Patent Publication Number: US-8127365-B1

Title: Origination-based content protection for computer systems

Description:
BACKGROUND OF THE INVENTION 
     1. Field of the Invention 
     The present invention relates generally to computer security, and more particularly but not exclusively to methods and apparatus for protecting digital content. 
     2. Description of the Background Art 
     Various data leakage prevention products are commercially available for protecting confidential information, such as company intellectual property, from unauthorized distribution and access. Generally speaking, data leakage prevention involves classifying content to determine if the content is confidential, and then safeguarding the perimeters of a network to ensure that confidential content is not sent out of the network without required authorization. For example, a company or organization may employ data leakage prevention to restrict access to confidential information and prevent the confidential information from being transmitted outside its enterprise network. 
     While currently available data leakage prevention techniques are relatively effective, they pose significant usability issues. More specifically, data leakage prevention as currently implemented involves tedious setup and configuration, which are typically manually performed by the user or administrator. For example, to prevent leakage of a confidential document outside an enterprise network, a user may place the confidential document in a designated file server. An administrator manually categorizes the confidential document and selects the confidential document&#39;s content sensitivity, access criteria, and protection method. The more document that needs to be protected, the more tedious content protection becomes. 
     SUMMARY 
     In one embodiment, content (e.g., confidential information of an organization), may be protected by automatically categorizing the content. The automatic categorization may be performed by calculating a sensititiy score of the content, the sensitivity score being indicative of whether or not the content is confidential. The sensitivity score may be compared to a threshold. Metadata of the content may be provided to collaborating computers outside the computer network where the content was created. The collaborating computers may compare the metadata to received content to determine if the received content discloses confidential information described by the metadata. 
     These and other features of the present invention will be readily apparent to persons of ordinary skill in the art upon reading the entirety of this disclosure, which includes the accompanying drawings and claims. 
    
    
     
       DESCRIPTION OF THE DRAWINGS 
         FIG. 1  shows a schematic diagram of a computer in accordance with an embodiment of the present invention. 
         FIG. 2  schematically shows a data leakage prevention system in accordance with an embodiment of the present invention. 
         FIG. 3  shows a flow diagram of a method of categorizing content for data leakage prevention in accordance with an embodiment of the present invention. 
         FIG. 4  schematically illustrates the stages of document creation and metadata that the content protection module may generate for the document being created in accordance with an embodiment of the present invention. 
         FIG. 5  schematically shows a collaborative data leakage prevention system in accordance with an embodiment of the present invention. 
     
    
    
     The use of the same reference label in different drawings indicates the same or like components. 
     DETAILED DESCRIPTION 
     In the present disclosure, numerous specific details are provided, such as examples of apparatus, components, and methods, to provide a thorough understanding of embodiments of the invention. Persons of ordinary skill in the art will recognize, however, that the invention can be practiced without one or more of the specific details. In other instances, well-known details are not shown or described to avoid obscuring aspects of the invention. 
     Being computer-related, it can be appreciated that some components disclosed herein may be implemented in hardware, software, or a combination of hardware and software (e.g., firmware). Software components may be in the form of computer-readable program code stored in a computer-readable storage medium, such as memory, mass storage device, or removable storage device. For example, a computer-readable storage medium may comprise computer-readable program code for performing the function of a particular component. Likewise, computer memory may be configured to include one or more components, which may be executed by a processor. Software components may be implemented in logic circuits, for example. Components may be implemented separately in multiple modules or together in a single module. 
     Referring now to  FIG. 1 , there is shown a schematic diagram of a computer  100  in accordance with an embodiment of the present invention. The computer  100  may be employed as a client, server, or gateway computer. For example, the computer  100  may be employed as an endpoint computer  230  of  FIG. 2 . The computer  100  may have less or more components to meet the needs of a particular application. The computer  100  may include a processor  101 , such as those from the Intel Corporation or Advanced Micro Devices, for example. The computer  100  may have one or more buses  103  coupling its various components. The computer  100  may include one or more user input devices  102  (e.g., keyboard, mouse), one or more data storage devices  106  (e.g., hard drive, optical disk, USB memory), a display monitor  104  (e.g., LCD, flat panel monitor, CRT), a computer network interface  105  (e.g., network adapter, modem), and a main memory  108  (e.g., RAM). The computer network interface  105  may be coupled to a computer network  109 , which in this example includes the Internet. 
     In the example of  FIG. 1 , the main memory  108  includes software modules  110 , which may comprise the later described content protection module  210  or other computer-readable program code. The software modules  110  may be loaded from the data storage device  106  to the main memory  108  for execution by the processor  101 . 
       FIG. 2  schematically shows a data leakage prevention (DLP) system  200  in accordance with an embodiment of the present invention. In the example of  FIG. 2 , the DLP system  200  prevents leakage of designated confidential content from the enterprise network  220 . The enterprise network  220  may be a private computer network of an organization (e.g., a corporation), and may comprise a data store computer  231 , a gateway computer  232 , and one or more endpoint computers  230 . 
     An endpoint computer  230  may be a user computer (e.g., desktop, workstation, or laptop computer) for creating content. Content may include word processing files, electronic spreadsheets, source code, project files, presentations, and other forms of computer-created information. The endpoint computer  230  may include a content protection module  210 , which may comprise computer-readable program code executed by the processor of the endpoint computer  230 . In one embodiment, the content protection module  210  is configured to automatically categorize content for data leakage prevention. The content protection module  210  allows for origination-based content protection in that the categorization of the content may occur at the computer where the content was first created, and automatically upon first creation of the content or before the content is transmitted out of the computer where the content was first created. 
     As shown in  FIG. 2 , other computers in the enterprise network  220  or even on the Internet may also run a content protection module  210  to perform automatic categorization of content for data leakage prevention. In the case of the enterprise network  220 , the content protection module  210  prevents unauthorized transmission and access of content created at an endpoint computer  230 , gateway computer  232 , or data store computer  231 . The gateway computer  232  may be configured to prevent unauthorized transmission of content that has been categorized by the content protection module  210  as confidential. Similarly, a cloud computer system  233  on the Internet may also run a content protection module  210  to perform automatic categorization of content created in the cloud. The cloud computer system  233  may comprise one or more server computers that provide cloud computing services on the Internet. The cloud computer system  233  may be configured to prevent unauthorized transmission and access of content categorized by the content protection module  210  as confidential. 
       FIG. 3  shows a flow diagram of a method  300  of categorizing content for data leakage prevention in accordance with an embodiment of the present invention. The method  300  may be performed by a content protection module  210  implemented as computer-readable program code executed by a processor of a computer. For example, the content protection module  210  may be running in the endpoint computer  230  of  FIG. 2 . 
     In the example of  FIG. 3 , the content protection module  210  receives content in the endpoint computer  230  (step  301 ), where the content was first created by its creator. The content may comprise a computer document, such as a word processing file, for example. 
     The content protection module  210  determines the sensitivity score of the content (step  302 ). The sensitivity score is indicative of whether or not the content is confidential and thus needs to be protected from general access. In one embodiment, the content protection module  210  determines the sensitivity score of the content using a sensitivity model that assigns numerical weights based on the content&#39;s human creator, type, template, and actual content (e.g., text, body). The sensitivity model may also include rules that add or subtract a numerical value based on existence or non-existence of certain features. 
     The creator&#39;s characteristics may be used to calculate the sensitivity score. For example, the group in which the creator belongs may be given a score depending on the importance and/or confidentiality of the work performed by the group. For example, creators belonging to groups, such as the engineering department, human resources, finance, special project, and other groups or departments, may be assigned predetermined weights based on their group. Information about the content&#39;s creator may be obtained by the content protection module  210  from directory services or the content&#39;s metadata. The creator&#39;s position in the group may also be given weight. For example, a vice president of engineering is more likely to create confidential content compared to director of customer support. 
     The template used in creating the content may be assigned a weight. For example, a particular Microsoft Word™ document template for creating documents for marketing projects may be assigned a higher weight compared to another Microsoft Word™ document template for creating letters in general. As another example, templates for creating engineering technical specifications may be given one weight, while templates for creating project schedules may be given another. 
     The content&#39;s body or actual content may be parsed for key words, objects, or other content features. Each content feature may be assigned a weight. For example, the name of high priority projects may be assigned more weight compared to the name of lower priority projects. Content features and their weights may also be selected and assigned using a machine-learning approach, based on the features&#39; appearance on samples of known highly confidential documents, for example. Rules, which may be in the form of regular expressions, may add or subtract from the sensitivity score based on existence or non-existence of features, as well as position of features in the content with respect to other features. 
     The content protection module  210  compares the sensitivity score of the content to a threshold (step  303 ). Depending on the granularity of the categorization, there may be one or several thresholds, with each threshold assigning a confidentiality level. For example, a first threshold may be for a first level confidential content, a second threshold higher than the first threshold may be a for second level confidential content, and so on. There may also be a single threshold for categorizing content as either confidential or not. If the sensitivity score of the content is higher than a threshold, the content protection module  210  may categorize the content as confidential at a level corresponding to the threshold. Otherwise, if the sensitivity score is lower than the threshold, the content protection module  210  categorizes the content as not confidential. 
     The method  300  includes an optional step for asking the creator to confirm the accuracy of the content categorization (step  304 ). After determining the category of the content (e.g., either confidential or not confidential), the content protection module  210  may optionally ask the creator whether or not he or she agrees with the categorization of the content. This optional step allows the sensitivity model to be adjusted over time. For example, if the categorization is incorrect, a report may be generated regarding the incorrect categorization. The administrator or programmer may troubleshoot what caused the incorrect categorization to prevent it from happening again in the future. For example, the weights of the content features may be adjusted to more properly reflect the features&#39; importance in categorizing contents. 
     In one embodiment, each creator is assigned his or her own unique creator identification (ID). The content protection module  210  may associate the creator ID with the sensitivity rules used to categorize contents made by the creator (step  305 ). For example, the features found in the content and allowed for correct categorization of the content as confidential may be stored in a database of rules. This enables identification and collection of important features for particular creators, allowing for personalized categorization. The sensitivity model used to determine the sensitivity score may be adjusted based on feedback from the creator (step  306 ) to further allow for personalized categorization. 
     The content may be protected based on its category (step  307 ). For example, non-confidential content may be freely distributed and accessed. Contents that have been categorized as confidential may be marked and protected in accordance with suitable data leakage prevention techniques. For example, the gateway  232  of  FIG. 2  may be configured to restrict transmission of confidential documents outside the enterprise network  220 , except by authorized users. 
     As can be appreciated from the foregoing, the content protection module  210  allows for categorization of content without the creator having to go through relatively tedious steps of moving the content to a designated server and waiting for the content to be manually categorized. Also, the content protection module  210  can be adapted for particular users, lowering the chance of incorrect categorization over time. 
       FIG. 4  schematically illustrates the stages of document creation and the metadata that the content protection module  210  may generate for the document being created in accordance with an embodiment of the present invention. 
     In the example of  FIG. 4 , a document  403  undergoes three phases starting from document initiation, then to work-in-progress, then finally to document completion. The document  403  may comprise a computer document, such as word processing file, pdf document, project file, electronic spreadsheet, source code file, etc. The document  403  is labeled as “ 403 A” when the document is first initiated. This is at time T 0  when the creator first started the application program to create the document  403 A or when the creator first opened the template on which the document  403 A will be based. When the document  403 A is first initiated, it may have metadata identifying its creator, summary, when created, and other properties. An example of such metadata includes the properties of a Microsoft Word™ document. The metadata created by the content protection module  210  for the document  403 A is labeled in  FIG. 4  as “ 401 A.” The content protection module  210  may determine the sensitivity score of the metadata  401 A as per the step  302  of the method  300 , for example. The content protection module  210  adds the metadata  401 A and its sensitivity score in the creator&#39;s historical record  402 , which may identify the creator by his or her creator ID. 
     The document  403  is labeled as “ 403 B” while it is currently being worked on by its creator. The metadata created by the content protection module  210  for the document  403 B is labeled as “ 401 B.” The metadata  401 B may include an updated metadata  401 A and a compact representation of the contents of the document  403 B as currently saved by its creator. For example, the metadata  401 B may include a hash or normalized version of the body of the document  403 B. As a particular example, the metadata  401 B may include the text entered by the creator in a word processing program. The content protection module  210  may parse the document  403 B for features having weights in the sensitivity model, and include those features in the metadata  401 B. The content protection module  210  may determine the sensitivity score of the metadata  401 B. The content protection module  210  adds the metadata  401 B and its sensitivity score in the creator&#39;s historical record  402 . The content protection module  210  may store the latest, all, or a subset of versions of the metadata  401 B depending on data storage constraints. 
     The document  403  is labeled as “ 403 C” after it has been completed by its creator to a point where the document may be, for the first time, published out of the computer where the document is created, for example as a first draft. The metadata created by the content protection module  210  for the document  403 C is labeled as “ 401 C.” The metadata  401 C may include an updated metadata  401 B and a compact representation of the contents of the document  403 C. The metadata  401 C is the same as the metadata  401 B but for a completed document. The content protection module  210  calculates the sensitivity score of the metadata  401 C, and includes the metadata  401 C and its sensitivity score in the creator&#39;s historical record  402 . The document  403 C may be categorized as per the method  300  of  FIG. 3 . 
     In one embodiment, metadata of categorized content is employed in a collaborative data leakage prevention system involving several computers across the Internet. This aspect of the present invention allows for identification of confidential content even after the confidential content has been transmitted out of the enterprise network or when the content has been converted into another form. This aspect of the present invention is now described with reference to  FIG. 5 . 
       FIG. 5  schematically shows a collaborative data leakage prevention system in accordance with an embodiment of the present invention. The collaborative data leakage prevention system includes a plurality of collaborating server computers  551  (i.e.,  551 - 1 ,  551 - 2 , . . .  551 - n ) that are configured to detect confidential content categorized by a protection module  210 . The server computers  551  may be configured to provide various web services on the Internet, including e-mail, social networking, blogging, website hosting, Internet service, etc. As will be further discussed below, the server computers  551  are configured to receive metadata of confidential content from content protection modules  210 . The metadata may be in the form of a metadata  401  (e.g.,  401 A,  401 B, and/or  401 C) or creator historical record  402 . The server computers  551  may be configured to watch for content having characteristics of received metadata. The server computers  551  may be operated by the same organization, related organizations, or be bound by agreement or contract to maintain confidentiality of metadata received from the enterprise network  220 . 
     In the example of  FIG. 5 , the content protection module  210  running on the endpoint computer  230  in the enterprise network  220  sends metadata to the collaborating computer servers  551  by way of the gateway computer  232  (see arrow  501 ). The metadata is in the form of a metadata  401  (e.g.,  401 A,  401 B, and/or  401 C) but may also be in the form of a creator historical record  402 . The metadata  401  is sent to a collaborating server computer  551 - 1 , which then sends copies of the metadata  401  to the other collaborating server computers  551  (see arrows  503 ,  504 , and  505 ). Alternatively, the gateway computer  232  may act as the central distribution point and forward copies of the metadata  401  to all collaborating server computers  551 . 
     Each collaborating server computer  551  may include a comparison module  513  for comparing received content to the metadata  401 . A comparison module  513  may comprise computer-readable program code configured to determine if content received in a collaborating computer discloses content described by a reference metadata. For example, the comparison module  513  may be configured to look for combination of words or unique words used in a top secret project as described in the reference metadata. Other suitable matching or detection algorithm may also be used without detracting from the merits of the present invention. In the example of  FIG. 5 , the reference metadata are those generated by a content protection module  210  for confidential content, such as the metadata  401 . 
     In the example of  FIG. 5 , a user on a client computer  514  creates content  512  on the collaborating server computer  551 - 2  (see arrow  506 ). The content  512  may be a blog, a web posting, or other online content. As can be appreciated, the content  512  does not necessarily have to be in the same format as the metadata  401 . For example, the content  512  may be a blog, while the metadata  401  may be metadata for a Microsoft Word™ word processing document. The comparison module  513  running on the collaborating server computer  551 - 2  determines whether the content  512  is described by the metadata  401  (see arrow  507 ). If the content  512  is described by the metadata  401 , the comparison module  513  deems the content  512  to be disclosing confidential information from the source of the metadata  401 . In that case, the comparison module  513  may report the incident to, for example, the gateway computer  232  where an administrator may read and respond to the report. 
     While specific embodiments of the present invention have been provided, it is to be understood that these embodiments are for illustration purposes and not limiting. Many additional embodiments will be apparent to persons of ordinary skill in the art reading this disclosure.