Methods to allow data classification in rigid software development environments

Abstract

The present disclosure relates to a method for allowing data classification in a rigid software development environment. A system and method for supporting the enforcement of data modification, classification and IRM capabilities in a standard isolated software application are disclosed, according to which additional code is installed on a terminal device of a user running a standard application. The additional code is suitable for interacting with a virtual keyboard used by a standard application to form a customized virtual keyboard with added features of classifying data items and / or modifying the content of the data items without changing the natural environment to which the user is usually accustomed. A customized virtual keyboard is then created including a designed UI interface object for adding input associated with classification and modification in the data item to the content of the data item in the form of a hidden label.

Description

[0001] This application is a divisional application of an invention patent application whose international application date is January 20, 2016, entered the Chinese national stage on June 30, 2017, has Chinese national application number 201680004796.5, and whose invention name is “Method for allowing data classification in a rigid software development environment”. Technical Field

[0002] The present invention relates to the field of information technology, and more particularly to a method for supporting data classification and encryption, enforcement of information rights management (IRM) capabilities, or other enforcement methods in software applications in a rigid (isolated) software development environment. Background Art

[0003] Information classification is used in many organizations to enforce encryption and other protection methods (e.g., blocking transmission) on sensitive corporate information to prevent unauthorized access and use by users. This allows enforcement of such protection methods based on business value and confidentiality level. The proliferation of mobile devices as primary enterprise productivity tools should provide this capability as well as other end devices.

[0004] IRM mainly involves enforcing access and usage rights to determine which user can perform actions on data, such as copy, drag / drop, print, screenshot, save as, save and view operations. One of the characteristics of IRM is the ability to classify data items generated or consumed by an application.

[0005] In many applications of mobile devices, software systems can be used for a long time and can be modified for new features and added functions (e.g., classification and protection functions) required by users or organizations. Therefore, the scalability of such software systems (the system can expand new functions, while the internal structure and data flow of the system are minimally affected or unaffected) becomes very important. Scalability enables developers to expand or add the capabilities of software. Some methods include facilities for allowing the insertion of user's own program routines and the ability to define new data types and define new format mark tags. However, it is difficult to create a solution that allows the addition of capabilities or content worship to third-party applications. This is even more serious in operating systems (e.g., iOS (a mobile operating system developed by Apple Inc. and distributed specifically to Apple hardware) and Android (a mobile operating system based on the Linux kernel)) where most of the applications are isolated from each other, which allows very few methods to make a supplier software package interact with another supplier's software package or local (embedded) application. In fact, the ability of standard (third-party) applications to call other applications and / or process code is very limited.

[0006] One of the existing solutions to this problem is to create a replacement application that, in addition to all the inherent capabilities of the standard application, includes the ability to classify, modify data items and protect. However, developing such a replacement application is very expensive and, moreover, forces the user to replace the standard application to which he is accustomed.

[0007] Therefore, the objective is to provide a method that supports standard and third-party applications by supporting data classification and data item manipulation and allows for the enforcement of classification and protection capabilities without interrupting the user's natural workflow.

[0008] Another object is to provide a method to support data classification and enforcement of encryption and Information Rights Management (IRM) capabilities in software applications that is common to all standard applications.

[0009] Other objects and advantages will become apparent as the description proceeds. Summary of the invention

[0010] A method for supporting data modification, classification, and enforcement of IRM capabilities in a standard isolated software application is disclosed, according to which additional code is installed on a terminal device of a user running a standard application. The additional code is adapted to interact with a virtual keyboard used by the standard application to form a customized virtual keyboard with added features of classifying data items and / or modifying the content of the data items without changing the natural environment to which the user is usually accustomed. A customized virtual keyboard is then created including a designed UI interface object for adding inputs associated with classification and modification in the data items in the form of hidden tags to the content of the data items.

[0011] When a standard application consumes the classified or modified data item, the method may further include: finding the hidden tag and deciding further processing of the data item according to a predetermined protection policy. A dedicated code may also be embedded in the inherent code of the virtual keyboard to track the characters entered by the user and detect keywords or character strings of the typed data item that represent the content of the data item that should be classified.

[0012] Data items for which no hidden tags are found may be bounced back to the sender along with a request for classification. The data item may be automatically encrypted in response to the classification of the data item.

[0013] The interface objects may be virtual buttons, check boxes, and icons for providing input associated with classification and modification in data items.

[0014] Modifications in the content of a data item may include adding a disclaimer, adding invisible tagging characters / objects, content marking, watermarks, or hidden signatures.

[0015] The hidden tag may be a character with a transparent font or a very small font presented at the bottom of the message body.

[0016] The protection policy may include blocking one or more operations that can be performed using the classified data items.

[0017] A method for supporting the enforcement of data modification, classification, and IRM capabilities in a standard isolated software application is disclosed, comprising the following steps:

[0018] a) installing a client application on a terminal device of a user running the standard application, wherein the client application is suitable for interacting with the push notification service;

[0019] b) Enforcing the classification of data items externally on the end device by using existing push notification services;

[0020] c) when a data item is created and forwarded to another instance for further processing, issuing a push notification via the push notification service to a user who forwarded the data item, while activating the client application to display an interface to the user via which the user can sort the sent data item;

[0021] d) sending the selected classification by the client application to the notification service infrastructure; and

[0022] e) Forward the created data item to its destination, or restrict the data item sent by the user until the classification result is received.

[0023] A method for supporting the enforcement of data modification, classification, and IRM capabilities in a standard isolated software application is disclosed, comprising the following steps:

[0024] a) installing additional code on a terminal device of a user running the standard application, the additional code being adapted to:

[0025] a.1) Provide navigation feedback to the user on behalf of installed standard applications;

[0026] a.2) Communicate with the user on behalf of the application when the user's finger hovers over the input area of ​​the screen.

[0027] In one aspect, an accessibility button can be displayed hovering over an input area of ​​the screen; while allowing the user to click the accessibility button using a UI that allows the user to select an appropriate classification for the content he has written and add visible or hidden tags to the written content based on his selection.

[0028] On the other hand, security products (e.g., CASB, DLP, or mail server policies) can be used to enforce desired security policies by allowing secure data items to reach their destination only after the security product has run the security policy (e.g., encryption, marking, or blocking operations) based on the classification performed. BRIEF DESCRIPTION OF THE DRAWINGS

[0029] In the attached picture:

[0030] Figure 1 An example of using a virtual keyboard within an application is shown;

[0031] Figure 2 Shown by visible marking using Figure 1 An example of a virtual keyboard in ;

[0032] Figure 3-5 An example of using an accessibility service as an alternative to a virtual keyboard for category modification is shown;

[0033] Figure 6 The architecture of a mobile device using the proposed classification tool is shown;

[0034] Figure 7 An architecture for providing security enforcement using third-party security products to enforce desired security policies is shown;

[0035] Figure 8 A flow chart showing the use of a notification service for classification and user approval; and

[0036] Fig. 9 A system is shown that supports data modification, classification, and enforcement of IRM capabilities in a standard isolated software application. DETAILED DESCRIPTION

[0037] The proposed method for supporting data classification and enforcing encryption and information rights management (IRM) capabilities in software applications in a rigid (isolated) software development environment includes two main embodiments:

[0038] Example 1.1: Using the in-app virtual keyboard

[0039] In this embodiment, a virtual keyboard is used to provide input data to standard applications in order to allow classification and modification of data items generated by users and used by applications (taking advantage of the fact that adding a designed custom keyboard is the most common available item allowed by the operating environment), thereby establishing a universal interaction with standard applications. This naturally does not require any intervention in the code of standard applications, because the keyboard service is provided by the operating system rather than by the application. This allows the addition of a custom keyboard to any application that requires a keyboard to interact with the user, and the custom keyboard is available to any application that uses the OS keyboard service. Since operating systems (e.g., iOS and Android) can allow users to select a desired keyboard or modify an existing keyboard to match their needs, this inherent ability is used to allow users to classify data by creating a custom virtual keyboard and adding features to the keyboard to classify data items and / or modify the content of data items. This allows users to classify or mark their data without changing the natural environment that users are usually accustomed to. Custom virtual keyboards can include interface objects, such as virtual buttons, check boxes, and icons, for providing input associated with classification and modification in data items. This feature allows software developers to create a desired custom keyboard with a rich dedicated interface that has desired additional functionality. For example, classification buttons can be added to the virtual keyboard, such as "Secret", "Top Secret", "Private", "Public", etc. Desired modifications can also be made within the content of the data item by passing any desired input method from the custom keyboard to the application content, such as adding disclaimers, invisible marker label characters / objects, content tags, watermarks, hidden signatures, etc. This also allows a specific classification mode to be defined as the default mode for the custom keyboard, which can be changed (or not) by the user, depending on the classification policy.

[0040] Custom keyboards allow for the creation of a designed UI that sends input to an input field that the user is typing into, thereby allowing the content to be modified based on the buttons the user taps in the custom keyboard (Examples of custom keyboards and systems that support custom keyboards include iOS and Android devices, such as in: https: / / developer.apple.com / library / ios / documentation / General / Conceptual / ExtensibilityPG / Keyboard.html in; or http: / / code.tutsplus.com / tutorials / create-a-custom-keyboard-on-andriod--cms-22615 described in ).

[0041] According to one embodiment, a dedicated code may be embedded in the native code of the virtual keyboard which will track the characters entered by the user in order to detect keywords or other character strings typed into a data item that may indicate that the content of the data item should be categorized.

[0042] One method of performing classification of data items is to add hidden tags to the content. For example, in the case of an edited email message, a hidden signature associated with a "secret" category can be added to the text of the message. Standardly, the hidden tag can be a character with a transparent or very small font that can appear at the bottom of the message body so as not to draw the user's attention and be effectively hidden.

[0043] After the user finishes editing the message, the user sends the message, and once the email reaches the email infrastructure system (which is the first point of sending a message outside the mobile device and can be, for example, a mail server, a proxy, a mail transfer agent (MTA - software that transfers email messages from one computer to another computer using a client-server application architecture)), etc., the email system intercepts the message, looks for hidden tags and decides on further processing of the intercepted message as part of a protection strategy. For example, the email system can enforce a set of predetermined protection rules, such as blocking one or more operations (e.g., printing, saving, copying, etc.). Similar protection schemes can also be applied to the transmission of data items to storage services (e.g., "DROPBOX" or storage clouds).

[0044] If the email system does not discover the hidden tag, it can bounce the message back to the sender along with a notification that the sender must categorize the message before sending it.

[0045] According to another embodiment, the custom virtual keyboard code may be adapted to read a configuration file that includes classification policy rules to be enforced. According to this example, if the user types confidential data (e.g., his ID or his social security number) into the body of a message, the configuration file (which includes protection policy management rules) may instruct the custom keyboard code to present the user with a notification that the data item he is currently editing must be classified as "secret". In this case, the content of the data item may be automatically encrypted before consumption or access by other parties.

[0046] Figure 1 An example of using a virtual keyboard within an application is shown. In this case, the user writes an email message, and the virtual keyboard for typing is modified to include an additional mark with a sort button. The user should press the sort button before he sends the message.

[0047] Figure 2 Shows the use of Figure 1 but with visible markings allowing selection of the desired classification level (in this case "Confidential"), which is shown in the content field.

[0048] Alternatively, the user can click a button provided by registering with the accessibility service (rather than presenting the classification UI to the user by changing the virtual keyboard). From this point on, the UI shown and the UI actions (such as inserting a visible / hidden marker) are the same. This alternative is described in Example 1.2 below.

[0049] Example 1.2: Using accessibility services

[0050] Accessibility services are features of the Android framework designed to provide alternative navigation feedback to users on behalf of applications installed on an Android device. Accessibility services can communicate with users on behalf of applications, such as converting text to speech, or providing tactile feedback when the user's finger hovers over important areas of the screen. For example, http: / / developer.android.com / training / accessibility / service.html A description of techniques for creating an accessibility service, processing information received from applications, and reporting the information back to the user is disclosed in .

[0051] In this example, an accessibility service is used, for example, on an Android device to provide a classification interface to the user. This can be achieved, for example, by displaying a "bubble" or "button" that hovers over an input area on the screen. By clicking on the accessibility "button", the same interface described in the above example 1.1 can be displayed to the user. This includes displaying a UI that allows the user to select an appropriate classification for the content he is writing, and based on his selection, a visible or hidden tag is added to the written content.

[0052] Figure 3-5 An example of using an accessibility service is shown. In this example, the accessibility service introduces a floating button 30 on a text area in a third-party application, such as Figure 3 When the floating button 30 is clicked, the accessibility service opens the classification UI 40, as shown in FIG. Figure 4 shown.

[0053] Figure 5 An example of using an accessibility service is shown, where when a desired classification is selected, the accessibility service adds a visible label for the selected classification level to a text field (in this example, "Inside").

[0054] Figure 6A mobile device architecture using a classification tool proposed according to an embodiment is shown. The vendor-provided OS is a closed environment (e.g., Apple's iOS). The device has embedded I / O services 61 as part of the device's OS and third-party I / O services 62 provided from external sources. The device can run multiple applications, such as a third-party document editor or a vendor's local mail client application, and the third-party document editor runs using an application sandbox (which limits the environment in which code can be executed). The classification tool is provided using an embedded keyboard to create a classified keyboard, and the embedded accessibility service is used to create a classified accessibility service 64.

[0055] Figure 7 An architecture is shown that uses third-party security products to enforce the desired security policies to provide security enforcement. These products can include cloud access security brokers (CASBs - software tools or services that sit between an organization's local infrastructure and the cloud provider's infrastructure. CASBs act as gatekeepers, allowing organizations to extend their security policies beyond their own infrastructure), data loss prevention modules (DLPs - used to ensure that end users do not send sensitive or critical information outside the company network), or mail server policies. According to the proposed architecture, after a data item is created and classified, the classified item reaches the security product, which runs the security policy based on the classification (which can include encryption tagging, blocking, etc.), and only then can the secure data item (e.g., a secure document or email) reach its destination.

[0056] Example 2: Using push notification service

[0057] In this embodiment, there is no need to hide the tags. According to this alternative embodiment (which uses an additional approach), classification of data items can be enforced externally on a mobile device by using an existing push notification service, such as the Apple Push Notification (APN) service (a service created by Apple Inc. that forwards notifications from third-party applications to Apple devices via the Notification Center). Here, instead of (or in addition to) the virtual keyboard, a backbone service is typically used to intercept user data items or interact with a service API when the content leaves the mobile device. The backbone service can then request input from the user (i.e., classify the data item) and act on the data item itself or use the backbone service API to take relevant actions (e.g., classify, add IRM, add encryption, restrict the data item, provide warnings, etc.). Utilizing Push Notification Service Related to Dropbox / Google drive / Salesforce and naturally email.

[0058] The infrastructure providing the push service is usually used to push notifications to the users of the devices, for example, a pop-up message "You have new mail" is pushed whenever a new message addressed to the user is received by the mail server. Therefore, this existing notification service can be used by the mail server to push a notification "You have created a new mail - please categorize it" to the user when a new message is created and sent. At the same time, the APN service will activate the client application (installed in advance on the user's mobile device), which will display an interface to the user (which may include buttons with icons for different categories), via which the user can categorize the sent emails. The client application sends the selected classification to the notification service infrastructure, and only then will the created message be forwarded to its destination. Until the classification result is received on the mail server side, the email messages sent by the user will be restricted.

[0059] Again, the classification features are added without intervening in the standard application (in this case, the mail application). The entire process will be done on the mail server side, which will use the notification service infrastructure in conjunction with the client application. This process can be done quickly enough to avoid any significant delays, as the general existing notification service infrastructure performs very quickly.

[0060] Figure 8 A flow chart for using a notification service for classification and user approval is shown. A device creates a data item (e.g., a document or email) and attempts to forward it to a destination. At a first step 801, the data item is intercepted by a security module (e.g., a CASB service) when leaving the device. At a next step 802, the security module sends a push notification to the device to collect the user's approval or classification. At a next step 803, the user provides his input via a push notification UI presented to him. At a next step 804, the user's input is sent to the security module. At a next step 805, the data item is protected and forwarded to its destination or blocked from reaching its destination, based on the security policy and user input.

[0061] The method proposed according to the embodiment does not require prior knowledge about standard applications. It is not necessary to have standard application source code, and does not change the application binary code, interface or user experience. In addition, the proposed solution can be implemented for standard users on standard devices without any administrator access.

[0062] Fig. 9A system for supporting data modification, classification and enforcement of IRM capabilities in a standard isolated software application is shown. The system 90 includes a user's terminal device 91, a standard application, on which additional code is installed. The additional code is adapted to interact with a virtual keyboard used by the standard application to form a customized virtual keyboard with added features for classifying data items and / or modifying the content of the data items, without changing the natural environment to which the user is normally accustomed.

[0063] The designed UI 92 displays a customized virtual keyboard including interface objects for categorizing data items based on user added input in the form of hidden tags associated with categorization and modification within the data items, the hidden tags being added to the content of the data items.

[0064] The system 90 includes a computerized device 93 including a memory 94 and a processor 95, the processor running a security module 96 for finding hidden tags and deciding further processing of the data item according to a predetermined protection policy, for example, converting the data item into a secure data item before consumption by a user or destination (e.g., an email or a document).

[0065] The security module may include special code that tracks the characters entered by the user and detects keywords or strings of characters typed into the data item that indicate the content of the data item should be classified. Data items for which no hidden tags are found are bounced back to the sender along with a request for classification.

[0066] Although some embodiments have been described by way of illustration, it is understood that these embodiments may be implemented with numerous modifications, variations, and adaptations and by using a number of equivalents or alternatives that fall within the purview of those skilled in the art without exceeding the scope of the claims.

Claims

1. A method for supporting the enforcement of data modification, classification, and information rights management (IRM) capabilities in a standard isolated software application, comprising: a) installing additional code on a user's terminal device, said terminal device running a standard application, said additional code being adapted to interact with a virtual keyboard used by said standard application to form a customized virtual keyboard to which features are added for classifying data items and / or modifying the content of said data items, without changing the natural environment to which said user is normally accustomed; as well as b) creating the customized virtual keyboard including the designed user interface UI interface object for adding inputs associated with classification and modification in the data item to the content of the data item in the form of hidden labels, wherein the modifications in the content of the data item include: adding a disclaimer, adding invisible mark label characters, watermarks or hidden signatures.

2. The method according to claim 1, further comprising: When the classified or modified data item is consumed by the standard application, the hidden tag is sought and a decision is made regarding further processing of the data item according to a predetermined protection policy.

3. The method according to claim 1, further comprising: A dedicated code is embedded into the inherent code of the virtual keyboard for tracking characters input by the user and detecting a keyword or a character string in the typed data item indicating that the content of the data item should be categorized.

4. The method according to claim 1, further comprising: Data items for which no hidden tags are found are bounced back to the sender along with a request for classification.

5. The method according to claim 1, further comprising: Responsive to the classification of the data item, the data item is automatically encrypted. 6 . The method of claim 1 , wherein the interface objects are virtual buttons, check boxes, and icons for providing input associated with classification and modification in the data items. 7 . The method of claim 1 , wherein the hidden tag is a character with a small transparent font presented at the bottom of a message body.

8. The method of claim 1, wherein the protection policy comprises blocking one or more operations that can be performed using the classified data item.

9. The method according to claim 1, further comprising: a) Accessibility buttons that appear hovering over input areas on the screen; b) allowing the user to click the accessibility button using a UI, which allows the user to select an appropriate classification for the user's written content and adds a visible or hidden mark to the written content based on the user's selection.

10. The method of claim 1, wherein a security product is used to enforce a desired security policy by allowing a safe data item to reach a destination of the data item only after the security product executes the security policy based on the classification made.

11. The method of claim 10, wherein the security product is selected from the group consisting of: Cloud Access Security Broker (CASB); Data Loss Prevention Module (DLP); Mail server policy.

12. The method of claim 10, wherein the security policy comprises encryption, marking or blocking operations.

13. A system for supporting the enforcement of data modification, classification, and information rights management (IRM) capabilities in a standard isolated software application, comprising: a) a terminal device of a user running a standard application, on which additional code is installed, the additional code being adapted to interact with a virtual keyboard used by the standard application to form a customized virtual keyboard to which features are added for classifying data items and / or modifying the content of said data items, without changing the natural environment to which the user is normally accustomed; as well as b) a user interface UI designed for displaying a customized virtual keyboard including interface objects for classifying the data item by allowing the user to add input associated with classification and modification in the data item in the form of hidden tags, the hidden tags being added to the content of the data item, wherein the modification in the data item comprises: adding a disclaimer, adding an invisible tag character, a watermark or a hidden signature; as well as c) A computerized device running a security module for finding said hidden tag and making a decision regarding further processing of said data item according to a predetermined protection policy.

14. The system of claim 13, wherein the further processing of the data item comprises: The data items are converted into secure data items before being consumed by a user or destination.

15. The system of claim 13, wherein the security module includes a dedicated code adapted to: a) tracking characters input by the user and detecting a keyword or character string in the typed data item indicating that the content of the data item should be categorized; b) The data items for which no hidden tags are found are bounced back to the sender along with a request for classification.

Images