WO2010030871A2 - Methods and systems to implement fingerprint lookups across remote agents - Google Patents

Methods and systems to implement fingerprint lookups across remote agents Download PDF

Info

Publication number
WO2010030871A2
WO2010030871A2 PCT/US2009/056651 US2009056651W WO2010030871A2 WO 2010030871 A2 WO2010030871 A2 WO 2010030871A2 US 2009056651 W US2009056651 W US 2009056651W WO 2010030871 A2 WO2010030871 A2 WO 2010030871A2
Authority
WO
WIPO (PCT)
Prior art keywords
organization
computer implemented
protecting
recited
secure information
Prior art date
Application number
PCT/US2009/056651
Other languages
French (fr)
Other versions
WO2010030871A3 (en
Inventor
Scott More
Ilya Beyer
Daniel Christopher John Sweeting
Original Assignee
Workshare Technology, Inc.
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Priority claimed from US12/209,096 external-priority patent/US9473512B2/en
Application filed by Workshare Technology, Inc. filed Critical Workshare Technology, Inc.
Publication of WO2010030871A2 publication Critical patent/WO2010030871A2/en
Publication of WO2010030871A3 publication Critical patent/WO2010030871A3/en

Links

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/12—Applying verification of the received information
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/30—Authentication, i.e. establishing the identity or authorisation of security principals
    • G06F21/31—User authentication
    • G06F21/32—User authentication using biometric data, e.g. fingerprints, iris scans or voiceprints
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
    • G06F21/55—Detecting local intrusion or implementing counter-measures
    • G06F21/554—Detecting local intrusion or implementing counter-measures involving event detection and direct action
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06K—GRAPHICAL DATA READING; PRESENTATION OF DATA; RECORD CARRIERS; HANDLING RECORD CARRIERS
    • G06K17/00—Methods or arrangements for effecting co-operative working between equipments covered by two or more of main groups G06K1/00 - G06K15/00, e.g. automatic card files incorporating conveying and reading operations
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F2221/00—Indexing scheme relating to security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F2221/21—Indexing scheme relating to G06F21/00 and subgroups addressing additional information or applications relating to security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F2221/2115—Third party
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
    • H04L63/1408—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic by monitoring network traffic

Abstract

The present invention provides methods and systems to protect an organization's secure information from unauthorized disclosure. The present system uses protect agents installed across various egress points (e.g., email server, user's computer, etc.) to monitor information disclosed by a user. The present system also provides the use of fingerprint servers to remotely maintain a database of fingerprints associated with the organization's secure data. In one embodiment, the protect agents transmit fingerprints associated with the user's information to the fingerprint server utilizing a local network or the public internet. The protect agents then receive a comparison analysis from the fingerprint servers and execute appropriate security action based on the analysis. In one embodiment, a combination of the local network and public internet is utilized to achieve remote agent lookups.

Description

METHODS AND SYSTEMS TO IMPLEMENT FINGERPRINT LOOKUPS ACROSS REMOTE AGENTS
CROSS-REFERENCE TO RELATED APPLICATIONS [0001] This application is related to U.S. Application no. 12/177,043 filed July 21, 2008, which is incorporated by reference as if fully set forth herein. This application is also related to applicants' co-pending application filed September 11, 2008 entitled "Methods And Systems For Protect Agents Using Distributed Lightweight Fingerprints," (Atty Docket No. 60072-8007.US01).
[0002] This application claims priority to U.S. Patent Application No. 12/209,096 filed September 11 , 2008, which is hereby incorporated by reference in its entirety.
FIELD OF INVENTION
[0003] The present invention relates to information security and more specifically it relates to systems and methods for detecting and preventing unauthorized disclosure of secure information. Furthermore, the present invention pertains to implementing fingerprint lookups across remote agents connected to a network.
BACKGROUND OF THE INVENTION
[0004] With the rapid increase and advances in digital documentation services and document management systems, organizations are increasingly storing important, confidential, and secure information in the form of digital documents. Unauthorized dissemination of this information, either by accident or by wanton means, presents serious security risks to these organizations. Therefore, it is imperative for the organizations to protect such secure information and detect and react to any secure information (or derivatives thereof) from being disclosed beyond the perimeters of the organization.
[0005] Additionally, the organizations face the challenge of categorizing and maintaining the large corpus of digital information across potentially thousands of data stores, content management systems, end-user desktops, etc. One solution to this challenge is to generate fingerprints from all of the digital information that the organization seeks to protect. These fingerprints tersely and securely represent the organization's secure data, and can be maintained in a database for later verification against the information that a user desires to disclose. When the user wishes to disclose any information outside of the organization, fingerprints are generated for the user's information, and these fingerprints are compared against the fingerprints stored in the fingerprint database. If the fingerprints of the user's information matches with fingerprints contained in the fingerprint server, suitable security actions are performed.
[0006] However, the user has at his disposal myriad options to disclose the information outside of the organization's protected environment. For example, the user could copy the digital information from his computer to a removable storage medium (e.g., a floppy drive, a USB storage device, etc.), or the user could email the information from his computer through the organization's email server, or the user could print out the information by sending a print request through the organization's print server, etc. Therefore, it is imperative to monitor the user's activity through each of these egress points.
[0007] In order to effectively protect the organization's secure information, the information that is transmitted through any of the organization's egress points needs to be converted to fingerprints and compared against the fingerprints contained in the organization's fingerprint database. One way of achieving this would be by replicating and maintaining a plurality of fingerprint database at the locations containing egress points (e.g., at the print server, at the email server, at the user's desktop computer, etc.). This can be achieved by means of database replication, agent polling, diff sync pushes from a central fingerprint server, etc.
[0008] However, most organizations have several desktop computers and maintain arrays of systems that represent a large number of egress points. With the increase in the number of egress points, the number of individual fingerprint databases that need to be created, maintained, and refreshed periodically becomes prohibitively large. In addition, the fingerprints in the fingerprint database may also contain additional metadata (e.g., to indicate the location of the fingerprint within a document, to indicate the origin information of the document, etc.), further increasing the size of the individual fingerprint databases, thus further exacerbating the cost and difficulties associated with maintaining a plethora of individual fingerprint databases.
[0009] Other solutions exist in the prior art to protect digital information in such porous environments. These solutions include encrypting the files, or applying digital rights management or watermarks directly to the files. These solutions do not typically employ the method of fingerprint lookups, and therefore do not require fingerprint databases to be maintained. However, they present other disadvantages. For example, the digital information itself needs to be converted, and unprotected versions of the information needs to be identified and managed (or destroyed) to ensure the security of the information. Additionally, the presence of the watermarking or the digital rights management information does not preclude the information from being disclosed outside of the organization. In most cases, the watermarks only serve as a security awareness or deterrent feature and do not actually prevent the information from being disclosed.
SUMMARY OF THE INVENTION
[0010] Methods and systems to provide efficient means to monitor and protect an organization's secure information using remote agent lookups is provided. In one embodiment, the present invention provides methods and systems to implement a protect agent across various egress points of an organization's computing environment. Examples of egress points include a printer or a removable storage device (e.g., a USB flash memory drive, CD drive, etc.) connected to a user's desktop computer through which the user could potentially transmit secure information outside of the organization's protected environment. The protect agents monitor activity across all egress points, and receive any information that a user intends to disclose through the egress points.
[0011] In one embodiment, the protect agents generate fingerprints from the received user information and transmit that information to a fingerprint server to do fingerprint lookups. The fingerprint server contains at least one copy of a registered fingerprint database. The registered fingerprint database comprises registered fingerprints generated from all of the organization's secure information. The fingerprint server and the protect agents communicate through a network to which they are connected. The network could either be a local network specific to the organization or could be the public internet. The network could also be a combination of the local network and the public internet.
[0012] In one embodiment, the fingerprint server receives client fingerprints transmitted by the protect agents. The fingerprint server does a lookup of the client fingerprints by comparing the client fingerprints against the registered fingerprints contained in the registered fingerprint database. The fingerprint server reports the results of the lookup by communicating the results of the comparison back to the protect agent that transmitted the client fingerprints. In one embodiment, the protect agent then initiates one or more security actions based on the results of the lookup.
[0013] An important feature of the present invention is that the registered fingerprints are maintained at a remote location (e.g., at the fingerprint servers connected to the network). This obviates the need to maintain numerous redundant copies of the registered fingerprints locally at the location of every protect agent. Maintaining remote central copies of the registered fingerprints also allows the registered fingerprint database to be updated and version controlled more efficiently.
BRIEF DESCRIPTION OF DRAWINGS
[0014] These and other objects, features and characteristics of the present invention will become more apparent to those skilled in the art from a study of the following detailed description in conjunction with the appended claims and drawings, all of which form a part of this specification. In the drawings:
FIG. 1 illustrates an overall embodiment of a remote agent fingerprint lookup system;
FIG. 2 is a flowchart depicting one embodiment of a method to achieve fingerprinting across remote agents;
FIG. 3 is a flowchart illustrating a method to use remote agent lookups for the purpose of taking appropriate security actions; and
FIG. 4 is a flowchart depicting an embodiment of a combined remote agent lookup method, where a combination of a local network and the public internet is utilized for remote lookups.
DETAILED DESCRIPTION OF THE INVENTION
[0015] The present invention may be embodied in several forms and manners. The description provided below and the drawings show exemplary embodiments of the invention. Those of skill in the art will appreciate that the invention may be embodied in other forms and manners not shown below. It is understood that the use of relational terms, if any, such as first, second, top and bottom, and the like are used solely for distinguishing one entity or action from another, without necessarily requiring or implying any such actual relationship or order between such entities or actions.
[0016] Fig. 1 shows one example of an overall setup to implement remote agent lookups. One of the means by which a user can disclose digital information outside of the organization's perimeter is by disclosing the information through his computer system 110. Examples of such a computer system include a desktop computer, a laptop, a PDA or any such device that allows a user to access the organization's information, hi one embodiment, the computing system 110 is connected to a network 125. Here, the computing system 110 comprises the desktop/laptop computer 111 through which the user accesses the organization's secure information. The user would be able to transfer information outside of the organization by transferring the information to any medium connected to the computer.
[0017] Such points at which information can be transferred outside of the organization's protected environment are called egress points. Examples of transferring data at egress points include copying the information from the computer to a CD disk 112 or any other optical storage medium, copying the information to a floppy drive 113 or any other tape medium, copying the information to a USB key 114 or other flash based storage medium, transferring the information by printing the information using a printer 115, copying information to the clipboard 115a of the local operating system, etc. In such an event, all the information that is transmitted through the computer 111 needs to be monitored to ensure that secure or sensitive information does not get transferred. [0018] To achieve this purpose, the various egress points of the computer 111 are monitored to detect any activity that purports to disclose information through the egress points. A software agent, called the protect agent 116, is run on the computer 111 to monitor activity at the egress points (112, 113, 114, 115, 115a) associated with the computer 111. If the organization supports more than one computer system, each of these computer systems (110, 116, 117, 118) have protect agents installed on them to ensure that the activity on each of the computer systems is monitored, hi one embodiment, the protect agent 116 is a set of computer instructions or a computer implemented program available on a memory location (e.g., on a magnetic tape drive, a flash memory drive, etc.) at the site of the protect agent 116.
[0019] In addition to being installed in every computer system (110, 116, 117, 118) in the network, the protect agents are also installed on other vulnerable egress points across the organization. One example of such a vulnerable egress point includes one or more email server systems 118 connected to the network. The email server 119 handles and routes the emails sent out and received by the organization. The protect agent 120 installed on the email server 119 monitors the emails desired to be sent out of the organization through the email server. Another example of a vulnerable egress point could be a print server 121 connected to the organization's network. A protect agent 123 connected to the print server 122 monitors print jobs sent by the users to the printers connected to the network.
[0020] Additional examples of vulnerable egress points include network appliance systems 126. Here, a protect agent 128 is installed in each network appliance 127 to ensure that information disclosed through a particular network appliance 127 is monitored. Examples of using network appliances 126 to transfer data include sharing of data over a network share medium, data transferred at the socket or TCP layer of the network, etc. It is understood that in addition to these examples, the egress points also include other porous environments through which information can be disclosed by the user beyond the secure environment of the organization. [0021] The computer systems and all other systems representing egress points (the egress point systems) are centrally connected to a network 125. In one embodiment, the network includes a local network. This includes a network that is managed and maintained locally by the organization. In another embodiment, the network could also be the internet. In the case of the internet, each of the egress point systems could be directly and individually connected to the internet, or could be connected to a local network or a cluster of local networks, with each of the local networks communicating with each other through the internet. Other combinations of the egress point systems within the local network and the internet are possible and such combinations will be apparent to a person of skill in the art.
[0022] In the case of the public internet, the protect agents transmit fingerprint lookup requests to a hosted fingerprint server. A hosted fingerprint server is similar to the fingerprint server connected to a local network in that it contains at least one copy of the database of registered fingerprints (corresponding to the secure information of an organization). However, the difference is that the hosted fingerprint server is publicly accessible over the internet. One advantage of using a hosted fingerprint server is that an organization does not have to deploy and manage one or more server appliances within its networks. Some small organizations may not even have infrastructure to maintain a network and host a fingerprint server, but may still require their secure information to be protected. In such cases, the support and manageability of the fingerprint server can be done by even a third party provider who provides the service of a hosted fingerprint server.
[0023] A hosted fingerprint service enables protect agents to behave consistently in mobile environments, with the same fingerprint lookups happening inside and outside of the organization. For example, a laptop user can be blocked from emailing confidential files while using a wireless internet connection in a cafe. In this case, the protect agent can still communicate with the publicly accessible hosted fingerprint service. A provider offering a hosted fingerprint service can also support multi-tenancy services, whereby the provider shares the hosted fingerprint server's resources across different organizations and cutting down on costs. In one embodiment, this would allow fingerprint databases for multiple organizations to reside on the same server.
[0024] Fig. 1 illustrates a plurality of fingerprint servers (131-135) connected to the network. In one embodiment, the protect agent located at each of the egress points collect the information that the user intends to disclose and transmit such information to the fingerprint server domain 140. One embodiment of the fingerprint server domain 140 includes one or more fingerprint servers directly connected to the network (not shown in Fig. 1), such that it directly receives the information transmitted by each protect agent. In another embodiment, one or more fingerprint servers (131 - 135) are connected to a fingerprint server router 130, such that more protect agents can be served with improved efficiency and reduced latency. The fingerprint server router 130 is connected to the network and serves as the gatekeeper for all the information received from the various protect agents through the network 125.
[0025] One of the functions of the fingerprint server router 130 is to collect performance and logistics information from each of the fingerprint servers and route any information received from the protect agents to the fingerprint server that is least busy, hi one embodiment, the fingerprint servers could be located at different geographical locations (not shown in Fig. 1) and connect to the fingerprint server router 130 through the network. This distributed model would allow organizations to run protect agents with minimal performance lag across geographically diverse locations, such that information from the protect agents are routed to the most optimal fingerprint server.
[0026] Regardless of whether a single fingerprint server is used or a suite of fingerprint servers are used, every fingerprint server contains at least one fingerprint database. The fingerprint data base is a repository of fingerprints representing the secure information that the organization intends to protect. In one embodiment, the fingerprint server router 130 is responsible for keeping the redundant fingerprint databases in every fingerprint server up to date. It should be noted that the fingerprint server router is not imperative to maintaining a distributed fingerprint server array. Any other means known in the art through which a distributed network can be achieved can be employed in the place of the fingerprint server router 130. More information on fingerprints and the generation of fingerprints is provided further below.
[0027] Fig. 2 is a flowchart depicting one embodiment of a method to achieve fingerprinting across remote agents, hi this method, a protect agent is first installed 210 at the location of the various egress points. As discussed above, some examples of where the protect agent could be installed include a desktop computer, a print server, an email server, etc. In one embodiment, the protect agent is a set of instructions or software modules copied to a physical memory on the egress point location. Examples of the physical memory include magnetic tapes, optical disks, flash memory devices, etc. Once the protect agent is installed at a particular egress point location, it monitors all the activity at that particular egress point. For example, a protect agent installed on a desktop computer would monitor all print jobs sent by the user to a printer directly attached to the desktop computer. In the course of monitoring the activity at egress points, the protect agent receives the information 215 that the user intends to disclose through one of the egress points.
[0028] The protect agent then transmits the user input information to the fingerprint server connected to the network. The protect agent transmits this information through the network. In one embodiment, the mechanism through which the protect agent and the fingerprint server communicate includes web service calls. Using the web service call standard or a similar standard (as understood by people skilled in the art) allows interoperability between different operating systems and computer language environments. These standards also allow the fingerprint lookups to operate as a service that can be published and integrated with third-parties. As indicated above, the network could either be a local network maintained by the organization, or could be the public internet, or a combination of the local network and the public internet. [0029] The information transmitted by the protect agent to the fingerprint server could be in several formats. In one embodiment, the protect agent directly transmits the digital information 220 that the user intends to disclose. Examples of such digital information include text files, audio files, video files, etc. These examples also include other forms of data, such as software code, design data (e.g., VLSI or CAD design files), or any other digital form of data that an organization wishes to protect, hi such cases, the protect agent transmits the information as-is, or encrypts the files before transmission to ensure the security of the transmitted information. The encryption can be done with any of the standard encryption algorithms known to people skilled in the art.
[0030] In another embodiment, the protect agent converts the information received from the user to a raw text format 225 before transmission to the fingerprint server. One advantage of converting the files to raw text is that it decreases the size of the file being sent over, thus reducing network congestion and file lookup latency. Additionally, processing the files at the site of the protect agents relieves the fingerprint server of some of the computational burden from handling the user input information received from all protect agents. The protect agents may additionally encrypt the raw text before transmission. There are several methods widely known in the field of art to convert a digital file to raw text. One such method is described in the U.S. Application no. 12/177,043, describing how a digital text file can be converted to raw text.
[0031] In one other embodiment, the protect agent converts the digital information to fingerprints 230 before transmission to the fingerprint server. Fingerprinting the information helps achieve a file size reduction, thus ensuring the advantages of reducing network congestion and lookup latency. The fingerprint servers are also freed up from the task of generating fingerprints, and therefore are relieved from the computational burden imposed by the several protect agents they communicate with. Additionally, because the fingerprints inherently add security to the information being transmitted, this method obviates the need for additional encryption of the transmitted files. There are several methods widely known in the field of art to generate fingerprints from digital information. One such method is described in the U.S. Application no. 12/177,043, providing how fingerprints are generated from digital text information.
[0032] The fingerprint server receives the information transmitted by the protect agent. If the information received is not in the form of fingerprints, the fingerprint server generates the fingerprints after receiving the information from the protect agent. Otherwise, the received fingerprints are used as-is. The fingerprint server, as discussed above, contains a database of fingerprints that represent the secure information for a particular organization. The fingerprint server is primarily a computer capable of performing arithmetic and logic operations. The fingerprint server compares the fingerprints associated with the user input information (the client fingerprints) with the fingerprints contained in the fingerprint server 235. Based on the results of the comparison, the fingerprint server generates a comparison analysis and transmits this analysis back to the protect agent 240. The fingerprint server contains a set of instructions or suitable software available in one of its memory locations to perform the comparison analysis. After completing the comparison analysis, the fingerprint server transmits the data to the protect agent utilizing the network.
[0033] Fig. 3 is a flowchart depicting another embodiment of a method to achieve fingerprinting across remote agents. Here, protect agents are first installed at various egress point locations 310. The protect agents residing at the location of the egress points receive the information a user intends to disclose through those particular egress points 315. In one embodiment, the protect agent generates fingerprints from information that the user desires to disclose 315. After generating the fingerprints, the protect agent transmits the fingerprints to the fingerprint server, utilizing the network 330. The network, as discussed above, could either be a local network 335 or the public internet 340. [0034] The fingerprint server is at a location remote from the protect agents. This fingerprint server contains a database of registered fingerprints 325. The registered fingerprints represent the secure digital information of a particular organization. The fingerprint server receives the fingerprints transmitted by the protect agents (the client fingerprints), and compares the received fingerprints with the registered fingerprints 345. The fingerprint server then transmits the results of the comparison back to the protect agent. If the protect agent receives information that one or more client fingerprints match the registered fingerprints, it takes an appropriate security action 350. Some examples of the security action include preventing the information from being transmitted out through the associated egress point, sending out a security alert to a system administrator, revoking the user's access to the particular information, alerting the user of the security violation, etc. The security actions may also include integration with third party software to offer security solutions (e.g., integration with Microsoft Windows® RMS to apply rights management to the information being disclosed). It is understood that these examples of security actions are used for illustrative purposes only, and that other security actions known to people skilled in the art are equally applicable here.
[0035] Fig. 4 is a flowchart depicting an embodiment of a combined network, where a combination of a local network and the public internet is utilized by the remote protect agents. Here, the protect agents are installed at every egress point at the client side 410. The protect agents monitor activity on the client, and receive information that a user intends to disclose outside of the organization through one of the egress points 415. In one embodiment, the protect agents generate fingerprints from the digital information input by the user 420. Redundant copies of the fingerprint database are maintained on several fingerprint serves such that at least one fingerprint server is connected to the local network 455, 450, and at least one fingerprint server is available as a hosted service connected to the internet 430, 435.
[0036] In one implementation of the embodiment, the protect agent determines whether the client is connected to a local network 425. If the protect agent determines that the client is connected to the local network, it transmits the fingerprints to the fingerprint server connected to the local network. The fingerprint server connected to the local network compares the fingerprints received from the client against the registered fingerprints contained in the fingerprint server 445. On the other hand, if the protect agent determines that the client is not connected to the local network (e.g., when the user uses his laptop computer from a public cafe), the fingerprints corresponding to information he attempts to disclose are transmitted to the hosted fingerprint server connected to the internet. This hosted fingerprint server compares the client fingerprints against the registered fingerprints to determine if there are any matches 445. If a match is detected by either fingerprint server, a suitable security action is taken 460.
[0037] The systems explained above and associated embodiments relate to apparatus for performing the operations herein. This apparatus may be specially constructed for the required purposes, or it may comprise a general purpose computer selectively activated or reconfigured by a computer program stored in the computer. Such a computer program may be stored in a computer readable storage medium, such as, but is not limited to, any type of disk including floppy disks, optical disks, CD-ROMs, and magnetic-optical disks, read-only memories (ROMs), random access memories (RAMs), EPROMs, EEPROMs, magnetic or optical cards, or any type of media suitable for storing electronic instructions, each coupled to a computer system.
[0038] The algorithms and software presented herein are not inherently related to any particular computer or other apparatus. Various general purpose systems may be used with programs in accordance with the teachings herein, or it may prove convenient to construct more specialized apparatus to perform the required method steps. The required structure for a variety of these systems will appear from other portions of this description, hi addition, the present invention is not described with reference to any particular programming language, and various embodiments may thus be implemented using a variety of programming languages.
[0039] In addition to the above mentioned examples, various other modifications and alterations of the invention may be made without departing from the invention. Accordingly, the above disclosure is not to be considered as limiting and the appended claims are to be interpreted as encompassing the true spirit and the entire scope of the invention.

Claims

CLAIMSWe claim:
1. A computer implemented method for protecting an organization's secure information from unauthorized disclosure, the computer implemented method comprising:
implementing a first protect agent at a first egress point, wherein the first protect agent receives input information that a user desires to transmit outside of a given organization, and wherein the first egress point represents means by which the input information is transmitted outside of the given organization;
transmitting the input information from the first protect agent to a remote fingerprint server utilizing a network, wherein the remote fingerprint server includes a database of registered fingerprints; and
generating a comparison analysis by comparing a set of client fingerprints associated with the input information transmitted by the first protect agent against the database of registered fingerprints included in the remote fingerprint server.
2. A computer implemented method for protecting an organization's secure information from unauthorized disclosure as recited in claim 1 , the computer implemented method further comprising:
transmitting the comparison analysis back to the first protect agent utilizing the network.
3. A computer implemented method for protecting an organization's secure information from unauthorized disclosure as recited in claim 1, wherein the first egress point includes a printer.
4. A computer implemented method for protecting an organization's secure information from unauthorized disclosure as recited in claim 1, wherein the first egress point includes a removable data storage medium.
5. A computer implemented method for protecting an organization's secure information from unauthorized disclosure as recited in claim 1, wherein the first egress point includes an email server connected to the network.
6. A computer implemented method for protecting an organization's secure information from unauthorized disclosure as recited in claim 1, wherein the first egress point includes a print server connected to the network.
7. A computer implemented method for protecting an organization's secure information from unauthorized disclosure as recited in claim 1, wherein the first egress point includes a network appliance connected to the network.
8. A computer implemented method for protecting an organization's secure information from unauthorized disclosure as recited in claim 1, wherein the first egress point includes a clipboard associated with a local operating system.
9. A computer implemented method for protecting an organization's secure information from unauthorized disclosure as recited in claim 1, wherein the input information that the user desires to transmit outside of the given organization includes digital data.
10. A computer implemented method for protecting an organization's secure information from unauthorized disclosure as recited in claim 1 , wherein the set of client fingerprints is generated at the location of the first protect agent such that the input information transmitted to the remote fingerprint server includes the set of client fingerprints.
11. A computer implemented method for protecting an organization's secure information from unauthorized disclosure as recited in claim 1 , wherein the set of client fingerprints is generated at the remote fingerprint server.
12. A computer implemented method for protecting an organization's secure information from unauthorized disclosure as recited in claim 11 , wherein a security feature is included in the input information transmitted to the remote fingerprint server.
13. A computer implemented method for protecting an organization's secure information from unauthorized disclosure as recited in claim 12, wherein the security feature includes encrypting the input information before transmission.
14. A computer implemented method for protecting an organization's secure information from unauthorized disclosure as recited in claim 1, wherein the network includes a local network.
15. A computer implemented method for protecting an organization's secure information from unauthorized disclosure as recited in claim 14, wherein the local network is inherent to the given organization such that the remote fingerprint server communicates with the first protect agent utilizing the local network.
16. A computer implemented method for protecting an organization's secure information from unauthorized disclosure as recited in claim 1, wherein the network includes a public internet.
17. A computer implemented method for protecting an organization's secure information from unauthorized disclosure as recited in claim 16, wherein the remote fingerprint server communicates with the first protect agent utilizing the public internet.
18. A computer implemented method for protecting an organization's secure information from unauthorized disclosure as recited in claim 17, wherein the remote fingerprint server is hosted and maintained by a hosted fingerprint service provider.
19. A computer implemented method for protecting an organization's secure information from unauthorized disclosure as recited in claim 18, wherein the hosted fingerprint service provider is not inherent to the given organization, and wherein the hosted fingerprint service provider maintains distinct databases of registered fingerprints for one or more organizations.
20. A computer implemented method for protecting an organization's secure information from unauthorized disclosure as recited in claim 1, wherein the network includes a local network and a public internet, such that:
the remote fingerprint server communicates with the first protect agent utilizing the local network when the first protect agent is connected to the local network; or
the remote fingerprint server communicates with the first protect agent utilizing the public internet when the first protect agent is disconnected from the local network.
21. A computer implemented method for protecting an organization's secure information from unauthorized disclosure as recited in claim 1 , the computer implemented method further comprising:
maintaining a plurality of remote fingerprint servers, wherein each of the plurality of the remote fingerprint servers includes the database of registered fingerprints.
22. A computer implemented method for protecting an organization's secure information from unauthorized disclosure as recited in claim 21, wherein the plurality of remote fingerprint servers are connected to the network.
23. A computer implemented method for protecting an organization's secure information from unauthorized disclosure as recited in claim 21, wherein requests from the plurality of protect agents is routed to a specific remote fingerprint server based on a load distribution.
24. A computer implemented method for protecting an organization's secure information from unauthorized disclosure as recited in claim 21, wherein one or more of the plurality of remote fingerprint servers are located in geographically diverse locations.
25. A computer implemented method for protecting an organization's secure information from unauthorized disclosure as recited in claim 1, wherein communication between the first protect agent and the remote fingerprint server is by means of web service calls.
26. A computer implemented method for protecting an organization's secure information from unauthorized disclosure as recited in claim 1 , wherein one or more client fingerprints from the set of client fingerprints is cached at the location of the first protect agent.
27. A computer implemented method for protecting an organization's secure information from unauthorized disclosure, the computer implemented method comprising:
storing a plurality of original fingerprints in a remote fingerprint server connected to a network, wherein the plurality of original fingerprints represents secure information of a given organization;
using a protect agent associated with an egress point to receive a first data that a user desires to transmit outside of a given organization, wherein the egress point represents the means by which the user desires to transmit the first data outside of the given organization;
generating a first set of client fingerprints for the first data;
transmitting the first set of client fingerprints to the remote fingerprint server utilizing the network; and
performing a lookup analysis in the remote fingerprint server, wherein the lookup analysis determines whether any of the first set of client fingerprints is identical to any of the plurality of original fingerprints stored in the remote fingerprint server.
28. A computer implemented method for protecting an organization's secure information from unauthorized disclosure as recited in claim 27, wherein the computer implemented method further comprises:
transmitting results of the lookup analysis back to the protect agent.
29. A computer implemented method for protecting an organization's secure information from unauthorized disclosure as recited in claim 27, wherein the egress point includes at least one of:
a printer;
a removable data storage medium;
a clipboard associated with a local operating system; an email server connected to the network;
a print server connected to the network; or
a network appliance connected to the network.
30. A computer implemented method for protecting an organization's secure information from unauthorized disclosure as recited in claim 27, wherein the first data includes digital data.
31. A computer implemented method for protecting an organization's secure information from unauthorized disclosure as recited in claim 27, the computer implemented method further comprising:
taking a security action in response to the lookup analysis indicating that at least one of the first set of client fingerprints is identical to one of the plurality of original fingerprints stored in the remote fingerprint server.
32. A computer implemented method for protecting an organization's secure information from unauthorized disclosure as recited in claim 31, wherein the security action includes at least one of:
preventing the first data from being disclosed;
logging the event as a security violation;
requiring a password from the user to allow the first data to be disclosed;
blocking the user's access to the first data; sending out a security alert; or integration of first data with rights management information.
33. A computer implemented method for protecting an organization's secure information from unauthorized disclosure as recited in claim 27, wherein the network includes a local network.
34. A computer implemented method for protecting an organization's secure information from unauthorized disclosure as recited in claim 33, wherein the local network is inherent to the given organization such that the remote fingerprint server communicates with the protect agent utilizing the local network.
35. A computer implemented method for protecting an organization's secure information from unauthorized disclosure as recited in claim 27, wherein the network includes public internet.
36. A computer implemented method for protecting an organization's secure information from unauthorized disclosure as recited in claim 35, wherein the remote fingerprint server communicates with the protect agent utilizing the public internet.
37. A computer implemented method for protecting an organization's secure information from unauthorized disclosure as recited in claim 36, wherein the remote fingerprint server is hosted and maintained by a hosted fingerprint service provider.
38. A computer implemented method for protecting an organization's secure information from unauthorized disclosure as recited in claim 37, wherein the hosted fingerprint service provider is not inherent to the given organization, and wherein the hosted fingerprint service provider maintains distinct databases of registered fingerprints for one or more organizations.
39. A computer implemented method for protecting an organization's secure information from unauthorized disclosure as recited in claim 27, wherein the network includes a local network and a public internet, such that: the remote fingerprint server communicates with the protect agent utilizing the local network when the protect agent is connected to the local network; or
the remote fingerprint server communicates with the protect agent utilizing the public internet when the protect agent is disconnected from the local network.
40. A computer implemented method for protecting an organization's secure information from unauthorized disclosure as recited in claim 27, the computer implemented method further comprising:
maintaining a plurality of remote fingerprint servers, wherein each of the plurality of the remote fingerprint servers stores the plurality of original fingerprints.
41. A computer implemented method for protecting an organization's secure information from unauthorized disclosure as recited in claim 40, wherein the plurality of remote fingerprint servers are connected to the network.
42. A computer implemented method for protecting an organization's secure information from unauthorized disclosure as recited in claim 40, wherein requests from a specific protect agent is routed to a specific remote fingerprint server based on a load distribution.
43. A computer implemented method for protecting an organization's secure information from unauthorized disclosure as recited in claim 40, wherein one or more of the plurality of remote fingerprint servers are located in geographically diverse locations.
44. A computer implemented method for protecting an organization's secure information from unauthorized disclosure as recited in claim 27, wherein communication between the protect agent and the remote fingerprint server is by means of web service calls.
45. A computer implemented method for protecting an organization's secure information from unauthorized disclosure as recited in claim 27, wherein one or more client fingerprints from the first set of client fingerprints is cached at the location of the protect agent.
46. A computer implemented system for protecting an organization's secure information from unauthorized disclosure, the computer implemented system comprising:
means for implementing a first protect agent at a first egress point, wherein the first protect agent receives input information that a user desires to transmit outside of a given organization, and wherein the first egress point represents means by which the information is transmitted outside of the given organization;
means for transmitting the input information from the first protect agent to a remote fingerprint server utilizing a network, wherein the remote fingerprint server includes a database of registered fingerprints; and
means for generating a comparison analysis by comparing a set of client fingerprints associated with the input information transmitted by the first protect agent against the database of registered fingerprints included in the remote fingerprint server.
47. A computer implemented system for protecting an organization's secure information from unauthorized disclosure as recited in claim 46, the system further comprising:
means for transmitting the comparison analysis back to the given protect agent utilizing the network.
48. A computer implemented system for protecting an organization's secure information from unauthorized disclosure as recited in claim 46, wherein the first egress point includes at least one of:
a printer;
a removable data storage medium;
a clipboard associated with a local operating system; an email server connected to the network;
a print server connected to the network; or
a network appliance connected to the network.
49. A computer implemented system for protecting an organization's secure information from unauthorized disclosure as recited in claim 46, wherein the input information includes digital data.
50. A computer implemented system for protecting an organization's secure information from unauthorized disclosure as recited in claim 46, wherein the set of client fingerprints is generated at the location of the first protect agent such that the input information transmitted to the remote fingerprint server includes the set of client fingerprints.
51. A computer implemented system for protecting an organization's secure information from unauthorized disclosure as recited in claim 46, wherein the set of client fingerprints is generated at the remote fingerprint server.
52. A computer implemented system for protecting an organization's secure information from unauthorized disclosure as recited in claim 51, wherein a security feature is included in the input information transmitted to the remote fingerprint server.
53. A computer implemented system for protecting an organization's secure information from unauthorized disclosure as recited in claim 52, wherein the security feature includes encrypting the input information before transmission.
54. A computer implemented system for protecting an organization's secure information from unauthorized disclosure as recited in claim 46, wherein the network includes a local network.
55. A computer implemented system for protecting an organization's secure information from unauthorized disclosure as recited in claim 54, wherein the local network is inherent to the given organization such that the remote fingerprint server communicates with the first protect agent utilizing the local network.
56. A computer implemented system for protecting an organization's secure information from unauthorized disclosure as recited in claim 46, wherein the network includes public internet.
57. A computer implemented system for protecting an organization's secure information from unauthorized disclosure as recited in claim 56, wherein the remote fingerprint server communicates with the first protect agent utilizing the public internet.
58. A computer implemented system for protecting an organization's secure information from unauthorized disclosure as recited in claim 56, wherein the remote fingerprint server is hosted and maintained by a hosted fingerprint service provider.
59. A computer implemented system for protecting an organization's secure information from unauthorized disclosure as recited in claim 58, wherein the hosted fingerprint service provider is not inherent to the given organization, and wherein the hosted fingerprint service provider maintains distinct databases of registered fingerprints for one or more organizations.
60. A computer implemented system for protecting an organization's secure information from unauthorized disclosure as recited in claim 46, wherein the network includes a local network and a public internet, such that: the remote fingerprint server communicates with the first protect agent utilizing the local network when the first protect agent is connected to the local network; or
the remote fingerprint server communicates with the first protect agent utilizing the public internet when the first protect agent is disconnected from the local network.
61. A computer implemented system for protecting an organization's secure information from unauthorized disclosure as recited in claim 46, the computer implemented system further comprising: a plurality of remote fingerprint servers, wherein each of the plurality of the remote fingerprint servers includes the database of registered fingerprints.
62. A computer implemented system for protecting an organization's secure information from unauthorized disclosure as recited in claim 61, wherein the plurality of remote fingerprint servers are connected to the network.
63. A computer implemented system for protecting an organization's secure information from unauthorized disclosure as recited in claim 61, wherein requests from the given protect agent is routed to a specific remote fingerprint server based on a load distribution.
64. A computer implemented system for protecting an organization's secure information from unauthorized disclosure as recited in claim 61, wherein one or more of the plurality of remote fingerprint servers are located in geographically diverse locations.
65. A computer implemented system for protecting an organization's secure information from unauthorized disclosure as recited in claim 46, wherein communication between the first protect agent and the remote fingerprint server is by means of web service calls.
66. A computer implemented system for protecting an organization's secure information from unauthorized disclosure as recited in claim 46, wherein one or more client fingerprints from the set of client fingerprints is cached at the location of the first protect agent.
67. A computer implemented system for protecting an organization's secure information from unauthorized disclosure, the computer implemented system comprising:
a remote fingerprint server to store a plurality of original fingerprints, wherein the plurality of original fingerprints represents secure information of a given organization;
means for implementing a protect agent that is associated with an egress point, wherein the protect agent receives a first data that a user desires to transmit outside of a given organization, and wherein the egress point represents means by which the user desires to transmit the first data outside of the given organization;
means for generating a first set of client fingerprints for the first data;
means for transmitting the first set of client fingerprints to the remote fingerprint server utilizing the network; and
means for performing a lookup analysis in the remote fingerprint server, wherein the lookup analysis determines whether any of the first set of client fingerprints is identical to any of the plurality of original fingerprints stored in the remote fingerprint server.
PCT/US2009/056651 2008-09-11 2009-09-11 Methods and systems to implement fingerprint lookups across remote agents WO2010030871A2 (en)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
US12/209,096 2008-09-11
US12/209,096 US9473512B2 (en) 2008-07-21 2008-09-11 Methods and systems to implement fingerprint lookups across remote agents

Publications (2)

Publication Number Publication Date
WO2010030871A2 true WO2010030871A2 (en) 2010-03-18
WO2010030871A3 WO2010030871A3 (en) 2010-06-17

Family

ID=41800303

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/US2009/056651 WO2010030871A2 (en) 2008-09-11 2009-09-11 Methods and systems to implement fingerprint lookups across remote agents

Country Status (1)

Country Link
WO (1) WO2010030871A2 (en)

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US9473512B2 (en) 2008-07-21 2016-10-18 Workshare Technology, Inc. Methods and systems to implement fingerprint lookups across remote agents

Citations (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
KR20010078840A (en) * 2001-04-17 2001-08-22 유성경 Security System detecting the leak of information using computer storage device
US20020138744A1 (en) * 2001-03-21 2002-09-26 Schleicher Jorg Gregor Method and system for providing a secure peer-to peer file delivery network
US20020164058A1 (en) * 2001-05-04 2002-11-07 International Business Machines Corporation Remote authentication of fingerprints over an insecure network
KR20060048686A (en) * 2004-06-30 2006-05-18 마이크로소프트 코포레이션 Method and system for detecting when an outgoing communication contains certain content
US20070025265A1 (en) * 2005-07-22 2007-02-01 Porras Phillip A Method and apparatus for wireless network security
KR20080029602A (en) * 2006-09-29 2008-04-03 한국전자통신연구원 Method and apparatus for preventing confidential information leak

Patent Citations (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20020138744A1 (en) * 2001-03-21 2002-09-26 Schleicher Jorg Gregor Method and system for providing a secure peer-to peer file delivery network
KR20010078840A (en) * 2001-04-17 2001-08-22 유성경 Security System detecting the leak of information using computer storage device
US20020164058A1 (en) * 2001-05-04 2002-11-07 International Business Machines Corporation Remote authentication of fingerprints over an insecure network
KR20060048686A (en) * 2004-06-30 2006-05-18 마이크로소프트 코포레이션 Method and system for detecting when an outgoing communication contains certain content
US20070025265A1 (en) * 2005-07-22 2007-02-01 Porras Phillip A Method and apparatus for wireless network security
KR20080029602A (en) * 2006-09-29 2008-04-03 한국전자통신연구원 Method and apparatus for preventing confidential information leak

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US9473512B2 (en) 2008-07-21 2016-10-18 Workshare Technology, Inc. Methods and systems to implement fingerprint lookups across remote agents

Also Published As

Publication number Publication date
WO2010030871A3 (en) 2010-06-17

Similar Documents

Publication Publication Date Title
US9614813B2 (en) Methods and systems to implement fingerprint lookups across remote agents
US8555080B2 (en) Methods and systems for protect agents using distributed lightweight fingerprints
US11057355B2 (en) Protecting documents using policies and encryption
US11695547B2 (en) Sharing encrypted documents within and outside an organization
US7882035B2 (en) Pre-performing operations for accessing protected content
US8752150B2 (en) System and method for information handling system multi-level authentication for backup services
US7725716B2 (en) Methods and systems for encrypting, transmitting, and storing electronic information and files
US8141129B2 (en) Centrally accessible policy repository
US20070101124A1 (en) Secure provisioning of digital content
JP2007241513A (en) Equipment monitoring device
CN101554010A (en) Systems and methods for document control using public key encryption
EP3356978B1 (en) Applying rights management policies to protected files
US20090158052A1 (en) Image processing apparatus for checking unauthorized access to information and method of performing the same
GB2483648A (en) Obfuscation of data elements in a message associated with a detected event of a defined type
US20180129819A1 (en) Redacting restricted content in files
US8353053B1 (en) Computer program product and method for permanently storing data based on whether a device is protected with an encryption mechanism and whether data in a data structure requires encryption
KR20060096887A (en) Method and computer-readable medium for generating usage rights for an item based upon access rights
US8402278B2 (en) Method and system for protecting data
US9355226B2 (en) Digital rights management system implemented on a scanner
JP2007179202A (en) Electronic business form server, client, electronic business form system, information providing method, information using method, service providing method, server program, client program, and storage medium
WO2010030871A2 (en) Methods and systems to implement fingerprint lookups across remote agents
US7886147B2 (en) Method, apparatus and computer readable medium for secure conversion of confidential files
US20230010179A1 (en) Backing up confidential data to user devices on the same local network
KR20140051479A (en) Document distribution management system and methods
Adeppa Security analysis in cloud computing environment

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 09813666

Country of ref document: EP

Kind code of ref document: A2

NENP Non-entry into the national phase in:

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 09813666

Country of ref document: EP

Kind code of ref document: A2