System and Method for Evaluating Integrity of Isolated Digital Assets

A device, method, and computer readable medium for conducting data integrity analyses is disclosed. Illustratively, the method includes transmitting a first script to a target device. The target device is at least in part isolated from an enterprise storing data elements on the target device to isolate them from subsystems of the enterprise. The first script includes instructions to search a target device for one or more properties, to create a data file based on found properties, to create a unique immutable property based on each data file, and to create an aggregated immutable property list for all data files generated by the first script. The first script is configured to locally store information generated by the first script upon execution, and remove the first script after execution. The method includes transmitting a second script, complementary to the first script, to evaluate integrity of information generated by the first script.

TECHNICAL FIELD

The following relates generally to evaluating digital system integrity and, in particular, to evaluating integrity of at least in part isolated digital systems.

BACKGROUND

Many current approaches to evaluating system integrity are based on storing a relatively immutable derivative property of a digital asset (e.g., a checksum) in a safe place, away from the asset, for use as a reference. These existing approaches are focused on removing the immutable property associated with the asset to a safe space. Once in the safe space, the approaches can control access to the associated property or environment, and obscure the form of the associated property to make it difficult to find in the safe environment.

DETAILED DESCRIPTION

It is understood that the use of the term “unique immutable property,” derived from or associated with a digital asset is not intended to be limited to, for example, the output property of a particular one-way function. To provide an example, the unique immutable property associated with or derived from the digital asset is not intended to be limited to a particular hashing function used to generate a checksum file, the form, or other limiting parameters of either the one-way function or the generated output, etc. It is also understood that while the term “unique immutable property” can imply total immutability and uniqueness, it is not intended to be interpreted in a binary manner. Instead, the immutability and uniqueness are understood to describe relative properties of operations known to persons skilled in the art, and it is acknowledged that existing approaches (such as certain hash functions) include unknown vulnerabilities, and can include known vulnerabilities. Relatedly, the use of the term “isolated” is intended to be interpreted similarly to the above, both in that it is not intended to be limited to a particular type of isolation (e.g., isolated from certain access rights, isolated connectivity, etc.), and in that it is understood that isolation can mean complete isolation, isolation in part, etc., unless indicated otherwise.

In addition, it is understood that the use of the term “data file,” also referred to as a “data asset” is not intended to be limited solely to individual data files, and that an expansive definition of the term is intended unless specified otherwise. For example, the data file can store information in different formats, can be stored on different media (e.g., a database, a portable data stick, etc.), etc. The data file may not necessarily be an independent file, and can be part of a data file, or include a routine, method, object, etc.

This disclosure relates to evaluating integrity of isolated digital assets. Maintaining a system for evaluating the isolated digital assets is to be practical, sufficiently secure so as to decrease the risk that adversaries can penetrate the evaluation scheme and/or the isolated system, and is to operate within the constraints of the isolated digital asset (e.g., isolated assets can preclude using more sophisticated tools that require interconnection or introduce other certainties).

The disclosed method can include the following features to address these technical challenges. An example method includes two scripts that are self-contained, such that a single transmission (or two transmissions, one for each script) is sufficient to enable the evaluation. The scripts perform relatively simple operations to determine the integrity of properties of the isolated system, as described herein, such that large applications are not required, the evaluation is relatively quick, and the integrity of a plurality of different features can be checked. The scripts remove themselves after performing the evaluation, to reduce the likelihood that adversaries can compromise the evaluation.

In one aspect a device for conducting data integrity analyses is disclosed. The device is at least in part an isolated from an enterprise storing data elements on the device to isolate the data elements from subsystems of the enterprise. The device includes a processor, a communications module coupled to the processor, and a memory coupled to the processor. The memory stores computer executable instructions that when executed by the processor cause the processor to receive a first script. The first script includes instructions to search the device for one or more properties, to create a data file based on found properties, to create a unique immutable property based on each data file, and to create an aggregated immutable property list for all data files generated by the first script. The instructions cause the processor to execute the first script, locally store created information generated by the first script, and remove the first script. The instructions cause the processor to execute a second script, complementary to the first script, to evaluate integrity of the created information.

In example embodiments, the created data file is at least in part a list populated with results of the search.

In example embodiments, the first script is configured to search for access control properties of one or more files.

In example embodiments, the second script is configured to remove itself after completion.

In example embodiments, the instructions cause the processor to indicate that the evaluation has failed in response to a first timing threshold being unsatisfied.

In example embodiments, the instructions cause the processor to transmit results of the evaluation to a controller to modify the found one or more properties.

In example embodiments, the instructions cause the processor to validate the respective immutable property for each data file based on contents of a validated aggregated immutable property list. In example embodiments, the instructions cause the processor to validate the data file based on respective validated immutable properties for each data file.

In example embodiments, the instructions cause the processor to validate the aggregated immutable property list by (1) extracting a reference feature introduced to, and based on the aggregated immutable property list, the reference feature introduced after aggregation of the immutable properties based on each data file into the aggregated immutable property list, (2) create a test reference feature based on the post-extraction aggregated immutable property list, and (3) compare the extracted reference feature to the test reference feature. In example embodiments, reference feature is stored within the aggregated immutable property list based on an obfuscation policy.

In example embodiments, the aggregated immutable property list stores immutable properties based on each data file along with data-specific reference properties, and the immutable properties are mapped to their respective data filed based on the associated data-specific reference properties for validation. In example embodiments, the data-specific reference properties are generated based on a name of the associated data file.

In another aspect a method for conducting data integrity analyses is disclosed. The method includes transmitting a first script to a target device. The first script includes instructions to search a target device for one or more properties, to create a data file based on found properties, to create a unique immutable property based on each data file, and to create an aggregated immutable property list for all data files generated by the first script. The first script is configured to locally store information generated by the first script upon execution, and remove the first script after execution. The method includes transmitting a second script, complementary to the first script, to evaluate integrity of information generated by the first script. The target device is at least in part isolated from an enterprise storing data elements on the device to isolate the data elements from subsystems of the enterprise.

In example embodiments, for the method, the created data file is at least in part a list populated with results of the search.

In example embodiments, for the method, the first script is configured to search for access control properties of one or more files.

In example embodiments, for the method, the second script is configured to remove itself after completion.

In example embodiments, the method includes failing the evaluation in response to a first timing threshold being unsatisfied.

In example embodiments, the method includes transmitting results of the evaluation to a controller to modify the found one or more properties.

In example embodiments, the method includes validating the respective immutable property for each data file based on contents of a validated aggregated immutable property list. In example embodiments, the method includes validating the data file based on respective validated immutable properties for each data file.

In example embodiments, the method includes validating the aggregated immutable property list by (1) extracting a reference feature introduced to, and based on the aggregated immutable property list, the reference feature introduced after aggregation of the immutable properties based on each data file into the aggregated immutable property list, (2) creating a test reference feature based on the post-extraction aggregated immutable property list, and (3) comparing the extracted reference feature to the test reference feature. In example embodiments, reference feature is stored within the aggregated immutable property list based on an obfuscation policy.

In example embodiments, the aggregated immutable property list stores immutable properties based on each data file along with data-specific reference properties, and the immutable properties are mapped to their respective data filed based on the associated data-specific reference properties for validation. In example embodiments, the method includes the data-specific reference properties being generated based on a name of the associated data file.

In another aspect, a non-transitory computer readable medium for performing any one of the method steps described here.

Referring now to the figures,FIG.1illustrates an example of a computing environment8. The computing environment8, as shown, includes an isolated platform10, one or more client devices12(shown by client devices12a,12b. . .12n,hereinafter referred to in the singular for ease of reference), and a communications network14connecting one or more components of the computing environment8.

The computing environment8can also include an enterprise system16(e.g., a financial institution such as commercial bank and/or insurance provider). It is noted that the enterprise system16can include different components, which components have been omitted fromFIG.1for clarity.

The system16can provide services to users (e.g., to process financial transactions), which services generate, or result in the enterprise system16coming into possession of, or are responsible for the storage and access control of various data and/or processes that can be commercially sensitive, or personally sensitive, etc. As a result, the enterprise system16can be configured to keep said sensitive data as confidential information.

This application is directed to applications where the aforementioned confidential information is at least in part stored in an isolated platform10. The isolated platform10can be partially isolated, totally isolated, etc. As noted above, the nature of isolation of the isolated platform10, and extent of isolation can vary based on the desired application. Digital liabilities or assets (hereinafter referred to more generally as “digital elements”) are stored in the isolated platform10at least in part to prevent them from being able to, or from having the potential to, interact with other systems or subsystems (whether internal to the enterprise system16, or otherwise). For example, the isolation can be enforced by preventing individuals or processes from accessing the data, or by positively defining individuals, processes, etc., that are able to access the isolated platform10. In example embodiments, the digital elements on the isolated platform10are sensitive or confidential data. The isolated platform10can be limited to access only certain data or tools to perform only rudimentary functions. For example, the isolated platform10can be configured to receive and operate commands only from a particular client device12within the enterprise system16, to only accept certain types of commands from the designated device, etc. In example embodiments, the isolated platform10is isolated from other systems of the enterprise system16. For example, the isolated platform10can be updated with new entries specifying access control rights within the enterprise system16(which updating occurs in a controlled fashion) and update a cloud datastore18to propagate the access control right changes to the organization (also controlled in a restricted fashion), while being isolated from all but select devices12or users of the enterprise system16(i.e., the users or devices with permission or granted access to update the access control rights). The isolated platform10in this instance can be a necessity to avoid risks associated with such sensitive processes being integrated within a larger system with more complicated threat matrices to control.

Confidential data and/or processes (or related data and/or processes) of the enterprise system16are at least in part stored in the isolated platform10, temporarily or otherwise. For example, the isolated platform10can store data elements generated by the operation of the enterprise system16prior to their being provided to a cloud database18. In another example, the isolated platform10can store processes which have stricter access control or relate to access control for a broader set of enterprise system16subsystems.

The enterprise system16can directly (e.g., by transmitting data to the isolated platform10from a device (e.g., device12a) within the system16), or indirectly (e.g., via a device12of the third-party contractor, etc.) store digital elements, and similarly require storage of the digital elements on the isolated platform10for a variety of processes. The digital elements can be stored on the isolated platform10in a particular configuration (e.g., encrypted), unencrypted in part, in a particular format, etc.

The digital elements can include team, intranet, messaging, committee, or other client- or relationship-based data. The digital elements can be data that is not controlled by certain processes within an enterprise system16, or otherwise (e.g., enterprise system16generated data). For example, the digital elements can include information about third party applications used by employees, such as human resources, information technology (IT), payroll, finance, or other specific applications. The digital elements may include data associated with a user of a client device12that interacts with the isolated platform10, and/or the enterprise system16(e.g., an employee, or other user associated with an organization associated with the enterprise system16, or a customer, etc.).

More generally, the digital elements can include data and/or related processes which can include or rely upon: customer data, enterprise data, or personal data associated with a client device12, system16, or platform10, and can include, for example, and without limitation, financial data, transactional data, personally identifiable information, data related to personal identification, demographic data (e.g., age, gender, income, location, etc.), preference data input by the client, and inferred data generated through machine learning, modeling, pattern matching, or other automated techniques. In at least one example embodiment, the digital elements include any data provided to a financial institution which is intended to be confidential, whether the data is provided by a client, employee, contractor, regulator, etc., whether for personal or enterprise uses, or otherwise. The digital elements may include historical interactions and transactions associated with the isolated platform10and/or enterprise system16, e.g., login history, search history, communication logs, documents, etc.

There is a need for the isolated platform10to perform integrity or other types of evaluations on digital assets or liabilities (referred to hereinafter more generally as “digital elements”) isolated therein. The isolated platform10may have access to certain tools to perform such analyses. For example, the platform10can have access to rudimentary tools (e.g., a tool to create unique immutable properties for data files to isolated platform10) to facilitate such analysis. In example embodiments, a platform10can temporarily store such tools to prevent tampering therewith. Any such tools (whether provided to the platform10or native thereto) can be isolated in the same fashion as the isolated platform10is isolated.

The isolated platform10can be configured to store data related to any analysis conducted thereon (hereinafter referred to generally as a log). The log can serve as chronologically accurate reference. The log can be encrypted, stored in a particular portion of the platform10, and can be used for outlining malicious activity encountered by the platform10for later retrieval.

It can be appreciated that while the isolated platform10and enterprise system16are shown as separate entities inFIG.1, they may also be part of the same system. For example, the isolated platform10can be hosted and provided within the enterprise system16.

Client device12may be associated with one or more users. Users may be referred to herein as employees, customers, clients, consumers, correspondents, or other entities that interact with the enterprise system16and/or isolated platform10(directly or indirectly). The computing environment8may include multiple client devices12, each client device12being associated with a separate user or associated with one or more users. In certain embodiments, a user may operate client device12such that client device12performs or causes the platform10to perform one or more processes consistent with the disclosed embodiments. For example, the user may use client device12to engage and interface with the isolated platform10via a mobile or web-based applications provided by the enterprise system16, which is provided within, or is complementary to, the isolated platform10to perform analyses. In certain aspects, client device12can include, but is not limited to, a personal computer, a laptop computer, a tablet computer, a notebook computer, a hand-held computer, a personal digital assistant, a portable navigation device, a mobile phone, a wearable device, a gaming device, an embedded device, a smart phone, a virtual reality device, an augmented reality device, third party portals, an automated teller machine (ATM), and any additional or alternate computing device, and may be operable to transmit and receive data across communication network14.

Communication network14may include a telephone network, cellular, and/or data communication network to connect different types of client devices12, enterprise system(s)16, datastore(s)20, and/or isolated platform(s)10. For example, the communication network14may include a private or public switched telephone network (PSTN), mobile network (e.g., code division multiple access (CDMA) network, global system for mobile communications (GSM) network, and/or any 3G, 4G, or 5G wireless carrier network, etc.), Wi-Fi or other similar wireless network, and a private and/or public wide area network (e.g., the Internet).

In one embodiment, isolated platform10may be one or more computer systems configured to process and store information and execute software instructions to perform one or more processes consistent with the disclosed embodiments. In certain embodiments, although not required, isolated platform10may be associated with one or more business entities. In certain embodiments isolated platform10may represent or be part of any type of business entity. For example, the isolated platform10may be a system associated with a commercial bank (e.g., enterprise system16), a digital media service provider, or some other type of business which performs data analysis (e.g., a cloud computing provider). The isolated platform10can also operate as a standalone entity that is configured to serve multiple business entities, e.g., to act as an agent thereof.

The isolated platform10and/or enterprise system16may also include a cryptographic server (not shown) for performing cryptographic operations and providing cryptographic services (e.g., authentication (via digital signatures), data protection (via encryption), etc.) to provide a secure interaction channel and interaction session, etc. Such a cryptographic server can also be configured to communicate and operate with a cryptographic infrastructure, such as a public key infrastructure (PKI), certificate authority (CA), certificate revocation service, signing authority, key server, etc. The cryptographic server and cryptographic infrastructure can be used to protect the various data communications described herein, to secure communication channels therefor, authenticate parties, manage digital certificates for such parties, manage keys (e.g., public, and private keys in a PKI), and perform other cryptographic operations that are required or desired for particular applications of the isolated platform10and/or enterprise system16. The cryptographic server may be used to protect, for example, the digital elements on which analysis is being performed, etc., by way of encryption for data protection, digital signatures, or message digests for data integrity, and by using digital certificates to authenticate the identity of the users and client devices12with which the enterprise system16and/or isolated platform10communicates to inhibit data breaches by adversaries. It can be appreciated that various cryptographic mechanisms and protocols can be chosen and implemented to suit the constraints and requirements of the particular deployment of the isolated platform10or enterprise system16as is known in the art.

FIG.2is a block diagram of an example workflow of part of evaluating the integrity of isolated digital assets.

Initially, the isolated platform10receives a script202(hereinafter referred to as the first script202, for ease of reference). The first script202is for performing analysis on digital elements stored on the isolated platform10. The first script202can be in whole, or in part, self-contained. That is, the first script202can include all the tools necessary to perform the analysis of the isolated platform10, or rely on certain tools (e.g., rudimentary, isolated tools) of the isolated platform10to perform the analysis. In this way, the first script can be provided to the isolated platform10to reduce the amount of failure or breach avenues for platform10.

The first script202includes, or is configured with, one or more reference parameters, shown visually as separate reference parameters202a,202b,and202c,for added clarity. The reference parameters, as described herein, control one or more aspects of an analysis performed by the first script202. In example embodiments, such as the one shown inFIG.2, different reference parameters control different stages of the analysis. Other variations in respect of parameters are contemplated.

At stage204, a data file is generated by the first script202. The generated data file can be at least in part a list populated with results of a search performed by the first script. The data file can include various components, including metadata, substantive data, etc. An example data file, data file212, is shown inFIG.2. The data file212includes a name212a,generated by the first script202in accordance with the reference parameters202a,and the data file212includes a body212b.

The reference parameters202a,202b,and202c,more generally, can define a schema for how names are generated, or how other portions of the first script202, or second script (as that term is used herein), or another script traverses or process the data resulting from the first script202. For example, the name212acan be based on the reference parameter202a.Particularizing one example, the reference parameter202acan specify that the name212ais based on a time the data file212is generated (e.g., the name starts with a date and time component), based on substantive material expected to be stored in the platform10(e.g., for access control lists, the name212acan start with “ACL”), based on a security tool (e.g., incorporate a hash value generated by a one-way function), be the result of a changing configuration (e.g., the naming convention is periodically changed by the generator of the first script202), etc. The reference parameters202a,202b,and202ccomplement the reference parameters of the second script, as will be discussed herein.

Each of the reference parameters202a,202b,and202ccan be based on a different scheme or methodology. Various combinations of different mechanisms both within a reference parameter, and between reference parameters202a,202b,and202care contemplated. For example, the parameters202acan enforce a naming convention, the parameter202bcan be used to describe processes that will occur to a body212b,and the parameters202ccan use a naming convention different from the reference parameters202a,and partially process the body212bwith a different security tool.

In the shown embodiment, the reference parameter202aspecifies that the name212ais defined by the type of data expected to be stored in the platform10, and a time.

The body212bcan include one or more entries associated with data elements stored on the platform10based on reference parameters202a.For example, the reference parameters202acan operate such that the first script202searches through a certain portion of data on the platform10(e.g., only certain directories of data stored in the platform10, such as a directory associated with a particular business line), extracts information based on particular elements within search directories (e.g., binaries, configuration files, etc.), and extracts certain information or parameters related to same (e.g., access control logs, or “ACL”s) in order to generate the data file212. The body212bcan be a listing of all relevant extracted properties. To particularize just one contemplated example, the body212bcan include a listing of different access ACLs for different programs or data elements stored on the platform10. The body212bcan identify directories where the extracted ACLS were present on the platform10at the time of the search by the first script202. The body212bcan also include other indicator(s), parameters, properties, etc. describing the state of both the organization of the data elements on the platform10, and the contents of the data elements at the time of the search.

At block206, a unique and immutable property of the data file212is generated. The aforementioned property is unique to the extent that is possible with present security instruments, such as one-way functions that generate hash values based on provided information. The aforementioned property is immutable in that if the data file212is not tampered with, the security tool will be able to reproduce the property (i.e., as in the case with one-way functions and hash values.). In the embodiment shown, the unique and immutable property of the data file212is a hash function.

One or more portions of the data file212can be used to generate the unique and immutable property (referred to hereinafter simply as the property, for ease of reference) based on the reference parameters202b.For example, in the shown embodiment, the parameters202bare such that a property is generated based on the name of data file212and is stored in a second data file214as a property in body214baresulting from the block206. In example embodiments, the data file214stores the properties in body214bain conjunction with a reference214bb.The reference can be a reference based on the name212a.For example, the reference214bbcan be the result of a process as simple as reversing the name of the data file212, or complicated, including being the result of a cypher, etc. The data file214can itself be given a name214a,based on the reference parameters202b.For example, the name214acan incorporate a timestamp of when the block206is executed. As with the reference element214bb,the name214acan be generated with a range of different approaches.

At block208, a master property file216is generated by the first script202based on the reference parameters202c.Similar to the data file214, the property file216can include a name216a,and a body216b.The name can be generated in a manner similar to the names214a,212a.

To generate the body216b,the first script can generate one or more unique and immutable properties of the data file214. For example, in the shown embodiment, the body216bincludes a body216baof generated properties of the body214bof the data file214. That is, the first script202can generate the name212abased on reference parameters202a,generate a hash of the name212aand store that hash in the body214baof the second data file214, and in the master property file body216bastore a hash of the hashed name from body214ba.Relatedly, the first script can generate corresponding name obfuscations identifying the generated property, shown as being listed in reference216bb.

Block208can also include the first script202generating a data element for insertion into the data file216. For example, in the shown embodiment, the first script generates the data element218(also based on the reference parameters202c) based on the aggregated immutable property list (body216b). The data element218can be a reference feature, as described herein.

After creating data element218, the first script202inserts the element218into, or incorporates it into body216b(i.e., the separation shown inFIG.2is illustrative) as a reference feature. In example embodiments, the first script202generates a new data file (not shown) without delineation between the inserted data element218and the body216b.

The element218can include a first portion218athat results from generating the property from the body216b(similar to the process used to generate the body216b), and a portion218bfor identifying the portion218a.In the shown embodiment, the portion218ais based on the parameters202cand an obfuscation policy (e.g., a naming convention) therein, wherein the portion218bis based on the name216a.

At block210, the data files212,214, and216are stored locally on the platform10.

Block210can include the first script202deleting itself, to remove the potential that an adversarial actor will be able to reverse engineer the script. Removal can include removal of all traces, including the stored script and any traces leftover in memory.

To summarize by way of an example, in at least one example embodiment, the block206includes generating at least a hash value for storage in body214ba(a first hash value) and generating an obfuscated name to associate with that hashed value. Block208includes generating a hash value (the second hash value) based on the first hash value(s), incorporating the generated obfuscated names, and generating obfuscations of the name generated by block206. Block208also includes generating a hash value based on the second hash value, resulting in a third hash value stored in an insertable element218. In at least some example embodiments, the name obfuscation also includes generating hash values based on preceding names, thereby increasing the amount of derivative, nested hash values used to assess integrity.

This above-described approach can potentially alleviate some issues associated with the isolated platform10. First, the described approach is relatively light weight, with a relatively large amount of processing (after searching) being expended to process names, and not the contents of the body212b.Second, the nested approach enables relatively simple scripts, such that the size of the script makes it harder for adversaries to introduce altered functionality in copycat scripts. Third, the nested configuration and focus on naming makes the process robust and able to assess various properties of a target device.

The first script202can generate a single data file212based on a single search, generate multiple data files212based on a single search, or generate multiple data files212based on different searches. Similarly, a single script can generate multiple data files214based on more than one data file214or generate a single data file216based on multiple data files214(e.g., by consolidating the data files214).

FIG.3is a block diagram of an example workflow complementary to the example workflow shown inFIG.2and shows part of evaluating the integrity of isolated digital assets in accordance with the disclosure herein.

FIGS.4A to4Cshall be referred to in reference to blocks304,306, and308, and these figures show block diagrams that complementFIG.3in describing the example workflow shown inFIG.3.

To verify data, a second script302is received by the isolated platform10in a manner similar to the first script202. Similar to the first script202, the second script302can be in whole, or in part self-contained. As with the first script202, the second script302includes one or more parameters which are visually represented as parameters302a,302b,and302c.

The isolated platform10can be configured to receive the scripts202,302in limited circumstances. For example, the isolated platform10can be reconfigured to only execute scripts received from a particular device, at a particular time, with particular user credentials, in a particular sequence, etc.

At block304, the data file216is verified. Verifying the data file216can include determining that the reference parameter302ais complementary to reference parameter202c,such that the second script302is able to parse the data file216(after insertion of the element218) and locate the data element218therein. The second script302ingests the data element218, and, with the reference parameter302a,determines the delineation between portions218aand218b.For example, the second script302reference parameters302acan be used to identify the portion218awhich includes the name of the data file216. Based on this reference point within the implemented obfuscation policy, the second script302can determine where the related portion218aresides.

The second script302stores the identified data element218for future reference in a location other than the data file216and removes the data element218from the data file216. The second script302generates the data element218x(seeFIG.4A), with the reference parameters302a,generating the data element218xin the same manner that the first script202generated data element218to compare to the previously extracted data element218. That is, the extracted data element218can be used as a test reference feature. The second script302generates the first portion218abased on the one-way function used in block208and generates the portion218bsimilarly (block402inFIG.4A). It is understood that generating the element218means that the second script302generates the data element218in the same manner as the first script, and not that the contents are identical (they are not, in the instance of tampering).

Verifying a data file216includes the second script302comparing the newly generated data file218x(the test reference feature) to the previously extracted data file218(e.g., step404inFIG.4A). If the two data files218do not match, evidence of tampering has been uncovered.

At block306, the second script302verifies the data file214. The reference parameters302B can include parameters which enable the second script302to parse the data file216to determine a reference216bbfor a particular data file214(process406ofFIG.4B). The second script302, using the determined reference216bb,determines the name214aof the relevant data file214. The second script302, similar to block304, and based on the reference parameters302b,and based on the determined name214a,generates the property216babased on the located data file214. The second script302thereafter compares the regenerated property216bato the original property216ba(e.g., process408ifFIG.4B). If the re-created property in body216bamatches the property in body216bastored in the data file216, the second script302determines that the data file214is verified.

At block308, the second script302verifies the data file212. The second script302, based on the reference parameters302c,and similar to block306, parses the data file body214bto find the reference214bb.Based on the found reference214bb,the second script302searches for the data file212(e.g., process410ofFIG.4C).

The second script verifies the content of data file212, after identifying the correct data file212, by regenerating the immutable property of the data file body212band comparing the regenerated value with the value stored in body214ba(e.g., process412shown inFIG.4C).

In example embodiments, the body214baincludes an immutable property of the name212a,and the body212bof the data file212is not used to determine an associated immutable property. This configuration may be advantageous in instances where the platform10is in restricted computing environments, where only limited processing is capable within a desired timeframe. As a result, the increase in speed in validating the data can be desirable.

In an embodiment where the body214bais not a property of the body212b(e.g., tampering has been discovered, or the scripts are malfunctioning, etc.), the platform10can be configured to discard the data on which the data file212is based, and to revert to a previously verified data file.

The second script302can, similar to script202, be configured to delete itself after providing the results of validation to a controller. For example, the script302can include instructions to email a platform10administrator the results of the analysis, and thereafter to remove itself.

The platform10, or script302can determine that the integrity of the data element in question has been comprised as a result of any failure of any of blocks304,306, and308.

In example embodiments, the evaluation can be failed in response to a first timing threshold being unsatisfied. For example, the second script302can be configured to track execution with a timer and compare a log of the length of time required to complete the script302with a pre-set threshold (e.g., 1 hour).

In example embodiments, the platform10performs the analysis with scripts202,302, periodically, on demand, or on a schedule (e.g., the first script202at the start of the week, the second script302at the end of the week, etc.). The platform10can perform multiple instances of the analysis with targeted scripts202,302, that search and evaluate data in subsections of the platform10.

As alluded to above, the second script generates a report with the results of the evaluation. In response, an enterprise system16can act as a controller upon receiving the transmitted results to modify the found one or more properties searched for by the script202. For example, the access permissions found and evaluated by the scripts202,302can be changed to update a subsequent cloud storage of access permissions.

The enterprise system16can be configured to take one or more corrective actions in response to the evaluation failing. For example, the corrective actions can include quarantining the evaluated data file(s), deleting the data file, quarantine the isolated platform10, switching deployment workflows to an alternative redundant isolated platform10, etc.

InFIG.5, an example configuration of the isolated platform10is shown. In certain embodiments, the isolated platform10may include one or more processors502, a communications module504to receive scripts (e.g., scripts202and302), and an interface module506for interfacing with the datastores controlled by the isolated platform10(if any), and/or a local database520. Communications module504enables the isolated platform10to communicate with one or more other components of the computing environment8, such as client device12(or one of its components), via a bus or other communication network, such as the communication network14. The isolated platform10includes at least one memory516or memory device that can include a tangible and non-transitory computer-readable medium having stored therein computer programs, sets of instructions, code, or data to be executed by processor502.FIG.5also shows a tool repository518, which can be stored in memory on the isolated platform10and operated by the processor502in order to execute received scripts. It can be appreciated that any of the tools (and modules, and applications) shown inFIG.5may at least in part be hosted externally and be available to the isolated platform10, e.g., via the communications module504. In the example embodiment shown inFIG.5, the isolated platform10includes an access control module508, the analysis module510, the evaluation application512, and an enterprise system interface module514.

The analysis module510performs the analysis in accordance with one or more received scripts. For example, the analysis module may include designated hardware, or designated tools from the tool repository518, etc., to conduct data element integrity analysis.

The access control module508may be used to apply a hierarchy of permission levels or otherwise apply predetermined criteria to determine what cloud database18, other data stored in database520, can be shared with which entity in the computing environment8, and to determine which computing resources can be accessed by the isolated platform10and any processes implemented by the processors502thereon. For example, the isolated platform10may completely isolate certain data in the database520, to prevent any tampering with source data (e.g., relying on reversion as a failsafe in place of the effort of recovery of data). In another example, the isolated platform10can have been granted access to only certain servers or computing resource blocks of the enterprise system16to conduct evaluations (e.g., all testing is done on servers that are not connected to sensitive data).

The isolated platform10may also include or host the server-side evaluation application512that enables client devices12to access or control the analysis module510, or the tool repository518. In example embodiments, the application512includes an application programming interface (API) to enable functionality of the platform10to be accessed via widely available software platforms, such as web browsers. The evaluation application512may also interface with, or be integrated into, the enterprise system interface module514to permit a seamless integration with existing user interfaces and tools associated with the enterprise system16.

The enterprise system interface module514can provide a GUI or API connectivity to communicate with the enterprise system16, to ingest enterprise data into the platform10, or to provide data to the cloud database18, or other datastore (if applicable). It can be appreciated that the enterprise system interface module514may also provide a web browser-based interface, an application or “app” interface, a machine language interface, etc.

InFIG.6, an example configuration of the client device12is shown. In example embodiments, the client device12may include one or more processors602, a communications module604, and a datastore(s)606, storing one or more of tools608(e.g., for inclusion with the scripts612), or data elements610or scripts612, or applications (not shown) that are to be ingested by the platform10. Communications module604enables the client device12to communicate with one or more other components of the computing environment8, such as the isolated platform10or enterprise system16, via a bus or other communication network, such as the communication network14. The client device12can include at least one memory603or memory device that can include a tangible and non-transitory computer-readable medium having stored therein computer programs, sets of instructions, code, or data to be executed by processor602.FIG.6illustrates examples of modules and applications stored in memory on the client device12and operated by the processor602. It can be appreciated that any of the modules and applications shown inFIG.6may also be hosted externally and be available to the client device12, e.g., via the communications module604.

In the example embodiment shown inFIG.6, the client device12includes a display module614for rendering GUIs and other visual outputs on a display device such as a display screen, and an input module616for processing user or other inputs received at the client device12, e.g., via a touchscreen, input button, transceiver, microphone, keyboard, etc. The client device12may also include an enterprise application618provided by the enterprise system16, e.g., for performing mobile insurance, banking, or other financial product or services. The client device12in this example embodiment also includes a web browser application620for accessing Internet-based content, e.g., via a mobile or traditional website. In this example, the client device12also includes a connections application622, which corresponds to a client-based application to access and interface with the evaluation application512hosted by the isolated platform10.

The datastore606may be used to store device data, such as, but not limited to, an IP address or a MAC address that uniquely identifies client device12within the computing environment8. The datastore606may also be used to store application data, such as, but not limited to, login credentials, user preferences, cryptographic data (e.g., cryptographic keys), etc.

It will be appreciated that only certain modules, applications, tools, and engines are shown inFIGS.5and6for ease of illustration and various other components would be provided and utilized by the isolated platform10, enterprise system16, and client device12, as is known in the art.

Although not shown inFIGS.5,6, as noted above, the platform10and/or enterprise system16may also include a cryptographic module for performing cryptographic operations and providing cryptographic services. The cryptographic server can also be configured to communicate and operate with a cryptographic infrastructure.

Referring now toFIG.7, an example embodiment of computer executable instructions for conducting data integrity analyses is shown. In the following discussion ofFIG.7, reference shall be made to the preceding figures and discussion. It is understood that the reference to the preceding figures and discussion is intended to aid clarity and is not limiting.

At block702, a first script (e.g., script302) is received. The script is for creating a data file based on found properties, for creating a unique immutable property based on each data file, and for creating an aggregated immutable property.

At block704, the first script is executed. The first script can be executed by the analysis module510.

At block706, the results of block704are stored by the platform10. For example, the results can be stored as a separate log file, a data file212, a data file214, and a data file216.

At block708, the first script is deleted.

At block710, a second script, complementary to the first script, for evaluating

the integrity of the created information is executed. The second script (e.g., script302) can be received in a manner similar to the first script.

At block712, optionally, the second script is removed. Removing the second script can beneficially reduce the amount of time that adversaries have to find and evaluate the second script, leading to an increased amount of protection.

Optionally, the shown process can include a precursor block, block714. At block714, a system remote to the platform10can generate the first and second scripts, and configure them with the necessary reference parameters to perform the methods described herein. The remote systems (e.g., enterprise system16) can transmit the scripts (together, or sequentially), to the target isolated device, receive results from the second script, and thereafter perform corrective actions.

The steps or operations in the flow charts and diagrams described herein are just for example. There may be many variations to these steps or operations without departing from the principles discussed above. For instance, the steps may be performed in a differing order, or steps may be added, deleted, or modified.