Unified source user checking of TCP data packets for network data leakage prevention
View Patent ↗Systems and methods are directed towards network data leakage prevention (DLP). More specifically, the systems and methods are directed towards using TCP (Transmission Control Protocol) data packets in conjunction with the DLP monitor. The network DLP utilizes TCP data packets to carry source user identity. With the source user identity, the DLP monitor can determine if sensitive data can be transmitted based on the provided user information and corresponding DLP policies for each user. Furthermore, the DLP monitor can determine if sensitive data can also be transmitted for particular users in situations where multiple users share the same IP address.
1. A method for data leakage prevention (DLP) by checking transfer control protocol (TCP) data packets, the method comprising:
establishing user information for a user with a network, the user information including secret keys for authenticating source user identity for TCP data packets being sent by a user device of the user;
intercepting a transmitted TCP data packet from the user device containing sensitive information, wherein the transmitted TCP data packet is being transmitted out of the network;
identifying, via a processor, that the transmitted TCP data packet from the user device does not contain source user-based information that is required to authenticate the user;
sending a request over a network interface to the user device that identifies source user-based information associated with the user, wherein the user device places the identified source user-based information in one or more data fields of a retransmitted TCP data packet based on a shared secret associated with the secret keys when an acknowledgment to the transmitted TCP data packet has not been received by the user device;
receiving the retransmitted TCP data packet from the user device, the retransmitted TCP data packet containing the source user-based information placed in the one or more data fields by the user device;
evaluating, via the processor, that the source user-based information included in the one or more data fields of the retransmitted TCP data packet matches the user information established with the network, thereby authenticating the identity of the user based on the shared secret;
evaluating, via the processor, corresponding policies associated with the authenticated user; and
processing, via the processor, the retransmitted TCP data packet containing sensitive information based on the evaluated policies for the authenticated user.
2. The method of claim 1 , wherein the user information for the user is established during an initial log-in with the network.
3. The method of claim 1 , wherein the user information includes a unique random identification, a standard keyed-hash message authentication code and a key used by the authentication code to generate a message authentication code.
4. The method of claim 1 , wherein the policies dictate what types of sensitive information can be transmitted by the user outside the network.
5. The method of claim 1 , wherein processing the retransmitted TCP data packet based on the evaluated policies includes blocking further transmission of the TCP data packet outside of the network.
6. The method of claim 1 , wherein processing the retransmitted TCP data packet based on the evaluated policies includes allowing the transmission of the TCP data packet outside of the network.
7. The method of claim 1 , wherein the source user-based information included in the retransmitted TCP data packet includes a message authentication code.
8. The method of claim 7 , wherein evaluating the source user-based information comprises matching the message authentication code included in the retransmitted TCP data packet by the user and the message authentication code generated via the secret keys.
9. A system for data leakage prevention (DLP) by checking transfer control protocol (TCP) data packets, the system comprising:
a memory that stores secret keys for authenticating source user identity for TCP data packets sent by each user device;
a processor associated with the memory, wherein the processor executes instructions stored in the memory to establish user information for a user associated with a network, the user information including secret keys for authenticating source user identity for TCP data packets being sent by a user device of the user; and
a network interface that intercepts a transmitted TCP data packet from the user device containing sensitive information, wherein the transmitted TCP data packet is transmitted out of the network,
wherein the processor executing instructions out of the memory identifies that the intercepted TCP data packet from the user does not contain source user-based information that is required to authenticate the user,
wherein the network interface:
sends a request to the user device that identifies source user-based information associated with the user wherein the user device places the identified source user-based information in one or more data fields of a retransmitted TCP data packet based on a shared secret associated with the secret keys of the user when an acknowledgment to the transmitted TCP data packet has not been received by the user device, and
receives the retransmitted TCP data packet,
wherein the processor identifies that the source user-based information included in the one or more data fields of the retransmitted TCP data packet matches the user information established with the network, thereby authenticating the identity of the user based on the shared secret, and processes the retransmitted TCP data packet containing sensitive information based on policies associated with the authenticated user.
10. The system of claim 9 , wherein the user information for the user is established during an initial log-in with the network.
11. The system of claim 10 , wherein the user information includes a unique random identification, a standard keyed-hash message authentication code and a key used by the authentication code to generate a message authentication code.
12. The system of claim 9 , wherein the policies dictate what types of sensitive information can be transmitted by the user outside the network.
13. The system of claim 9 , wherein processing the retransmitted TCP data packet based on the evaluated policies includes blocking further transmission of the TCP data packet outside of the enterprise network.
14. The system of claim 9 , wherein processing the retransmitted TCP data packet based on the evaluated policies includes allowing the transmission of the TCP data packet outside of the enterprise network.
15. The system of claim 9 , wherein the source user-based information included in the retransmitted TCP data packet includes a message authentication code.
16. The system of claim 15 , wherein evaluating the source user-based information comprises matching the message authentication code included in the retransmitted TCP data packet by the user and the message authentication code generated via the secret keys.
17. A non-transitory computer readable storage medium, having embodied thereon a program executable by a processor to perform a method for data leakage prevention (DLP) by checking transfer control protocol (TCP) data packets, the method comprising:
establishing user information for a user with a network, the user information including secret keys for authenticating source user identity for TCP data packets being sent by a user device;
intercepting a transmitted TCP data packet from the user device containing sensitive information, wherein the transmitted TCP data packet is being transmitted out of the network;
identifying that the transmitted TCP data packet from the user device does not contain source user-based information that is required to authenticate the user;
sending a request to the user device that identifies source user-based information that is associated with the user, wherein the user device places the identified source user-based information in one or more data fields of a retransmitted TCP data packet based on a shared secret when an acknowledgment to the transmitted TCP data packet has not been received by the user device;
receiving the retransmitted TCP data packet from the user device, the retransmitted TCP data packet containing the source user-based information placed in the one or more data fields by the user device;
evaluating that the source user-based information included in the one or more data fields of the retransmitted TCP data packet matches the user information established with the network, thereby authenticating the identity of the user based on the shared secret;
evaluating corresponding policies associated with the authenticated user; and
processing the retransmitted TCP data packet containing sensitive information based on the evaluated policies for the authenticated user.
18. The non-transitory computer readable storage medium of claim 17 , wherein the user information for the user is established during an initial log-in with the network.
19. The non-transitory computer readable storage medium of claim 17 , wherein the user information includes a unique random identification, a standard keyed-hash message authentication code and a key used by the authentication code to generate a message authentication code.
20. The non-transitory computer readable storage medium of claim 17 , wherein the policies dictate what types of sensitive information can be transmitted by the user outside the network.