Patent Description:
Due to its popularity as a content medium, ever more digital content is being produced and made available to users. As a result, the efficiency with which such digital content can be managed and secured has become increasingly important to the producers, owners, and distributors of that content. One significant content management challenge in digital content production is tracking the location of a digital asset as it moves through a workflow pipeline having multiple collaborators, some of which may be internal resources of the digital content producer (e.g., a studio), and some of which may be resources or services provided to the digital content producer by external vendors.

Identifying the location of a digital asset can typically occur once a source of and destination for the digital asset are identified. However, in the case of digital content producers interfacing with many vendors for production and post distribution work, tracking the transfers of a digital asset among the digital content producer and vendors, as well as the transport pathways used for those transfers remains challenging. Although there are existing solutions in the networking and cyber-security fields that attempt to track digital assets, those solutions typically require localized applications in each environment in which the digital asset is processed or resides. <CIT> discloses a system and method for automated insider threat prevention including monitoring network communications at a network device, detecting an anomalous activity based on the monitored network communications associated with a user based on a behavior profile for the user, and performing an action in response to the detected anomalous activity based on a policy. The network device is positioned on the side of a server and a firewall is disposed between a client and the server. <CIT> discloses a traffic analysis service.

It is the object of the present invention to omit or reduce these drawbacks.

The present invention is defined by the features of the independent claims. The dependent claims describe preferred embodiments.

The invention provides a content transport security system and a method for use by a content transport security system as follow:
A content transport in a first data domain, the content transport security system adapted to be communicatively coupled to a client device in the first data domain and to transport a content file received from the client device over a communication network to a second data domain including a destination device, the content transport security system security system comprising:.

Preferably the content transport security system, further comprising a content history database, wherein the processing hardware is further configured to execute the content security software code to:.

Preferably the content transport security system, wherein the processing hardware is further configured to execute the content security software code to:.

Preferably the content transport security system, further comprising a machine learning (ML) model-based content analyzer, wherein the at least one of the audio analysis, the text analysis, or the visual analysis of the content asset is performed using the ML model-based content analyzer.

Preferably the content transport security system, wherein the forensic identifier comprises a watermark.

Preferably the content transport security system, wherein the forensic identifier comprises a hash value.

Preferably the content transport security system, wherein the client device is administered in a first data domain controlled by a domain owner and the destination device is administered in a second data domain controlled by another domain owner.

A method for use by a content transport security system in a first data domain, the content transport security system adapted to be communicatively coupled to a client device in the first data domain and to transport a content file received from the client device over a communication network to a second data domain including a destination device, the content transport security system including a computing platform having a processing hardware and a system memory storing a software code and a database including at least one business rule, the method comprising:.

Preferably the method, wherein the content transport security system further comprises a content history database, the method further comprising:.

Preferably the method, further comprising:.

Preferably the method, wherein the content transport security system further comprises a machine learning (ML) model-based content analyzer, and wherein the at least one of the audio analysis, the text analysis, or the visual analysis of the content asset is performed using the ML model-based content analyzer.

Preferably the method, wherein the forensic identifier comprises a watermark.

Preferably the method, wherein the forensic identifier comprises a hash value.

Preferably the method, wherein the client device is administered in a first data domain controlled by a domain owner and the destination device is administered in a second data domain controlled by another domain owner.

Preferably the method, wherein the client device will accept a proxy.

Preferably the method, wherein the client device does not allow proxy configurations.

Preferably the method, wherein the client device is configured to use the content transport security system as a default gateway.

The invention also comprises:
A computer-readable non-transitory storage medium having stored thereon instructions, which when executed by a processing hardware of a content transport security system, instantiate a method according to the present invention, especially comprising:.

Preferably the computer-readable non-transitory storage medium, the method further comprising:.

Preferably the computer-readable non-transitory storage medium, wherein the at least one of the audio analysis, the text analysis, or the visual analysis of the content asset is performed using a machine learning (ML) model-based content analyzer of the content transport security system.

Preferably the computer-readable non-transitory storage medium, wherein the forensic identifier comprises at least one of a watermark or a hash value.

Preferably the computer-readable non-transitory storage medium, wherein the client device is administered in a first data domain controlled by a domain owner and the destination device is administered in a second data domain controlled by another domain owner.

The following description contains specific information pertaining to implementations in the present disclosure. One skilled in the art will recognize that the present disclosure may be implemented in a manner different from that specifically discussed herein. The drawings in the present application and their accompanying detailed description are directed to merely exemplary implementations. Unless noted otherwise, like or corresponding elements among the figures may be indicated by like or corresponding reference numerals. Moreover, the drawings and illustrations in the present application are generally not to scale, and are not intended to correspond to actual relative dimensions.

The present application discloses systems and methods for automating digital content transport security (hereinafter "content transport security") that overcome the drawbacks and deficiencies in the conventional art. By way of brief overview, the automated digital content transport security solution disclosed in the present application intercedes in a file transfer of a content file from a client device, such as a computer, to a destination device, such as another computer, evaluates data contained in the content file, classifies the file transfer as one of allowable, forbidden, or suspicious, and takes action accordingly, as described in greater detail below. In various implementations, the digital content secured using the systems and methods disclosed in the present application may include audio-video (AV) content in the form of video games, movies, or episodic television (TV) content that includes episodes of TV shows that are broadcast, streamed, or otherwise available for download or purchase on the Internet or via a user application. Alternatively, or in addition, that digital content may include one or more of software code, financial or business records, marketing or distribution plans, a graphical image or images, or other digital media content, for example, such as digital audio without video, digital video without audio, or animation.

It is noted that, as defined in the present application, the terms "automation," "automated," and "automating" refer to systems and processes that do not require the participation of a human user, such as a human system administrator. For example, although in some implementations a human system administrator may review the performance of the systems and methods disclosed herein, that human involvement is optional. Thus, the processes described in the present application may be performed under the control of hardware processing components of the disclosed systems.

<FIG> shows an exemplary content transport security system <NUM> automating content transport security, according to one implementation. As shown in <FIG>, content transport security system <NUM> includes computing platform <NUM> having processing hardware <NUM> and system memory <NUM> implemented as a computer-readable non-transitory storage medium. According to the present exemplary implementation, system memory <NUM> stores asset monitoring software code <NUM>, machine learning (ML) model-based content analyzer <NUM>, and database <NUM>.

It is noted that, as defined in the present application, the expression "machine learning model" or "ML model" may refer to a mathematical model for making future predictions based on patterns learned from samples of data or "training data. " Various learning algorithms can be used to map correlations between input data and output data. These correlations form the mathematical model that can be used to make future predictions on new input data. Such a predictive model may include one or more logistic regression models, Bayesian models, or neural networks (NNs). Moreover, a "deep neural network," in the context of deep learning, may refer to an NN that utilizes multiple hidden layers between input and output layers, which may allow for learning based on features not explicitly defined in raw data. As used in the present application, a feature identified as an NN refers to a deep neural network. In various implementations, NNs may be trained as classifiers and may be utilized to perform image processing, audio processing, or natural-language processing.

As further shown in <FIG>, content transport security system <NUM> is implemented within a use environment including content history database <NUM>, communication network <NUM>, first data domain <NUM> including content transport security system <NUM>, client device <NUM>, and destination device <NUM>, as well as second data domain <NUM> including destination device <NUM>. In addition, <FIG> shows network communication links <NUM> communicatively coupling content history database <NUM> and second data domain <NUM> with content transport security system <NUM> via communication network <NUM>. Also shown in <FIG> are content file <NUM>, content asset <NUM> included in content file <NUM>, one or more business rules <NUM> (hereinafter "business rule(s) <NUM>"), and log entry <NUM> generated by asset monitoring software code <NUM>.

Content transport security system <NUM> is responsible for recognizing, categorizing, modifying, and directing content traffic using any of the following: content recognition, deep learning-based content recognition, allow/deny lists, and the use of unique forensic identifiers such as hash values, content fingerprints, and watermarks, to name a few examples. Content history database <NUM> stores the unique forensic identifier assigned to content asset <NUM>, along with metadata and a history of where content asset <NUM> has traveled. The information in content history database <NUM> is updated by content transport security system <NUM> in real-time with respect to a file transfer including content asset <NUM> in order to enable the owner of content asset <NUM> to know where that asset is at all times. It is noted that although content transport security system <NUM> may be communicatively coupled to content history database <NUM> via communication network <NUM> and network communication links <NUM>, as shown in <FIG>, in some implementations, content history database <NUM> may be integrated with computing platform <NUM>, or may be in direct communication with content transport security system <NUM> as shown by dashed communication link <NUM>.

It is further noted that each of first and second data domains <NUM> and <NUM> may be a distinct computing environment, for example, controlled by different owners and governed by different administrative procedures and security protocols. By way of example, first data domain <NUM> may be owned and controlled by a digital content production studio, while second data domain <NUM> may be owned and controlled by a remote third-party vendor providing external resources or services for processing digital content originating from first data domain <NUM>, such as content asset <NUM> included in content file <NUM>. That is to say, first data domain <NUM> may be governed by a first security protocol, while second data domain <NUM> may be governed by a second security protocol different from the first security protocol governing first data domain <NUM>. It is further noted that, as used in the present application, the expression "first data domain <NUM> and second data domain <NUM> being governed by different security protocols," and the like, may refer to the implementation of distinct authentication and encryption strategies by each of first and second data domains <NUM> and <NUM>, that would typically require separate key management solutions for accessing data files stored on those domains.

It is also noted that although <FIG> shows two data domains, one client device, and two destination devices in the interests of conceptual clarity, in other implementations, content transport security system <NUM> may be communicatively coupled to more than one external data domain, such as tens or hundreds of data domains for example, each including multiple client devices corresponding to client device <NUM> and multiple destination devices corresponding to destination devices <NUM> and <NUM>.

Moreover, although the exemplary implementation shown in <FIG> corresponds to file transfer of content file <NUM> between client device <NUM> and destination device <NUM> both internal to first data domain <NUM>, as well as to file transfer of content file <NUM> between client device <NUM> and external destination device <NUM>, the principles according to the present invention also apply to ingestion of content into first data domain <NUM> from an external source, such as second data domain <NUM>. Exemplary specific use cases of content file transfers include, but are not limited to:.

With respect to the representation of content transport security system <NUM> shown in <FIG>, it is noted that although asset monitoring software code <NUM>, ML model-based content analyzer <NUM>, and database <NUM> are depicted as being stored in system memory <NUM> for conceptual clarity, more generally, system memory <NUM> may take the form of any computer-readable non-transitory storage medium. The expression "computer-readable non-transitory storage medium," as used in the present application, refers to any medium, excluding a carrier wave or other transitory signal that provides instructions to processing hardware of a computing platform, such as processing hardware <NUM> of computing platform <NUM>. Thus, a computer-readable non-transitory storage medium may correspond to various types of media, such as volatile media and non-volatile media, for example. Volatile media may include dynamic memory, such as dynamic random access memory (dynamic RAM), while non-volatile memory may include optical, magnetic, or electrostatic storage devices. Common forms of computer-readable non-transitory storage media include, for example, optical discs, RAM, programmable read-only memory (PROM), erasable PROM (EPROM), and FLASH memory.

It is further noted that although <FIG> depicts asset monitoring software code <NUM>, ML model-based content analyzer <NUM>, and database <NUM> as being mutually co-located in system memory <NUM>, that representation is also merely provided as an aid to conceptual clarity. More generally, content transport security system <NUM> may include one or more computing platforms, such as computer servers for example, which may be co-located, or may form an interactively linked but distributed system, such as a cloud-based system, for instance. As a result, processing hardware <NUM> and system memory <NUM> may correspond to distributed processor and memory resources within content transport security system <NUM>. Thus, it is to be understood that asset monitoring software code <NUM>, ML model-based content analyzer <NUM>, and database <NUM> may be stored remotely from one another within the distributed memory resources of content transport security system <NUM>.

It is also noted that, in some implementations, ML model-based content analyzer <NUM> may take the form of a software module included in asset monitoring software code <NUM>. However, in other implementations, ML model-based content analyzer <NUM> may be omitted from content transport security system <NUM> and the functionality attributed to that feature may be performed by asset monitoring software code <NUM>.

Processing hardware <NUM> may include multiple hardware processing units, such as one or more central processing units, one or more graphics processing units, and one or more tensor processing units, one or more field-programmable gate arrays (FPGAs), custom hardware for machine-learning training or inferencing, and an application programming interface (API) server, for example. By way of definition, as used in the present application, the terms "central processing unit" (CPU), "graphics processing unit" (GPU), and "tensor processing unit" (TPU) have their customary meaning in the art. That is to say, a CPU includes an Arithmetic Logic Unit (ALU) for carrying out the arithmetic and logical operations of computing platform <NUM>, as well as a Control Unit (CU) for retrieving programs, such as asset monitoring software code <NUM>, from system memory <NUM>, while a GPU may be implemented to reduce the processing overhead of the CPU by performing computationally intensive graphics or other processing tasks. A TPU is an application-specific integrated circuit (ASIC) configured specifically for artificial intelligence (AI) applications such as machine learning modeling.

In some implementations, computing platform <NUM> may correspond to one or more web servers, accessible over a packet-switched network such as the Internet, for example. Alternatively, computing platform <NUM> may correspond to one or more computer servers supporting a private wide area network (WAN), local area network (LAN), or included in another type of limited distribution or private network. As yet another alternative, in some implementations, content transport security system <NUM> may be implemented virtually, such as in a data center. For example, in some implementations, content transport security system <NUM> may be implemented in software, or as virtual machines.

Although client device <NUM> and destination devices <NUM> and <NUM> are shown as desktop computers in <FIG>, those representations are provided merely as examples. More generally, each of client device <NUM> and destination devices <NUM> and <NUM> may be any suitable mobile or stationary computing device or system that implements data processing capabilities sufficient to provide a user interface, support connections to communication network <NUM>, and implement the functionality ascribed to client device <NUM> and destination devices <NUM> and <NUM> herein. For example, in some implementations, one or more of client device <NUM> and destination devices <NUM> and <NUM> may take the form of a laptop computer, tablet computer, or smartphone, for example.

<FIG> shows a diagram of exemplary digital content transport path 201A including content transport security system <NUM>, according to one implementation. As shown in <FIG>, content transport security system <NUM> intercedes in the file transfer of content file <NUM> from client device <NUM> within first data domain <NUM> to a destination device outside of first data domain <NUM> (destination device not shown in <FIG>) via router <NUM> and communication network <NUM>.

Content transport security system <NUM>, first data domain <NUM>, client device <NUM>, content file <NUM>, and communication network <NUM> correspond respectively in general to content transport security system <NUM>, first data domain <NUM>, client device <NUM>, content file <NUM>, and communication network <NUM>, in <FIG>. Thus, content transport security system <NUM>, first data domain <NUM>, client device <NUM>, content file <NUM>, and communication network <NUM> may share any of the characteristics attributed to respective content transport security system <NUM>, first data domain <NUM>, client device <NUM>, content file <NUM>, and communication network <NUM> by the present disclosure, and vice versa. That is to say, although not shown in <FIG>, like content transport security system <NUM>, content transport security system <NUM> may include processing hardware <NUM> and system memory <NUM> storing asset management software code <NUM>, ML model-based content analyzer <NUM>, and database <NUM>.

According to the exemplary implementation shown in <FIG>, client device <NUM> is any computing device that will accept a proxy. As further shown in <FIG>, content transport security system <NUM> is configured to intercept content file <NUM> at router <NUM> prior to its transfer out of first data domain <NUM>. Content file <NUM> may be encrypted by client device <NUM> using an encryption key available to client device <NUM>. For example, such an encryption key may have been provided to client device <NUM> by content transport security system <NUM> prior to the file transfer of content file <NUM>. After intercepting content file <NUM> during the file transfer, content transport security system <NUM> is further configured to determine an authorization status of the destination device for content file <NUM>, decrypt content file <NUM> using a decryption key corresponding to the encryption key available to client device <NUM>, and search a content asset included in content file <NUM> for a forensic identifier, such as a hash value or watermark for example. Content transport security system <NUM> may then assign a classification to the file transfer, based on the authorization status of the destination device and a result of the search for a forensic identifier, where the classification optionally is one of allowable, forbidden, or suspicious, and allow or block the file transfer to the destination device, based on the classification and one or more business rules.

<FIG> shows a diagram of exemplary digital content transport path 201B including content transport security system <NUM>, according to another implementation. It is noted that any feature identified by a reference number identical to that shown in <FIG> corresponds respectively to that previously described feature and may share any of the characteristics attributed to that corresponding feature by the present disclosure.

The exemplary implementation shown in <FIG> utilizes a transparent proxy when client device <NUM> is a device that does not allow proxy configurations. As shown in <FIG>, one way for content transport security system <NUM> to intercept content file <NUM> is with the destination Internet Protocol (IP) address intact is to configure client device <NUM> to use content transport security system <NUM> as the default gateway. As noted above, after intercepting content file <NUM>, content transport security system <NUM> determines the authorization status of the destination device for content file <NUM>, decrypts content file <NUM> using a decryption key corresponding to the encryption key used by client device <NUM> to encrypt content file <NUM>, and searches a content asset included in content file <NUM> for a forensic identifier. Content transport security system <NUM> may then assign a classification to the file transfer, based on the authorization status of the destination device and a result of the search for a forensic identifier as one of allowable, forbidden, or suspicious, and allows or blocks the file transfer to the destination device, based on the classification and one or more business rules.

<FIG> shows a diagram of exemplary digital content transport path 201C including content transport security system <NUM>, according to yet another implementation. Any feature identified by a reference number identical to those shown in <FIG> corresponds respectively to that previously described feature and may share any of the characteristics attributed to that corresponding feature by the present disclosure.

As shown in <FIG>, digital content transport path 201C is similar to digital content transport path 201B, in <FIG>, but omits router <NUM>. As described above, after intercepting content file <NUM>, content transport security system <NUM> determines the authorization status of the destination device for content file <NUM>, decrypts content file <NUM> using a decryption key corresponding to the encryption key used by client device <NUM> to encrypt content file <NUM>, and searches a content asset included in content file <NUM> for a forensic identifier. Content transport security system <NUM> then assigns a classification to the file transfer, based on the authorization status of the destination device and a result of the search for a forensic identifier as one of allowable, forbidden, or suspicious, and allows or blocks the file transfer to the destination device, based on the classification and one or more business rules.

The functionality of content transport security system <NUM>/<NUM> and asset monitoring software code <NUM> will be further described by reference to <FIG> in combination with <FIG> and <FIG>. <FIG> shows flowchart <NUM> presenting an exemplary method for automating content transport security, according to one implementation. With respect to the method outlined in <FIG>, it is noted that certain details and features have been left out of flowchart <NUM> in order not to obscure the discussion of the inventive features in the present application.

<FIG> shows an exemplary diagram of asset monitoring software code <NUM> suitable for execution by content transport security system <NUM>/<NUM>, according to one implementation. As shown in <FIG>, asset monitoring software code <NUM> is communicatively coupled to ML model-based content analyzer <NUM> and database <NUM>, and may include content parsing and destination screening module <NUM>, decryption module <NUM>, content analysis module <NUM>, classification module <NUM>, and file transfer control module <NUM>. In addition, <FIG> shows content file <NUM>, content asset <NUM> included in content file <NUM>, authorization data <NUM>, forensic identifier data <NUM>, content analysis data <NUM>, classification <NUM>, and one or more business rules <NUM> (hereinafter "business rule(s) <NUM>").

ML model-based content analyzer <NUM>, database <NUM>, content file <NUM>, content asset <NUM>, and business rule(s) <NUM> correspond respectively in general to ML model-based content analyzer <NUM>, database <NUM>, content file <NUM>, content asset <NUM>, and business rule(s) <NUM>, in <FIG>. Consequently, ML model-based content analyzer <NUM>, database <NUM>, content file <NUM>, content asset <NUM>, and business rule(s) <NUM> may share any of the characteristics attributed to respective ML model-based content analyzer <NUM>, database <NUM>, content file <NUM>, content asset <NUM>, and business rule(s) <NUM> by the present disclosure, and vice versa. In addition, asset monitoring software code <NUM> corresponds in general to asset monitoring software code <NUM>, in <FIG>, and those corresponding features may share any of the characteristics attributed to either feature. That is to say, like asset monitoring software code <NUM>, asset monitoring software code <NUM> may include modules corresponding respectively to content parsing and destination screening module <NUM>, decryption module <NUM>, content analysis module <NUM>, classification module <NUM>, and file transfer control module <NUM>.

Referring to <FIG> in combination with <FIG> and <FIG>, flowchart <NUM> begins with intercepting content file <NUM>/<NUM> including content asset <NUM>/<NUM>, during a file transfer of content file <NUM>/<NUM> between client device <NUM> and either of destination devices <NUM> or <NUM> (action <NUM>). As shown in <FIG>, in some use cases, the destination device for file transfer of content file <NUM>/<NUM> is destination device <NUM> administered by first data domain <NUM> common to client device <NUM>, serving as the source of the file transfer. However, in other use cases in which destination device <NUM> is to receive the file transfer, destination device <NUM> is administered in second data domain <NUM> controlled by a domain owner other than the owner of first data domain <NUM> from which the file transfer originates.

Content file <NUM>/<NUM> may include any of a wide variety of content as content asset <NUM>/<NUM>, including, as noted above, software code, financial or business records, marketing or distribution plans, one or more graphical images, or other digital media content, for example, such as digital audio without video, digital video without audio, animation, or digital AV content, to name a few examples. Interception of content file <NUM>/<NUM> during the file transfer, may be performed using asset monitoring software code <NUM>/<NUM>, and executed by processing hardware <NUM> of content transport security system <NUM>.

It is noted that although action <NUM> alludes to transfer of content file <NUM>/<NUM> either within first data domain <NUM> or from first data domain <NUM> to second data domain <NUM>, those examples are merely illustrative. As noted above, in some use cases, a file transfer secured using file transport security system <NUM> may involve ingestion of a content file into first data domain <NUM> from an external data domain, such as second data domain <NUM>. Thus, although data domain <NUM> is referred to herein as a "first data domain" and data domain <NUM> is referred to as a "second data domain" as a matter of convenience, more generally, either of data domains <NUM> or <NUM> may serve as the "first data domain" recited by flowchart <NUM>, and the other of data domains <NUM> and <NUM> may serve as the "second data domain.

Flowchart <NUM> further includes determining an authorization status of destination device <NUM> or <NUM> (action <NUM>). For example, processing hardware <NUM> of content transport security system <NUM> may execute asset monitoring software code <NUM>/<NUM> to reference a registry of allowable destination devices for content files transferred from client device <NUM> or first data domain <NUM>, a list of forbidden data domains for transfer of content files from first data domain <NUM>, or may list allowable destination devices as well as forbidden destination devices. Determination of the authorization status of destination device <NUM> or <NUM> in action <NUM> may be performed by asset monitoring software code <NUM>/<NUM>, executed by processing hardware <NUM> of content transport security system <NUM>, using content parsing and destination screening module <NUM> to generate authentication data <NUM>.

Flowchart <NUM> further includes decrypting content file <NUM>/<NUM>, using a decryption key corresponding to an encryption key available to client device <NUM> (action <NUM>). As noted above, in some implementations, content transport security system <NUM> may distribute encryption keys to client devices included in one or more of first data domain <NUM> and second data domain <NUM>, such as exemplary client device <NUM>. In those implementations, content transport security system <NUM> may retain corresponding decryption keys for decrypting content file <NUM>/<NUM> encrypted using such an encryption key. Decryption of content file <NUM>/<NUM> in action <NUM> may be performed by asset monitoring software code <NUM>/<NUM>, executed by processing hardware <NUM> of content transport security system <NUM>, using decryption module <NUM>.

It is noted that although flowchart <NUM> and <FIG> depict action <NUM> as preceding action <NUM>, that sequence is merely exemplary. In some implementations, action <NUM> may occur after action <NUM>. Furthermore, in some implementations, actions <NUM> and <NUM> may be performed in parallel, i.e., substantially concurrently.

In some implementations, flowchart <NUM> may include optionally analyzing content asset <NUM>/<NUM> included in content file <NUM>/<NUM> (action <NUM>). That is to say, action <NUM> is optional, and in some implementations may be omitted from the method outlined by flowchart <NUM>. Nevertheless, in some implementations in which action <NUM> is performed, processing hardware <NUM> of content transport security system <NUM> may execute asset monitoring software code <NUM>/<NUM> to use content analysis module <NUM> to perform one or more of an audio analysis, a text analysis, or a visual analysis of content asset <NUM>/<NUM>. Action <NUM>, when performed, results in generation of content analysis data <NUM>, which may be any data identifying or otherwise describing audio, text, or imagery included in content asset <NUM>/<NUM>. As noted above, in some implementations, content transport security system <NUM> may include ML model-based content analyzer <NUM>/<NUM>. In some of those implementations, the one or more of the audio analysis, the text analysis, or the visual analysis of content asset <NUM>/<NUM> of action <NUM> may be performed by asset monitoring software code <NUM>/<NUM>, executed by processing hardware <NUM>, and using ML model-based content analyzer <NUM>/<NUM>.

Flowchart <NUM> further includes searching content asset <NUM>/<NUM> for a forensic identifier (action <NUM>). As noted above, such a forensic identifier may take the form of one or more of a hash value, a content fingerprint, or a forensic watermark, for example. As a specific example, the forensic identifier of content asset <NUM>/<NUM> may include a Secure Hashtag Algorithm <NUM> (SHA-<NUM>) sum of content asset <NUM>/<NUM>, such as a SHA-<NUM> sum of content asset <NUM>/<NUM> for instance. Alternatively, or in addition, the forensic identifier may include a forensic watermark undetectable to the human eye, a content fingerprint such as a Universally Unique Identifier (UUID, also sometimes referred to as Globally Unique Identifier or GUID) of content asset <NUM>/<NUM>, or both. The search of content asset <NUM>/<NUM> for a forensic identifier in action <NUM> may be performed by asset monitoring software code <NUM>/<NUM>, executed by processing hardware <NUM> of content transport security system <NUM>, and using content parsing and destination screening module <NUM> to generate forensic identifier data <NUM>.

It is noted that in use cases in which the search of content asset <NUM>/<NUM> performed in action <NUM> detects a forensic identifier, forensic identifier data <NUM> includes that detected forensic identifier. However, in use cases in which the search performed in action <NUM> fails to detect a forensic identifier, forensic identifier data <NUM> reports that failure.

It is noted that although flowchart <NUM> and <FIG> depict action <NUM> as preceding action <NUM>, that sequence is merely exemplary. In some implementations, action <NUM> may occur after action <NUM>. Moreover, in some implementations, actions <NUM> and <NUM> may be performed in parallel, i.e., substantially concurrently. In still other implementations, action <NUM> may be omitted, and the method outlined by flowchart <NUM> may include action <NUM> following directly from actions <NUM> and <NUM>.

Flowchart <NUM> further includes assigning a classification to the file transfer of content file <NUM>/<NUM> from client device <NUM> to destination device <NUM> or <NUM>, based on the authorization status determined in action <NUM> and the result of the searching performed in action <NUM>, the classification being one of allowable, forbidden, or suspicious (action <NUM>). Action <NUM> may be performed by asset monitoring software code <NUM>/<NUM>, executed by processing hardware <NUM> of content transport security system <NUM>, and using classification module <NUM>. In some implementations, classification module <NUM> receives authorization data <NUM> and forensic identifier data <NUM> and assigns classification <NUM> to the file transfer of content file <NUM>/<NUM> based on authorization data <NUM> and forensic identifier data <NUM>. For example, where forensic identifier data <NUM> includes a forensic identifier detected by the search performed in action <NUM>, processing hardware <NUM> may execute asset monitoring software code <NUM>/<NUM> to compare the detected forensic identifier with a forensic identifier of content asset <NUM>/<NUM> stored in content history database <NUM>.

In addition, and as shown in <FIG>, in some implementations, classification module <NUM> receives content analysis data <NUM> from content analysis module <NUM>, in addition to receiving authorization data <NUM> and forensic identifier data <NUM> from content parsing and destination screening module <NUM>. In those implementations, the assignment of classification <NUM> in action <NUM> may further be based on content analysis data <NUM>.

In some implementations, flowchart <NUM> may further include generating log entry <NUM> flagging the file transfer of content file <NUM>/<NUM> as being assigned classification <NUM> of one of allowable, forbidden, or suspicious (action <NUM>). Flagging the file transfer of content file <NUM>/<NUM> based on classification <NUM> may be performed by content monitoring software code <NUM>/<NUM>, executed by processing hardware <NUM> of content transport security system <NUM>.

In some implementations, flowchart <NUM> may further include updating a security status of content asset <NUM>/<NUM> in content history database <NUM>, using log entry <NUM>, in real-time with respect to assigning classification <NUM> to the file transfer of content file <NUM>/<NUM> in action <NUM> (action <NUM>). Action <NUM> may be performed by content monitoring software code <NUM>/<NUM>, executed by processing hardware <NUM> of content transport security system <NUM>. Thus, although flowchart <NUM> shows action <NUM> as preceding actions <NUM> and <NUM>, in some implementations, action actions <NUM> and <NUM>, actions <NUM> and <NUM>, or actions <NUM>, <NUM>, and <NUM> may be performed in parallel, i.e., substantially concurrently.

Updating the security status of content asset <NUM>/<NUM> in content history database <NUM> in action <NUM> advantageously enables the performance a variety of different types of data analytics including, but not limited to:.

Referring once again to flowchart <NUM> with continued further reference to <FIG> and <FIG>, flowchart <NUM> also includes allowing or blocking the file transfer of content file <NUM>/<NUM> based on classification <NUM> and business rule(s) <NUM>/<NUM> (action <NUM>). It is noted that because business rule(s) <NUM>/<NUM> are predetermined and stored in database <NUM>/<NUM>, business rule(s) <NUM>/<NUM> may be predetermined so as not to include conflicting business rules. To describe merely two examples: <NUM>) business rule(s) <NUM>/<NUM> may specify that only file transfers classified as allowable in action <NUM> be allowed, while those classified as forbidden or suspicious be blocked. Alternatively: <NUM>) business rule(s) <NUM>/<NUM> may specify that file transfers classified as allowable and suspicious be allowed and that all file transfers classified as forbidden be blocked, but that file transfers classified as suspicious, the file transfers classified as forbidden, or both, be flagged as such and reported to a cyber-security administrator of first data domain <NUM>. Action <NUM> may be performed by content monitoring software code <NUM>/<NUM>, executed by processing hardware <NUM> of content transport security system <NUM>, using file transfer control module <NUM>.

It is noted that although flowchart <NUM> shows actions <NUM> and <NUM> as preceding action <NUM>, that sequence is merely exemplary. In some implementations, actions <NUM> and <NUM> may occur after action <NUM>. Moreover, in some implementations, actions <NUM>, <NUM> and <NUM> may be performed in parallel, i.e., substantially concurrently. In other implementation, action <NUM> may be omitted, while actions <NUM> and <NUM> may follow action <NUM> in any order, or may be performed in parallel with action <NUM>. In still other implementations, actions <NUM> and <NUM> may be omitted, and the method outlined by flowchart <NUM> may include action <NUM> following directly from action <NUM> or performed in parallel with action <NUM>.

With respect to the method outlined by flowchart <NUM>, it is noted that actions <NUM>, <NUM>, <NUM>, <NUM>, <NUM>, and <NUM>, or actions <NUM>, <NUM>, <NUM>, <NUM>, <NUM>, <NUM> and <NUM>, or actions <NUM>, <NUM>, <NUM>, <NUM>, <NUM>, <NUM>, and <NUM>, or actions <NUM>, <NUM>, <NUM>, <NUM>, <NUM>, <NUM>, <NUM>, and <NUM>, or actions <NUM>, <NUM>, <NUM>, <NUM>, <NUM>, <NUM>, <NUM>, and <NUM>, or actions <NUM>, <NUM>, <NUM>, <NUM>, <NUM>, <NUM>, <NUM>, <NUM>, and <NUM>, may be performed in an automated process from which human participation may be omitted.

Claim 1:
A content transport security system (<NUM>, <NUM>) for a first data domain (<NUM>, <NUM>), the content transport security system (<NUM>, <NUM>) adapted to be communicatively coupled to a client device (<NUM>, <NUM>) in the first data domain (<NUM>, <NUM>) and to transport a content file (<NUM>, <NUM>, <NUM>) received from the client device (<NUM>, <NUM>) over a communication network (<NUM>, <NUM>) to a second data domain (<NUM>) including a destination device (<NUM>), the content transport security system (<NUM>, <NUM>) comprising:
a computing platform (<NUM>) including a processing hardware (<NUM>) and a system memory (<NUM>) storing a software code (<NUM>, <NUM>) and a database (<NUM>, <NUM>) including at least one business rule (<NUM>, <NUM>):
the processing hardware (<NUM>) configured to execute the software code (<NUM>, <NUM>) to:
intercept in the first data domain (<NUM>, <NUM>) the content file (<NUM>, <NUM>, <NUM>) including a content asset (<NUM>, <NUM>), during a file transfer of the content file (<NUM>, <NUM>, <NUM>) from the client device (<NUM>, <NUM>), over the communication network (<NUM>, <NUM>), to the destination device (<NUM>) in the second data domain (<NUM>);
determine an authorization status of the destination device (<NUM>);decrypt the content file (<NUM>, <NUM>, <NUM>), using a decryption key corresponding to an encryption key available to the client device (<NUM>, <NUM>);
search the content asset (<NUM>, <NUM>) for a forensic identifier (<NUM>);
perform at least one of an audio analysis or a visual analysis of the content asset (<NUM>, <NUM>) to provide content analysis data (<NUM>) identifying at least one of audio or imagery, respectively, included in the content asset (<NUM>, <NUM>);
assign a classification (<NUM>) to the file transfer, based on the authorization status, a result of the searching, and the content analysis data (<NUM>), the classification (<NUM>) being one of allowable, forbidden, or suspicious; and
allow or block the file transfer to the destination device (<NUM>), based on the classification (<NUM>) and the at least one business rule (<NUM>, <NUM>).