Category-based data loss prevention for network-connected devices
A network-connected device (such as an “internet of things” device) that periodically transmits data to recipient devices (e.g., smartphones, tablets, laptops) may be protected by a firewall that include software firewall elements, hardware firewall elements, or some combination thereof. The firewall may intercept datasets sent by the network-connected device, inspect the datasets, and categorize data within each dataset as belonging to one of a number of previously-identified data categories, such as personal data, location data, behavior data, or energy data, or as not belonging to any recognized data category. Rules within firewall policies may indicate whether data of each data category is to be allowed to be sent to the recipient devices or to be blocked from being sent to the recipient devices, for example allowing a firewall to block transmission of location data. Data not belonging to a recognized data category is sent to a support system for classification.
1. A method for data filtering, the method comprising:
storing a plurality of filtering rules associated with one or more security functions at a firewall, wherein each filtering rule is associated with at least one data category and identifies whether data categorized under the at least one data category is allowed be sent to one or more recipient devices;
intercepting a first dataset at the firewall, the first dataset transmitted by a network-connected device and directed to one or more recipient devices;
identifying a first data chunk that includes at least a subset of the first dataset;
comparing the first data chunk to a plurality of data category definitions, wherein at least one of the data category definitions includes a definition rule that identifies a data pattern;
recognizing that the first data chunk matches the at least one category definitions based on an identification that the first data chunk meets a predetermined level of similarity to the data pattern that is consistent with one or more examples of computer data, the matching data category definition associated with a corresponding data category;
retrieving a first filter rule from the plurality of stored filtering rules, the first filtering rule associated with the corresponding data category and identifying that data categorized under a first data category is to be blocked in accordance with an associated security function; and
blocking transmission of at least the first data chunk to the one or more recipient devices based on the first filter rule.
2. The method of claim 1 , wherein the associated security function concerns controlling distribution of at least one of personal data, device data, location data, behavior data, energy data, confidential data, computer viruses, computer malware, software updates, or firmware updates.
3. The method of claim 1 , further comprising inspecting the first dataset by performing a deep packet inspection of secure socket layer (DPI-SSL) encryption of the dataset.
4. The method of claim 1 , wherein the plurality of data category definitions include the one or more data examples of the computer data that was previously classified into one or more data categories.
5. The method of claim 1 , wherein the network-connected device includes one or more of a one of a light bulb, a lamp, a refrigerator, a cooler, an oven, a stovetop, a grill, a microwave, a slow cooker, a pressure cooker, a rice cooker, a food thermometer, a pot, a pan, a kitchen appliance, a video camera, a security camera, a photography camera, a home security system, a motion sensor, a door lock, a door, a thermostat, a thermometer, a heater, an air conditioner, a fan, a smoke alarm, a pacemaker, a medical implant device, a medical sensor device, a phone, an answering machine, a car, a motorcycle, a bicycle, a scooter, a skateboard, a bus, a train, a tram, a trolley, a watercraft, a manned aircraft, an unmanned aircraft, a vehicle computer device, a home media player device, a portable media player device, a printer, a scanner, a fax machine, a pager, a beeper, a radio, a television, a massager, a user-massaging furniture device, a user-heating furniture device, a heated floor, a chair, a stool, a recliner, a couch, a vehicle seat, a bed, a wearable watch device, a wearable band device, a wearable ring device, a wearable glasses-based device, a wearable necklace device, a wearable clothing device, a wearable jewelry device, a cellular phone, a tablet device, a portable video game console, a home video game console, a laptop computer, a desktop computer, a television, or a media center device.
6. The method of claim 1 , wherein the one or more recipient devices include at least one of a desktop computer, a laptop computer, a tablet device, a cellular phone device, a portable video game console, a home video game console, a television, a media center device, a vehicle computer device.
7. The method of claim 1 , wherein the first dataset is transmitted by the network-connected device at least partially via at least one of a wireless communication transmitter or a wired communication transmitter.
8. The method of claim 1 , wherein the first dataset is transmitted by the network-connected device through a hub device before it is intercepted by the firewall, the hub device including at least one of a wireless communication receiver, a wired communication receiver, or some combination thereof, the hub device also including at least one of a wireless communication transmitter or a wired communication transmitter.
9. The method of claim 1 , wherein the plurality of data category definitions are at least partially based on input from a support system that has previously classified one or more non-recognized data chunks previously transmitted by the network-connected device into at least a subset of the plurality of data categories, the one or more non-recognized data chunks previously submitted to the support system by the firewall after the firewall determined that the one or more non-recognized data chunks did not match a previous set of one or more data category definitions.
10. The method of claim 9 , wherein the support system classifies the one or more non-recognized data chunks at least partially based on a classifying input received by the support system via a user input device of the support system.
11. The method of claim 9 , wherein the support system classifies the one or more non-recognized data chunks at least partially based on an artificially intelligent classifying algorithm that compares the previous set of one or more category definitions to permutations data within the one or more non-recognized data chunks.
12. A system for data filtering, the system comprising:
a data storage that stores a plurality of filtering rules associated with one or more security functions at a firewall, wherein each filtering rule is associated with at least one data category and identifies whether data categorized under the at least one data category is allowed be sent to one or more recipient devices;
a communication transceiver in communicative contact at least with a network-connected device and one or more recipient devices, the communication transceiver to intercept a first dataset, the first dataset transmitted by the network-connected device and directed to the one or more recipient devices; and
a processor coupled to a memory and to the communication transceiver, wherein execution of instructions stored at the memory by the processor:
identifies a first data chunk that includes at least a subset of the first dataset,
compares the first data chunk to a plurality of data category definitions, wherein at least one of the data category definitions includes a definition rule that identifies a data pattern,
recognizes that the first data chunk matches the at least one data category definitions based on an identification that the first data chunk meets a predetermined level of similarity to the data pattern that is consistent with one or more examples of computer data, the matching data category definition associated with a corresponding data category,
retrieves a first filter rule from the plurality of stored filtering rules, the first filtering rule associated with the corresponding data category and identifying that data categorized under a first data category is to be blocked in accordance with an associated security function, and
blocks transmission of at least the first data chunk to the one or more recipient devices based on the first filter rule.
13. The system of claim 12 , wherein the data storage is in the memory.
14. The system of claim 12 , further comprising a database server storing the plurality of data category definitions in one or more data structures, wherein the communication transceiver is in communicative contact with the database server.
15. The system of claim 14 , wherein the firewall policy is stored in a data structure at the database server.
16. The system of claim 14 , wherein the plurality of category definitions include the one or more data examples of the computer data that was previously classified into one or more of the plurality of data categories.
17. The system of claim 14 , further comprising a support system in communication with the communication transceiver and that provides input upon which the plurality of data category definitions are at least partially based, wherein the support system previously classified one or more non-recognized data chunks previously transmitted by the network-connected device into at least a subset of the plurality of data categories, and the one or more non-recognized data chunks were previously submitted to the support system after a determination that the one or more non-recognized data chunks did not match a previous set of one or more category definitions.
18. A non-transitory computer-readable storage medium, having embodied thereon a program executable by a processor to perform a method for data filtering, the method comprising:
storing a plurality of filtering rules associated with one or more security functions at a firewall, wherein each filtering rule is associated with at least one data category and identifies whether data categorized under the at least one data category is allowed be sent to one or more recipient devices;
intercepting a first dataset at the firewall, the first dataset transmitted by a network-connected device and directed to one or more recipient devices;
identifying a first data chunk that includes at least a subset of the first dataset;
comparing the first data chunk to a plurality of data category definitions, wherein at least one of the data category definitions includes a definition rule that identifies a data pattern;
recognizing that the first data chunk matches of the at least one data category definitions based on an identification that the first data chunk meets a predetermined level of similarity to the data pattern that is consistent with one or more examples of computer data, the matching data category definition associated with a corresponding data category;
retrieving a first filter rule from the plurality of stored filtering rules, the first filtering rule associated with the corresponding data category and identifying that data categorized under a first data category is to be blocked in accordance with an associated security function; and
blocking transmission of at least the first data chunk to the one or more recipient devices based on the first filter rule.