Granted Patent B2

US 9,152,821 · App. 14/230,968 · Granted Oct 6, 2015

Abstract

Claims (49)

1. A system comprising:

a hardware processor; and

a computer memory on which are store instructions, comprising instructions that when executed cause the processor to:

identify first data as data predetermined for the application of data leakage protection, the first data being identified from among second data, wherein the first data includes at least an indication of data signature;

recognize a first operation requested to be performed upon first data, before the first operation is performed upon the first data;

associate the first operation with an operation type;

determine whether the operation type of the first operation is among a group of operation types that has been predetermined to create a security risk, wherein the first operation includes at least an encryption operation for the purpose of obfuscating data identity; and

preventing the first operation from being performed on the first data if the operation type of the first operation is in the group of operation types.

2. The system of claim 1 wherein the group of operation types that has been predetermined to create a security risk includes an encryption type operation, an encoding type operation, and a compression type operation.

3. The system of claim 1 wherein first data is data predetermined for the application of data leakage protection because first data is confidential to a person or entity.

4. The system of claim 1 wherein first data is data predetermined for the application of data leakage protection due to a policy of a person or entity.

5. The system of claim 1 wherein the group of operation types that has been predetermined to create a security risk includes a delete type operation or an archiving type operation.

6. The system of claim 1 wherein the instructions further comprise instructions that when executed cause the processor to monitor all requests to access the first data.

7. The system of claim 1 wherein the group of operation types that has been predetermined to create a security risk includes a transformation type operation that may change the format of first data from a first format to a second format.

8. The system of claim 1 wherein the determination whether the operation type of the first operation is among a group of operation types that has been predetermined to create a security risk comprises comparing the type of the recognized first operation with a list of operation types that have been previously associate with a security risk.

9. A non-transitory computer-readable storage medium on which are stored instructions, comprising instructions that when executed on a processor configure the processor to:

identify first data from among second data for the purpose of applying data leakage protection to the first data, wherein the first data includes at last an indication of data signature;

identify operations requested to be performed upon the first data, before the operations are performed upon the first data;

detect a first operation requested to be performed upon the first data;

determine whether the first operation is associated with potentially malicious software by comparing a type of the first operation with a list of operation types; and

conditionally preventing the first operation on the first data depending upon whether the type of the first operation is an operation type that is associated with malicious software activity, wherein the first operation includes at least an encryption operation for the purpose of obfuscating data identity.

10. The computer-readable medium of claim 9 wherein the instructions that when executed configure the processor to identify operations requested to be performed upon the first data, before the operations are performed upon the first data, comprise instructions that when executed configure the processor to monitor all requests to access the first data.

11. The computer-readable medium of claim 9 wherein the instructions that when executed configure the processor determine whether the first operation is associated with potentially malicious software by comparing the type of the first operation with a list of operation types, comprise instructions that when executed cause the processor to compare the type of the first operation with a list of operation types that have previously been associated with malicious software.

12. The computer-readable medium of claim 9 wherein the instructions that when executed configure the processor to determine whether the first operation is associated with potentially malicious software by comparing the type of the first operation with a list of operation types, comprise instructions that when executed configure the processor to compare the type of the first operation with a list of operation types that have not previously been associated with malicious software.

13. The computer-readable medium of claim 12 wherein the instructions that when executed configure the processor to conditionally prevent the first operation on the first data depending upon whether the type of the first operation is an operation type that is associated with malicious software activity, comprise instructions that when executed configure the processor to allow the first operation if the type of the first operation matches an operation type that has not previously been associated with malicious software.

14. The computer-readable medium of claim 9 wherein the instructions that when executed configure the processor to conditionally prevent the first operation on the first data depending upon whether the type of the first operation is an operation type that is associated with malicious software activity, comprise instructions that when executed configure the processor to prevent the first operation if the operation type of the first operation is not found on a list of operation types previously determined not to be associated with malicious software.

15. A non-transitory machine accessible storage medium having instructions stored thereon, comprising instructions that when executed on a machine cause the machine to:

determine that a first data is a type of data that has been pre-determined for data leakage protection, wherein the first data includes at least an indication of data signature;

recognize operations requested to be performed upon the first data, before the operations are performed upon the first data;

identify a first operation requested to be performed upon the first data;

determine whether the first operation is a type of operation that has been predetermined to create a risk of data leakage, wherein the first operation includes at least an encryption operation for the purpose of obfuscating data identity; and

based upon whether the first operation's type of operation has been predetermined to create a risk of data leakage, conditionally prevent the first operation on the first data upon the determination of the type of the first operation.

16. The machine accessible storage medium of claim 15 wherein the first data is of a data type predetermined for the application of data leakage protection because the first data is confidential to a person or entity.

17. The machine accessible storage medium of claim 15 wherein the first data is of a data type predetermined for the application of data leakage protection due to a policy of a person or entity.

18. The machine accessible storage medium of claim 15 wherein the instructions that when executed cause the machine to determine whether the first operation is a type of operation that has been predetermined to create a risk of data leakage, comprise instructions that when executed cause the machine to compare the type of the first operation to a group of operation types where each operation type in the group has been previously been associated with a risk of data leakage.

19. The machine accessible storage medium of claim 18 wherein the group of operation types that has been previously associated with a risk of data leakage includes at least one of a delete type operation, a archiving type operation, an encryption type operation, or a transforming type operation.

20. The machine accessible storage medium of claim 15 wherein the instructions that when executed cause the machine to determine whether the first operation is a type of operation that has been predetermined to create a risk of data leakage comprise instructions that when executed cause the machine to compare the type of the first operation to a group of operation types where each operation type in the group has not previously been associated with a risk of data leakage.

21. The machine accessible storage medium of claim 20 wherein the group of operation types that has not been previously associated with a risk of data leakage does not include at least one of an encryption type operation, or a transforming type operation.

22. A method, comprising:

applying, using a computing device, data leakage protection to a first set of data, the first set of data existing as part of a second set of data, wherein the first data includes at least an indication of data signature;

detecting, by the computing device, an attempt to perform an operation on the first set of data, the detection occurring prior to the performance of the operation;

determining whether or not the attempted operation is associated with malicious software, wherein the attempted operation includes at least an encryption operation for the purpose of obfuscating data identity; and

preventing the attempted operation from occurring if it is associated with malicious software; and

allowing the attempted operation to occur if it is not associated with malicious software.

23. The method of claim 22 wherein determining whether or not the attempted operation is associated with malicious software comprises:

determining a type of the attempted operation; and

comparing the determined type of a list of operation types.

24. The method of claim 23 wherein the list of operation types comprises only operation types that have previously been associated with malicious software.

25. The method of claim 23 wherein the list of operation types comprises only operation types that have not previously been associated with malicious software.

Assignments (8)