Digital asset usage accountability via event journaling
View Patent ↗A technique for establishing a perimeter of accountability for usage of digital assets such as data files. The accountability model not only tracks authorized users' access to files, but monitors passage of such files to uncontrollable removable storage media or through network connections and the like which may indicate possible abuse of access. In accordance with a preferred embodiment, an autonomous independent agent process running at a point of use, such as in the background of a client operating system kernel, interrupts requests for access to resources. The agent process senses low level system events, filters, aggregates them, and makes reports to a journaling server. The journaling server analyzes sequences of low level events to detect when aggregate events of interest occur, such as “FileEdit”, network file transfers and the like. Reports can be generated to provide an understanding of how digital assets have been accessed, used or communicated by individuals in an enterprise.
1. A system for providing usage accountability of a digital asset in a data processing system, comprising:
a client device having (i) a sensor located within an operating system kernel of the client device and configured to sense atomic-level events relating to authorized access to the digital asset by an end user of the client device, and (ii) a coalescing aggregator configured to aggregate multiple atomic-level events relating to a single end-user's action into a coalesced atomic-level event, the coalesced atomic-level event being a single atomic-level event selected from the multiple atomic-level events; and
a journaling server in communication with the client device and having (i) a high-level aggregator configured to generate a high-level aggregate event by aggregating multiple atomic-level events, including at least one coalesced atomic-level event, based on a predetermined sequence of atomic-level events, and (ii) a reporter configured to generate an audit trail from one or more aggregate events, the audit trail representing usage of the digital asset by the end user.
2. A system as in claim 1 wherein the client device further includes a filter configured to filter the atomic-level events with an approved event list, filtering-out atomic-level events corresponding to events on the approved event list.
3. A system as in claim 2 wherein the approved event list includes a list of approved file identifiers.
4. A system as in claim 3 wherein the file identifiers are a hash code.
5. A system as in claim 1 wherein the audit trail is determined to indicate a suspect action with the digital asset.
6. A system as in claim 1 wherein the coalescing aggregator creates a single atomic-level event after a given time-out period with no activity by the end user.
7. A system as in claim 1 wherein the audit trail is used to control security of the data processing system by determining patterns of unexpected behavior based on the audit trail.
8. A system as in claim 1 wherein the audit trail provides a perimeter of accountability for usage of the digital asset at a point of use of the digital asset.
9. A system as in claim 8 wherein the point of use is the client device and the accountability is of access, modification, and distribution of the digital asset.
10. A system as in claim 1 wherein the usage of the digital asset includes access and dissemination of the digital asset.
11. A system as in claim 1 wherein the aggregate event is attributable to the end user, a thread, or an application as identified at a known time.
12. A system as in claim 1 wherein the aggregate event is associated with a particular executing process.
13. A system as in claim 12 wherein the executing process is associated with the end user.
14. A system as in claim 1 wherein bundles of coalesced atomic-level events are created before transmitting the coalesced atomic-level events from the client device to the journaling server.
15. A system as in claim 14 wherein sequence numbers are added to the bundles.
16. A method for providing usage accountability of a digital asset in a data processing system, the method comprising:
sensing atomic-level events within an operating system kernel of a client device, the atomic-level events relating to authorized access to the digital asset by an end user of the client device;
aggregating multiple atomic-level events relating to a single end-user's action into a coalesced atomic-level event, the coalesced atomic-level event being a single atomic-level event selected from the multiple atomic-level events;
forwarding the coalesced atomic-level event to a journaling server;
generating a high-level aggregate event at the journaling server by aggregating multiple atomic-level events, including at least one coalesced atomic-level event, based on a predetermined sequence of atomic-level events; and
generating an audit trail from one or more aggregate events, the audit trail representing usage of the digital asset by the end user.
17. A method as in claim 16 further including filtering the atomic-level events with an approved event list, and wherein forwarding the coalesced atomic-level events to the journaling server includes forwarding only atomic-level events not corresponding to events in the approved event list.
18. A method as in claim 17 wherein the approved event list includes a list of approved file identifiers.
19. A method as in claim 16 further including creating bundles of coalesced atomic-level events before transmitting the coalesced atomic-level events from the client device to the journaling server.
20. A method as in claim 16 wherein the usage of the digital asset includes access and dissemination of the digital asset.