Tracking the origins of data and controlling data transmission
View Patent ↗Provided are methods, apparatus and computer programs for tracking the origins of data and controlling transmission of the data. In one embodiment, transmission of sensitive data by script operations is limited, to prevent transmission to any network location other than to the source of that sensitive data, by a new function within a scripting engine of an HTTP client that is responsive to origin tags placed within the data. Origin tags that are associated with data inputs are propagated to any output data items, so that transmission of derived information can also be controlled.
1. A computer-implemented method for controlling transmission of sensitive data comprising the steps, performed within a scripting environment, of:
a processor associating an indication of origin with a first data element;
the processor propagating said indication of origin to a generated data element, wherein said generated data element was generated from the first data element, and wherein said propagating indications of origin comprises:
identifying a set of one or more inputs to a scripting operation that generates one or more outputs;
identifying any indications of origin that are associated with the one or more inputs;
deriving secondary indications of origin from the inputs' indications of origin; and
saving the secondary indications of origin in association with the one or more generated outputs; and
the processor restricting transmission of the first data element and said generated data element to only permitted destinations that are identified with reference to the indication of origin, wherein said associating the indication of origin with the first data element and said restricting transmissions of the first data element are performed in response to determining that the first data element comprises sensitive data.
2. The computer-implemented method of claim 1 , wherein the first data element is obtained from a source data processing system that is remote from the scripting environment, and wherein said restricting transmission comprises preventing transmission of the first data element to any destination other than the source data processing system.
3. The computer-implemented method of claim 1 , wherein said associating the indication of origin with the first data element is performed in response to determining that the first data element is to be processed by a scripting operation.
4. The computer-implemented method of claim 1 , wherein said associating, propagating and restricting are performed on a client data processing apparatus that comprises a network connection interface for communicating with a remote server data processing apparatus;
wherein the computer-implemented method further comprises:
the processor sending a request to the remote server data processing apparatus via the network connection interface, to retrieve the first data element from the remote server data processing apparatus; and
the processor receiving data from the remote server data processing apparatus.
5. The computer-implemented method of claim 4 , wherein said sending a request comprises specifying within the request that the client data processing apparatus comprises means for performing the step of restricting transmission.
6. The computer-implemented method of claim 5 , wherein said associating the indication of origin with the first data element is performed in response to receiving data from the remote server data processing system, wherein said data from the remote server data processing system includes an indication that the data from the remote server data processing system includes sensitive data.
7. The computer-implemented method of claim 4 , wherein said sending and receiving are performed by an HTTP client program, and wherein the first data element is obtained by the HTTP client program in response to an HTTP request that includes an indication that the HTTP client program can provide protection for sensitive data.
8. The computer-implemented method of claim 7 , wherein said associating and propagating are implemented by a scripting engine running within the client data processing apparatus.
9. The computer-implemented method of claim 1 , wherein the first data element is retrieved by a scripting operation from a data processing system that is remote from the scripting environment.
10. A data processing system comprising:
at least one data processing unit;
at least one data storage unit;
a script interpreter;
means for associating an indication of origin with a first data element;
means for propagating the indication of origin to a generated data element, wherein the generated data element was generated from the first data element, and wherein said propagating the indication of origin comprises:
identifying a set of one or more inputs to a scripting operation that generates one or more outputs;
identifying any indications of origin that are associated with the one or more inputs;
deriving secondary indications of origin from the inputs' indications of origin; and
saving the secondary indications of origin in association with the one or more generated outputs; and
means for restricting transmissions of the first data element and said generated data element from the data processing system to only permitted destinations that are identified with reference to the indications of origin, wherein said associating the indication of origin with the first data element and said restricting transmissions of the first data element are performed in response to determining that the first data element comprises sensitive data.
11. The data processing system of claim 10 , further comprising:
a network connection interface for communicating with a remote server data processing apparatus;
means for sending a request to the remote server data processing apparatus via the network connection interface, to retrieve the first data element from the remote server data processing apparatus; and
means for receiving data from the remote server data processing apparatus.
12. The data processing system of claim 11 , wherein the means for associating and means for propagating comprise components of a scripting engine.
13. The data processing system of claim 12 , wherein the means for associating, means for propagating and means for restricting comprise components of an HTTP client program.
14. The data processing system of claim 10 , wherein the means for restricting transmissions comprises an application-specific integrated circuit.
15. A computer program product, comprising program code recorded on a memory device, for controlling a data processing apparatus on which the program code executes a process for controlling transmission of sensitive data within a scripted environment, wherein the process comprises the steps of:
associating an indication of origin with a first data element;
propagating indications of origin to a generated data element, wherein the generated data element was generated from the first data element, and wherein said propagating indications of origin comprises:
identifying a set of one or more inputs to a scripting operation that generates one or more outputs;
identifying any indications of origin that are associated with the one or more inputs;
deriving secondary indications of origin from the inputs' indications of origin; and
saving the secondary indications of origin in association with the one or more generated outputs; and
restricting transmission of the first data element and said generated data element to only permitted destinations that are identified with reference to the indications of origin, wherein said associating the indication of origin with the first data element and said restricting transmissions of the first data element are performed in response to determining that the first data element comprises sensitive data.