Abstract:
Protecting sensitive content, such as business critical documents or other computer files, is disclosed. In various embodiments, upon receiving an indication that a threat pattern associated with a content item has been matched, the protected content “self-destructs”, such as y rendering the content item inaccessible, e.g., at a client and or to a particular user or group of users.

Description:
CROSS REFERENCE TO OTHER APPLICATIONS 
       [0001]    This application is a continuation of co-pending U.S. patent application Ser. No. 13/630,887, entitled SELF-DESTRUCTING CONTENT filed Sep. 28, 2012 which is incorporated herein by reference for all purposes. 
     
    
     BACKGROUND OF THE INVENTION 
       [0002]    Security of the business critical documents that are sent or shared over network like a new product design is important. Files falling into the possession of unintended users (internal or external, hackers, competitors, etc.) might result in significant competitive, financial, or other damage or loss to an enterprise. Information rights management (IRM) and other techniques may be used to protect documents, but in typical approaches it may be possible for an unintended user to receive an IRM-protected (or other protected) copy and a malicious user may gain access to the authorized user&#39;s credential or may be able to use offline tools to gain unprotected access to the content. 
     
    
     
       BRIEF DESCRIPTION OF THE DRAWINGS 
         [0003]    Various embodiments of the invention are disclosed in the following detailed description and the accompanying drawings. 
           [0004]      FIG. 1  is a block diagram illustrating an embodiment of a content management system. 
           [0005]      FIG. 2  is a flow chart illustrating an embodiment of a process to protect against unauthorized access to sensitive content. 
           [0006]      FIG. 3  is a flow chart illustrating an embodiment of a process to protect against unauthorized access to sensitive content. 
           [0007]      FIG. 4  is a block diagram illustrating an embodiment of a system to protect against unauthorized access to sensitive content. 
           [0008]      FIG. 5  is a flow chart illustrating an embodiment of a process to protect against unauthorized access to sensitive content. 
       
    
    
     DETAILED DESCRIPTION 
       [0009]    The invention can be implemented in numerous ways, including as a process; an apparatus; a system; a composition of matter; a computer program product embodied on a computer readable storage medium; and/or a processor, such as a processor configured to execute instructions stored on and/or provided by a memory coupled to the processor. In this specification, these implementations, or any other form that the invention may take, may be referred to as techniques. In general, the order of the steps of disclosed processes may be altered within the scope of the invention. Unless stated otherwise, a component such as a processor or a memory described as being configured to perform a task may be implemented as a general component that is temporarily configured to perform the task at a given time or a specific component that is manufactured to perform the task. As used herein, the term ‘processor’ refers to one or more devices, circuits, and/or processing cores configured to process data, such as computer program instructions. 
         [0010]    A detailed description of one or more embodiments of the invention is provided below along with accompanying figures that illustrate the principles of the invention. The invention is described in connection with such embodiments, but the invention is not limited to any embodiment. The scope of the invention is limited only by the claims and the invention encompasses numerous alternatives, modifications and equivalents. Numerous specific details are set forth in the following description in order to provide a thorough understanding of the invention. These details are provided for the purpose of example and the invention may be practiced according to the claims without some or all of these specific details. For the purpose of clarity, technical material that is known in the technical fields related to the invention has not been described in detail so that the invention is not unnecessarily obscured. 
         [0011]    Self-destruction of business critical documents is disclosed. In various embodiments, self-destruction is triggered based at least in part on security threat pattern matching. In some embodiments, an information rights management (IRM) or other service is leveraged to implement and use the disclosed feature. This can prevent documents from falling into the wrong hands based on security threat pattern matching. 
         [0012]    In some embodiments, there is a configurable field in the protection wizard for a document which if set results in the document being treated as extremely confidential. Documents protected with this configurable item to be true are protected in various embodiments by a service or other mechanism that results in their self-destruction based on security threat pattern matching. In various embodiments, self-destruction may be performed locally, e.g., at a client to which the document or other content has been downloaded, or by operation of a remote service, for example one that renders the document inaccessible at or to a client in response to a security threat pattern being matched. 
         [0013]    The following are some of the variables that may be considered to develop a security threat pattern (single variable or multiple variables) in various embodiments: time restrictions, network restrictions, permissions, user restrictions, wrong password attempts, etc. By way of example, a document is protected with a security restriction to be opened between only certain times in the day, e.g., between LOAM and 11 AM on some given date or day of the week. While the protection was being defined, for example via a content security wizard, the document was marked as “extremely confidential” or some other designation with which self-destruction is associated. If anyone tries to open this document apart from the authorized time and day, a security pattern defined to impose the time/day restriction is determined to be matched, resulting in various embodiments in self-destruction of the document, for example the document is replaced on or as available to the client with content in a format that is not usable at the client. In some embodiments, before self-destructing real time data of who tried to view to document, from which Internet protocol (IP) address, etc. is sent to a server administrator. In some embodiments, an extracted format of the original document is sent to the IRM server for backup, to protect against loss of the latest version of the document or other content, which once backed up to the server is self-destructed at the client, for example by replacing the document at the client with an unusable format. 
         [0014]      FIG. 1  is a block diagram illustrating an embodiment of a content management system. In the example shown, a plurality of clients, represented in  FIG. 1  by clients  102 ,  104 , and  106 , access, via network  108 , content associated with a content server  110  and stored in a repository  112 . An IRM server  114  uses IRM data  116  to monitor and control access to and/or use of content made accessible via content server  110  and repository  112 , for example to ensure that content intended to be accessible only to authorized users is only accessed by such users. 
         [0015]      FIG. 2  is a flow chart illustrating an embodiment of a process to protect against unauthorized access to sensitive content. In the example shown, threat detection criteria are received and stored ( 202 ). For example, in some embodiments, an administrative interface is provide to enable an administrator to define the types of security restrictions that users will be provided an opportunity to designate for a document, for example via a security wizard or other interface, in connection with creating and saving the document, such as to a content management system or other repository. In connection with configuring protection for a particular document, folder, or other content or set of content, a user selects or otherwise specifies a type of protection and, where applicable, associated attributes. For example, in one of the examples mentioned above a user may select an option to impose a day/time restriction and may enter or otherwise provide values to designate that access is to be provided only at the days and/or times desired, such as weekdays between 9 am and 5 pm. In response to the designation, a threat pattern is defined and associated with the document(s) or other content, for example, a rule that is triggered if an attempt is made to access the document at a time or on a day other than as specified. In various embodiments, server and/or client side plugins and/or other components may be configured to cause the protected document(s) or other content to self-destruct in the event a threat is detected based on the stored pattern ( 204 ). For example, a client side plugin may be configured to render a copy of the document as stored at the client inaccessible, such as by substituting a document in an unusable format, in response to a threat pattern having been determined to have been matched. 
         [0016]      FIG. 3  is a flow chart illustrating an embodiment of a process to protect against unauthorized access to sensitive content. In the example shown, documents or other content that has been designated as “business critical” or some other designation associated with a self-destruction protection as disclosed herein is monitored to determine whether associated threat detection criteria (patterns) have been matched ( 302 ). For example, if a day/time of access restriction has been applied, attempts to access the content are monitored and the day/time of any attempt to access is checked against the criteria to determine whether a threat pattern (i.e., attempt to access outside of approved day/time) has been matched. By way of further example, if a document is restricted to being accessed by nodes using an IP or other address, such as one in a statically configured and approved address range, then an attempt to access the document from a client having an IP address not in the approved range would trigger a determination that a threat pattern has been matched. Upon detecting a threat ( 304 ), the business critical document, or in some embodiments all business critical content on that client, if any, is rendered inaccessible at and/or to the client ( 306 ). For example, the protected content may be replaced by content in an unusable format, or a security data (e.g., key or associated data) required to access the content as stored at the client may be rendered inaccessible, unusable, and/or otherwise unavailable at the client. Monitoring of content, including by comparing actual access attempts to threat detection patterns, continues unless/until done ( 308 ), for example the system is shut down for maintenance. 
         [0017]    Note that in various embodiments even an unauthorized user who has learned the secret credential of an authorized user may be foiled by techniques disclosed herein. For example, if the unauthorized user were to attempt to use the authorized user&#39;s credential to gain access to protected content, for example at a prohibited time or from a prohibited system or location, the unauthorized user, being unaware of the protections disclosed herein, would cause a corresponding threat pattern to be determined to have been matched, resulting in the content being rendered, inaccessible and/or otherwise auto-destructed, to the unauthorized user or others attempting to use the stolen credential. 
         [0018]      FIG. 4  is a block diagram illustrating an embodiment of a system to protect against unauthorized access to sensitive content. In the example shown, client system  102  includes a communication interface  404 , e.g., a network interface card or other interface, which provides network connectivity via a physical, wireless, or other connection  406 . A client side content application  408 , such as a content authoring application running on a content management or other application framework, communicates via the communication interface  404  and connection  406  with a remote content server (not shown in  FIG. 4 ) to provide access to content stored in a remote repository with which the content server is associated. A critical content protection plugin (or other software)  410  provides content protection as disclosed herein, including in various embodiments by keeping track of which content at the client, for examples stored in memory, disk, or other storage device  412 , such as by application  408 , has been designated as “critical content”; monitoring to determine whether a threat pattern has been matched (e.g., access attempt outside authorized time of day); and causing self-destruction of critical content upon determining that a threat pattern has been matched (e.g., replacing critical content as stored on storage device  412  with an unusable format. 
         [0019]      FIG. 5  is a flow chart illustrating an embodiment of a process to protect against unauthorized access to sensitive content. In some embodiments, the process of  FIG. 5  is implemented by a client side plugin and/or other client side component, such as critical content protection plugin  410  of  FIG. 4 . In the example shown in  FIG. 5 , upon detecting a threat at a protected client ( 502 ), the current content (i.e., most recently updated and/or saved locally at the client) is extracted and sent to a remote server, e.g., an IRM server, content server, or other server, for backup ( 504 ). Data associated with the access attempt that trigger the threat pattern match determination is collected and reported, e.g., to the IRM server ( 506 ). The content is rendered inaccessible at the client ( 508 ), e.g., replaced by an unusable format, etc. 
         [0020]    In various embodiments, techniques disclosed herein will ensure, or at least reduce the possibility, that a business critical document or other content, like a new product design, a new drug composition etc., will not fall into the wrong hands, thereby helping companies avoid potentially huge financial and/or other losses. 
         [0021]    Although the foregoing embodiments have been described in some detail for purposes of clarity of understanding, the invention is not limited to the details provided. There are many alternative ways of implementing the invention. The disclosed embodiments are illustrative and not restrictive.