Techniques for detecting and preventing unintentional disclosures of sensitive data
View Patent ↗Protection is provided to prevent a computer user from unintentionally giving away sensitive data (e.g., security credentials, credit card number, PINs, personal data, or bank account number) to an illegitimate or unintended entity by means of a client application capable of communicating the sensitive data across a network to other computer users. To provide the protection, user input is monitored to detect a user entry of the sensitive data into the client application for communication to other users. When such an entry occurs, action is taken to reduce the likelihood of an unintentional giveaway of the sensitive data or to reduce the effects of an unintentional giveaway.
1. A computer-implemented method of protecting against an unintentional giveaway of sensitive data by a computer user to an illegitimate or unintended entity, the method comprising:
detecting that a client application capable of communicating the sensitive data across a network to other computer users is being used under conditions that have characteristics of an unintentional giveaway of sensitive data to an illegitimate or unintended entity;
in response to detecting that the client application is being used under conditions that have characteristics of an unintentional giveaway of sensitive data to an illegitimate or unintended entity, monitoring data being entered into the client application by the computer user;
accessing a set of pattern generating functions;
generating a set of string matching patterns by applying the set of pattern generating functions to the sensitive data;
detecting an entry, or partial entry of the sensitive data or a variation of the sensitive data into the client application by comparing the data being entered into the client application to the string matching patterns in the set of string matching patterns;
in response to detecting an entry, or partial entry of the sensitive data or a variation of the sensitive data into the client application, performing one or more of the following actions: requesting that the computer user confirm a communication of the sensitive data; warning the computer user that communicating the sensitive data might result in an unintentional giveaway of sensitive data to an illegitimate or unintended entity; preventing the client application from communicating the sensitive data; or logging a communication of the sensitive data by the client application;
downloading an updated set of pattern generating functions; and
generating an updated set of string matching patterns by applying the updated set of pattern generating functions to the sensitive data.
2. The computer-implemented method of claim 1 wherein determining whether the client application is being used under conditions that have characteristics of an unintentional giveaway of sensitive data to an illegitimate or unintended entity comprises determining whether a provider of a communication mechanism provided to the client application for communicating the sensitive data is a trusted provider.
3. The computer-implemented method of claim 2 wherein the mechanism is a web page with an input form and a list is maintained that comprises a first list of ISP client form ids, a second list of globally trusted web domains, and a third list of personally trusted web domains such that determining whether the provider is a trusted provider comprises:
using the first list to determine whether the provider is an ISP;
using the second list to determine whether the provider is a globally trusted web domain, wherein globally trusted web domains are web domains external to the ISP's network that are known to the ISP to have trusted web pages with input forms; and
using the third list to determine whether the provider is a personally trusted web domain, wherein personally trusted web domains are web domains that are known to a user of the client application to have trusted web pages with input forms.
4. The computer-implemented method of claim 2 wherein the mechanism is a web page and detecting that the client application is being used under conditions that have characteristics of an unintentional giveaway of sensitive data to an illegitimate or unintended entity comprises detecting that the web page is provided from a web domain that is not on a list of trusted web domains.
5. The computer-implemented method of claim 1 wherein the sensitive data and the variation are text-based.
6. The computer-implemented method of claim 5 wherein detecting the entry or partial entry of the sensitive data or a variation of the sensitive data into the client application comprises:
passing the data entered in to the client application to a the matcher program or object; and
passing a at least one of the string-matching patterns based on the sensitive-data to the matcher program or object.
7. The computer-implemented method of claim 1 further comprising:
selecting at least one matcher program or object; and
detecting an entry or partial entry of a variation of the sensitive data by:
passing data entered into the client application to the selected matcher program or object;
passing the sensitive data to the matcher program or object; and
comparing the data entered to a variation of the sensitive data encoded in the matcher program or object.
8. The computer-implemented method of claim 1 wherein the sensitive data is text-based.
9. The computer-implemented method of claim 1 wherein determining whether the client application is being used under conditions that have characteristics of an unintentional giveaway of sensitive data to an illegitimate or unintended entity comprises determining whether a sequence of events preceding the entry or partial entry of the sensitive data is known to be characteristic of an unintentional giveaway of sensitive data to an illegitimate or unintended entity.
10. The computer-implemented method of claim 1 wherein determining whether the client application is being used under conditions that have characteristics of an unintentional giveaway of sensitive data to an illegitimate or unintended entity comprises determining whether a sequence of events preceding the entry or partial entry of the sensitive data is known to be characteristic of a submission of sensitive data to a legitimate or intended entity.
11. The computer-implemented method of claim 1 wherein determining whether the client application is being used under conditions that have characteristics of an unintentional giveaway of sensitive data to an illegitimate or unintended entity comprises determining whether an intended recipient of the sensitive data entered into the client application is known to be an illegitimate or unintended entities.
12. The computer-implemented method of claim 1 wherein determining whether the client application is being used under conditions that have characteristics of an unintentional giveaway of sensitive data to an illegitimate or unintended entity comprises determining whether an intended recipient of the sensitive data entered into the client application is known to be a legitimate or intended entities.
13. The computer-implemented method of claim 1 wherein determining whether the client application is being used under conditions that have characteristics of an unintentional giveaway of sensitive data to an illegitimate or unintended entity comprises determining whether a provider of a communication mechanism provided to the client application for communicating the sensitive data is not a trusted provider.
14. The computer-implemented method of claim 1 wherein the action comprises preventing the client application from communicating the sensitive data.
15. The computer-implemented method of claim 1 wherein the action comprises warning the computer user that communicating the sensitive data might result in an unintentional giveaway of sensitive data to an illegitimate or unintended entity.
16. The computer-implemented method of claim 1 wherein the action comprises logging a communication of the sensitive data by the client application.
17. The computer-implemented method of claim 1 wherein the action comprises requesting that the computer user confirm a communication of the sensitive data.
18. The computer-implemented method of claim 1 wherein the sensitive data comprises security credentials.
19. The computer-implemented method of claim 18 wherein the security credentials comprise security credentials used to log onto an ISP's network.
20. The computer-implemented method of claim 18 wherein the security credentials comprise security credentials used to log onto a website.
21. The computer-implemented method of claim 1 wherein the sensitive data comprises a credit card number.
22. A computer-usable medium storing a computer program for protecting against an unintentional giveaway of sensitive data by a computer user to an illegitimate or unintended entity, the computer program comprising instructions for causing a computer to:
detect that a client application capable of communicating the sensitive data across a network to other computer users is being used under conditions that have characteristics of an unintentional giveaway of sensitive data to an illegitimate or unintended entity;
in response to detecting that the client application is being used under conditions that have characteristics of an unintentional giveaway of sensitive data to an illegitimate or unintended entity, monitor data being entered into the client application by the computer user;
access a set of pattern generating functions;
generate a set of string matching patterns by applying the set of pattern generating functions to the sensitive data;
detect an entry or partial entry of the sensitive data or a variation of the sensitive data into the client application by comparing the data being entered into the client application to the string matching patterns in the set of string matching patterns;
in response to detecting an entry or partial entry of the sensitive data or a variation of the sensitive data into the client application, perform one or more of the following actions: requesting that the computer user confirm a communication of the sensitive data; warning the computer user that communicating the sensitive data might result in an unintentional giveaway of sensitive data to an illegitimate or unintended entity; preventing the client application from communicating the sensitive data; or logging a communication of the sensitive data by the client application;
download an updated set of pattern generating functions; and
generate an updated set of string matching patterns by applying the updated set of pattern generating functions to the sensitive data.
23. The computer-usable medium of claim 22 wherein, to determine whether the client application is being used under conditions that have characteristics of an unintentional giveaway of sensitive data to an illegitimate or unintended entity, the computer program further comprises instructions for causing the computer to determine whether a provider of a communication mechanism provided to the client application for communicating the sensitive data is a trusted provider.
24. The computer-usable medium of claim 23 wherein the mechanism is a web page with an input form and a list is maintained that comprises a first list of ISP client form ids, a second list of globally trusted web domains, and a third list of personally trusted web domains such that the computer program code to determine whether the provider is a trusted provider further comprises instructions for causing the computer to:
use the first list to determine whether the provider is an ISP;
use the second list to determine whether the provider is a globally trusted web domain, wherein globally trusted web domains are web domains external to the ISP's network that are known to the ISP to have trusted web pages with input forms; and
use the third list to determine whether the provider is a personally trusted web domain, wherein personally trusted web domains are web domains that are known to a user of the client application to have trusted web pages with input forms.
25. The computer-usable medium of claim 23 wherein the mechanism is a web page and, to detect that the client application is being used under conditions that have characteristics of an unintentional giveaway of sensitive data to an illegitimate or unintended entity, the computer program further comprises instructions for causing the computer to detect that the web page is provided from a web domain that is not on a list of trusted web domains.
26. The computer-usable medium of claim 22 wherein the sensitive data and the variation are text-based.
27. The computer-usable medium of claim 26 wherein to detect the entry or partial entry of the sensitive data or a variation of the sensitive data into the client application, the computer program further comprises instructions for causing the computer to:
pass the data entered into the client application to a selected matcher program or object; and
pass a at least one of the string-matching patterns based on the sensitive data to the matcher program or object.
28. The computer-usable medium of claim 22 , the computer program further comprises instructions for causing the computer to:
select at least one matcher program or object; and
to detect an entry or partial entry of a variation of the sensitive data, the computer program further comprises instructions for causing the computer to:
pass data entered into the client application to the matcher program or object;
pass the sensitive data to the matcher program or object; and
compare the input text to a variation of the sensitive data encoded in the matcher program or object.
29. The computer-usable medium of claim 22 wherein the sensitive data is text-based.
30. The computer-usable medium of claim 22 wherein, to determine whether the client application is being used under conditions that have characteristics of an unintentional giveaway of sensitive data to an illegitimate or unintended entity, the computer program further comprises instructions for causing the computer to determine whether a sequence of events preceding the entry or partial entry of the sensitive data is known to be characteristic of an unintentional giveaway of sensitive data to an illegitimate or unintended entity.
31. The computer-usable medium of claim 22 wherein, to determine whether the client application is being used under conditions that have characteristics of an unintentional giveaway of sensitive data to an illegitimate or unintended entity, the computer program further comprises instructions for causing the computer to determine whether a sequence of events preceding the entry or partial entry of the sensitive data is known to be characteristic of a submission of sensitive data to a legitimate or intended entity.
32. The computer-usable medium of claim 22 wherein, to determine whether the client application is being used under conditions that have characteristics of an unintentional giveaway of sensitive data to an illegitimate or unintended entity, the computer program further comprises instructions for causing the computer to determine whether an intended recipient of the sensitive data entered into the client application is known to be an illegitimate or unintended entity.
33. The computer-usable medium of claim 22 wherein, to determine whether the client application is being used under conditions that have characteristics of an unintentional giveaway of sensitive data to an illegitimate or unintended entity, the computer program further comprises instructions for causing the computer to determine whether an intended recipient of the sensitive data entered into the client application is known to be a legitimate or intended entity.
34. The computer-usable medium of claim 22 wherein, to determine whether the client application is being used under conditions that have characteristics of an unintentional giveaway of sensitive data to an illegitimate or unintended entity, the computer program further comprises instructions for causing the computer to determine whether a provider of a communication mechanism provided to the client application for communicating the sensitive data is not a trusted provider.
35. The computer-usable medium of claim 22 wherein the action comprises preventing the client application from communicating the sensitive data.
36. The computer-usable medium of claim 22 wherein the action comprises warning the computer user that communicating the sensitive data might result in an unintentional giveaway of sensitive data to an illegitimate or unintended entity.
37. The computer-usable medium of claim 22 wherein the action comprises logging a communication of the sensitive data by the client application.
38. The computer-usable medium of claim 22 wherein the action comprises requesting that the computer user confirm a communication of the sensitive data or logging a communication of the sensitive data by the client application.
39. The computer-usable medium of claim 22 wherein the sensitive data comprises security credentials.
40. The computer-usable medium of claim 39 wherein the security credentials comprise security credentials used to log onto an ISP's network.
41. The computer-usable medium of claim 39 wherein the security credentials comprise security credentials used to log onto a website.
42. The computer-usable medium of claim 22 wherein the sensitive data comprises a credit card number.
43. A computer-implemented method of protecting against an unintentional giveaway of sensitive data by a computer user to an illegitimate or unintended entity, the method comprising:
detecting that the client application is being used under conditions that have characteristics of an unintentional giveaway of sensitive data to an illegitimate or unintended entity;
monitoring data being entered into the client application by the computer user;
accessing a set of pattern generating functions;
generating a set of string matching patterns by applying the set of pattern generating functions to the sensitive data;
detecting an entry or partial entry of the sensitive data or a variation of the sensitive data into the client application by comparing the data being entered into the client application to the string matching patterns in the set of string matching patterns;
in response to detecting an entry or partial entry of the sensitive data or a variation of the sensitive data into the client application and detecting that the client application is being used under conditions that have characteristics of an unintentional giveaway of sensitive data to an illegitimate or unintended entity, performing one or more of the following actions: requesting that the computer user confirm a communication of the sensitive data; warning the computer user that communicating the sensitive data might result in an unintentional giveaway of sensitive data to an illegitimate or unintended entity; preventing the client application from communicating the sensitive data; or logging a communication of the sensitive data by the client application;
downloading an updated set of pattern generating functions; and
generating an updated set of string matching patterns by applying the updated set of pattern generating functions to the sensitive data.
44. The computer-implemented method of claim 43 wherein determining whether the client application is being used under conditions that have characteristics of an unintentional giveaway of sensitive data to an illegitimate or unintended entity comprises determining whether a provider of a communication mechanism provided to the client application for communicating the sensitive data is a trusted provider.
45. The computer-implemented method of claim 44 wherein the mechanism is a web page with an input form and a list is maintained that comprises a first list of ISP client form ids, a second list of globally trusted web domains, and a third list of personally trusted web domains such that determining whether the provider is a trusted provider comprises:
using the first list to determine whether the provider is an ISP;
using the second list to determine whether the provider is a globally trusted web domain, wherein globally trusted web domains are web domains external to the ISP's network that are known to the ISP to have trusted web pages with input forms; and
using the third list to determine whether the provider is a personally trusted web domain, wherein personally trusted web domains are web domains that are known to a user of the client application to have trusted web pages with input forms.
46. The computer-implemented method of claim 43 wherein the sensitive data is text-based.
47. The computer-implemented method of claim 43 wherein determining whether the client application is being used under conditions that have characteristics of an unintentional giveaway of sensitive data to an illegitimate or unintended entity comprises determining whether a sequence of events preceding the entry or partial entry of the sensitive data is known to be characteristic of an unintentional giveaway of sensitive data to an illegitimate or unintended entity.
48. The computer-implemented method of claim 43 wherein determining whether the client application is being used under conditions that have characteristics of an unintentional giveaway of sensitive data to an illegitimate or unintended entity comprises determining whether an intended recipient of the sensitive data entered into the client application is known to be a legitimate or intended entity.
49. The computer-implemented method of claim 43 wherein the action comprises preventing the client application from communicating the sensitive data.
50. The computer-implemented method of claim 43 wherein the action comprises warning the computer user that communicating the sensitive data might result in an unintentional giveaway of sensitive data to an illegitimate or unintended entity.
51. The computer-implemented method of claim 43 wherein the action comprises logging a communication of the sensitive data by the client application.
52. The computer-implemented method of claim 43 request that the computer user confirm a communication of the sensitive data.
53. The computer-implemented method of claim 43 wherein the sensitive data comprises security credentials.
54. The computer-implemented method of claim 53 wherein the security credentials comprise security credentials used to log onto an ISP's network.
55. The computer-implemented method of claim 53 wherein the security credentials comprise security credentials used to log onto a website.
56. The computer-implemented method of claim 43 wherein the sensitive data comprises a credit card number.