US20140189349A1 - Decrypting Files for Data Leakage Protection in an Enterprise Network - Google Patents
Decrypting Files for Data Leakage Protection in an Enterprise Network Download PDFInfo
- Publication number
- US20140189349A1 US20140189349A1 US14/142,155 US201314142155A US2014189349A1 US 20140189349 A1 US20140189349 A1 US 20140189349A1 US 201314142155 A US201314142155 A US 201314142155A US 2014189349 A1 US2014189349 A1 US 2014189349A1
- Authority
- US
- United States
- Prior art keywords
- password
- logic
- encrypted file
- decrypting
- meta data
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Abandoned
Links
- 238000000034 method Methods 0.000 claims abstract description 67
- 238000012544 monitoring process Methods 0.000 claims description 10
- 238000004590 computer program Methods 0.000 description 11
- 238000010586 diagram Methods 0.000 description 11
- 230000008901 benefit Effects 0.000 description 10
- 230000008569 process Effects 0.000 description 9
- 230000006870 function Effects 0.000 description 8
- 238000012545 processing Methods 0.000 description 5
- 238000004891 communication Methods 0.000 description 4
- 230000007246 mechanism Effects 0.000 description 4
- 230000003287 optical effect Effects 0.000 description 4
- 239000013307 optical fiber Substances 0.000 description 2
- 230000009471 action Effects 0.000 description 1
- 238000013459 approach Methods 0.000 description 1
- 230000005540 biological transmission Effects 0.000 description 1
- 238000007796 conventional method Methods 0.000 description 1
- 238000004519 manufacturing process Methods 0.000 description 1
- 238000012986 modification Methods 0.000 description 1
- 230000004048 modification Effects 0.000 description 1
- 230000002093 peripheral effect Effects 0.000 description 1
- 230000002265 prevention Effects 0.000 description 1
- 230000000644 propagated effect Effects 0.000 description 1
- 239000004065 semiconductor Substances 0.000 description 1
- 238000012546 transfer Methods 0.000 description 1
Images
Classifications
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
- G06F21/60—Protecting data
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F16/00—Information retrieval; Database structures therefor; File system structures therefor
- G06F16/10—File systems; File servers
- G06F16/13—File access structures, e.g. distributed indices
- G06F16/137—Hash-based
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F16/00—Information retrieval; Database structures therefor; File system structures therefor
- G06F16/10—File systems; File servers
- G06F16/16—File or folder operations, e.g. details of user interfaces specifically adapted to file systems
- G06F16/162—Delete operations
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F16/00—Information retrieval; Database structures therefor; File system structures therefor
- G06F16/10—File systems; File servers
- G06F16/17—Details of further file system functions
- G06F16/174—Redundancy elimination performed by the file system
- G06F16/1748—De-duplication implemented within the file system, e.g. based on file segments
- G06F16/1756—De-duplication implemented within the file system, e.g. based on file segments based on delta files
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F16/00—Information retrieval; Database structures therefor; File system structures therefor
- G06F16/10—File systems; File servers
- G06F16/18—File system types
- G06F16/182—Distributed file systems
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F16/00—Information retrieval; Database structures therefor; File system structures therefor
- G06F16/20—Information retrieval; Database structures therefor; File system structures therefor of structured data, e.g. relational data
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
- G06F21/10—Protecting distributed programs or content, e.g. vending or licensing of copyrighted material ; Digital rights management [DRM]
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
- G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
- G06F21/60—Protecting data
- G06F21/606—Protecting data by securing the transmission between two devices or processes
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/02—Network architectures or network communication protocols for network security for separating internal from external traffic, e.g. firewalls
- H04L63/0227—Filtering policies
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/04—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks
- H04L63/0428—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks wherein the data content is protected, e.g. by encrypting or encapsulating the payload
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
- H04L63/1408—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic by monitoring network traffic
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F11/00—Error detection; Error correction; Monitoring
- G06F11/07—Responding to the occurrence of a fault, e.g. fault tolerance
- G06F11/14—Error detection or correction of the data by redundancy in operation
- G06F11/1402—Saving, restoring, recovering or retrying
- G06F11/1446—Point-in-time backing up or restoration of persistent data
- G06F11/1458—Management of the backup or restore process
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F16/00—Information retrieval; Database structures therefor; File system structures therefor
- G06F16/10—File systems; File servers
- G06F16/18—File system types
- G06F16/1873—Versioning file systems, temporal file systems, e.g. file system supporting different historic versions of files
Definitions
- DLP data leakage protection
- Another aspect of the claimed subject matter is to provide techniques for creating a short list of collected passwords in contrast with a dictionary for use in a brute-force attack to thereby solve a problem, that is, passwords which are conceivable by business users and adapted for use in encryption within an enterprise network are relatively scarce.
- a DLP checkup conducted with a password list created in accordance with the claimed subject matter takes less time than one e conducted with a dictionary according to the prior art; hence, the claimed subject matter shortens the duration of service interruption and thus enables a real-time DLP checkup.
- Yet another aspect of the claimed subject matter is to provide techniques whereby passwords entered by users are efficiently identified by monitoring a specific application (such as 7-Zip or Microsoft Word) executed at a terminal within an enterprise network and a file encryption procedure performed by means of the application.
- a specific application such as 7-Zip or Microsoft Word
- the techniques of the claimed subject matter dispense with the hassle of monitoring all the operations performed or data entered by users at the terminal all the time.
- the techniques of the claimed subject matter not only prevent privacy infringement, but also reduce the required system resources greatly.
- the techniques of the claimed subject matter provides, in an embodiment thereof, techniques for collecting decrypting passwords for encrypted files within an enterprise network.
- the techniques comprise:
- the claimed subject matter provides, in another embodiment thereof, techniques for decrypting an encrypted file within an enterprise network.
- the techniques comprise:
- the claimed subject matter provides, in another embodiment thereof, techniques for decrypting an encrypted file within an enterprise network.
- the techniques comprise;
- the claimed subject matter further provides, in yet another embodiment thereof, an apparatus and a computer-readable medium or a computer program product for implementing the aforesaid techniques.
- FIG. 1 is schematic view of an enterprise network according to a specific embodiment of the claimed subject matter
- FIG. 2 is a flow chart of a method of collecting passwords according to a specific embodiment of the claimed subject matter
- FIG. 3 shows a password table PT according to a specific embodiment of the claimed subject matter.
- FIG. 4 is a flow chart of a method of attempting to decrypt according to as specific embodiment of the claimed subject matter.
- the claimed subject matter may be embodied as an apparatus, a method or a computer program product. Accordingly, the claimed subject matter may take the form of an entirely hardware embodiment, an entirely software embodiment (including firmware, resident software, micro-code, etc.) or an embodiment combining software and hardware aspects that may all generally be referred to herein as a “circuit,” “module” or “system.” Furthermore, the claimed subject matter may take the form of a computer program product embodied in any tangible medium of expression having computer-usable program code embodied in the medium.
- the computer-usable or computer-readable medium may be, for example but not limited to, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, device, or propagation medium.
- the computer-readable medium would include the following: an electrical connection having one or more wires, a portable computer diskette, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or Flash memory), an optical fiber, a portable compact disc read-only memory (CD-ROM), an optical storage device, a transmission media such as those supporting the Internet or an intranet, or a magnetic storage device.
- RAM random access memory
- ROM read-only memory
- EPROM or Flash memory erasable programmable read-only memory
- CD-ROM compact disc read-only memory
- CD-ROM compact disc read-only memory
- a transmission media such as those supporting the Internet or an intranet, or a magnetic storage device.
- a computer-usable or computer-readable medium could even be paper or another suitable medium upon which the program is printed, as the program can be electronically captured, via, for instance, optical scanning of the paper or other medium, then compiled, interpreted, or otherwise processed in a suitable manner, if necessary, and then stored in a computer memory.
- a computer-usable or computer-readable medium may be any medium that can contain, store, communicate, propagate, or transport the program for use by or in connection with the instruction execution system, apparatus, or device.
- the computer-usable medium may include a propagated data signal with the computer-usable program code embodied therewith, either in baseband or as part of a carrier wave.
- the computer usable program code may be transmitted using any appropriate medium, including but not limited to wireless, wireline, optical fiber cable, RF, etc.
- Computer program code for carrying out operations of the claimed subject matter may be written in any combination of one or more programming languages, including an object oriented programming language such as Java, Smalltalk C++ or the like and conventional procedural programming languages, such as the “C” programming language or similar programming languages.
- the program code may execute entirely on the user's computer, partly on the user's computer, as a stand-alone software package, partly on the user's computer and partly on to remote computer or entirely on the remote computer or server.
- the remote computer or server may be connected to the user's computer through any type of network, including a local area network (LAN) or a wide area network (WAN), or the connection may be made to an external computer (for example, through the Internet using an Internet Service Provider).
- LAN local area network
- WAN wide area network
- Internet Service Provider for example, AT&T, MCI, Sprint, EarthLink, MSN, GTE, etc.
- These computer program instructions may also be stored in a computer-readable medium that can direct a computer or other programmable data processing apparatus to function in a particular manner, such that the instructions stored in the computer-readable medium produce an article of manufacture including instruction means which implement the function/act specified in the flowchart and/or block diagram block or blocks.
- the computer program instructions may also be loaded onto a computer or other programmable, data processing apparatus to cause a series of operational steps to be performed on the computer or other programmable apparatus to produce a computer implemented process such that the instructions which execute on the computer or other programmable apparatus provide processes for implementing the functions/acts specified in the flowchart and/or block diagram block or blocks.
- each block in the flowchart or block diagrams may represent a module, segment, or portion of code, which comprises one or more executable instructions for implementing the specified logical function(s). It should also be noted that, in some alternative implementations, the functions noted in the block may occur out of the order noted in the figures.
- the enterprise network 10 comprises a terminal 20 , a password collecting module 30 , and a data leakage protection (DLP) module 40 .
- Terminal 20 is provided in the form of a personal mobile device (for example, iPhone or iPad of Apple Inc.) or a personal computer and adapted to communicate (for example, file transfer or sending emails) with an extranet 50 outside the enterprise network 10 .
- a personal mobile device for example, iPhone or iPad of Apple Inc.
- a personal computer for example, a personal computer and adapted to communicate (for example, file transfer or sending emails) with an extranet 50 outside the enterprise network 10 .
- FIG. 1 persons skilled in the art understand that the claimed subject matter does not set forth a limit to the quantity of terminal 20 .
- password collecting module 30 and DLP module 40 are further illustrated with FIG. 2 through FIG. 4 .
- enterprise network 19 provides an existing protection mechanism (not shown) pertaining to data leakage or data security with respect to the communication of terminal 20 and extranet 50 .
- existing protection mechanism (not shown) pertaining to data leakage or data security with respect to the communication of terminal 20 and extranet 50 .
- the methods and the apparatus of the claimed subject matter can be integrated into the existing protection mechanism, especially next-generation firewalls.
- Password collecting module 30 is preferably provided in the form of software, for example, in the form of a daemon operating on terminal 20 ; the claimed subject matter is not restrictive thereof, as password collecting module 30 of the claimed subject matter can also be provided in the form of standalone hardware, such as an apparatus. Referring to FIG. 2 , there is shown a flow chart of a method of collecting passwords according to a specific embodiment of the claimed subject matter, wherein password collecting module 30 , provided in the form of a daemon, collects passwords.
- password collecting module 30 communicates with the operating system (for example, the task manager in the Windows operating system) of terminal 20 , so as to be informed of any application to be executed on the terminal 20 .
- the operating system for example, the task manager in the Windows operating system
- password collecting module 30 is capable of detecting a processing process of the application or an action of a graphical user interface (GUI) object to thereby determine a procedure currently being performed by the application.
- GUI graphical user interface
- an application When performing a file encryption procedure, an application typically provides a specific user interface message or prompt and requests the user to enter a password. Hence, password collecting module 30 detects the specific user interface message or prompt to thereby determine a file encryption procedure currently being executed by the application.
- password collecting module 30 not only identifies passwords, but also identifies meta data related to the passwords, including, but not limited to, time and date of file encryption, application name, encrypted file format (such as a filename extension), hash value of an encrypted file, and a user ID for use in the login of the application.
- Password collecting module 30 sends the meta data and the passwords together to DLP module 40 , such that the meta data and the passwords are stored in the password table PT, as shown in FIG. 3 . Further details are describe below.
- Terminal 20 , password collecting module 30 , and DLP module 40 are disposed in enterprise network 10 and communicate with each other via the network-based connection, including a fixed LAN or WAN, or any means of connection other than wired connection and wireless connection, provided by enterprise network 10 .
- DLP module 40 is preferably provided in the form of an apparatus and integrated into an existing access point, router, switch, gateway, firewall device, proxy, or intrusion prevention system (IPS) device, for example.
- IPS intrusion prevention system
- DLP module 40 provided in the form of an apparatus comprises a memory 42 and a processor 44 .
- Memory 42 is a computer magnetic disk, hard disk drive, random-access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), compact disk, optical storage device, or magnetic storage device.
- Memory 42 stores a program code and, for example, the password table PT shown in FIG. 3 .
- Processor 44 accesses the program code and the password table PT from memory 42 to thereby execute a predetermined program, as illustrated with FIG. 4 .
- FIG. 1 varies from embodiment to embodiment.
- intrinsic hardware or peripheral devices such as flash read-only memory (flash ROM), equivalent non-volatile memory, or CD-ROM can be included in or can substitute for the hardware illustrate with FIG. 1 .
- a plugin module for use with the application operates on terminal 20 .
- a plugin module for use with the application operates on terminal 20 .
- FIG. 4 there is shown a flow chart of a method of attempting by DLP module 40 to decrypt according to a specific embodiment of the claimed subject matter.
- the embodiment described hereunder is merely intended for a single encrypted file of a single terminal 20 , but persons skilled in the art understand that it is feasible for DLP module 40 to perform the process flow (depicted in FIG. 4 ) on different files at different terminals 20 simultaneously or different files at the same terminal 20 .
- DLP module 40 will further tidy up and sort the password table PT.
- the password table PT in the embodiment illustrated with FIG. 3 is sorted according to the time and date of file encryption.
- DLP module 40 calculates the number of instances of use of each password and adds it to a related field in the password table PT.
- DLP module 40 sorts the password table PT according to the number of instances of use, application name, file format, hash value, or user ID. The sorting result functions as the basis of priority given to a decryption attempt.
- DLP module 40 calculates the degree of match between an encrypted file and each password according to a comparison of meta data of the encrypted file and meta data of each password collected by password collecting module 30 , so as to determine the priority given to a decryption attempt. DLP module 40 determines the way of calculating the degree of match as needed, or adjusts the weight assigned to each item in the meta data for the purpose of calculating the degree of match, of which the claimed subject matter is not restrictive. For instance, DLP module 40 may assign a greater weight to file format than to user ID in calculating the degree of match.
Abstract
A method of decrypting an encrypted file within an enterprise network is provided. The method includes identifying by a password collecting module a password entered during a file encryption procedure performed at a terminal and storing the password; receiving an encrypted file by a data leakage protection (DLP) module; and attempting to decrypt the encrypted file with the password by the DLP module.
Description
- The claimed subject matter relates to enterprise data leakage protection (DLP), and more particularly, to decrypting encrypted files in order to provide data leakage protection (DLP).
- To ensure that confidential data will not leak out through a means of electronic communication, for example, the Internet, enterprises use a data leakage protection (DLP) mechanism to check for confidential data in their outbound communication contents. See Check Point DLP Software Blade produced by Check Point Software Technologies Ltd.
- To conduct the DLP checkup thoroughly, it is necessary to decrypt encrypted files whenever the encrypted files are discovered in communication contents. Related prior art discloses attempting to decrypt encrypted files by a brute-three attack, though this approach is conceivably time-consuming. Furthermore, US Pub. 2012/0216046 discloses parsing text contents of emails to create a dictionary required for a brute-force attack.
- It is an aspect of the claimed subject matter to provide techniques for collecting in advance passwords entered during a file encryption procedure performed at a terminal within an enterprise network, storing the passwords collected, creating a password list, and attempting to decrypt according to the password list whenever it is necessary to decrypt encrypted files, so as to perform a DLP checkup within the enterprise network.
- Most of the encrypted files to be sent out of an enterprise network have already undergone a file encryption procedure performed at a terminal within the enterprise network. Hence, the aforesaid techniques enhance the accuracy of passwords greatly and dispenses with the hassle of attempting to decrypt indiscriminately by a brute-force attack.
- Another aspect of the claimed subject matter is to provide techniques for creating a short list of collected passwords in contrast with a dictionary for use in a brute-force attack to thereby solve a problem, that is, passwords which are conceivable by business users and adapted for use in encryption within an enterprise network are relatively scarce. Conceivably, in the course of attempting to decrypt, a DLP checkup conducted with a password list created in accordance with the claimed subject matter takes less time than one e conducted with a dictionary according to the prior art; hence, the claimed subject matter shortens the duration of service interruption and thus enables a real-time DLP checkup.
- Yet another aspect of the claimed subject matter is to provide techniques whereby passwords entered by users are efficiently identified by monitoring a specific application (such as 7-Zip or Microsoft Word) executed at a terminal within an enterprise network and a file encryption procedure performed by means of the application. In so doing, the techniques of the claimed subject matter dispense with the hassle of monitoring all the operations performed or data entered by users at the terminal all the time. Hence, the techniques of the claimed subject matter not only prevent privacy infringement, but also reduce the required system resources greatly.
- The techniques of the claimed subject matter provides, in an embodiment thereof, techniques for collecting decrypting passwords for encrypted files within an enterprise network. The techniques comprise:
-
- monitoring an application executed at a terminal;
- monitoring a procedure performed with a predetermined application executed at the terminal; and
- identifying a password entered by users for a file encryption procedure performed with the predetermined application.
- The claimed subject matter provides, in another embodiment thereof, techniques for decrypting an encrypted file within an enterprise network. The techniques comprise:
-
- receiving an encrypted file from a terminal; and
- attempting to decrypt the encrypted file with the decrypting passwords obtained by the method of collecting decrypting passwords for encrypted files within an enterprise network.
- The claimed subject matter provides, in another embodiment thereof, techniques for decrypting an encrypted file within an enterprise network. The techniques comprise;
-
- identifying by a password collecting module a first password entered during a first file encryption procedure performed at a terminal, and storing the first password;
- receiving an encrypted file by a data leakage protection (DLP) module; and
- attempting to decrypt the encrypted file with the first password by the DLP module.
- The claimed subject matter further provides, in yet another embodiment thereof, an apparatus and a computer-readable medium or a computer program product for implementing the aforesaid techniques.
- Reference throughout this specification to features, advantages, or similar language does not imply that all of the features and advantages that may be realized with the claimed subject matter should be or are in any single embodiment of the claimed subject matter. Rather, language referring to the features and advantages is understood to mean that a specific feature, advantage, or characteristic described in connection with an embodiment is included in at least one embodiment of the claimed subject matter. Thus, discussion of the features and advantages, and similar language, throughout this specification may, but do not necessarily, refer to the same embodiment.
- Furthermore, the described features, advantages, and characteristics of the claimed subject matter may be combined in any suitable manner in one or more embodiments. One skilled in the relevant art will recognize that the claimed subject matter may be practiced without one or more of the specific features or advantages of a particular embodiment. In other instances, additional features and advantages may be recognized in certain embodiments that may not be present in all embodiments of the claimed subject matter.
- The following description, the appended claims, and the embodiments of the claimed subject matter further illustrate the features and advantages of the claimed subject matter.
- In order that the advantages of the claimed subject matter will be readily understood, a more particular description of the claimed subject matter briefly described above will be rendered by reference to specific embodiments that are illustrated in the appended drawings. Understanding that these drawings depict only typical embodiments of the claimed subject matter and are not therefore to be considered to be limiting of scope, the claimed subject matter will be described and explained with additional specificity and detail through the use of the accompanying drawings.
-
FIG. 1 is schematic view of an enterprise network according to a specific embodiment of the claimed subject matter; -
FIG. 2 is a flow chart of a method of collecting passwords according to a specific embodiment of the claimed subject matter; -
FIG. 3 shows a password table PT according to a specific embodiment of the claimed subject matter; and -
FIG. 4 is a flow chart of a method of attempting to decrypt according to as specific embodiment of the claimed subject matter. - Reference throughout this specification to “one embodiment,” “an embodiment,” or similar language means that a particular feature, structure, or characteristic described in connection with the embodiment, is included in at least one embodiment of the claimed subject matter. Thus, appearances of the phrases “in one embodiment,” “in an embodiment,” and similar language throughout this specification may, but do not necessarily, all refer to the same embodiment.
- As will be appreciated by one skilled in the art, the claimed subject matter may be embodied as an apparatus, a method or a computer program product. Accordingly, the claimed subject matter may take the form of an entirely hardware embodiment, an entirely software embodiment (including firmware, resident software, micro-code, etc.) or an embodiment combining software and hardware aspects that may all generally be referred to herein as a “circuit,” “module” or “system.” Furthermore, the claimed subject matter may take the form of a computer program product embodied in any tangible medium of expression having computer-usable program code embodied in the medium.
- Any combination of one or more computer usable or computer readable medium(s) may be utilized. The computer-usable or computer-readable medium may be, for example but not limited to, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, device, or propagation medium. More specific examples (a non-exhaustive list) of the computer-readable medium would include the following: an electrical connection having one or more wires, a portable computer diskette, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or Flash memory), an optical fiber, a portable compact disc read-only memory (CD-ROM), an optical storage device, a transmission media such as those supporting the Internet or an intranet, or a magnetic storage device. Note that the computer-usable or computer-readable medium could even be paper or another suitable medium upon which the program is printed, as the program can be electronically captured, via, for instance, optical scanning of the paper or other medium, then compiled, interpreted, or otherwise processed in a suitable manner, if necessary, and then stored in a computer memory. In the context of this document, a computer-usable or computer-readable medium may be any medium that can contain, store, communicate, propagate, or transport the program for use by or in connection with the instruction execution system, apparatus, or device. The computer-usable medium may include a propagated data signal with the computer-usable program code embodied therewith, either in baseband or as part of a carrier wave. The computer usable program code may be transmitted using any appropriate medium, including but not limited to wireless, wireline, optical fiber cable, RF, etc.
- Computer program code for carrying out operations of the claimed subject matter may be written in any combination of one or more programming languages, including an object oriented programming language such as Java, Smalltalk C++ or the like and conventional procedural programming languages, such as the “C” programming language or similar programming languages. The program code may execute entirely on the user's computer, partly on the user's computer, as a stand-alone software package, partly on the user's computer and partly on to remote computer or entirely on the remote computer or server. In the latter scenario, the remote computer or server may be connected to the user's computer through any type of network, including a local area network (LAN) or a wide area network (WAN), or the connection may be made to an external computer (for example, through the Internet using an Internet Service Provider).
- The claimed subject matter is described below with reference to flowchart illustrations and/or block diagrams of methods, apparatus (systems) and computer program products according to embodiments of the claimed subject matter. It will be understood that each block of the flowchart illustrations and/or block diagrams, and combinations of blocks in the flowchart illustrations and/or block diagrams, can be implemented by computer program instructions. These computer program instructions may be provided to a processor of a general purpose computer, special purpose computer, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via, the processor of the computer or other programmable data processing apparatus, create means for implementing the functions/acts specified in the flowchart and/or block diagram block or blocks.
- These computer program instructions may also be stored in a computer-readable medium that can direct a computer or other programmable data processing apparatus to function in a particular manner, such that the instructions stored in the computer-readable medium produce an article of manufacture including instruction means which implement the function/act specified in the flowchart and/or block diagram block or blocks.
- The computer program instructions may also be loaded onto a computer or other programmable, data processing apparatus to cause a series of operational steps to be performed on the computer or other programmable apparatus to produce a computer implemented process such that the instructions which execute on the computer or other programmable apparatus provide processes for implementing the functions/acts specified in the flowchart and/or block diagram block or blocks.
- Referring now to
FIG. 1 throughFIG. 4 , apparatuses, methods, and computer program products are illustrated as structural or functional block diagrams or process flowcharts according to various embodiments of the claimed subject matter. The flowchart and block diagrams in the figures illustrate the architecture, functionality, and operation of possible implementations of systems, methods and computer program products according to various embodiments of the claimed subject matter. In this regard, each block in the flowchart or block diagrams may represent a module, segment, or portion of code, which comprises one or more executable instructions for implementing the specified logical function(s). It should also be noted that, in some alternative implementations, the functions noted in the block may occur out of the order noted in the figures. For example, two blocks shown in succession may, in fact, be executed substantially concurrently, or the blocks may sometimes be executed in the reverse order, depending upon the functionality involved. It will also be noted that each block of the block diagrams and/or flowchart illustration, and combinations of blocks in the block diagrams and/or flowchart illustration, can be implemented by special purpose hardware-based systems that perform the specified functions or acts, or combinations of special purpose hardware and computer instructions. - <System Architecture>
- Referring to
FIG. 1 , there is shown a schematic view of anenterprise network 10 according to a specific embodiment of the claimed subject matter. Theenterprise network 10 comprises a terminal 20, apassword collecting module 30, and a data leakage protection (DLP)module 40.Terminal 20 is provided in the form of a personal mobile device (for example, iPhone or iPad of Apple Inc.) or a personal computer and adapted to communicate (for example, file transfer or sending emails) with anextranet 50 outside theenterprise network 10. Although only oneterminal 20 is shown inFIG. 1 , persons skilled in the art understand that the claimed subject matter does not set forth a limit to the quantity ofterminal 20. - Details of
password collecting module 30 andDLP module 40 are further illustrated withFIG. 2 throughFIG. 4 . In addition topassword collecting module 30 andDLP module 40, enterprise network 19 provides an existing protection mechanism (not shown) pertaining to data leakage or data security with respect to the communication ofterminal 20 andextranet 50. For more information, make reference to Check Point DLP Software Blade manufactured by Check Point Software Technologies Ltd. or Security Network Protection XGS 5000 manufactured by international Business Machines Corp. Hence, the methods and the apparatus of the claimed subject matter can be integrated into the existing protection mechanism, especially next-generation firewalls. - <Password Collecting Module>
-
Password collecting module 30 is preferably provided in the form of software, for example, in the form of a daemon operating onterminal 20; the claimed subject matter is not restrictive thereof, aspassword collecting module 30 of the claimed subject matter can also be provided in the form of standalone hardware, such as an apparatus. Referring toFIG. 2 , there is shown a flow chart of a method of collecting passwords according to a specific embodiment of the claimed subject matter, whereinpassword collecting module 30, provided in the form of a daemon, collects passwords. -
- Block 200: starts
password collecting module 30 disposed onterminal 20 to monitor and determine whether terminal 29 is going to execute one or more predetermined applications. Go to block 202 when the determination is affirmative, otherwise keep performingblock 200.
- Block 200: starts
- In this embodiment,
password collecting module 30 communicates with the operating system (for example, the task manager in the Windows operating system) ofterminal 20, so as to be informed of any application to be executed on the terminal 20. - Before this block, it is feasible to register, optionally, any concerned applications, especially any applications susceptible to an encryption procedure such as 7-Zip, Microsoft Word, WinRAR, and Microsoft Outlook, with
password collecting module 30 beforehand; hence,password collecting module 30 can ignore those applications which are not registered, thereby saving system resources. -
- Block 202: monitor and determine by
password collecting module 30 as to whether the application is executing a file, encryption procedure. Go to block 204 when the determination is affirmative, otherwise go back to block 200.
- Block 202: monitor and determine by
- In this embodiment,
password collecting module 30 is capable of detecting a processing process of the application or an action of a graphical user interface (GUI) object to thereby determine a procedure currently being performed by the application. For more information, make reference to Spy++ developed by Microsoft. - When performing a file encryption procedure, an application typically provides a specific user interface message or prompt and requests the user to enter a password. Hence,
password collecting module 30 detects the specific user interface message or prompt to thereby determine a file encryption procedure currently being executed by the application. -
- Block 204: identify by
password collecting module 30 passwords entered by the user during an encryption procedure being executed by the application (for example, by means of the specific use interface message or prompt.) The identifying of passwords bypassword collecting module 30 can be implemented by keystroke tracking or any conventional technique of detecting user's input, of which the claimed subject matter is not restrictive. After identifying the passwords,password collecting module 30 sends the passwords toDLP module 40, such that the passwords are stored therein to create a password table PT. Afterward, the process flow of the method either ends or returns to block 200 or block 202 such that the process flow can be executed repeatedly to obtain multiple passwords which are then stored in the password table PT.
- Block 204: identify by
- In another embodiment,
password collecting module 30 not only identifies passwords, but also identifies meta data related to the passwords, including, but not limited to, time and date of file encryption, application name, encrypted file format (such as a filename extension), hash value of an encrypted file, and a user ID for use in the login of the application.Password collecting module 30 sends the meta data and the passwords together toDLP module 40, such that the meta data and the passwords are stored in the password table PT, as shown inFIG. 3 . Further details are describe below. - <DLP Module>
-
Terminal 20,password collecting module 30, andDLP module 40 are disposed inenterprise network 10 and communicate with each other via the network-based connection, including a fixed LAN or WAN, or any means of connection other than wired connection and wireless connection, provided byenterprise network 10. -
DLP module 40 is preferably provided in the form of an apparatus and integrated into an existing access point, router, switch, gateway, firewall device, proxy, or intrusion prevention system (IPS) device, for example. -
DLP module 40 provided in the form of an apparatus comprises amemory 42 and a processor 44.Memory 42 is a computer magnetic disk, hard disk drive, random-access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), compact disk, optical storage device, or magnetic storage device.Memory 42 stores a program code and, for example, the password table PT shown inFIG. 3 . Processor 44 accesses the program code and the password table PT frommemory 42 to thereby execute a predetermined program, as illustrated withFIG. 4 . Persons skilled in the art understand that the hardware ofDLP module 40 illustrated withFIG. 1 varies from embodiment to embodiment. Furthermore, in another embodiment of the claimed subject matter, intrinsic hardware or peripheral devices, such as flash read-only memory (flash ROM), equivalent non-volatile memory, or CD-ROM can be included in or can substitute for the hardware illustrate withFIG. 1 . - In another embodiment, a plugin module for use with the application operates on
terminal 20. For more information, refer to the operation principle of plugin modules for use with an existing. Web browser or word processing software, - Referring to
FIG. 4 , there is shown a flow chart of a method of attempting byDLP module 40 to decrypt according to a specific embodiment of the claimed subject matter. The embodiment described hereunder is merely intended for a single encrypted file of asingle terminal 20, but persons skilled in the art understand that it is feasible forDLP module 40 to perform the process flow (depicted inFIG. 4 ) on different files atdifferent terminals 20 simultaneously or different files at thesame terminal 20. -
- Block 400: receive or intercept by
DLP module 40 an encrypted file fromterminal 20, wherein, for the technique of file interception, please refer to conventional DLP or firewall mechanism. This block optionally comprises the sub-block of identifying meta data of encrypted file, such as file format, hash value, and user ID of the source of the file sent. For more information, please refer to Security Network Protection XGS 5000 developed by International Business Machines Corp. or other next-generation firewalls. - Block 402 (optional): determine preliminarily by
DLP module 40 as to whether to attempt to decrypt (for example, by comparing meta data of encrypted files and meta data of passwords collected by password collecting module 30) with the passwords collected bypassword collecting module 30 according to the identified meta data of the encrypted files. Go to block 404 to attempt to decrypt when the determination is affirmative, otherwise go to block 450 to execute a predetermine policy, for example, refusing to send the encrypted files toextranet 50, or sending messages to request encrypted file senders to provide passwords. - Block 404: attempt by
DLP module 40 to decrypt encrypted files received inblock 400, using passwords (see the process flow ofFIG. 2 and the password table PT ofFIG. 3 ) collected bypassword collecting module 30. Preferably, block 404 is performed in a real-time manner, that is, immediately afterblock 400.
- Block 400: receive or intercept by
- In this block, if the password table PT contains multiple passwords,
DLP module 40 will further tidy up and sort the password table PT. The password table PT in the embodiment illustrated withFIG. 3 is sorted according to the time and date of file encryption.DLP module 40 calculates the number of instances of use of each password and adds it to a related field in the password table PT. In another embodiment,DLP module 40 sorts the password table PT according to the number of instances of use, application name, file format, hash value, or user ID. The sorting result functions as the basis of priority given to a decryption attempt. - In another embodiment,
DLP module 40 calculates the degree of match between an encrypted file and each password according to a comparison of meta data of the encrypted file and meta data of each password collected bypassword collecting module 30, so as to determine the priority given to a decryption attempt.DLP module 40 determines the way of calculating the degree of match as needed, or adjusts the weight assigned to each item in the meta data for the purpose of calculating the degree of match, of which the claimed subject matter is not restrictive. For instance,DLP module 40 may assign a greater weight to file format than to user ID in calculating the degree of match. -
- Block 406: end the process flow as soon as the decryption is successful Go to block 450 to execute a predetermined if it is impossible to decrypt all the passwords.
- The foregoing preferred embodiments are provided to illustrate and disclose the technical features of the claimed subject matter, and are not intended to be restrictive of the scope of the claimed subject matter. Hence, all equivalent variations or modifications made to the foregoing embodiments without departing from the spirit embodied in the disclosure of the claimed subject matter should fall within the scope of the claimed subject matter as set forth in the appended claims.
Claims (20)
1. A method, comprising:
monitoring: an application executed at a terminal;
monitoring a procedure performed with a predetermined application executed at the terminal; and
identifying a password entered by users for a file encryption procedure performed with the predetermined application.
2. The method of claim 1 , wherein the identifying further comprises identifying meta data of the password.
3. The method of claim 1 , further comprising:
receiving an encrypted file from the terminal; and
decrypting the encrypted file with the password.
4. The method of claim 3 , wherein the decrypting is performed in a real-time manner.
5. The method of claim 3 , wherein the receiving an encrypted file further comprises identifying meta data of the encrypted file, wherein the decrypting further comprises selecting the password by determining that meta data of the encrypted file matches at least a potion of meta data of the password.
6. The method of claim 3 , wherein the decrypting comprises decrypting the encrypted file with multiple passwords obtained by executing the method of claim 1 two or more times.
7. The method of claim 6 , wherein the receiving an encrypted file further comprises identifying meta data of the encrypted file, wherein the decrypting further comprises determining priority given to attempting to decrypt with each password according to meta data of the multiple passwords obtained by executing the method of claim 2 several times.
8. The method of claim 6 , wherein the receiving an encrypted file further comprises identifying meta data of the encrypted file, wherein the decrypting further comprises determining a degree of match between meta data of the encrypted file and meta data of the multiple passwords obtained by executing the method of claim 2 several times, so as to determine priority given to a decryption performed with each password.
9. An apparatus, comprising:
a processor;
a non-transitory, computer-readable medium coupled to the processor; and
logic, stored on the computer-readable medium and executed on the processor, for:
monitoring an application executed at a terminal;
monitoring a procedure performed with a predetermined application executed at the terminal; and
identifying a password entered by users for a file encryption procedure performed with the predetermined application.
10. The apparatus of claim 9 , wherein the logic for identifying further comprises logic for identifying meta data of the password.
11. The apparatus of claim 9 , the logic further comprising logic for:
receiving an encrypted file from the terminal; and
decrypting the encrypted file with the password.
12. The apparatus of claim 11 , wherein the decrypting is performed in a real-time manner.
13. The apparatus of claim 11 , wherein the logic for receiving an encrypted file further comprises logic for identifying meta data of the encrypted file, wherein the logic for decrypting further comprises logic for selecting the password by determining that meta data of the encrypted file matches at least a portion of meta data of the password.
14. The apparatus of claim 11 , wherein the logic for decrypting comprises logic for decrypting the encrypted file with multiple passwords obtained by executing the logic of claim 9 two or more times.
15. A computer programming product, comprising:
a non-transitory, computer-readable medium; and
logic, stored on the computer-readable medium for execution on a processor, for:
monitoring an application executed at a terminal;
monitoring a procedure performed with a predetermined application executed at the terminal; and
identifying a password entered by users for a file encryption procedure performed with the predetermined application.
16. The computer programming product of claim 15 , wherein the logic for identifying further comprises logic for identifying meta data of the password.
17. The computer programming product of claim 15 , the logic further comprising logic for:
receiving an encrypted file from the terminal; and
decrypting the encrypted file with the password.
18. The computer programming product of claim 17 , wherein the decrypting is performed in a real-time manner.
19. The computer programming product of claim 17 , wherein the logic for receiving an encrypted file further comprises logic fur identifying meta data of the encrypted file, wherein the logic for decrypting further comprises logic for selecting the password by determining that meta data of the encrypted file matches at least a portion of meta data of the password.
20. The computer programming product of claim 17 , wherein the logic for decrypting comprises logic for decrypting the encrypted file with multiple passwords obtained by executing the logic of claim 9 two or more times.
Priority Applications (2)
Application Number | Priority Date | Filing Date | Title |
---|---|---|---|
US14/336,216 US9727739B2 (en) | 2012-12-28 | 2014-07-21 | Decrypting files for data leakage protection in an enterprise network |
US15/657,850 US10607016B2 (en) | 2012-12-28 | 2017-07-24 | Decrypting files for data leakage protection in an enterprise network |
Applications Claiming Priority (2)
Application Number | Priority Date | Filing Date | Title |
---|---|---|---|
TW101151161 | 2012-12-28 | ||
TW101151161A TW201427366A (en) | 2012-12-28 | 2012-12-28 | Method and appliance of decrypting files for data leakage protection in an enterprise network |
Related Child Applications (1)
Application Number | Title | Priority Date | Filing Date |
---|---|---|---|
US14/336,216 Continuation US9727739B2 (en) | 2012-12-28 | 2014-07-21 | Decrypting files for data leakage protection in an enterprise network |
Publications (1)
Publication Number | Publication Date |
---|---|
US20140189349A1 true US20140189349A1 (en) | 2014-07-03 |
Family
ID=51018715
Family Applications (3)
Application Number | Title | Priority Date | Filing Date |
---|---|---|---|
US14/142,155 Abandoned US20140189349A1 (en) | 2012-12-28 | 2013-12-27 | Decrypting Files for Data Leakage Protection in an Enterprise Network |
US14/336,216 Expired - Fee Related US9727739B2 (en) | 2012-12-28 | 2014-07-21 | Decrypting files for data leakage protection in an enterprise network |
US15/657,850 Active US10607016B2 (en) | 2012-12-28 | 2017-07-24 | Decrypting files for data leakage protection in an enterprise network |
Family Applications After (2)
Application Number | Title | Priority Date | Filing Date |
---|---|---|---|
US14/336,216 Expired - Fee Related US9727739B2 (en) | 2012-12-28 | 2014-07-21 | Decrypting files for data leakage protection in an enterprise network |
US15/657,850 Active US10607016B2 (en) | 2012-12-28 | 2017-07-24 | Decrypting files for data leakage protection in an enterprise network |
Country Status (2)
Country | Link |
---|---|
US (3) | US20140189349A1 (en) |
TW (1) | TW201427366A (en) |
Cited By (2)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
EP3428829A1 (en) * | 2015-03-31 | 2019-01-16 | Juniper Networks, Inc. | Analyzing a password-protected file for malware |
WO2022134559A1 (en) * | 2020-12-23 | 2022-06-30 | 珠海格力电器股份有限公司 | File processing method and apparatus, intelligent device, and storage medium |
Families Citing this family (10)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US10114966B2 (en) * | 2015-03-19 | 2018-10-30 | Netskope, Inc. | Systems and methods of per-document encryption of enterprise information stored on a cloud computing service (CCS) |
TWI575401B (en) | 2015-11-12 | 2017-03-21 | 財團法人資訊工業策進會 | Mobile device and an monitoring method suitable for mobile device |
US10834113B2 (en) | 2017-07-25 | 2020-11-10 | Netskope, Inc. | Compact logging of network traffic events |
US10798105B2 (en) | 2018-11-15 | 2020-10-06 | Bank Of America Corporation | Access control value systems |
US10872164B2 (en) | 2018-11-15 | 2020-12-22 | Bank Of America Corporation | Trusted access control value systems |
US11416641B2 (en) | 2019-01-24 | 2022-08-16 | Netskope, Inc. | Incident-driven introspection for data loss prevention |
US11122081B2 (en) | 2019-02-21 | 2021-09-14 | Bank Of America Corporation | Preventing unauthorized access to information resources by deploying and utilizing multi-path data relay systems and sectional transmission techniques |
US11113396B2 (en) | 2019-02-22 | 2021-09-07 | Bank Of America Corporation | Data management system and method |
US11856022B2 (en) | 2020-01-27 | 2023-12-26 | Netskope, Inc. | Metadata-based detection and prevention of phishing attacks |
US11475158B1 (en) | 2021-07-26 | 2022-10-18 | Netskope, Inc. | Customized deep learning classifier for detecting organization sensitive data in images on premises |
Citations (35)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
EP0526054A2 (en) * | 1991-07-26 | 1993-02-03 | Research Machines Plc | Monitoring execution of a computer program to provide test coverage analysis |
US5991402A (en) * | 1997-09-23 | 1999-11-23 | Aegisoft Corporation | Method and system of dynamic transformation of encrypted material |
US20030084279A1 (en) * | 2001-10-29 | 2003-05-01 | Pitney Bowes Inc. | Monitoring system for a corporate network |
US20030200459A1 (en) * | 2002-04-18 | 2003-10-23 | Seeman El-Azar | Method and system for protecting documents while maintaining their editability |
US20050022012A1 (en) * | 2001-09-28 | 2005-01-27 | Derek Bluestone | Client-side network access polices and management applications |
US20050086196A1 (en) * | 2003-07-16 | 2005-04-21 | Pkware, Inc. | Method and system for decrypting strongly encrypted .ZIP files |
US20060059350A1 (en) * | 2004-08-24 | 2006-03-16 | Microsoft Corporation | Strong names |
US20060117178A1 (en) * | 2004-11-29 | 2006-06-01 | Fujitsu Limited | Information leakage prevention method and apparatus and program for the same |
US20060206432A1 (en) * | 2003-11-26 | 2006-09-14 | Russell John C P | Digital rights management using network topology testing |
US20070217609A1 (en) * | 2006-03-02 | 2007-09-20 | Aruze Corp. | Portable telephone and program for sending and receiving electronic mail |
US20090037984A1 (en) * | 2007-07-30 | 2009-02-05 | International Business Machines Corporation | Automated password tool and method of use |
US20100030982A1 (en) * | 2008-08-04 | 2010-02-04 | Sandisk Il Ltd. | Backing up digital content that is stored in a secured storage device |
US20100079571A1 (en) * | 2006-12-21 | 2010-04-01 | Tetsuya Hayashi | Drawing apparatus and method, and computer program |
US20100125891A1 (en) * | 2008-11-17 | 2010-05-20 | Prakash Baskaran | Activity Monitoring And Information Protection |
US20100174902A1 (en) * | 2005-12-23 | 2010-07-08 | Phison Electronics Corp. | Portable storage media with high security function |
US20100268934A1 (en) * | 2009-04-20 | 2010-10-21 | International Business Machines Corporation | Method and system for secure document exchange |
US20100268955A1 (en) * | 2008-03-17 | 2010-10-21 | Chiyo Ohno | Content transmission device and content reception device |
US20100266129A1 (en) * | 2007-11-09 | 2010-10-21 | Icon Corp. | Key management device and information transmission system using the same |
US7836310B1 (en) * | 2002-11-01 | 2010-11-16 | Yevgeniy Gutnik | Security system that uses indirect password-based encryption |
US20110010550A1 (en) * | 2008-01-28 | 2011-01-13 | Zte Corporation | method for locking an application program |
US7917946B2 (en) * | 2001-04-10 | 2011-03-29 | Telefonaktiebolaget Lm Ericsson (Publ) | Method and network for securely delivering streaming data |
US20110239306A1 (en) * | 2008-08-27 | 2011-09-29 | Applied Neural Technologies Limited | Data leak protection application |
US20120137368A1 (en) * | 2010-11-30 | 2012-05-31 | Scott Alexander Vanstone | Apparatus, system and method for preventing data loss |
US20120158768A1 (en) * | 2010-12-15 | 2012-06-21 | Microsoft Corporation | Decomposing and merging regular expressions |
US20120210126A1 (en) * | 2011-02-10 | 2012-08-16 | SecurenCrypt, LLC | Document encryption and decryption |
US20120222110A1 (en) * | 2011-02-28 | 2012-08-30 | International Business Machines Corporation | Data leakage protection in cloud applications |
US8286253B1 (en) * | 2009-11-23 | 2012-10-09 | Trend Micro Incorporated | Data leakage prevention for resource limited device |
US8387110B1 (en) * | 2010-02-10 | 2013-02-26 | Socialware, Inc. | Method, system and computer program product for tagging content on uncontrolled web application |
US20130111219A1 (en) * | 2011-11-02 | 2013-05-02 | Sasikanth Avanch | Delivering data from a secure execution environment to a display controller |
US20130227280A1 (en) * | 2012-02-29 | 2013-08-29 | Good Technology Corporation | Method of operating a computing device, computing device and computer program |
US8542823B1 (en) * | 2009-06-18 | 2013-09-24 | Amazon Technologies, Inc. | Partial file encryption |
US20130340031A1 (en) * | 2012-06-17 | 2013-12-19 | Skycure Ltd | Access control system for a mobile device |
US20140108792A1 (en) * | 2012-10-12 | 2014-04-17 | Citrix Systems, Inc. | Controlling Device Access to Enterprise Resources in an Orchestration Framework for Connected Devices |
US8825773B1 (en) * | 2010-09-20 | 2014-09-02 | Symantec Corporation | Systems and methods for concealing information relating to a profile provided by a social networking service |
US9081974B2 (en) * | 2011-11-10 | 2015-07-14 | Microsoft Technology Licensing, Llc | User interface for selection of multiple accounts and connection points |
Family Cites Families (73)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
EP0218176B1 (en) * | 1985-10-07 | 1991-11-13 | Kabushiki Kaisha Toshiba | Portable electronic device |
EP0332117B1 (en) * | 1988-03-09 | 1994-05-11 | Kabushiki Kaisha Toshiba | Portable electronic apparatus |
US5584023A (en) * | 1993-12-27 | 1996-12-10 | Hsu; Mike S. C. | Computer system including a transparent and secure file transform mechanism |
US6240184B1 (en) * | 1997-09-05 | 2001-05-29 | Rsa Security Inc. | Password synchronization |
JP2000148276A (en) * | 1998-11-05 | 2000-05-26 | Fujitsu Ltd | Device and method for monitoring security and securithy monitoring program recording medium |
US7137008B1 (en) * | 2000-07-25 | 2006-11-14 | Laurence Hamid | Flexible method of user authentication |
WO2002083865A2 (en) * | 2001-04-13 | 2002-10-24 | First Genetic Trust | Methods and systems for managing informed consent processes |
FI115356B (en) * | 2001-06-29 | 2005-04-15 | Nokia Corp | A method for processing audio-visual information in an electronic device, a system and an electronic device |
US7526654B2 (en) * | 2001-10-16 | 2009-04-28 | Marc Charbonneau | Method and system for detecting a secure state of a computer system |
US7058811B2 (en) | 2001-10-31 | 2006-06-06 | Intel Corporation | Apparatus and method to prevent a device driver from loading on a counterfeit hardware element |
JP3899918B2 (en) * | 2001-12-11 | 2007-03-28 | 株式会社日立製作所 | Login authentication method, its execution system, and its processing program |
US7774791B1 (en) * | 2002-04-24 | 2010-08-10 | Informatica Corporation | System, method and computer program product for data event processing and composite applications |
JP4239741B2 (en) * | 2003-07-30 | 2009-03-18 | ソニー株式会社 | Information recording medium manufacturing management system, information processing apparatus and method, and computer program |
US20050044380A1 (en) * | 2003-08-21 | 2005-02-24 | International Business Machines Corporation | Method and system to enable access to multiple restricted applications through user's host application |
JP2005128996A (en) * | 2003-09-30 | 2005-05-19 | Dainippon Printing Co Ltd | Information processing apparatus and system, and program |
WO2005052761A2 (en) * | 2003-11-25 | 2005-06-09 | Geno Munari | Method and apparatus for vending magic, pranks, and gags |
TWI230533B (en) | 2003-12-23 | 2005-04-01 | Mitac Int Corp | Method for protecting private file in smart phone |
US20060041932A1 (en) * | 2004-08-23 | 2006-02-23 | International Business Machines Corporation | Systems and methods for recovering passwords and password-protected data |
GB0422907D0 (en) * | 2004-10-15 | 2004-11-17 | Dyson Technology Ltd | A vacuum cleaning head |
US7802096B1 (en) * | 2004-10-19 | 2010-09-21 | Cisco Technology, Inc. | Fallback key retrieval |
US7814317B1 (en) * | 2004-10-19 | 2010-10-12 | Cisco Technology, Inc. | Multiple password documents |
EP1672486A1 (en) | 2004-12-15 | 2006-06-21 | Sony Ericsson Mobile Communications AB | Method and device for permitting secure use of program modules |
US20070039042A1 (en) * | 2005-08-12 | 2007-02-15 | First Data Corporation | Information-security systems and methods |
US7835024B2 (en) * | 2006-03-17 | 2010-11-16 | Ricoh Company, Ltd. | Print information processing apparatus |
US7681048B2 (en) * | 2006-04-27 | 2010-03-16 | Matthew Thomas Starr | Data encryption using a key and moniker for mobile storage media adapted for library storage |
US7831563B2 (en) * | 2006-05-17 | 2010-11-09 | International Business Machines Corporation | Active storage and retrieval systems and methods |
US20080083037A1 (en) * | 2006-10-03 | 2008-04-03 | Rmcl, Inc. | Data loss and theft protection method |
JP4918638B2 (en) | 2006-11-10 | 2012-04-18 | 株式会社カオスウェア | E-mail processing apparatus, e-mail processing method, and program |
US7950051B1 (en) * | 2007-01-30 | 2011-05-24 | Sprint Communications Company L.P. | Password management for a communication network |
US8028269B2 (en) * | 2007-03-09 | 2011-09-27 | International Business Machines Corporation | Compliance management method and system |
US9325682B2 (en) * | 2007-04-16 | 2016-04-26 | Tailstream Technologies, Llc | System for interactive matrix manipulation control of streamed data and media |
WO2009049034A2 (en) * | 2007-10-11 | 2009-04-16 | Joseph Mcneill Everett | Dual source connector system |
US8332918B2 (en) * | 2007-12-06 | 2012-12-11 | Novell, Inc. | Techniques for real-time adaptive password policies |
US8893285B2 (en) * | 2008-03-14 | 2014-11-18 | Mcafee, Inc. | Securing data using integrated host-based data loss agent with encryption detection |
US20090247125A1 (en) * | 2008-03-27 | 2009-10-01 | Grant Calum Anders Mckay | Method and system for controlling access of computer resources of mobile client facilities |
US8707452B1 (en) * | 2008-04-14 | 2014-04-22 | Avaya Inc. | Secure data management device |
TW200905516A (en) | 2008-09-16 | 2009-02-01 | W & Amp Jsoft Inc | Method and system for protecting file data against divulgence |
US8826443B1 (en) * | 2008-09-18 | 2014-09-02 | Symantec Corporation | Selective removal of protected content from web requests sent to an interactive website |
US20100082364A1 (en) * | 2008-09-30 | 2010-04-01 | Abbott Diabetes Care, Inc. | Medical Information Management |
US8695090B2 (en) * | 2008-10-31 | 2014-04-08 | Symantec Corporation | Data loss protection through application data access classification |
TWI381285B (en) | 2009-02-13 | 2013-01-01 | Fineart Technology Co Ltd | Rights management system for electronic files |
US8438630B1 (en) * | 2009-03-30 | 2013-05-07 | Symantec Corporation | Data loss prevention system employing encryption detection |
US8419806B2 (en) * | 2009-05-05 | 2013-04-16 | Absolute Software Corporation | Discriminating data protection system |
US8752180B2 (en) * | 2009-05-26 | 2014-06-10 | Symantec Corporation | Behavioral engine for identifying patterns of confidential data use |
GB2471282B (en) * | 2009-06-22 | 2015-02-18 | Barclays Bank Plc | Method and system for provision of cryptographic services |
CN101615237A (en) | 2009-08-11 | 2009-12-30 | 威盛电子股份有限公司 | Can verify embedded system and verification method thereof |
KR101047884B1 (en) * | 2009-08-11 | 2011-07-08 | 주식회사 안철수연구소 | Method and device for data protection using a virtual environment and a computer-readable recording medium recording a program for performing the method |
US8738934B2 (en) * | 2009-08-25 | 2014-05-27 | Keeper Security, Inc. | Method and apparatus for protecting account numbers and passwords |
US8224796B1 (en) * | 2009-09-11 | 2012-07-17 | Symantec Corporation | Systems and methods for preventing data loss on external devices |
US8578504B2 (en) | 2009-10-07 | 2013-11-05 | Ca, Inc. | System and method for data leakage prevention |
US9262643B2 (en) * | 2010-02-22 | 2016-02-16 | Sookasa Inc. | Encrypting files within a cloud computing environment |
US8806190B1 (en) * | 2010-04-19 | 2014-08-12 | Amaani Munshi | Method of transmission of encrypted documents from an email application |
US8607330B2 (en) * | 2010-09-03 | 2013-12-10 | International Business Machines Corporation | Orderly change between new and old passwords |
US8893300B2 (en) | 2010-09-20 | 2014-11-18 | Georgia Tech Research Corporation | Security systems and methods to reduce data leaks in enterprise networks |
US8880905B2 (en) * | 2010-10-27 | 2014-11-04 | Apple Inc. | Methods for processing private metadata |
US9715598B2 (en) | 2010-11-17 | 2017-07-25 | Invysta Technology Group | Automatic secure escrowing of a password for encrypted information an attachable storage device |
US8726396B1 (en) * | 2011-01-14 | 2014-05-13 | Symantec Corporation | Scanning protected files for violations of a data loss prevention policy |
US9342381B2 (en) | 2011-02-03 | 2016-05-17 | Symantec Corporation | Method and system for establishing a DLP-compliant environment |
WO2012109533A1 (en) | 2011-02-10 | 2012-08-16 | Beyondtrust Software, Inc. | System and method for detecting or preventing data leakage using behavior profiling |
US8787567B2 (en) * | 2011-02-22 | 2014-07-22 | Raytheon Company | System and method for decrypting files |
US8510369B1 (en) * | 2011-03-15 | 2013-08-13 | Symantec Corporation | Method and system for adding plug-in functionality to virtualized applications |
US8782392B1 (en) * | 2011-04-11 | 2014-07-15 | Google Inc. | Privacy-protective data transfer and storage |
US9582678B2 (en) * | 2011-04-19 | 2017-02-28 | Invenia As | Method for secure storing of a data file via a computer communication network |
US9438419B1 (en) * | 2011-07-12 | 2016-09-06 | The Florida State University Research Foundation, Inc. | Probabilistic password cracking system |
JP5459289B2 (en) * | 2011-10-25 | 2014-04-02 | コニカミノルタ株式会社 | Wet image forming device |
US9330245B2 (en) * | 2011-12-01 | 2016-05-03 | Dashlane SAS | Cloud-based data backup and sync with secure local storage of access keys |
US8544060B1 (en) * | 2012-01-27 | 2013-09-24 | Symantec Corporation | Method and system for detecting and protecting against potential data loss from unknown applications |
US9294281B2 (en) * | 2012-02-10 | 2016-03-22 | Microsoft Technology Licensing, Llc | Utilization of a protected module to prevent offline dictionary attacks |
US9003475B1 (en) * | 2012-06-05 | 2015-04-07 | Symantec Corporation | Systems and methods for applying data-loss-prevention policies |
US9176838B2 (en) * | 2012-10-19 | 2015-11-03 | Intel Corporation | Encrypted data inspection in a network environment |
US8584219B1 (en) * | 2012-11-07 | 2013-11-12 | Fmr Llc | Risk adjusted, multifactor authentication |
US9536096B2 (en) * | 2012-12-17 | 2017-01-03 | Business Objects Software Ltd. | Presenting visualizations of business intelligence data |
CN103077163B (en) | 2012-12-24 | 2015-07-08 | 华为技术有限公司 | Data preprocessing method, device and system |
-
2012
- 2012-12-28 TW TW101151161A patent/TW201427366A/en unknown
-
2013
- 2013-12-27 US US14/142,155 patent/US20140189349A1/en not_active Abandoned
-
2014
- 2014-07-21 US US14/336,216 patent/US9727739B2/en not_active Expired - Fee Related
-
2017
- 2017-07-24 US US15/657,850 patent/US10607016B2/en active Active
Patent Citations (36)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
EP0526054A2 (en) * | 1991-07-26 | 1993-02-03 | Research Machines Plc | Monitoring execution of a computer program to provide test coverage analysis |
US5991402A (en) * | 1997-09-23 | 1999-11-23 | Aegisoft Corporation | Method and system of dynamic transformation of encrypted material |
US7917946B2 (en) * | 2001-04-10 | 2011-03-29 | Telefonaktiebolaget Lm Ericsson (Publ) | Method and network for securely delivering streaming data |
US20050022012A1 (en) * | 2001-09-28 | 2005-01-27 | Derek Bluestone | Client-side network access polices and management applications |
US20030084279A1 (en) * | 2001-10-29 | 2003-05-01 | Pitney Bowes Inc. | Monitoring system for a corporate network |
US20030200459A1 (en) * | 2002-04-18 | 2003-10-23 | Seeman El-Azar | Method and system for protecting documents while maintaining their editability |
US7836310B1 (en) * | 2002-11-01 | 2010-11-16 | Yevgeniy Gutnik | Security system that uses indirect password-based encryption |
US20050086196A1 (en) * | 2003-07-16 | 2005-04-21 | Pkware, Inc. | Method and system for decrypting strongly encrypted .ZIP files |
US20060206432A1 (en) * | 2003-11-26 | 2006-09-14 | Russell John C P | Digital rights management using network topology testing |
US20060059350A1 (en) * | 2004-08-24 | 2006-03-16 | Microsoft Corporation | Strong names |
US20060117178A1 (en) * | 2004-11-29 | 2006-06-01 | Fujitsu Limited | Information leakage prevention method and apparatus and program for the same |
US20100174902A1 (en) * | 2005-12-23 | 2010-07-08 | Phison Electronics Corp. | Portable storage media with high security function |
US20070217609A1 (en) * | 2006-03-02 | 2007-09-20 | Aruze Corp. | Portable telephone and program for sending and receiving electronic mail |
US20100079571A1 (en) * | 2006-12-21 | 2010-04-01 | Tetsuya Hayashi | Drawing apparatus and method, and computer program |
US20090037984A1 (en) * | 2007-07-30 | 2009-02-05 | International Business Machines Corporation | Automated password tool and method of use |
US20100266129A1 (en) * | 2007-11-09 | 2010-10-21 | Icon Corp. | Key management device and information transmission system using the same |
US20110010550A1 (en) * | 2008-01-28 | 2011-01-13 | Zte Corporation | method for locking an application program |
US20100268955A1 (en) * | 2008-03-17 | 2010-10-21 | Chiyo Ohno | Content transmission device and content reception device |
US8984646B2 (en) * | 2008-03-17 | 2015-03-17 | Hitachi Maxell, Ltd. | Content transmission device and content reception device |
US20100030982A1 (en) * | 2008-08-04 | 2010-02-04 | Sandisk Il Ltd. | Backing up digital content that is stored in a secured storage device |
US20110239306A1 (en) * | 2008-08-27 | 2011-09-29 | Applied Neural Technologies Limited | Data leak protection application |
US20100125891A1 (en) * | 2008-11-17 | 2010-05-20 | Prakash Baskaran | Activity Monitoring And Information Protection |
US20100268934A1 (en) * | 2009-04-20 | 2010-10-21 | International Business Machines Corporation | Method and system for secure document exchange |
US8542823B1 (en) * | 2009-06-18 | 2013-09-24 | Amazon Technologies, Inc. | Partial file encryption |
US8286253B1 (en) * | 2009-11-23 | 2012-10-09 | Trend Micro Incorporated | Data leakage prevention for resource limited device |
US8387110B1 (en) * | 2010-02-10 | 2013-02-26 | Socialware, Inc. | Method, system and computer program product for tagging content on uncontrolled web application |
US8825773B1 (en) * | 2010-09-20 | 2014-09-02 | Symantec Corporation | Systems and methods for concealing information relating to a profile provided by a social networking service |
US20120137368A1 (en) * | 2010-11-30 | 2012-05-31 | Scott Alexander Vanstone | Apparatus, system and method for preventing data loss |
US20120158768A1 (en) * | 2010-12-15 | 2012-06-21 | Microsoft Corporation | Decomposing and merging regular expressions |
US20120210126A1 (en) * | 2011-02-10 | 2012-08-16 | SecurenCrypt, LLC | Document encryption and decryption |
US20120222110A1 (en) * | 2011-02-28 | 2012-08-30 | International Business Machines Corporation | Data leakage protection in cloud applications |
US20130111219A1 (en) * | 2011-11-02 | 2013-05-02 | Sasikanth Avanch | Delivering data from a secure execution environment to a display controller |
US9081974B2 (en) * | 2011-11-10 | 2015-07-14 | Microsoft Technology Licensing, Llc | User interface for selection of multiple accounts and connection points |
US20130227280A1 (en) * | 2012-02-29 | 2013-08-29 | Good Technology Corporation | Method of operating a computing device, computing device and computer program |
US20130340031A1 (en) * | 2012-06-17 | 2013-12-19 | Skycure Ltd | Access control system for a mobile device |
US20140108792A1 (en) * | 2012-10-12 | 2014-04-17 | Citrix Systems, Inc. | Controlling Device Access to Enterprise Resources in an Orchestration Framework for Connected Devices |
Cited By (2)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
EP3428829A1 (en) * | 2015-03-31 | 2019-01-16 | Juniper Networks, Inc. | Analyzing a password-protected file for malware |
WO2022134559A1 (en) * | 2020-12-23 | 2022-06-30 | 珠海格力电器股份有限公司 | File processing method and apparatus, intelligent device, and storage medium |
Also Published As
Publication number | Publication date |
---|---|
US9727739B2 (en) | 2017-08-08 |
TW201427366A (en) | 2014-07-01 |
US10607016B2 (en) | 2020-03-31 |
US20140344573A1 (en) | 2014-11-20 |
US20180018467A1 (en) | 2018-01-18 |
Similar Documents
Publication | Publication Date | Title |
---|---|---|
US10607016B2 (en) | Decrypting files for data leakage protection in an enterprise network | |
US9929991B2 (en) | Just-in-time, email embedded URL reputation determination | |
US10270758B2 (en) | Login method, server, and login system | |
EP3128459B1 (en) | System and method of utilizing a dedicated computer security service | |
US8787567B2 (en) | System and method for decrypting files | |
EP2859495B1 (en) | Malicious message detection and processing | |
US20190036955A1 (en) | Detecting data exfiltration as the data exfiltration occurs or after the data exfiltration occurs | |
US9137245B2 (en) | Login method, apparatus, and system | |
WO2014172956A1 (en) | Login method,apparatus, and system | |
US11770385B2 (en) | Systems and methods for malicious client detection through property analysis | |
US9692759B1 (en) | Control of cloud application access for enterprise customers | |
US9223980B1 (en) | Systems and methods for indicating malware statuses of electronic messages | |
US9325690B2 (en) | Verification service | |
US9021578B1 (en) | Systems and methods for securing internet access on restricted mobile platforms | |
US20150215302A1 (en) | Rich content scanning for non-service accounts for email delivery | |
WO2022159611A1 (en) | Preventing phishing attacks via document sharing | |
WO2016037489A1 (en) | Method, device and system for monitoring rcs spam messages | |
US11363020B2 (en) | Method, device and storage medium for forwarding messages | |
US9049169B1 (en) | Mobile email protection for private computer networks | |
US20230394151A1 (en) | Protected qr code scanner using operational system override | |
US20210185080A1 (en) | Social engineering attack prevention | |
CN117729024A (en) | Method, server and system for processing internet and internet files | |
CN114428967A (en) | Data transmission method, device, equipment and storage medium | |
CN104683287A (en) | Method and device for decrypting file for data leakage protection in enterprise network |
Legal Events
Date | Code | Title | Description |
---|---|---|---|
AS | Assignment |
Owner name: INTERNATIONAL BUSINESS MACHINES CORPORATION, NEW Y Free format text: ASSIGNMENT OF ASSIGNORS INTEREST;ASSIGNORS:TSAI, YA HSUAN;YU, YING-HUNG;MAHADEVAN, HARIHARAN;SIGNING DATES FROM 20140701 TO 20140711;REEL/FRAME:033301/0018 |
|
STCB | Information on status: application discontinuation |
Free format text: ABANDONED -- FAILURE TO RESPOND TO AN OFFICE ACTION |