Data leak protection system, method and apparatus
View Patent ↗A method, system and apparatus for data leak prevention. An information system, such as a database system, which has been configured for data leak protection in accordance with the present invention can include an IDS coupled to the information system and a data leak protection system configured to apply a data leak protection policy for result sets produced by the information system in response to a database query. The data leak protection policy can include a listing of data shapes and corresponding remedial measures. The data leak protection policy further can include consideration for metrics produced by the IDS.
1. A data leak protection method comprising:
receiving a database query;
producing metrics, by an intrusion detection system (IDS), for said database query;
receiving the result set produced by said database query; and
limiting a response to said database query based upon:
a shape of said result set produced by said database query,
said metrics, and
a data leak protection policy specifying a set of limitations for a corresponding set of shapes and metrics.
2. The method of claim 1 , wherein said limiting comprises:
characterizing said shape of said result set;
comparing said shape to pre-specified shapes to identify a matching shape;
retrieving a remedial measure corresponding to said matching shape; and,
applying said remedial measure.
3. The method of claim 1 , wherein said shape of said result set is characterized by at least two characteristics of said result set.
4. The method of claim 2 , wherein said characterizing comprises processing at least one of
a stateless function for data in said result,
a stateful function for data in multiple result sets,
a stateful function for said metrics produced by said IDS, and
a stateless function for said metrics produced by said IDS.
5. The method of claim 2 , wherein said applying comprises quashing said result set.
6. The method of claim 2 , wherein said applying comprises returning said result set in its entirety.
7. The method of claim 2 , wherein said applying comprises pruning said result set.
8. The method of claim 2 , wherein said applying comprises disconnecting a user issuing said database query.
9. A machine readable storage having stored thereon a computer program for data leak protection, the computer program comprising a routine set of instructions which when executed by a machine causes the machine to perform:
receiving a database query;
producing metrics, by an intrusion detection system (IDS), for said database query;
receiving the result set produced by said database query; and
limiting a response to said database query based upon:
a shape of said result set produced by said database query,
said metrics, and
a data leak protection policy specifying a set of limitations for a corresponding set of shapes and metrics.
10. The machine readable storage of claim 9 , wherein said limiting comprises:
characterizing said shape of said result set;
comparing said shape to pre-specified shapes to identify a matching shape;
retrieving a remedial measure corresponding to said matching shape; and,
applying said remedial measure.
11. The machine readable storage of claim 9 , wherein said shape of said result set is characterized by at least two characteristics of said result set.
12. The machine readable storage of claim 10 , wherein said characterizing comprises processing at least one of
a stateless function for data in said result,
a stateful function for data in multiple result sets,
a stateful function for said metrics produced by said IDS, and
a stateless function for said metrics produced by said IDS.
13. The machine readable storage of claim 10 , wherein said applying comprises quashing said result set.
14. The machine readable storage of claim 10 , wherein said applying comprises returning said result set in its entirety.
15. The machine readable storage of claim 10 , wherein said applying comprises pruning said result set.
16. The machine readable storage of claim 10 , wherein said applying comprises disconnecting a user issuing said database query.
17. An information hardware system configured for data leak protection comprising:
a database server configured to receive a database query and produce a result set for the database query;
an intrusion detection system (IDS) coupled to said database server; and,
a data leak protection system configured to limit a response to the database query based upon:
a shape of the result set produced by said database query,
a data leak protection policy specifying a set of limitations for a corresponding set of shapes and metrics.
18. The system of claim 17 , wherein the data leak protection policy comprises a listing of data shapes and corresponding remedial measures.
19. The system of claim 17 , wherein the data leak protection policy further comprises consideration for metrics produced by the IDS.
20. The system of claim 17 , wherein the information hardware system is a database hardware system.
21. The system of claim 17 , wherein said shape of said result set is characterized by at least two characteristics of said result set.
22. The system of claim 18 , wherein the data shapes are stateless functions of data included in each of the result sets.
23. The system of claim 18 , wherein the data shapes are stateful functions of data included across multiple ones of the result sets.