Classifications

• • H—ELECTRICITY
  • H04—ELECTRIC COMMUNICATION TECHNIQUE
  • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
  • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
  • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
  • H04L9/3236—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials using cryptographic hash functions
  • H04L9/3239—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials using cryptographic hash functions involving non-keyed hash functions, e.g. modification detection codes [MDCs], MD5, SHA or RIPEMD
• • G—PHYSICS
  • G06—COMPUTING OR CALCULATING; COUNTING
  • G06F—ELECTRIC DIGITAL DATA PROCESSING
  • G06F16/00—Information retrieval; Database structures therefor; File system structures therefor
  • G06F16/10—File systems; File servers
  • G06F16/14—Details of searching files based on file metadata
  • G06F16/148—File search processing
  • G06F16/152—File search processing using file content signatures, e.g. hash values
• • G—PHYSICS
  • G06—COMPUTING OR CALCULATING; COUNTING
  • G06F—ELECTRIC DIGITAL DATA PROCESSING
  • G06F16/00—Information retrieval; Database structures therefor; File system structures therefor
  • G06F16/20—Information retrieval; Database structures therefor; File system structures therefor of structured data, e.g. relational data
  • G06F16/22—Indexing; Data structures therefor; Storage structures
  • G06F16/2228—Indexing structures
• • G—PHYSICS
  • G06—COMPUTING OR CALCULATING; COUNTING
  • G06F—ELECTRIC DIGITAL DATA PROCESSING
  • G06F16/00—Information retrieval; Database structures therefor; File system structures therefor
  • G06F16/60—Information retrieval; Database structures therefor; File system structures therefor of audio data
  • G06F16/68—Retrieval characterised by using metadata, e.g. metadata not derived from the content or metadata generated manually
  • G06F16/683—Retrieval characterised by using metadata, e.g. metadata not derived from the content or metadata generated manually using metadata automatically derived from the content
• • G—PHYSICS
  • G06—COMPUTING OR CALCULATING; COUNTING
  • G06F—ELECTRIC DIGITAL DATA PROCESSING
  • G06F16/00—Information retrieval; Database structures therefor; File system structures therefor
  • G06F16/70—Information retrieval; Database structures therefor; File system structures therefor of video data
  • G06F16/78—Retrieval characterised by using metadata, e.g. metadata not derived from the content or metadata generated manually
  • G06F16/783—Retrieval characterised by using metadata, e.g. metadata not derived from the content or metadata generated manually using metadata automatically derived from the content
• • G—PHYSICS
  • G06—COMPUTING OR CALCULATING; COUNTING
  • G06F—ELECTRIC DIGITAL DATA PROCESSING
  • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
  • G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
  • G06F21/55—Detecting local intrusion or implementing counter-measures
  • G06F21/56—Computer malware detection or handling, e.g. anti-virus arrangements
• • G—PHYSICS
  • G06—COMPUTING OR CALCULATING; COUNTING
  • G06F—ELECTRIC DIGITAL DATA PROCESSING
  • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
  • G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
  • G06F21/57—Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities
  • G06F21/577—Assessing vulnerabilities and evaluating computer system security
• • G—PHYSICS
  • G06—COMPUTING OR CALCULATING; COUNTING
  • G06F—ELECTRIC DIGITAL DATA PROCESSING
  • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
  • G06F21/60—Protecting data
  • G06F21/64—Protecting data integrity, e.g. using checksums, certificates or signatures
  • G06F21/645—Protecting data integrity, e.g. using checksums, certificates or signatures using a third party
• • H—ELECTRICITY
  • H04—ELECTRIC COMMUNICATION TECHNIQUE
  • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
  • H04L63/00—Network architectures or network communication protocols for network security
• • G—PHYSICS
  • G06—COMPUTING OR CALCULATING; COUNTING
  • G06F—ELECTRIC DIGITAL DATA PROCESSING
  • G06F2201/00—Indexing scheme relating to error detection, to error correction, and to monitoring
  • G06F2201/83—Indexing scheme relating to error detection, to error correction, and to monitoring the solution involving signatures

Definitions

• the illustrated clients include a laptop computer 1 10, a printer/fax/scanner 1 12, a server 1 14, a desktop computer 116, and a handheld computing device (e.g., a PDA, smartphone, etc.) 118.
• the content reputation service 102 may, for example, accept, aggregate, store, and furnish upon request claims about digital content (files or any other type of data). Additionally, in some embodiments, steps may be taken to ensure that only trusted parties are allowed to submit claims to the service 102. In such embodiments, claims submitted from unknown or un-trusted clients will not be accepted. In some embodiments, there are no restrictions as to which clients are allowed to lookup existing claims.
• any modification to the data will lead to a different calculated fingerprint.
• any modification to a file will automatically disassociate the file with all previously issued claims.
• Issuer Entity that issued this claim. This may, for example, identify a particular application, service, user, etc.
• all content claims may be stored in centralized relational database 108 with the fingerprint used as the primary key.
• a server 106 may formulate a database query using the fingerprint included in the client request as the primary key (step 604). If a matching fingerprint exists in the database 108 (step 606), the server 106 may retrieve the claim(s) associated with the fingerprint (step 608), filter those claims according to any criteria specified by the client (step 609), and return the filtered claim data (which may be either a subset of the retrieved claim data or the entire claim set if filtering is not employed or if no filtering criteria are specified by the client) to the requesting client (step 610).
• the server 106 may inform the client that no matching claims were found (step 612).
• the content reputation service 102 may thus identify any claims that are associated with a given piece of data by comparing a calculated fingerprint for the data (received from the client) with a fingerprint stored in the database that is associated with the claims for the data in question.
• content claims may be created when data is subjected to a certain type of analysis for the first time within the system 100. Thereafter, as data travels within the system and needs to be accessed, previously issued claims may be used in order to get necessary information about the data without analyzing it all over again. In some embodiments, additional claims about data may be added when new types of scans are performed on the data, thus extending the claim set with new information.
• the following practical example illustrates how the content reputation service 102 may be employed to minimize the resources that need to be devoted to examining the content of a particular piece of data.
• a document file e.g., a MICROSOFT WORD ® document
• the organization's edge server may scan the attachment, determine that it is free of virus, spyware, and malicious URLs, and create three claims with the content reputation service 102.
• the recipient may then, for example, receive the file and upload it to the
• SHAREPOINT ® site (Suppose that the security policy that is enforced on this SHAREPOINT ® site requires that all files be scanned for viruses, spyware, malicious URLs, and DLP.) During upload, the security scanner for the
• the overhead caused by interaction with the content reputation service 102 may be significantly lower than that of an actual scan or other data evaluation process. It should also be noted that, in some embodiments, inclusion of additional data inspection processes (which increases scan/evaluation time) will not have an adverse effect on claim submission and lookup time.
• the content reputation service 102 may export a content claim or claim set as digitally signed file, e.g., an XML file.
• This "content certificate” may, for example, be delivered with or without (if the recipient already possesses this data) corresponding data to parties who for one reason or another have no access to the content reputation service and cannot communicate with it directly. Despite this fact, the recipient may reliably verify the validity of the content certificate, and, if valid, may decide to trust some or all of the included content claims.
• Fig. 7 shows an example of how the claim set shown in Fig. 4 may appear when exported as a content certificate.
• Such an XML file may, for example, be signed using enveloped XML digital signature.
• the recipient of such a file may first verify the digital signature, to make sure that integrity of the XML is intact. If the signature is valid, the recipient may, for example, calculate the fingerprint of the data using an algorithm specified in the XML. If resulting value matches the fingerprint value in the XML, then the recipient may determine that all claims in this XML file are relevant to the data and can be trusted.
• the recipient of such a content certificate is able to identify one or more claims that are associated with a given piece of data by comparing the calculated fingerprint for the data with a fingerprint included in the content certificate that also contains the claim(s).
• a verification tool may be provided that automates verification of such content certificates.
• content certificates for data items may also offer some additional flexibility when the data item itself has been modified.
• at least some reclassification of content e.g. PII, HBI, etc.
• classification technology that generates a "soft hash" which can be used to determine how close the document is to the original.
• the entire reclassification process may be avoided.
• the above-described embodiments of the present invention can be implemented in any of numerous ways.
• the embodiments may be implemented using hardware, software or a combination thereof.
• the software code can be executed on any suitable processor or collection of processors, whether provided in a single computer or distributed among multiple computers.
• processors may be implemented as integrated circuits, with one or more processors in an integrated circuit component.
• a processor may be implemented using circuitry in any suitable format.
• a computer may be embodied in any of a number of forms, such as a rack-mounted computer, a desktop computer, a laptop computer, or a tablet computer. Additionally, a computer may be embedded in a device not generally regarded as a computer but with suitable processing capabilities, including a Personal Digital Assistant (PDA), a smart phone or any other suitable portable or fixed electronic device.
• PDA Personal Digital Assistant
• a computer may have one or more input and output devices. These devices can be used, among other things, to present a user interface. Examples of output devices that can be used to provide a user interface include printers or display screens for visual presentation of output and speakers or other sound generating devices for audible presentation of output. Examples of input devices that can be used for a user interface include keyboards, and pointing devices, such as mice, touch pads, and digitizing tablets. As another example, a computer may receive input information through speech recognition or in other audible format.
• Such computers may be interconnected by one or more networks in any suitable form, including as a local area network or a wide area network, such as an enterprise network or the Internet.
• networks may be based on any suitable technology and may operate according to any suitable protocol and may include wireless networks, wired networks or fiber optic networks.
• the various methods or processes outlined herein may be coded as software that is executable on one or more processors that employ any one of a variety of operating systems or platforms. Additionally, such software may be written using any of a number of suitable programming languages and/or programming or scripting tools, and also may be compiled as executable machine language code or intermediate code that is executed on a framework or virtual machine.
• non-transitory computer-readable storage medium encompasses only a computer-readable medium that can be considered to be a manufacture (i.e., article of manufacture) or a machine.
• Computer-executable instructions may be in many forms, such as program modules, executed by one or more computers or other devices.
• program modules include routines, programs, objects, components, data structures, etc. that perform particular tasks or implement particular abstract data types.
• functionality of the program modules may be combined or distributed as desired in various embodiments.
• data structures may be stored in computer-readable media in any suitable form.
• data structures may be shown to have fields that are related through location in the data structure. Such relationships may likewise be achieved by assigning storage for the fields with locations in a computer-readable medium that conveys relationship between the fields.
• any suitable mechanism may be used to establish a relationship between information in fields of a data structure, including through the use of pointers, tags or other mechanisms that establish relationship between data elements.

Landscapes

• Engineering & Computer Science (AREA)
• Computer Security & Cryptography (AREA)
• Theoretical Computer Science (AREA)
• General Engineering & Computer Science (AREA)
• Computer Hardware Design (AREA)
• Software Systems (AREA)
• Physics & Mathematics (AREA)
• General Physics & Mathematics (AREA)
• Databases & Information Systems (AREA)
• General Health & Medical Sciences (AREA)
• Computing Systems (AREA)
• Computer Networks & Wireless Communication (AREA)
• Signal Processing (AREA)
• Health & Medical Sciences (AREA)
• Data Mining & Analysis (AREA)
• Library & Information Science (AREA)
• Bioethics (AREA)
• Virology (AREA)
• Multimedia (AREA)
• Storage Device Security (AREA)
• Information Transfer Between Computers (AREA)
• Information Retrieval, Db Structures And Fs Structures Therefor (AREA)
• Management, Administration, Business Operations System, And Electronic Commerce (AREA)

Priority Applications (7)

Applications Claiming Priority (2)

Publications (2)

Family

ID=45023123

Family Applications (1)

Country Status (8)

Families Citing this family (20)

Family Cites Families (29)

• 2010
  • 2010-06-01 US US12/791,305 patent/US8732473B2/en active Active
• 2011
  • 2011-05-17 CN CN201180027177.5A patent/CN102918533B/zh active Active
  • 2011-05-17 JP JP2013513199A patent/JP5711361B2/ja not_active Expired - Fee Related
  • 2011-05-17 KR KR1020127031360A patent/KR101751566B1/ko active Active
  • 2011-05-17 RU RU2012151502/08A patent/RU2573760C2/ru not_active IP Right Cessation
  • 2011-05-17 BR BR112012030409A patent/BR112012030409A2/pt not_active IP Right Cessation
  • 2011-05-17 WO PCT/US2011/036733 patent/WO2011152987A2/en not_active Ceased
  • 2011-05-17 EP EP11790177.7A patent/EP2577523B1/en active Active

Non-Patent Citations (1)

Also Published As

Similar Documents

Legal Events