Patent Application
20080235196
1. Technical Field
The present invention relates generally to an improved data processing system and method. More specifically, the present invention is directed to a system and method for searching a computing device for confidential content and reporting back any policy violations.
2. Description of Related Art
Maintaining the security of confidential files, e.g., image files, document files, data files, and the like, is a major concern for both government and business organizations. If an organization is not able to control the dissemination of their confidential files, many potentially harmful disclosures of information may occur. The consequences of such harmful disclosures may cause an organization to lose market share, lose trade secrets, or, in the case of government organizations, may actually lead to placing individuals in harm's way.
Typically, an organization has a written policy for ensuring the security of such files, however the implementation of this written policy is left up to the individual employees of the organization. For example, an organization may require that all electronic mail attachments be encrypted, however it is left up to the employee to actually abide by the policy. Whenever a security policy is left up to a human being for implementation, a potential source of error exists where the security policy may not be followed, or at least may not be followed in every situation.
Recently, desktop search engines have been developed for searching a user's own computer. These desktop search engines are client resident programs that search and index electronic mail, files, web browser history, and instant messages on a client computer's storage device. Examples of such desktop search engines include Google Desktop™, X1 Desktop™, and Microsoft Windows Vista™.
With these desktop search engines, a user may enter search terms into a field of the search engine and the search engine will search the electronic mail, files, web browser history, and instant messages to identify those entities that contain that search term. The search term may be found in the content of the entity, meta-tags of the entity, or the like. Results of the search may then be provided to the user. In this way, the user is able to obtain easy access to information on their personal computer by performing a text, search term based, search.
In view of the above, it would be beneficial to have a system and method that implements the searching of client computing devices so as to ensure compliance of items of information on the client computing device with security policies of an organization with which the client computing device or user is associated. The illustrative embodiments of the present invention provide such a system and method for ensuring compliance with security policies.
With the illustrative embodiments, a security compliance search engine is provided for searching one or more client computing devices for items of information that meet a security criteria established by an individual or organization. For example, the security compliance search engine searches for items of information that have confidential information. The term “item of information,” as it is used in the present description, refers to any individually identifiable collection of data. Examples of items of information include electronic mails, electronic files, objects in an object oriented environment, electronic documents, electronic images, and the like. In the present description, the term “confidential information” means information to which security policies are to be applied in order to ensure that the information is not accessible by unauthorized individuals.
The security compliance search engine uses a set of security search rules for determining how to locate and rate items of information that contain confidential information. These security search rules may include, for example, searching for particular character strings in the content of the item of information or in meta-information associated with the item of information, e.g., “Confidential,” “SSN:,” “Personal,” “Private,” “Secret,” or the like.
The security search rules may further include rules for searching indicators of confidentiality, e.g., data flags, particular parameters of the item of information being set, file system settings associated with the item of information, etc., in the content of the item of information or in meta-information associated with the item of information. Embodiments may also comprise rules for searching file name patterns to identify items of information that contain confidential information or even file usage patterns, as may be obtained from a usage log for example, that are indicative of confidential information being present. The rules may comprise subsets of rules for various types of items of information, e.g., subsets of rules for various file types, formats, and the like. Moreover, the same character strings noted above, e.g., “Confidential,” “SSN:,” and the like, may also be indicators of confidentiality.
The security compliance search engine may be provided on a server computing device and may remotely administer searches of client computing devices. The security compliance search engine may make use of a client computing device database to retrieve information about the client computing devices that are to be searched using the mechanisms of the security compliance search engine.
In remotely administering searches of client computing devices, the security compliance search engine may download or transfer a client agent to the client computing devices which may run the client agent to collect information from the client computing device and provide the information back to the server. For example, the client agent may collect information about the items of information present on the client computing device and provide this information, in a secure manner, back to the server for analysis using the security search rules. Alternatively, the client agent may actually perform the search of the items of information on the client computing device using the security search rules present on the server.
For items of information meeting one or more criteria set forth in the security search rules, characteristic information may be gathered about these items of information. This characteristic information may comprise, for example, identification of the item of information, the criteria met by the item of information, characteristic information about the item of information, information identifying the protection mechanisms currently applied to the item of information on the client computing device, and the like. This characteristic information may be used by the security compliance search engine to determine if the item of information is being maintained in accordance with established security policies.
The security compliance search engine may use the characteristic information gathered about the item of information to identify one or more security policies in a security policy database that apply to that item of information. The one or more security policies may then be applied to the characteristic information gathered about the item of information to determine if the item of information is being maintained in compliance with applicable security policies. Results of the application of the one or more security policies may be logged and maintained in the client computing device database, for example. In addition, the results may be used to generate reports and notifications that are sent to the client computing device and/or an administrator's computing device. In this way, the user of the client computing device and/or the administrator may be notified of any violations of the security policy. Moreover, solutions for placing the item of information in compliance with the security policy may be provided as part of the log, report and/or notification.
In a further embodiment, the security compliance search engine may be distributed from a server to client computing devices such that the security compliance search engine is run on the client computing device and results are provided back to a server for logging and reporting. In such an embodiment, the security search rules may be provided to the client computing devices such that these rules are applied by the client-based security compliance search engine in searching the client computing device upon which the client-based security compliance search engine runs. Because these security search rules may be updated from time to time, the client-based security compliance search engine may periodically communicate with the server to download the most recent updates to the security search rules.
Results of the security search of the client computing device may be returned to the server which may then apply the security policies to these search results as discussed previously. Alternatively, in a similar manner as the security search rules, the security policies may be downloaded to the client computing devices such that the application of the security policies to the results of the security search may be performed on the client computing device. Results of the application of the security policies to the results of the security search may be logged and maintained in the server and/or the client computing device and may be reported to the user of the client computing device and/or an administrator in a similar manner as previously discussed.
In one illustrative embodiment, a method is provided for searching a client computing device to identify items of information containing confidential information. The method may comprise retrieving one or more security search rules setting forth one or more security criteria for identifying items of information that contain confidential information and performing a security search of a client computing device to identify at least one item of information meeting the one or more security criteria. Search results of the security search may be retrieved and analyzed to determine if the at least one item of information meets security policy compliance requirements. A report may be generated based on results of the analysis of the search results. The security policy compliance requirements may identify requirements for maintaining items of information that contain confidential information in a confidential state.
The one or more security criteria may comprise a particular character strings indicative of confidential information, data flags indicative of confidential information, particular parameters associated with items of information indicative of confidential information, file system settings associated with items of information indicative of confidential information, file usage patterns indicative of confidential information, and/or file name patterns indicative of confidential information. The item of information may be an electronic mail, an electronic file, and electronic objects in an object oriented environment, an electronic document, an electronic image, or the like.
The data processing system in which the method is implemented may be a server computing device. In such an embodiment, the security search may be performed on a plurality of client computing devices associated with the server computing device. With this embodiment, the method may further comprise retrieving information from a client computing device database identifying one or more client computing devices on which to perform the security search. Alternatively, the data processing system in which the method is implemented may be a client computing device.
Performing the security search of a client computing device to identify at least one item of information meeting the one or more security criteria may comprise installing a client agent on the client computing device and executing the client agent on the client computing device. The client agent may use the retrieved one or more security rules to perform the security search of the client computing device.
Retrieving the search results of the security search may include gathering characteristic information associated with the at least one item of information. The characteristic information may include an identity of the at least one item of information, the search criteria met by the at least one item of information, and/or information identifying a protection mechanism currently applied to the at least one item of information. In such an embodiment, analyzing the search results to determine if the at least one item of information meets security policy compliance requirements may comprise identifying one or more security policies in a security policy database that are to be applied to the at least one item of information, based on the characteristic information gathered for the at least one item of information.
Generating the report based on results of the analysis of the search results may comprise providing a notification to the client computing device indicating a violation of the security policy compliance requirements. The notification may further include an indication of a solution for placing the at least one item of information in compliance with the security policy compliance requirements.
In addition to the above, the illustrative embodiments provide a computer program product comprising a computer useable medium having a computer readable program. The computer readable program, when executed on a computing device, causes the computing device to perform the method previously described above.
Moreover, the illustrative embodiments further provide a system for searching a client computing device to identify items of information containing confidential information. The system may comprise a processor, a memory coupled to the processor, and a storage device coupled to the processor. The memory may comprise executable instructions which, when executed by the processor, cause the processor to perform the method previously described above.
These and other features and advantages of the present invention will be described in, or will become apparent to those of ordinary skill in the art in view of, the following detailed description of the exemplary embodiments of the present invention.
The novel features believed characteristic of the invention are set forth in the appended claims. The invention itself, however, as well as a preferred mode of use, further objectives and advantages thereof, will best be understood by reference to the following detailed description of an illustrative embodiment when read in conjunction with the accompanying drawings, wherein:
The illustrative embodiments of the present invention provide mechanisms for ensuring compliance of client computing devices in the maintaining of items of information that contain confidential content. As such, the mechanisms of the illustrative embodiments are especially well suited for implementation in a distributed data processing system having a plurality of computing devices that communicate with one another by way of one or more networks. The following
With reference now to the figures,
In the depicted example, server 104 is connected to network 102 along with storage unit 106. In addition, clients 108, 110, and 112 are connected to network 102. These clients 108, 110, and 112 may be, for example, personal computers or network computers. In the depicted example, server 104 provides data, such as boot files, operating system images, and applications to clients 108-112. Clients 108, 110, and 112 are clients to server 104. Network data processing system 100 may include additional servers, clients, and other devices not shown. In the depicted example, network data processing system 100 is the Internet with network 102 representing a worldwide collection of networks and gateways that use the Transmission Control Protocol/Internet Protocol (TCP/IP) suite of protocols to communicate with one another. At the heart of the Internet is a backbone of high-speed data communication lines between major nodes or host computers, consisting of thousands of commercial, government, educational and other computer systems that route data and messages. Of course, network data processing system 100 also may be implemented as a number of different types of networks, such as for example, an intranet, a local area network (LAN), or a wide area network (WAN).
Referring to
Peripheral component interconnect (PCI) bus bridge 214 connected to I/O bus 212 provides an interface to PCI local bus 216. A number of modems may be connected to PCI local bus 216. Typical PCI bus implementations will support four PCI expansion slots or add-in connectors. Communications links to clients 108-112 in
Additional PCI bus bridges 222 and 224 provide interfaces for additional PCI local buses 226 and 228, from which additional modems or network adapters may be supported. In this manner, data processing system 200 allows connections to multiple network computers. A memory-mapped graphics adapter 230 and hard disk 232 may also be connected to I/O bus 212 as depicted, either directly or indirectly.
Those of ordinary skill in the art will appreciate that the hardware depicted in
The data processing system depicted in
With reference now to
In the depicted example, local area network (LAN) adapter 310, small computer system interface (SCSI) host bus adapter 312, and expansion bus interface 314 are connected to PCI local bus 306 by direct component connection. In contrast, audio adapter 316, graphics adapter 318, and audio/video adapter 319 are connected to PCI local bus 306 by add-in boards inserted into expansion slots. Expansion bus interface 314 provides a connection for a keyboard and mouse adapter 320, modem 322, and additional memory 324. SCSI host bus adapter 312 provides a connection for hard disk drive 326, tape drive 328, and CD-ROM drive 330. Typical PCI local bus implementations will support three or four PCI expansion slots or add-in connectors.
An operating system runs on processor 302 and is used to coordinate and provide control of various components within data processing system 300 in
Those of ordinary skill in the art will appreciate that the hardware in
As another example, data processing system 300 may be a stand-alone system configured to be bootable without relying on some type of network communication interfaces As a further example, data processing system 300 may be a personal digital assistant (PDA) device, which is configured with ROM and/or flash ROM in order to provide non-volatile memory for storing operating system files and/or user-generated data.
The depicted example in
With reference again to
The security compliance search engine uses a set of security search rules for determining how to locate and rate items of information that contain confidential information. The security search rules may be maintained on the server 104 or in a separate storage system, such as storage system 106 in
The security compliance search engine, on server 104 for example, may remotely administer searches of client computing devices 108-112. The security compliance search engine may make use of a client computing device database, which may be stored on the server or another storage system such as storage system 106, to retrieve information about the client computing devices 108-112 that are to be searched using the mechanisms of the security compliance search engine.
In remotely administering searches of client computing devices 108-112, the security compliance search engine may download or transfer a client agent to the client computing devices 108-112 which runs the client agent to collect information from the client computing device 108-112 and provide the information back to the server 104. For example, the client agent may collect information about the items of information present on the client computing device and provide this information, in a secure manner, back to the server for analysis using the security search rules. Alternatively, the client agent may actually perform the search of the items of information on the client computing device 108-112 using the security search rules present on the server 104.
For items of information meeting one or more criteria set forth in the security search rules, characteristic information may be gathered about these items of information. This characteristic information may comprise, for example, identification of the item of information, the criteria met by the item of information, characteristic information about the item of information, information identifying the protection mechanisms currently applied to the item of information on the client computing device, and the like. This characteristic information may be used by the security compliance search engine to determine if the item of information is being maintained in accordance with established security policies.
The security compliance search engine may use the characteristic information gathered about the item of information to identify one or more security policies in a security policy database, which may also be stored on the server 104 or a separate storage system such as storage system 106, that apply to that item of information. The one or more security policies may then be applied to the characteristic information gathered about the item of information to determine if the item of information is being maintained in compliance with applicable security policies. Results of the application of the one or more security policies may be logged and maintained in the client computing device database, for example. In addition, the results may be used to generate reports and notifications that are sent to the client computing device 108-112 and/or an administrator's computing device. In this way, the user of the client computing device 108-112 and/or the administrator may be notified of any violations of the security policy by items of information maintained on the client computing device 108-112. Moreover, solutions for placing the item of information in compliance with the security policy may be provided as part of the log, report and/or notification.
In a further embodiment, the security compliance search engine may be distributed from the server 104 to the client computing devices 108-112 such that the security compliance search engine is run on the client computing device 108-112 and results are provided back to the server 104 for logging and reporting. In such an embodiment, the security search rules may be provided to the client computing devices 108-112 such that these rules are applied by the client-based security compliance search engine in searching the client computing device 108-112 upon which the client-based security compliance search engine runs. Because these security search rules may be updated from time to time, the client-based security compliance search engine may periodically communicate with the server 104 to download the most recent updates to the security search rules to the client computing devices 108-112.
Results of the security search of the client computing device 108-112 may be returned to the server 104 which may then apply the security policies to these search results as discussed previously. Alternatively, in a similar manner as the security search rules, the security policies may be downloaded to the client computing devices 108-112 such that the application of the security policies to the results of the security search may be performed on the client computing device 108-112. Results of the application of the security policies to the results of the security search may be logged and maintained in the server 104 and/or the client computing device 108-112 and may be reported to the user of the client computing device 108-112 and/or an administrator in a similar manner as previously discussed.
The security compliance search engine may be run on the client computing devices 108-112 in accordance with a schedule established by a user of the client computing device 108-112. The schedule is preferably established such that the security search is performed at a time when such a security search will not interfere with normal operation of the client computing device 108-112 by a user. Alternatively, the security compliance search engine may include a module for monitoring the current activity of the client computing device 108-112 and may initiate the security search at a time of detected inactivity of the client computing device 108-112. For example, if the client computing device 108-112 enters a sleep state, e.g., such as when a screensaver is initiated, or the user logs-out of the client computing device 108-112 but leaves the client computing device 108-112 running, the security compliance search engine may initiate a security search of the client computing device 108-112.
In addition, in order to ensure that the security compliance search engine is run periodically on the client computing devices 108-112, the server 104 may maintain information in the client computing device database identifying a last time that the security compliance search engine was run on each client computing device 108-112. The server 104 may remotely initiate the running of the security compliance search engine on the client computing device 108-112 when the elapsed time from the last time the security compliance search engine was run on that client computing device 108-112 exceeds a predetermined threshold.
As mentioned above, the security compliance search engine makes use of security search rules that govern the manner by which the security compliance search engine identifies items of information that contain confidential information. These items of information may be, for example, electronic documents, electronic images, electronic files, compilations of data, objects in an object oriented environment, or other units of data. Security search rules may be established for various types of items of information, e.g., various file formats such as Microsoft Word™ documents, Adobe Acrobat™ documents, JPEG image files, bitmap image files, Freelance Graphics™ files, Microsoft PowerPoint™ files, Microsoft Excel™ files, and the like. Security search rules may be established for identifying particular filename patterns indicative of confidential information being contained in the files, e.g., a filename with the string “secret,” “confidential,” “_c,” “_s,” or the like.
The security search rules may further designate text strings to be looked for in the actual content of the item of information. Thus, for example, a security search rule may look into the content of an electronic document to determine if the electronic document includes the word “confidential” as a title item in the electronic document, includes a text string “SSN:” indicative of a person's social security number, or the like. Other security search rules may be established for identifying, either in the content of the items of information, in the filenames of the items of information, meta-information describing the item of information, or the like, indicators of confidentiality of the item of information. The particular security search rules that are used will depend upon the particular implementation of the illustrative embodiments according to the particular interests and concerns of the individual or organization using the illustrative embodiments of the present invention.
The security search rules, as applied by the security compliance search engine, provide a mechanism for identifying those items of information on a client computing device that contain confidential information. Having identified those items of information, the security compliance search engine uses security policies to determine if the manner by which those items of information are being maintained meets with the security policies established by the individual or organization. In order to make such a determination, characteristic information regarding the items of information may be obtained from the client computing device and used with the security policies to determine if the item of information is being maintained in accordance with the security policies. This characteristic information may include, for example, a path to access the item of information, file system settings associated with the item of information (e.g., is the file a hidden file), archive settings for the item of information, whether the item of information is behind a firewall, whether the item of information is only accessible through a password mechanism, and the like. Security policies may be applied to such characteristic information to see if the security policies are met or not met by the particular manner in which the item of information is maintained on the client computing device.
For example, a security policy may be that all items of information that contain confidential information must be maintained in client computing devices in an encrypted format. If, during the security search, an item of information containing confidential information is identified, and the characteristic information obtained from the client computing device 108-112 indicates that the item of information is not encrypted, the client computing device 108-112 is determined to be maintaining the item of information in violation of the security policy. The security policy may further dictate, for example, that any items of information found to be in violation of the security policy must be viewed by the user of the client computing device no later than a specified number of days from a date of the security search or that the items of information must be viewed by the user by a certain time. In such a case, such items of information may be automatically deleted after viewing by the user, e.g., in the case of electronic mail items having confidential content.
As a result, the violation may be logged and a report sent to the user of the client computing device 108-112 and/or an administrator or other security monitor's computing device. This report may designate the security policy that has been violated, the item of information that has been determined to be in violation of the security policy, and may provide information as to how the user of the client computing device 108-112 may bring his client computing device 108-112 back into compliance with security policies with regard to the identified item of information. Other information may also be provided in the report in addition to, or in replacement of, the information noted above.
Thus, the illustrative embodiments of the present invention provide mechanisms for searching a client computing device for items of information that contain confidential information and obtaining characteristic information regarding the manner by which the item of information is being maintained in the client computing device. The illustrative embodiments further provide mechanisms for determining whether the manner by which the item of information is being maintained in the client computing device violates any established security policies. The illustrative embodiments also provide mechanisms for reporting security policy violations and providing information regarding how to bring client computing devices back into compliance with the established security policies.
The SCSE 414 obtains, from the security search rules database 418 security search rules for searching the client computing device 430 for items of information containing confidential content. The SCSE 414 obtains, from security policy database 416, security policies for application to results of a security search of the client computing device 430. These databases 416 and 418 may be regularly updated so as to maintain current the items of interest for security searches of client computing devices.
The SCSE 414 obtains client computing device information from client computing device database 420. This client computing device information may include, for example, network identifiers of the client computing devices, addresses, etc. for identifying the client computing devices that may be the subject of a security search in accordance with the illustrative embodiments. The client computing device database 420 may serve as storage for results of a security search and/or application of security policies to results of a security search.
The SCSE 414 communicates with the client computing device 430, using known network communication protocols, to perform a search of an information storage 434 of the client computing device 430. The information storage 434 may store many different types of items of information including electronic mail messages, instant messages, electronic files, electronic documents, electronic images, or other compilations of data. The information storage 434 may be an actual physical storage device, a plurality of physical storage devices, a portion of a physical storage device, a memory, or the like.
The SCSE 414 applies the security search rules obtained from the security search rules database 418 to the items of information maintained in the information storage 434 to thereby identify items of information in the information storage 434 that contain confidential information. Characteristic information regarding those items of information in the information storage 434 meeting one or more criteria set forth in one or more security search rules is retrieved from the client computing device 430 by the SCSE 414. The characteristic information may be stored in the client computing device database 420 for use with the security policies in determining whether the client computing device 430 is in compliance with current security policy.
The SCSE 414 may apply the security policies obtained from the security policy database 416 to the characteristic information retrieved from the client computing device 430 and generate results indicative of whether one or more of the security policies are violated by the manner in which the client computing device 430 is maintaining one or more items of information in the information storage 434. Information regarding any detected violations may be stored in correlation with entries in the client computing device database for the client computing device 430. These violations may also be notified to the SCSE 414 which may in turn notify the log/report generation engine 412.
The SCSE 414, for identified violations of security policies, may access security policy database 416 to identify suggested solutions for bringing the client computing device 430 into compliance with the established security policy. For example, an identifier of the security policy or policies violated by an item of information may be used to lookup a suggested solution in a data structure of the security policy database 416. This suggested solution information may be provided to the log/report generation engine 412 for use in generating logs and/or reports of the identified violations.
The log/report generation engine 412 may access the client computing device database 420 and/or receive notifications from the SCSE 414 in order to identify violations of security policy. In addition, the log/report generation engine 412 may obtain suggested solutions for identified violations from the SCSE 414 and/or the client computing device database 420. The log/report generation engine 412 generates logs and/or reports which may then be communicated to the client computing device 430 for display to a user of the client computing device 430. The logs and/or reports may also be provided to a security administrator computing device 450 so that a security administrator may be informed of violations occurring in system of client computing devices, including client computing device 430.
As mentioned previously, in some illustrative embodiments, the SCSE 414, a client agent of the SCSE 414, the security policies and security search rules may be downloaded to the client computing device 430, e.g., as SCSE/client agent 432. In such embodiments, the SCSE 414, or portions of the SCSE 414 may executed on the client computing device 414. In
The security policy application module is responsible for applying security policies obtained from the security policy database 416 to the characteristic information collected by the characteristic information collection module 530 for items of information identified by the security search rules application module 520. The results generation module 550 is responsible for generating results of the application of the security policies to the characteristic information by the security policy application module 540. The results may be provided to the client computing device database 420 and/or to the log/report generation engine 412.
Accordingly, blocks of the flowchart illustration support combinations of means for performing the specified functions, combinations of steps for performing the specified functions and program instruction means for performing the specified functions. It will also be understood that each block of the flowchart illustration, and combinations of blocks in the flowchart illustration, can be implemented by special purpose hardware-based computer systems which perform the specified functions or steps, or by combinations of special purpose hardware and computer instructions.
As shown in
The characteristic information is the compared to security policies to identify violations of the security policies, if any (step 670). The client computing device database entries may then be updated based on identified violations (step 680). Logs/reports of the violations may be generated and transmitted to the client computing device and/or a security monitoring computing device (step 690) and the operation terminates.
Thus, the present invention provides a mechanism for searching a client computing device for items of information that contain confidential content. Based on the results of the search, security policies may be applied to determine if the items of information that contain confidential content are being maintained on the client computing devices in accordance with established security policies. Any violations identified may be reported to a security monitor and/or to the user of the client computing device along with suggested solutions for bringing the client computing device into compliance with the established security policies. In this way, breaches of security policy may be quickly and easily identified in a network of client computing devices and solutions offered for ensuring the confidentiality of items of information containing confidential content.
It is important to note that while the present invention has been described in the context of a fully functioning data processing system, those of ordinary skill in the art will appreciate that the processes of the present invention are capable of being distributed in the form of a computer readable medium of instructions and a variety of forms and that the present invention applies equally regardless of the particular type of signal bearing media actually used to carry out the distribution. Examples of computer readable media include recordable-type media, such as a floppy disk, a hard disk drive, a RAM, CD-ROMs, DVD-ROMs, and transmission-type media, such as digital and analog communications links, wired or wireless communications links using transmission forms, such as, for example, radio frequency and light wave transmissions. The computer readable media may take the form of coded formats that are decoded for actual use in a particular data processing system.
The description of the present invention has been presented for purposes of illustration and description, and is not intended to be exhaustive or limited to the invention in the form disclosed. Many modifications and variations will be apparent to those of ordinary skill in the art. The embodiment was chosen and described in order to best explain the principles of the invention, the practical application, and to enable others of ordinary skill in the art to understand the invention for various embodiments with various modifications as are suited to the particular use contemplated.
| Number | Date | Country | |
|---|---|---|---|
| Parent | 11336224 | Jan 2006 | US |
| Child | 12130148 | US |
