associating at least one user pattern with each user context based, at least in part, on the correlating; and
generating for at least one user comparative content-imaging-pattern information for at least two user contexts of the plurality of user contexts;
performing an automated risk evaluation of the comparative content-imaging-pattern information; and
transmitting an alert to a designated user responsive to the comparative content-imaging-pattern information meeting specified criteria.

2. The method of claim 1 , wherein the accessing comprises extracting at least a portion of the information from logs produced by one or more of the plurality of network-accessible peripheral devices.

3. The method of claim 1 , wherein:
the accessing comprises accessing communications from at least one communications platform;
the identifying comprises identifying communications in which at least one network-accessible peripheral device of the plurality of network-accessible peripheral devices is a communication participant; and
the identified communications correspond to at least a portion of the discrete content-imaging events.

4. The method of claim 1 , wherein:
the at least two user contexts comprise a first user context and a second user context, wherein the first user context and the second user context are mutually exclusive; and
the comparative content-imaging-pattern information comprises:
first content-imaging-pattern information related to content-imaging events occurring in the first user context; and
second content-imaging-pattern information related to content-imaging events occurring in the second user context.

5. The method of claim 1 , wherein at least one of the at least two user contexts specifies events occurring during one or more recurring periods of time.

6. The method of claim 5 , wherein the one or more recurring periods of time comprise time periods deemed non-working hours.

7. The method of claim 1 , comprising:
activating a cross-platform data loss prevention (DLP) policy for enforcement against a plurality of users on a set of peripheral devices from the plurality of network-accessible peripheral devices;
monitoring content-imaging events of the plurality of users on each of the set of peripheral devices for violations of the cross-platform DLP policy;
responsive to a detected violation of the cross-platform DLP policy by at least one user on at least one peripheral device, the computer system dynamically acquiring context information for the detected violation using information associated with the detected violation; and
the computer system publishing violation information to one or more designated users, the violation information comprising at least a portion of the information associated with the detected violation and at least a portion of the context information.

8. The method of claim 1 , wherein the discrete content-imaging events comprise one or more of the following content-imaging events: print, scan, copy, and fax.

9. The method of claim 1 , wherein the plurality of network-accessible peripheral devices comprise one or more of the following devices: printers, scanners, copiers, and fax machines.

10. An information handling system comprising at least one processor and memory, wherein the at least one processor and memory in combination are operable to implement a method comprising:
accessing information related to enterprise usage of a plurality of network-accessible peripheral devices;
identifying, from the information, discrete content-imaging events that occurred on the plurality of network-accessible peripheral devices;
determining particular users associated with the discrete content-imaging events on a per-event basis;
determining information related to particular times when the discrete content-imaging events are deemed to have occurred on a per-event basis;
identifying particular content that was imaged as a result of the discrete content-imaging events on a per-event basis;
accessing stored content-based classifications of the particular content on a per-event basis, wherein the stored content-based classifications comprise topics of the particular content;
correlating the topics of the particular content to a plurality of user contexts on a per-event basis, wherein each user context of the plurality of user contexts is defined by a distinct combination of at least one of the particular users and at least one of the particular times;
associating at least one user pattern with each user context based, at least in part, on the correlating; and
generating for at least one user comparative content-imaging-pattern information for at least two user contexts of the plurality of user contexts;
performing an automated risk evaluation of the comparative content-imaging-pattern information; and
transmitting an alert to a designated user responsive to the comparative content-imaging-pattern information meeting specified criteria.

11. The information handling system of claim 10 , wherein the accessing comprises extracting at least a portion of the information from logs produced by one or more of the plurality of network-accessible peripheral devices.

12. The information handling system of claim 10 , wherein:
the accessing comprises accessing communications from at least one communications platform;
the identifying comprises identifying communications in which at least one network-accessible peripheral device of the plurality of network-accessible peripheral devices is a communication participant; and
the identified communications correspond to at least a portion of the discrete content-imaging events.

13. The information handling system of claim 10 , wherein:
the at least two user contexts comprise a first user context and a second user context, wherein the first user context and the second user context are mutually exclusive; and
the comparative content-imaging-pattern information comprises:
first content-imaging-pattern information related to content-imaging events occurring in the first user context; and
second content-imaging-pattern information related to content-imaging events occurring in the second user context.

14. The information handling system of claim 10 , wherein at least one of the at least two user contexts specifies events occurring during one or more recurring periods of time.

15. The information handling system of claim 14 , wherein the one or more recurring periods of time comprise time periods d

Assignees

• Dell Software Inc
• Quest Software Inc

Inventors

• Brisebois Michel Albert
• Goyal Sawan
• Hu Guangning
• Johnstone Curtis T

Classifications

• G06F21/62 Primary

  Protecting access to data via a platform, e.g. using keys or access control rules · CPC title

• H04L63/20

  for managing network security; network security policies in general (filtering policies H04L63/0227) · CPC title