Secure data leak detection
A system to detect leaks of secure data (e.g., passwords) includes a browser extension (or other software) identifying information (e.g., a password) input to a web page in a browser, processing the information locally using a transformation operation to transform the information to a transformed result (e.g., hash using a salt), forwarding the transformed result to a remote computer system storing secure data, determining that the transformed result matches the stored secure data, and performing a protective action in response to the determining that the transformed result matches the stored secure data.
1. A computer implemented method for secure data leak detection, comprising:
creating a session between a first computer system and a second computer system based on authenticating with a user identification;
during the session, automatically identifying, at the first computer system, information input to a form;
automatically processing the information locally at the first computer system using a transformation operation to transform the information to a transformed result;
automatically forwarding the transformed result from the first computer system to the second computer system, the second computing system stores secure data associated with the user identification of the session;
automatically determining that the transformed result matches the secure data that is associated with the user identification of the session and that is stored at the second computing system; and
performing a protective action in response to the determining that the transformed result matches the secure data associated with the user identification of the session and that is stored at the second computing system.
2. The computer implemented method of claim 1 , wherein:
the using the transformation operation to transform the information comprises combining the information with a randomly generated value.
3. The computer implemented method of claim 1 , wherein:
the using the transformation operation to transform the information comprises hashing the information with a salt.
4. The computer implemented method of claim 1 , further comprising:
during the session between the first computer system and the second computer system, the first computing system requesting from the second computers system a random value previously stored for and associated with the user identification, the first computer system is aware of the user identification based on the session;
the second computer system using the user identification to identify the random value previously stored for and associated with the user identification; and
the second computer system sending the random value previously stored for and associated with the user identification to the first computer system, the first computer system uses the random value with transformation operation to transform the information to the transformed result.
5. The computer implemented method of claim 1 , further comprising:
during the session between the first computer system and the second computer system, the first computing system requesting from the second computers system a salt previously stored for and associated with the user identification, the first computer system is aware of the user identification based on the session;
the second computer system using the user identification to identify the salt previously stored for and associated with the user identification; and
the second computer system sending the salt previously stored for and associated with the user identification to the first computer system, the using the transformation operation to transform the information comprises hashing the information with the salt.
6. The computer implemented method of claim 1 , wherein:
the performing the protective action comprises locking a user account from accessing a network resource, the user account associated with the user identification.
7. The computer implemented method of claim 1 , further comprising:
performing access management services for a network resource using the second computer system, the second computer system maintains a plurality of user accounts for accessing the network resource, the user identification is associated with a first user account of the plurality of user accounts, the performing the protective action comprises automatically locking the first user account so that the first user account cannot be used to access the network resource.
8. The computer implemented method of claim 1 , wherein:
the automatically identifying comprises a browser extension on the first computer system identifying password information input to a web page in a browser on the first computing system;
the processing the information locally is performed by the browser extension; and
the performing the protective action comprises the browser extension preventing the information input to the web page from being submitted to a server for the web page.
9. The computer implemented method of claim 1 , wherein:
the automatically identifying comprises a browser extension on the first computing system automatically identifying a password input field for a web page and identifying password information input to the password input field in a browser on the first computing system; and
the processing the information locally is performed by the browser extension.
10. The computer implemented method of claim 9 , further comprising:
during the session between the first computer system and the second computer system, the browser extension requesting from the second computers system a random value previously stored for and associated with the user identification, the browser extension is aware of the user identification based on the session;
the second computer system using the user identification to identify the random value previously stored for and associated with the user identification; and
the second computer system sending the random value previously stored for and associated with the user identification to the browser extension, the using the transformation operation to transform the information comprises the browser extension hashing the information with the random value.
11. A computer implemented method for secure data leak detection, comprising:
a first computing system identifying information input to a computer based form;
the first computing system requesting a random value from a second computer system, the random value is prestored and associated with a user identification at the second computing system;
the first computing system processing the information using a transformation operation with the random value to transform the information to a transformed result;
forwarding the transformed result to the second computer system storing secure data, the secure data is prestored and associated with the user identification at the second computing system;
receiving an indication that the transformed result matches the secure data; and
performing a protective action in response to the receiving the indication that the transformed result matches the secure data.
12. The computer implemented method of claim 11 , further comprising:
creating a session between the first computer system and the second computer system based on authenticating with the user identification, the first computer system is aware of the user identification based on the session.
13. The computer implemented method of claim 12 , wherein:
the identifying information comprises a browser extension on the first computer system identifying password information input to the web page in a browser on the first computing system; and
the processing the information, identifying the user identification, forwarding, requesting the salt, receiving the salt, receiving the indication and performing the protective action are performed by the browser extension.
14. A non-transitory processor readable storage medium, comprising:
processor readable code that programs one or more processors to implement a browser extension that performs a method comprising:
recognizing input of password information in a browser associated with an identity;
obtaining a salt associated with the identity from a remote server;
creating a hash of the password information using the salt;
sending the hash to a remote server;
receiving results of an indication that the hash matches a stored password hash for the identity; and
performing a protective action in response to the receiving.
15. An apparatus, comprising:
a communication interface;
a memory; and
a processor connected to the communication interface and the memory, the processor is configured to:
recognize input of password information for a user that is authenticated on the apparatus,
obtain a salt associated with the user from a remote server,
hash the password information using the salt,
send the hashed password information to the remote server,
receive results of an indication of whether the hashed password information matches a stored hash of a password for the user, and
performing a protective action if the hashed password information matches the stored hash of the password for the user.
16. The apparatus of claim 15 , further comprising:
a computing system configured to perform access management service for a network resource, the computing system includes the remote server, the computing system is configured to maintain user accounts for accessing the network resource, the user is associated with a first user account for accessing the network resource, the salt is associated with and unique to the first user account, the computing system is configured to lock the first user account by preventing the network resource from being accessed with the first user account if the hashed password information matches the stored hash of the password for the user.
17. A computer implemented method for secure data leak detection, comprising:
creating a session between a computing device and an access management system using a user identification;
during the session between the computing device and the access management system, identifying information input to the computing device;
during the session between the computing device and the access management system, the computing device requesting from the access management system a random value previously stored for and associated with the user identification, the computing device is aware of the user identification based on the session;
the access management system using the user identification to identify the random value previously stored for and associated with the user identification;
the access management system sending the random value previously stored for and associated with the user identification to the computing device;
the computing device using a one way transformation operation to transform the information and the random value to create a new transformed result;
during the session between the computing device and the access management system, forwarding the new transformed result to the access management system;
the access management system using the user identification to identify a pre-stored transformed result;
the access management system comparing the pre-stored transformed result to the new transformed result;
determining that the new transformed result matches the pre-stored transformed result; and
performing a protective action in response to the determining that the new transformed result matches the pre-stored transformed result.
18. The computer implemented method for secure data leak detection of claim 17 , wherein:
the performing a protective action comprises the access management system locking out the user identification from access a network resource protected by the access management system.
19. The computer implemented method for secure data leak detection of claim 17 , wherein:
the creating the session, identifying information, using a one way transformation operation and forwarding the transformed result are performed by a browser extension operating with a browser on the computing device; and
the performing a protective action comprises the browser extension blocking submission of the information.
20. The computer implemented method for secure data leak detection of claim 19 , wherein:
the random value is a salt; and
the transformation operation creates a hash of the information and the salt.