Information barriers for sensitive information

Abstract

Embodiments of information barriers that are conditional on the type of information being communicated are disclosed. The information barrier policies provided by the disclosed embodiments selectively allow communications between accounts or groups based on characteristics of the content of the communications. For example, communications between the marketing department and the engineering department may be conditioned on the communications not including any sensitive information. The determination as to whether a communication includes sensitive information is further designed to provide good performance even in off-site or cloud environments, environments where large data portions are maintained, where the latency associated with searching large data stores may be prohibitive.

Description

[0001] CROSS-REFERENCE TO RELATED APPLICATIONS

[0002] This application claims priority to U.S. Provisional Application No. 62 / 854,868, filed on May 30, 2019, entitled “Data Protection in Cloud Environments.” This application also claims priority to U.S. Provisional Application No. 62 / 854,839, filed on May 30, 2019, entitled “Information Barriers Using Database Filters.” The contents of these two prior applications are considered part of this application and are incorporated herein by reference in their entirety. Background Art

[0003] With the advent of modern communication applications such as email, chat, text messaging, and web-based sharing, the ability for members of an organization to communicate with one another has greatly increased. While this communication can improve organizational productivity in some cases, the increased ability to share information also brings with it its associated risks. For example, confidential information is sometimes inappropriately shared with members of an organization who do not necessarily understand the considerations required to protect the information. This information may then be disclosed in a way that harms the organization. Similarly, knowledge gained by one organization (e.g., sales) from another organization (engineering) may change the behavior of that organization in ways that are undesirable and not beneficial to the organization as a whole. For example, if the sales organization learns of an upcoming new product, the sales team may de-emphasize existing products in anticipation of the new product, resulting in a decrease in sales.

[0004] Data protection products reduce the risk of sensitive enterprise data being inappropriately transmitted outside the enterprise. The first generation of data protection services identified the transmission of sensitive information by comparing intercepted network transmissions with local data stores. Appropriate policies were then applied to the data based on, for example, the account performing the transmission and the nature of the intercepted data and its sensitivity. As enterprises migrate their data to cloud environments, local comparisons of intercepted data with local data stores become less effective given that some significant portions of enterprise data exist only in cloud-based data stores. BRIEF DESCRIPTION OF THE DRAWINGS

[0005] In the drawings, which are not necessarily drawn to scale, the same numerals may describe similar components in different views. The same numerals with different letter suffixes may represent different instances of similar components. The accompanying drawings generally illustrate various embodiments discussed in this document by way of example and not limitation.

[0006] Figure 1Ais an overview of a network system that is implemented at least in part by one or more of the disclosed embodiments.

[0007] Figure 1B is an overview of a network system that is implemented at least in part by one or more of the disclosed embodiments.

[0008] Figure 1C is an overview of a network system that is implemented at least in part by one or more of the disclosed embodiments.

[0009] Figure 1D is an overview diagram illustrating an example implementation of an information barrier.

[0010] Figure 1E is an overview diagram illustrating an example implementation of an information barrier.

[0011] Figure 2A It is shown Figure 1B and 1C A block diagram of a simplified view of the components included in a network system.

[0012] Figure 2B is a block diagram showing one organization of modules and communication flows implemented by one or more of the disclosed embodiments.

[0013] Figure 2C Two client modules are shown communicating with communication server(s).

[0014] Figure 3 An example of indexed data storage implemented in one or more of the disclosed embodiments is shown.

[0015] Figure 4 An example user interface implemented in one or more of the disclosed embodiments is shown.

[0016] Figure 5 An example user interface is shown that may be implemented in one or more of the disclosed embodiments.

[0017] Figure 6 An example user interface is shown that may be implemented in one or more of the disclosed embodiments.

[0018] Figure 7 An example user interface implemented in one or more of the disclosed embodiments is shown.

[0019] Figure 8 Example data structures implemented in one or more of the disclosed embodiments are shown.

[0020] Fig. 9is a flow diagram of an example method for managing sensitive information within an enterprise environment.

[0021] Fig.10 is a flow chart of an example method for performing exact data matching on portions of data received from a secure environment.

[0022] Fig.11 is a flow chart of an example method for managing restricted access to new data until the new data is uploaded to a data matching system.

[0023] Fig.12 is a flow chart of an example method for providing conditional access to data based on whether access to the data is restricted.

[0024] Fig.13A Example message portions exchanged between devices implementing one or more of the disclosed embodiments are shown.

[0025] Fig. 13B is an example of a message portion implemented by some of the disclosed embodiments.

[0026] Fig.14A Example message portions implemented by one or more of the disclosed embodiments are shown.

[0027] Fig. 14B is an example message portion implemented in one or more of the disclosed embodiments.

[0028] Fig.15 Example data structures implemented in one or more of the disclosed embodiments are shown.

[0029] Fig.16 An example user interface is shown that may be implemented in one or more of the disclosed embodiments.

[0030] Fig.17 An example user interface is shown that may be implemented in one or more of the disclosed embodiments.

[0031] Fig.18 An example user interface is shown that may be implemented in one or more of the disclosed embodiments.

[0032] Fig.19 is a flow chart of a method of generating a data structure to support an information barrier (IB).

[0033] Fig. 20 is a flow chart of a method for implementing IB.

[0034] Fig.21 This is a flowchart of the response method for IB information query

[0035] Fig. 22 It is a flowchart of the method of responding to IB information query.

[0036] Fig.23 is a flow chart of an example method for applying IB policies regarding sensitive information.

[0037] Fig.24 A block diagram illustrating an example machine upon which any one or more of the techniques (eg, methodologies) discussed herein may be performed. DETAILED DESCRIPTION

[0038] The following description and accompanying drawings sufficiently illustrate specific embodiments to enable those skilled in the art to practice them. Other embodiments may incorporate structural, logical, electrical, process and other changes. Parts and features of some embodiments are included in or replace the parts and features of other embodiments. The embodiments set forth in the claims cover all available equivalents of these claims.

[0039] The disclosed embodiments provide an information barrier policy that manages communications between two accounts or account groups conditioned on the nature of the communications. Past information barrier policies have provided an "all or nothing" approach to information barriers, where communications between accounts and / or account groups are either allowed or prohibited. This presents a technical problem because it is not possible to provide a flexible approach to communications management between two accounts or account groups. For example, in previous solutions, in order to prevent certain types of communications flow between accounts or account groups, these solutions required shutting down all communications.

[0040] The disclosed embodiments solve the technical problem by providing a more subtle approach. The proposed technical solution allows certain types of communication between accounts or account groups to be allowed, while other types of communication are prohibited. This type of contact can refer to a specific classification of the content included in the communication. For example, in some embodiments, the transmission of sensitive information (e.g., the first type) between two individuals or groups is prohibited, while the transmission of non-sensitive information (e.g., the second type) is allowed. Some embodiments provide multiple classifications of the information being transmitted. For example, some embodiments classify information as sensitive (e.g., the first type), confidential (e.g., the second type), public (e.g., the third type), financial-related (e.g., the fourth type), product-related (e.g., the fifth type), or other classifications. The disclosed embodiments then provide selective configuration of which types of information are allowed to be transmitted between accounts or account groups.

[0041] Some of the disclosed embodiments solve additional technical problems related to cloud-based data protection. These embodiments provide the above-mentioned selective communication while also improving data protection in a cloud environment. In some aspects, data protection includes two parts, a first part being a local part and a second part being a remote or cloud-based part. The local part analyzes network data intended to be distributed outside a secure enterprise environment (e.g., an intranet). The network data is analyzed for one or more heuristics to detect indications of sensitive information. For example, a heuristic may detect numbers arranged in a manner that may be credit card information. Another heuristic may detect patterns similar to those included in one or more databases maintained by an enterprise. Since some parts of enterprise data are maintained in a cloud-based implementation, it may be impractical for a local solution to accurately identify a data source. Once an indication of sensitive information in network data is detected via a local scan, the portion of the network data including the indication is sent to a data matching service (DMS). References to DMS below refer to a software service running on a computer (such as a computing device), or to both a software service and a computer running the software service. The DMS may have access to a more comprehensive enterprise data set that may include data that resides primarily in a cloud-based implementation and, therefore, is not local data in a comprehensive form.

[0042] In some other embodiments, both the heuristic analysis and the exact data matching are performed off-premise. In these embodiments, the heuristic analysis is still performed within the secure environment, where the secure environment extends from the local environment to include the location of the heuristic analysis. For example, the off-premise portion of the secure environment may include a cloud-based email solution used by an enterprise. In these embodiments, data stored within the cloud-based email application is considered to still be within the secure environment.

[0043] Upon receiving a portion of the network data, the DMS system compares the portion to a more comprehensive set of enterprise data and responds to the local component with an indication of whether enterprise data matching the portion is identified. If so, the DMS further indicates whether the portion includes information that the enterprise considers sensitive. The local component then selectively allows the network data to be transmitted externally. If the network data is sensitive, the secure enterprise environment blocks the transmission.

[0044] Some of the disclosed embodiments further take into account data that was recently created locally. In some embodiments, such data is uploaded to the off-site DMS to provide identification of the data when appropriate. Depending on the implementation, there is a delay between the time when local data is created and the completion of its transmission to the off-site DMS environment. During this delay period, the off-site DMS environment does not have a copy of the new data, and therefore cannot identify the new data as sensitive enterprise data when requested. Therefore, if an attempt is made to transfer new data to the off-site, during this delay period, the EMDS environment will not be able to identify the data as enterprise data. In order to avoid this vulnerability, some of the disclosed embodiments can initially limit the newly created local data to restrict transmission from the off-site. This restriction can exist until the new data is successfully transmitted to the DMS environment.

[0045] In addition to providing a more flexible and document-specific information barrier approach and improved data protection in cloud environments, some of the disclosed embodiments also provide static configuration of segments and information barrier policies. During static configuration, queries that define segments are not evaluated, but rather are defined for later execution.

[0046] After configuring the segments and information barrier policies, queries are executed to populate the segments with the accounts selected by the corresponding queries. Allowed and excluded account lists are then defined for each account based on the populated segments and information barrier policies. Once the allowed and / or excluded account lists are populated, the disclosed embodiments can then determine the presence or absence of an information barrier between two accounts in an efficient manner.

[0047] By populating allowed and excluded account lists for each account prior to applying the information barrier policy to a particular communication between a first account and a second account, execution can rely on the allowed and / or excluded lists to provide more efficient execution than when the query is dynamically performed in response to the particular communication.

[0048] Figure 1A is an overview of a network system 100A, at least part of which is implemented by one or more of the disclosed embodiments. Figure 1A A user terminal 172A and a user terminal 172B are shown. A first account logged into the user terminal 172A can access the data store 104C. When a message to be sent to a second account logged into the user terminal 172B or a message to be sent to a third destination account logged into the external device 172C is generated, the first account and the user terminal 172A access the data store 104C. Figure 1AThe network system 100A includes an application server 176 that provides communication services to the user terminal 172A to the user terminal 172B. For example, in some embodiments, the application server 176 runs an email system. In one example, the user terminal 172A constructs a communication (such as an email message) locally on the user terminal 172A and then sends the communication to the application server 176 for further processing, which may include forwarding the communication to a destination account, such as a second account logged into the user terminal 172B or a third account logged into the external device 172C.

[0049] Figure 1A 174B and 174C. Figure 1A In the example of , the information barrier policy indicates that some data can be transferred between accounts logged into user terminal 172A and user terminal 172B, but sensitive information cannot be transferred between these accounts. As discussed further below, network system 100A implements such an information barrier policy via application server 176, filter 107C, information barrier controller 179, and data matching classifier 108C.

[0050] The user terminal 172A constructs the communication and transmits the message to the application server 176. The application server 176 is configured to determine an information barrier policy to be applied to the communication between the first account logged into the user terminal 172A and the second account logged into the user terminal 172B. To determine the information barrier policy, the application server 176 is configured to communicate with the filter 107C, which interfaces with the information barrier controller 179. The information barrier controller 179 determines the appropriate policy to be applied to the communication between the first account logged into the user terminal 172A and the second account logged into the user terminal 172B based on the information policy data store 178.

[0051] If the policy indicates that sensitive information cannot be passed between the first account and the second account, but non-sensitive information can be transmitted, the filter and / or application server 176 then notifies the data matching classifier 108C. The data matching classifier 108C runs one or more heuristics (e.g., regular expressions or machine learning models) on the message sent by the first account to the second account. If the heuristics indicate that the communication has an indication of sensitive information, the probability of the communication including sensitive information is determined to be higher than zero. However, the heuristics also generally cannot determine that the probability of sensitive information is 100%. Therefore, at least in some embodiments, additional processing is performed to determine whether the communication actually has a 100% probability of including sensitive information.

[0052] Thus, if the data match classifier 108C indicates sensitive information, the portion of the communication indicating sensitive information is provided to the data matching service 114C. The data matching service compares the portion to the data store 125C to determine if there is a match. If the portion matches the sensitive information included in the data store 125C, the data matching service 114C provides an indication of the match back to the filter 107C, which takes appropriate action on the communication. The appropriate action may include blocking, allowing, or anonymizing the portion of the communication to eliminate sensitive information from the message.

[0053] Figure 1B 1 is an overview of a network system, at least part of which is implemented by one or more of the disclosed embodiments. Network system 100B includes enterprise 103A and remote cloud-based IT resources such as application server 116A. Enterprise 103A includes user terminal 102A. User terminal 102A can access enterprise data, including sensitive data stored in data storage 104A. As described above, the disclosed embodiments provide monitoring and control of data leaving enterprise 103A.

[0054] The user terminal 102A sends network data 105A to the remote application server(s) 116A. The remote application server(s) 116A include a filter 107A that intercepts the network data 105A sent to the remote application server(s) 116A. The user terminal 102A may send data to the remote application server(s) 116A for a variety of reasons. For example, in some embodiments, the network data 105A is at least part of an email message, and the remote application server(s) 116A may implement an email application service. The network data 105A may alternatively represent a document uploaded to a website or remote storage that facilitates sharing of data between multiple users (e.g., Sharepoint TM 、Box TM In these embodiments, the network data 105A is included in an HTTP Post type message in some embodiments.

[0055] Once the web data 105A has been delivered to the application server(s) 116A, it is at risk of being exposed outside of the secure environment 141 A. For example, where the application server(s) 116A implement an email application, the user terminal 102A may attempt to send the web data 105A to the external device 117A as part of an email message. Where the application server(s) 116A implement a website with sharing capabilities, once the web data 105A is publicly available via the website, it is at risk of being viewed by the external device 117A.

[0056] To determine whether network data 105A includes data deemed sensitive by enterprise 103A, filter 107A transmits network data 105A to data match classifier (DMC) 108A. DMC 108A consults with policy data store 110A to perform one or more screening methods on network data 105A.

[0057] Each of the one or more screening methods identifies whether the network data 105A has one or more indications of sensitive information. The screening method can perform various analyses on the network data to determine whether the network data includes an indication of sensitive information. In some embodiments, the screening method run by the DMC 108A can adopt one or more of regular expression evaluation and / or keyword matching to the network data. In some embodiments, the information defining the regular expression and / or keyword to be identified in the network data is obtained by the DMC 108A from the configuration information. In some aspects, the regular expression and / or keyword is policy-specific. In some embodiments, the policy is based on one or more of the time of day, user identifier, group identifier, or other parameters. In some embodiments, the policy to be applied to the network data 105A is obtained from the policy data store 110A. In some embodiments, the policy information included in the policy data store 110A is configured via the management console 113A.

[0058] The disclosed embodiments may segment the network data into portions and determine an indication of whether each individual portion includes sensitive data. Thus, for example, if the network data 105A represents a single electronic document, the document is segmented into multiple portions in some embodiments, and the DMC 108A may determine an indication of whether each of the multiple portions includes sensitive information. Although the screening methods cannot determine with certainty whether the network data includes sensitive information, they provide an indication of the risk that sensitive information is included in the network data 105A.

[0059] In some embodiments, segmentation of network data 105A is performed using a variety of techniques, which may vary from embodiment to embodiment. In some embodiments, segmentation is performed according to the size of a particular segment in some embodiments. For example, in these embodiments, each segment, except for the last segment of the network data, has an equal size in some embodiments. Other embodiments may segment data based on contextual knowledge of the network data itself. For example, if the network data represents an electronic document, some embodiments may segment the network data in a manner consistent with the boundaries of the electronic document, such as along page boundaries, paragraph boundaries, electronic table cells, row or column boundaries, or other contextual boundaries that vary according to the particular electronic document encoded by the network data.

[0060] If a portion of the network data 105A is determined to present a risk of exposing sensitive information, the DMC 108A sends the portion to the DMS 114A via a network, such as the Internet. The DMS 114A compares the received portion with data in the EDM search data store 125A.

[0061] The EDM search data store 125A is populated via a data stream 126A from a data store 104A located within the enterprise 103A. In some embodiments, data from the data store 104A to the EDM search data store 125A is provided by a data upload system 130A in some embodiments. For example, the data upload system 130A may hash or encrypt the data in the data store 104A before uploading the data to the enterprise data store 140A. The import process 145A may further process the data before populating the EDM search data store 125A. In some embodiments, the import process 145A that imports data from the enterprise data store 140A to the EDM search data store 125A is controlled by configuration information included in an exact data match configuration data store 142A, which in some embodiments is configured via a user interface displayed on the management console 113A.

[0062] In addition to analyzing the network data 105A via one or more screening methods as described above, in some embodiments, the DMC 108A is also configured to determine whether the network data 105A is waiting to be uploaded to the EDM search data store 125A. For example, the DMC 108A can check the new data queue 132A to determine whether the upload of the network data 105A is pending. In these embodiments, new data created within the enterprise 103A is added to the data store 104A and is also indicated in the new data queue 132A. In some embodiments, the upload from the data store 104A to the EDM search data store 125A is driven by the data upload system 130A through the data in the new data queue 132A. In some embodiments, the data upload system 130A operates periodically or at least at discrete intervals, which introduces some delay between the time when the new data is initially created and the time when the data has been successfully transferred to the EDM search data store 125A. During this delay, unless remedial measures are taken as described herein, the new data is easily exposed by the user terminal 102A.

[0063] Thus, the DMC 108A may check the new data queue 132A to determine whether the network data 105A has been uploaded and can therefore be successfully detected by the DMS 114A, or whether the DMC 108A should ensure that the new data is not exposed by the user terminal 102A. To determine whether the new data is restricted from being exposed by the user terminal 102A, the DMC 108A may check an indicator for the data included in the data store 104A. For example, the data store 104A may indicate whether a particular portion of the network data 105A is restricted from being exposed by the user terminal 102A. If the network data 105A is restricted, the DMC 108A may prevent the transmission of the network data 105A outside of the secure environment without consulting the DMS 114A. This capability is described below at least with respect to Figure 11 to Figure 12 Discuss in more detail.

[0064] Figure 1C 1 is an overview of a network system, at least part of which is implemented by one or more of the disclosed embodiments. Network system 100C includes enterprise 103B (local) and remote, cloud-based IT resources such as application server 116B. Enterprise 103B (local) includes user terminal 102B. User terminal 102B can access enterprise data, including sensitive data stored in data store 104B. As described above, the disclosed embodiments provide monitoring and control of data leaving enterprise 103B.

[0065] The user terminal includes a communication application 106. The communication application 106 may include a filter 107B. The filter 107B monitors the data accessed by the communication application 106. The communication application 106 may attempt to send the data to a device outside the enterprise 103B, such as an external device 117B. For various reasons, the communication application 106 may attempt to send the data to the external device 117B. For example, in some embodiments, the data is at least part of an email message, and in some embodiments, the external device 117B is a device for receiving emails. The data may alternatively be represented as being uploaded to a website or remotely stored document (e.g., Sharepoint) that facilitates sharing of data between multiple users. TM 、Box TM In these embodiments, the data is included in a HTTP Post type message.

[0066] Before communication application 106 sends data outside of enterprise 103B, the data is intercepted by filter 107B integrated with communication application 106. Filter 107B transmits network data 105B to data matching classifier (DMC) 108B. DMC consults with policy data store 110B to perform one or more screening methods on network data 105B.

[0067] Each of the one or more screening methods identifies whether the network data 105B has one or more indications of sensitive information. The screening method can perform various analyses on the network data to determine whether the network data includes an indication of sensitive information. In some embodiments, the screening method run by the DMC 108B can adopt one or more of regular expression evaluation and / or keyword matching to the network data. In some embodiments, the information defining the regular expression and / or keyword to be identified in the network data is obtained by the DMC 108B from the configuration information. In some aspects, the regular expression and / or keyword is policy-specific. In some embodiments, the policy is based on one or more of the time of day, user identifier, group identifier, or other parameters. In some embodiments, the policy to be applied to the network data 105B is obtained from the policy data store 110B. In some embodiments, the policy information included in the policy data store 110B is configured via the management console 113B.

[0068] The disclosed embodiments may segment the network data into portions and determine an indication of whether each individual portion includes sensitive data. Thus, for example, if the network data 105B represents a single electronic document, the document is segmented into multiple portions in some embodiments, and the DMC 108B may determine an indication of whether each of the multiple portions includes sensitive information. Although the screening methods cannot determine with certainty whether the network data includes sensitive information, they provide an indication of the risk that sensitive information is included in the network data 105B.

[0069] Segmentation of network data is performed using a variety of techniques, which may vary from embodiment to embodiment. In some embodiments, segmentation is performed based on the size of a particular segment in some embodiments. For example, in these embodiments, each segment, except for the last segment of the network data, has an equal size in some embodiments. Other embodiments may segment the data based on contextual knowledge of the network data itself. For example, if the network data represents an electronic document, some embodiments may segment the network data in a manner consistent with the boundaries of the electronic document, such as along page boundaries, paragraph boundaries, electronic table cells, row or column boundaries, or other contextual boundaries that vary depending on the particular electronic document encoded by the network data.

[0070] If a portion of the network data 105B is determined to present a risk of exposing sensitive information, the DMC 108B sends the portion via a network, such as the Internet, to the DMS 114B. The DMS 114B compares the received portion with data in the EDM search data store 125B.

[0071] The EDM search data store 125B is populated via a data stream 126B from a data store 104B located within the enterprise 103B. In some embodiments, the data from the data store 104B to the EDM search data store 125B is provided by a data upload system 130B in some embodiments. For example, the data upload system 130B may hash or encrypt the data in the data store 104B before uploading the data to the enterprise data store 140B. The import process 145B may further process the data before populating the EDM search data store 125B. In some embodiments, the import process 145B of importing data from the enterprise data store 140B to the EDM search data store 125B is controlled by configuration information, which is included in the exact data match configuration data store 142B, which in some embodiments is configured via a user interface displayed on the management console 113B.

[0072] In addition to analyzing the network data 105B via one or more screening methods as described above, in some embodiments, the DMC 108B is also configured to determine whether the network data 105B is waiting to be uploaded to the EDM search data store 125B. For example, the DMC 108B can check the new data queue 132B to determine whether the upload of the network data 105B is pending. In these embodiments, new data created within the enterprise 103B is added to the data store 104 and is also indicated in the new data queue 132B. In some embodiments, the upload from the data store 104B to the EDM search data store 125B is driven by the data upload system 130B through the data in the new data queue 132B. In some embodiments, the data upload system 130B operates periodically or at least at discrete intervals, which introduces some delay between the time when the new data is initially created and the time when the data has been successfully transferred to the EDM search data store 125B. During this delay, unless remedial measures are taken as described herein, the new data is easily exposed by the user terminal 102B.

[0073] Thus, the DMC 108B may check the new data queue 132B to determine whether the network data 105B has been uploaded and can therefore be successfully detected by the DMS 114B, or whether the DMC 108B should ensure that the new data is not exposed by the user terminal 102B. To determine whether the new data is restricted from being exposed by the user terminal 102B, the DMC 108B may check an indicator for the data included in the data store 104B. For example, the data store 104B may indicate whether a particular portion of the data store 104B is restricted from being exposed by the user terminal 102B. If the network data 105B is restricted, the DMC 108B may prevent the transmission of the network data 105B outside of the secure environment without consulting the DMS 114B. This capability is described below at least with respect to Figure 11 to Figure 12 are discussed in more detail.

[0074] Figure 1D is an overview diagram illustrating an example implementation 100D of an information barrier. Figure 1D Three user terminals 162A to 162C are shown. The three user terminals are surrounded by the first information barrier 160. The first information barrier 160 prevents the user terminals from communicating with devices outside the first information barrier 160. Therefore, the user terminal 162A communicates with one or more of the user terminals 162B and / or 162C without interference from the first information barrier 160. Similarly, the user terminal 162B communicates with one or more of the user terminals 162A and / or 162C within the interference from the first information barrier 160. The user terminal 162C communicates with any one of the user terminals 162A and / or 162C without interference from the first information barrier 160.

[0075] Figure 1D Three other user terminals 162D to 162F are also shown. The three user terminals 162D-F are almost completely surrounded by the second information barrier 164. The second information barrier 164 allows the three user terminals 162D to 162F to communicate with each other, but generally prevents other devices from communicating with any of the three user terminals 162D to 162F. Similarly, the second information barrier 164 prevents the three user terminals 162D to 162F from initiating communications with other devices other than the three user terminals 162D to 162F.

[0076] A third information barrier 174 is also shown. The third information barrier 174 provides for communication between the three user terminals 162A to 162C and the user terminal 162E. Thus, via the third information barrier 174, the user terminal 162E can communicate with any of the user terminals 162A to 162C, and vice versa. Thus, while the first information barrier 160 and the second information barrier 164 typically prevent communication between the two grouped user terminals 162A to 162C and the second information barrier 162D to 162F, the third information barrier 174 provides an exception to these barriers by allowing communication between the user terminal 162E and any one or more of the user terminals 162A to 162C.

[0077] Figure 1E A second example implementation 100E of an information barrier is shown. Figure 1E Three groups of user terminals are shown, the first group of user terminals includes user terminal 162A, user terminal 162B and user terminal 162C, the second group of devices includes device 162D, user terminal 162E and user terminal 162F, and the third group of user terminals includes user terminal 162G, user terminal 162H and user terminal 162I, each of the first three group of user terminals is protected by information barrier 160A, information barrier 160B or information barrier 160C. The fourth information barrier 160D provides communication between user terminals 162C, 162E and 162I. Each of user terminals 162C, 162E and 162I is within a separate information barrier 160A to 160C, but can still communicate via the fourth information barrier 160D.

[0078] The disclosed embodiments provide illustrated information barriers. An information barrier defines how two groups of devices or user terminals communicate with each other. An information barrier between two groups can completely prevent communication between these devices, or can define selective communications that can be allowed, provided that these communications meet certain criteria. Because information barriers may overlap, some of the disclosed embodiments provide configurations of the least restrictive or most restrictive options. For example, if the least restrictive option is configured, any communication path between the devices allows such communication. If the most restrictive option is configured, any information barrier that prevents communication between two devices is sufficient to prevent communication between these devices, regardless of other information barriers that may facilitate such communication. Certain aspects may provide for prioritization of information barriers so that higher priority barriers take precedence over other barriers with lower priorities.

[0079] Figure 2A It is shown Figure 1B The network system 100B and / or Figure 1C1 is a block diagram of a simplified view of the components included in the network system 100C. Figure 2A Filter module 202, DMC module 204, DMS module 206, and management user interface module 208 are shown. Each of filter module 202, DMC module 204, DMS module 206, and management user interface module 208 may define or include instructions for hardware processing circuitry that configures the hardware processing circuitry to perform one or more functions discussed below and attributed to each of filter module 202, DMC module 204, DMS module 206, and / or management user interface module 208. For example, filter module 202 may be described above with respect to each of the above. Figure 1B and 1C In some aspects, the DMC module 204 may be implemented as described above with respect to Figure 1B or Figure 1C In some aspects, the DMS module 206 may be executed on the DMS 114A or 114B. In some aspects, the management user interface module 208 may be executed on the management console 113A and / or 113B.

[0080] With the above Figure 1B to Figure 1C The discussion is consistent with Figure 2A Network data 210 is shown being transmitted from the filter module 202 to the DMC module 204. The DMC module 204 may perform one or more screening methods on the network data 210 to determine whether the network data 210 includes an indication of sensitive information. In some embodiments, if the screening method indicates that sensitive information is included in the network data 210, the DMC module 204 sends a portion 216 of the network data 210 including the indication to the DMS module 206. The DMS module 206 performs an exact data match search with the EDM search data store 125A or 125B to determine whether the portion includes sensitive information of the organization. In some embodiments, the exact data match search determines whether the portion is accurately represented by a portion of the EDM search data store 125A or 125B. In other words, the exact data match search determines whether a copy of the portion received by the DMS module 206 is included in the EDM search data store 125A or 125B. In some other aspects, the exact data match search may determine a similarity score between the portion and a portion of the EDM search data store 125A or 125B. If the similarity score meets the criteria, a match is identified.

[0081] As described above, in some aspects, the EDM search data store 125A or 125B includes hashed or encrypted enterprise data, and thus in some aspects, the DMS module 206 may hash or encrypt the portion 216 prior to performing the comparison.

[0082] After performing an exact data match comparison on portion 216, DMS module 206 sends response 218 to DMC module 204. Response 218 may indicate whether DMS module 206 found an exact data match between portion 216 and data included in EDM search data store 125A or 125B. If a match is identified, response 218 may further indicate a sensitivity level for the matching data in EDM search data store 125A or 125B.

[0083] Upon receiving response 218 from DMS module 206 , DMC module 204 then indicates to filter module 202 whether network data 210 is allowed to be transmitted out of the managed enterprise (eg, 103 ) or is blocked from transmission. The indication is provided to filter module 202 via response message 212 .

[0084] Administrative user interface module 208 includes instructions for implementing one or more administrative user interfaces that provide for configuration of policy information (eg, stored in policy data store 110) and / or filter information.

[0085] Figure 2B is a block diagram illustrating one organization 220 of modules and communication flows implemented by one or more of the disclosed embodiments. Figure 2B Two client modules 222A and 222B are shown. Each of the client modules 222A and 222B communicates with an IB service 224. The IB service 224 reads data from an IB data store 226. The IB data store 226 stores configuration information defining information barriers implemented by the client modules 222A to 222B. In some embodiments, the configuration information in the IB data store 226 is established via a management UI module 228.

[0086] Each of the client modules 222A and 222B provides network application services for the corresponding first computer account and the second computer account. For example, in some embodiments, the client modules 222A and / or 222B are integrated with an instant messaging application, an email application, or other communication applications that provide communication services for computer accounts. Each of the client modules 222A and / or 222B interfaces with the IB service 224 to determine which other accounts each of the first account and the second account can communicate with. The client module 222A is executed on the user terminal 102A, as described above with respect to Figure 1D and 1EThe example information barrier embodiment shown is discussed. The IB service 224 can receive a first request 240A from a client module 222A and a second request 240B from a client module 222B. Each request identifies a corresponding computer account. Each of the first request 240A and the second request 240B also indicates a request for a list of other accounts with which the corresponding client module can communicate. The IB service 224 can then consult the IB data store 226 to identify the other accounts and provide the information to the requesting client module via a message, which is shown as messages 242A and 242B for client modules 222A and 222B, respectively. In some embodiments, the information barrier data is written to the IB data store 226 by the management UI module 228.

[0087] The information received from the IB service 224 is used by each of the client modules 222A and 222B to control the communication with other client modules. As shown, each of the client modules 222A and 222B can manage the communication flow 242A to 242B based on the information received from the IB service 224. For example, if the IB service 224 indicates that the account managed by the client module 222A can communicate with the second account managed by the client module 222B, each of the client modules 222A to 222B can communicate with each other. Otherwise, the communication between the two client modules 222A to 222B is blocked based on the information barrier information received from the IB service 224.

[0088] Figure 2C A view 250 of a client module 252A and a client module 252B in communication with one or more communication servers 254 is shown. The communication server(s) 254 communicate with an information barrier service 256. Figure 2B 260, server(s) 254 requests information barrier information for a particular account from IB service 256. After consulting IB data store 258, IB service 256 provides information to server(s) 254 via response message 262 to indicate which accounts the particular account may communicate with. In some embodiments, IB data store 258 is initialized or populated by management UI module 265.

[0089] Figure 3 An example of index data storage implemented in one or more of the disclosed embodiments is shown. Figure 3As shown, hashed or encrypted enterprise data is received via data stream 126A or data stream 126B and inserted into EDM search data store 125A or 125B. EDM search data store 125A or 125B includes multiple data store entries, of which two sample entries 302A to 302B are identified to maintain graphic clarity. Each entry includes hash data 310 and sensitivity indicator 312.

[0090] Figure 3 Also shown is an index 320 generated for an EDM search data store 125A or 125B. In some aspects, the index 320 is generated by the DMS module 206, as described above with respect to Figure 2A The index 320 includes entries such as first entry 322A and second entry 322B that identify entries 302A and 302B within the EDM search data store 125A or 125B or 125C, respectively. Exact data match (EDM) query 324 is used to search for a portion of network data (such as the above-mentioned Figure 2A Index 320 may be consulted when discussing section 216). Note that because Figure 3 In the illustrated embodiment, the data included in the EDM search data store 125A or 125B is hashed or encrypted, and the EDM query 324 will submit the encrypted data, which is indexed by the index 320.

[0091] Figure 4 An example user interface implemented in one or more of the disclosed embodiments is shown. In some embodiments, Figure 4 The user interface 400 shown is composed of the above Figure 2A The user interface 400 provides for the definition of locations for which a particular policy is applied. For example, the user interface 400 includes a selectable control 402A, a selectable control 402B, and a selectable control 402C, which respectively provide for enabling policies for email, shared websites, and shared storage devices. For each location, the user interface 400 provides for the configuration of groups or users to be included in the policy via column 404, and the configuration of groups or users to be excluded from the policy via column 406.

[0092] Figure 5 5 shows an example user interface implemented in one or more of the disclosed embodiments. In some aspects, the user interface 500 is composed of the above-mentioned Figure 2A The user interface 500 is implemented by instructions included in the management user interface module 208 discussed above. The user interface 500 provides for configuration of data that is considered sensitive via the UI portion 502. The UI portion 502 defines data that is found to be sensitive by the DMS 114, as discussed above with respect to FIG. 1. Figure 5As shown, user interface 500 displays that an exact match on credit card information as indicated at 504 will cause the portion of data including the matching credit card information to be considered sensitive. UI portion 502 also provides for configuration of instance count 506 and match accuracy 508. In some embodiments, minimum and maximum values ​​for each of instance count 506 and match accuracy 508 are configured via user interface portion 502. User interface portion 502 also provides for configuration of specific groupings of conditions to be applied via control 510. Additional conditions are included in the policy via control 512.

[0093] Figure 6 600 is an example user interface implemented in one or more of the disclosed embodiments. Figure 2A The instructions included in the management user interface module 208 discussed above are implemented. Figure 6 The user interface 600 of provides the control for selecting the strategy operation mode. As shown, the user interface 600 provides the strategy of opening immediately via the control 602A, the strategy in the test mode via the control 602B, or the strategy of keeping closed via the control 602C.

[0094] Figure 7 1 shows an example user interface implemented by one or more of the disclosed embodiments. In some aspects, the user interface 700 is composed of the above-mentioned Figure 2A In some aspects, the user interface 700 is displayed above with respect to Figures 1A to 1E In some embodiments, when DMC 108A or 108B determines that a user terminal has attempted to send data that is considered sensitive, user interface 700 is displayed.

[0095] Figure 8 2 shows an example data structure implemented in one or more of the disclosed embodiments. Figure 8 The data structure is discussed below as a relational database table, but the skilled person will understand that in various embodiments, the fields of the data structure discussed below may be implemented using various data storage technologies, including traditional memory structures such as linked lists, trees, graphs, or arrays, or may be implemented using unstructured data storage. Figure 8 An example implementation of the screening data store 112 and the policy data store 110 discussed above, for example, with respect to FIG. 1 is shown.

[0096] Screening data store 112 includes a criteria table 800. The criteria table includes a criteria identifier field 804 and a criteria field 806. The criteria identifier 804 uniquely identifies a particular criteria used to identify sensitive data. In some embodiments, the criteria identifier 804 is associated with the following Figure 8 800. In some aspects, screening data store 112 is configured via management console 113A or management console 113B, as described above with respect to each of the following aspects, respectively. Figure 1B and 1C discussed.

[0097] Figure 8 The illustrated embodiment of the policy data store 110 includes an account table 810, a group table 815, an included group table 820, an excluded group table 825, a policy criteria table 830, an included account table 840, and an excluded account table 850. The account table 810 includes an account identifier field 812 and an account credential field 813. The account identifier field 812 uniquely identifies a particular (user) account. The account credential field 813 defines the authentication credentials for the account (such as, account name and / or password). The group table 815 includes a group identifier field 816 and an account identifier field 818. The group identifier field 816 uniquely identifies a group account. The account identifier field 818 indicates an account included in the group defined by the group identifier 816. The included group table 820 includes a policy identifier 822 and an included group identifier field 824. The policy identifier field 822 uniquely identifies a particular policy, which in some embodiments is associated with a policy regarding Figure 8 The included group identifier field 824 identifies the group to be included in the policy identified by the policy identifier field 822. The excluded group table 825 includes a policy identifier 826 and an excluded group identifier field 828. The policy identifier field 826 uniquely identifies a particular policy, which in some embodiments is associated with a policy identifier field 828. Figure 8 The other policy identifier fields discussed are cross-referenced. The exclusion packet identifier field 828 identifies packets to be excluded within the policy identified by the policy identifier field 826.

[0098] The policy criteria table 830 includes a policy identifier field 832 and a criteria identifier field 834. The policy criteria table 830 defines the criteria included in the policy (identified via the policy identifier field 832) for determining whether data is sensitive. The included accounts table 840 defines the accounts to which the policy is applied and includes a policy identifier field 842 and an account identifier 844. The policy identified by the policy identifier field 842 is applied to the account identified by the account identifier field 844. The excluded accounts table 850 includes a policy identifier field 852 and an excluded account identifier field 854. The policy identified by the policy identifier field 852 is not applied to the account identified by the excluded account identifier field 854.

[0099] Figure 8 It is also shown that as above with respect to at least Figure 1B At least a partial embodiment of the data store 104A is discussed. Figure 8 The illustrated embodiment includes a data table 860 and a data content table 870. The data table 860 includes a data identifier field 862 and a restricted indication field 864. The data identifier field 862 uniquely identifies specific data within the data store 104A. In some embodiments, the data identifier field 862 may identify a file, a database, a database table, or other data structure. The restricted indication field 864 indicates whether the data identified by the data identifier field 862 is restricted. As described above, and with respect to the following Fig.11 As described, after the data is created, in some configurations, it can be a default that does not allow guest accounts to access the data until the data has been uploaded to the EDM search data store 125A or 125B. Once the upload is complete, the precise data matching method described herein can detect any sensitivity associated with the data, and then access to the data can be obtained by, for example, the following description of Fig. 9 A discussion of process 900 is provided.

[0100] The data content table 870 includes a data identifier field 872 and a content field 874. The data identifier field 872 can uniquely identify a data set manipulated and accessed by the disclosed embodiments. The data identifier field 872 can identify, for example, an electronic document, a row in a relational database, or any other data set managed by the disclosed embodiments. The content field 874 includes data defining the data itself. Thus, if the data identifier field 872 identifies an electronic form file or document, the content field 874 includes the data of the electronic form itself. The content field 874 can also define metadata associated with the file or document.

[0101] Fig. 9is a flow chart of an example method for managing sensitive information within an enterprise environment. In some aspects, one or more of the functions discussed below are performed by hardware processing circuitry. For example, in some aspects, the instructions 2424 in memory 2404 and / or 2406 convert the following Fig.24 The hardware processor 2402 is configured to perform the following Fig. 9 In some aspects, the following Fig. 9 One or more of the functions discussed above are Figure 2A The DMC module 204 discussed above is executed.

[0102] After starting operation 905, process 900 moves to operation 910. In operation 910, a message is received within a secure environment. In some aspects, the message is received from a user terminal 102A or 102B. In some aspects, the message is received from a network device such as (multiple) application servers 116A, proxy servers, network caches, switches, routers, or other devices. The message is received in a secure environment. For example, in some aspects, the message is received within an enterprise 103A or 103B. In some aspects, the message is received within a "DMZ" (also known as a perimeter network or screened subnet) within the network infrastructure of the enterprise 103A or 103B.

[0103] The received message is addressed to a device outside the secure environment. For example, the message may include a destination host name or a destination Internet Protocol (IP) address that identifies the device outside the secure environment. For example, the message may identify the external device 117A or 117B, as described above with respect to Figures 1B to 1C discussed.

[0104] The message received in operation 910 includes data. For example, in some embodiments, the data is included in an electronic document, such as a word processing document, text data, a spreadsheet, a presentation file, a data store, or other data.

[0105] In operation 920, it is determined whether the portion of the data indicates a security risk. Figure 1B and Figure 1CAs discussed, operation 920 can apply regular expressions or keyword matching processes to data. In some aspects, operation 920 can adopt one or more methods in the Rabin-Karp method, the Knuth-Morris-Pratt method, the Boyer-Moore string search method or other methods to identify one or more indicators including sensitive data about the part. For example, some aspects can attempt to identify personal identifiable information or credit card information in the part. In some aspects, sensitive data in an enterprise can include some data that conform to a specific pattern. As an example, a data storage record (such as a relational data storage table) can have a unique signature within an organization.

[0106] The functionality associated with operation 920 is based on, for example, the above description of Figure 8 The screening data store 112 discussed above is changed to search for customized data patterns that indicate sensitive information risk. In some embodiments, these customized patterns are configured through a configuration interface presented via the management console 113A. Note that in some embodiments, operation 920 is performed on multiple portions of the data included in the message received in operation 910.

[0107] Decision operation 925 evaluates whether operation 920 determined that the portion represents a risk of sensitive data. If there is no risk of sensitive data in the portion, process 900 moves from decision operation 925 to operation 943, in which the portion is allowed to be transmitted. Note that in some cases, the data may include a cohesive data set, such as data in an electronic document or data store, and the portion may represent less than the entire electronic document or data store. Therefore, allowing a portion of a document or data store does not necessarily cause the portion to be transmitted outside the enterprise. Conversely, process 900 can determine whether all portions of a cohesive data set, such as all data included in a particular message or data included in an electronic document or data store, are allowed or blocked as a whole.

[0108] If decision operation 925 determines that the portion does present a risk of exposing sensitive data, process 900 moves to operation 930. At operation 930, the portion is transmitted to (DMS). In some embodiments, the transmission of operation 930 is a request to the DMS to search a data store (e.g., 125A or 125B) for data that matches the portion. In some embodiments, the precise data matching service is physically located outside the secure environment. Therefore, the transmission of the portion exposes the portion, which may include sensitive information. Therefore, in some aspects, the portion is encrypted before being transmitted to the EDM service.

[0109] In operation 940, a response is received from the EDM matching service. The response indicates whether the portion matches data within the data store (e.g., 125A or 125B). The response may also separately indicate whether the portion includes sensitive data. Thus, while the determination of operation 920 provides an indication of whether the portion indicates a security risk, it does not necessarily determine whether the portion matches known sensitive data within the organization (e.g., enterprise 103A or enterprise 103B), such as data included in one of data stores 104A-104C.

[0110] If the decision operation 942 determines that the portion matches sensitive data within the EDM search data store 125A or 125B (and / or 104), then the process 900 moves to operation 945, which blocks transmission of the message to the device based on the response. In some aspects, operation 945 may include sending status information to a firewall, proxy, cache, or other network device integrated with the DMC to indicate that the network device should block the message.

[0111] If decision operation 942 determines that the response indicates that the portion does not match the data in EDM search data store 125A or 125B (and / or 104) and is not sensitive, process 900 moves from decision operation 942 to operation 943, which allows the portion. Processing then moves from operation 943 or operation 945 to end operation 975.

[0112] Fig.10 is a flow chart of an example method for performing an exact data match on a portion of data received from a secure environment. In some aspects, one or more of the functions discussed below are performed by hardware processing circuitry. For example, in some aspects, instructions 2424 in memory 2404 and / or 2406 configure hardware processor 2402 to perform the following regarding Fig.10 In some aspects, the process 1000 discussed below is a continuation of the process 1000 discussed above. Figure 2A The DMS module 206 discussed here performs.

[0113] After start operation 1005, process 1000 moves to operation 1010. In operation 1010, a message indicating a portion of data, such as an electronic document or a data store, is received. In some aspects, the message is received from a DMC, such as DMC 108A or DMC 108B, as described above with respect to Figure 1B and 1C In some embodiments, the message is received indirectly from the DMC, where there is at least a firewall, cache, proxy, workload, or other network component physically between the DMC and the device performing process 1000.

[0114] In operation 1020, the portion is compared to data stored in the document data store. For example, as described above, process 1000 may attempt to identify an exact data match between the data of the portion and data stored in a data store such as EDM search data store 125A or 125B (and / or 104). As described above, in some embodiments, EDM search data store 125A or 125B is synchronized with data stored in a secure environment (e.g., synchronizing EDM search data store 125A or 125B with data store 104A or 104B, respectively). In some aspects, the portion is encrypted and / or hashed when received in operation 1010. Thus, the comparison performed in operation 1020 may compare the hashed / encrypted portion to a similarly hashed / encrypted portion in the EDM search data store (e.g., 125A or 125B). In some aspects, the comparison in operation 1020 may depend on one or more indexes for the data store, such as described above with respect to Figure 3 Index 320 of discussion.

[0115] Decision operation 1030 determines whether an exact match for the portion was detected by operation 1020. If not, process 1000 moves from decision operation 1030 to operation 1045, indicating that the portion is insensitive.

[0116] If operation 1020 finds an exact match, process 1000 moves from decision operation 1030 to decision operation 1035, which determines whether the matching portion is sensitive. In some embodiments, the sensitivity of the portion is indicated in EDM search data store 125A or 125B (e.g., as indicated in FIG. 10A , 10B , respectively). Figure 1B and 1C If the decision operation determines that the matching portion is not sensitive, the process 1000 moves from the decision operation 1035 to operation 1045. Otherwise, the process 1000 moves from the decision operation 1035 to operation 1040, which concludes that the portion is sensitive. In operation 1050, a response is transmitted indicating whether a match is found and / or indicating the sensitivity of the portion determined by the decision operation 1035. For example, as described above with respect to Figure 2A As discussed, the DMS module 206 can send a response 218 indicating the sensitivity of the portion to the DMC module 204. The process 1000 then moves to end operation 1060.

[0117] Fig.11is a flow chart of an example method for managing restricted access to new data until the new data is uploaded to the data matching system. In some aspects, one or more of the functions discussed below are performed by hardware processing circuitry. For example, in some aspects, instructions 2424 in memory 2404 and / or 2406 configure hardware processor 2402 to perform the following regarding Fig.11 In some aspects, the process 1100 discussed below is a continuation of the process 1100 discussed above. Figure 2A The DMC module 204 discussed above is executed. Process 1100 may be combined with the following Fig.12 The process 1200 discussed herein is operated in accordance with the embodiment of the present invention. For example, the process 1100 describes one embodiment for managing restriction settings for newly created data. The process 1200 describes one embodiment for providing access to newly created data based on restriction settings.

[0118] After starting operation 1105, process 1100 moves to operation 1110 where new data is created. New data is any number of entries in a file, data table, database, or any other data stored on a non-transient medium. Decision operation 1115 determines whether limiting new data is a default setting. In other words, as described above, the management user interface displayed on management console 113A can provide the configuration of any network system in network systems 100A to 100E, such as to make newly created data initially set to be restricted by default. When set to restricted, for example, any network system in network systems 100A to 100E will not allow data to be passed to the outside of enterprise 103A or 103B. If the data is restricted by default, process 1100 moves from decision operation 1115 to operation 1120. Otherwise, processing moves from decision operation 1115 to operation 1130.

[0119] In operation 1120, a restricted indicator for the data is set to indicate that the data is restricted. For example, as discussed above with respect to data table 860, data identifier field 862 may identify the newly created data, for example, via data content table 870 discussed above. Operation 1120 may set restricted indication field 864 to indicate that the file is restricted.

[0120] Operation 1125 waits for the upload of data to complete. Figure 1B and / or Figure 1CAs discussed above, new data is added to the new data queue 132A or 132B. While data is waiting in the new data queue 132A or 132B, in some embodiments, it is restricted (e.g., via the restricted indication field 864). After being uploaded from the new data queue (and / or any of the data stores 104A to 104C) to the EDM search data store 125A or 125B, the DMS will be able to detect matches for the new data if an attempt is made to transfer the new data outside of the enterprise 103A or 103B.

[0121] After the upload is complete, process 1100 moves from operation 1125 to operation 1130, which sets an indicator (eg, via restricted indication field 864) to indicate that the new data created in operation 1110 is no longer restricted. Process 1100 then moves to end operation 1135.

[0122] Fig.12 2 is a flowchart of an example method for providing conditional access to data based on whether access to the data is restricted. In some aspects, one or more of the functions discussed below are performed by hardware processing circuitry. For example, in some aspects, instructions 2424 in memory 2404 and / or 2406 configure hardware processor 2402 to perform one or more of the functions discussed below with respect to FIG. 2. In some aspects, process 1200 discussed below is performed by hardware processing circuitry as described above with respect to FIG. Figure 2A The DMC module 204 discussed above is executed. Process 1200 may be combined with the following Fig.11 The process 1100 discussed herein operates as described above. For example, the process 1100 describes one embodiment for managing restriction settings for newly created data. The process 1200 describes an embodiment for providing access to newly created data based on restriction settings.

[0123] After start operation 1205, process 1200 moves to operation 1210. In operation 1210, a request to access data is received. For example, the request to access data is received by DMC 108A or 108B. In other words, user terminal 102A or 102B may attempt to send data outside of enterprise 103A or 103B, which is intercepted by DMC 108A or 108B.

[0124] Decision operation 1215 determines whether access to the data is restricted. In some embodiments, decision operation 1215 may search data store 104 to identify the data via data identifier field 862. Decision operation 1215 may then consult restricted indication field 864 to determine whether the data is restricted. If access to the data is not restricted, process 1200 moves from decision operation 1215 to operation 1230, which allows access to the data. Otherwise, process 1200 moves from decision operation 1215 to decision operation 1220, which determines whether the access request of operation 1210 was generated by a guest account.

[0125] In some aspects, decision operation 1220 consults the guest account indicator 814 discussed above to determine whether the request was generated by a guest account. If the request was not generated by a guest account, the process 1200 moves from decision operation 1220 to operation 1230. Otherwise, the process 1200 moves from decision operation 1220 to decision operation 1225, which determines whether the data is sensitive by default. If the data is not sensitive by default, the process 1200 moves to operation 1230, which allows access. Otherwise, the process 1200 moves from decision operation 1225 to operation 1235, which denies access to the data. The process 1200 then moves to end operation 1240.

[0126] Fig.13A Example message portions exchanged between devices implementing one or more of the disclosed embodiments are shown. Fig.13A Shown by Figure 2C The message portion 1300 generated and / or transmitted by the client module 252A and / or the client module 252B and / or the above Figure 2C The IB service 256 in question.

[0127] Fig.13A Message portion 1300 is shown, and message portion 1300 includes a message identifier 1302, a source account identifier 1304, and a destination account identifier 1306. Message identifier 1302 identifies the type of message portion 1300. Message identifier 1302 may store a value indicating the type or format of message portion 1300. For example, the value stored in message identifier 1302 may indicate the presence and size of source account id field 1304 and / or destination account identifier field 1306. Message portion 1300 indicates a request to determine whether a first account identified by source account id field 1304 can communicate with a second account identified by destination account identifier field 1306 based on information barriers(es).

[0128] The source account identifier field 1304 identifies the first account and the destination account identifier field 1306 identifies the second account.

[0129] Fig. 13B is an example of a message portion implemented by some of the disclosed embodiments. Fig. 13B The message section 1310 discussed consists of the above respectively about Figure 2B and 2C The IB service 224 and / or the IB service 256 discussed generate and / or transmit.

[0130] Message portion 1310 includes a message id field 1312 and a communication status field 1314. In some embodiments, message portion 1310 is transmitted in response to receipt of message portion 1300. In some aspects, message identifier field 1312 stores a value indicating the type or format of message portion 1310, and message portion 1310 is a response to message portion 1300. Communication status field 1314 indicates the communication status between the first account identified by source account identifier field 1304 and the second account identified by destination account identifier field 1306. For example, if the first account is allowed to communicate with the second account, communication status field 1314 stores a first predetermined value, and if the first account is not allowed to communicate with the second account, communication status field 1314 stores a second predetermined value.

[0131] Fig.14A An example message portion implemented by one or more of the disclosed embodiments is shown. In some aspects, the message portion 1400 discussed below with respect to FIG. 14 is derived from the message portion 1400 discussed above with respect to FIG. Figure 2B The client modules 222A and / or 222B discussed above and / or Figure 2C The communication server(s) 254 discussed generate and / or transmit.

[0132] Message portion 1400 includes a message identifier 1402 and a source account identifier field 1404. Message identifier 1402 carries a value indicating the format or type of message portion 1400. For example, the value of message identifier 1402 may indicate the presence and size of message portion 1400, message id field 1402, and / or source account identifier field 1404. Message portion 1400 indicates a request to identify an account, and the account identified by source account identifier field 1404 can communicate with the account. In other words, the device may need to obtain a list of accounts with which the first account can communicate. In some embodiments, the list is used to display a list of accounts in a user interface so that one or more accounts in the account are selected as the destination of the message. In some embodiments, the list is requested via message portion 1400.

[0133] Fig. 14B is an example message portion implemented in one or more of the disclosed embodiments. In some aspects, message portion 1410 is composed of the above-mentioned Figure 2B and 2C The IB service 224 and / or the IB service 256 discussed generate and transmit.

[0134] Fig. 14B Message portion 1410 is shown including message identifier field 1412, communication status field 1414, and account list 1416. In some embodiments, message portion 1400 is sent in response to message portion 1400, as discussed above with respect to 14A. Message identifier 1412 identifies the type or format of message portion 1410. Message identifier 1412 is set to a predetermined value that identifies message portion 1410. Communication status field 1414 indicates the status of the response to message portion 1400. For example, communication status field 1414 may indicate via a first predetermined value that the account identified by source account identifier field 1404 is a valid account, while a second predetermined value indicates that source account identifier field 1404 indicates an invalid account identifier. Account list 1416 identifies zero or more accounts with which the account identified by source account identifier field 1404 can communicate.

[0135] Fig.15 1 shows an example data structure implemented in one or more of the disclosed embodiments. Fig.15 The data structures discussed are described as relational database tables, but the skilled person will appreciate that the data described may be represented using a variety of data structures, including unstructured data storage, traditional memory structures such as linked lists, arrays, queues, trees, or other representations. In some embodiments, the data structures discussed below are included in the above respective descriptions of Figure 3 and 4 The IB data store 226 or the IB data store 258 discussed.

[0136] Fig.15 An account table 1500, a group table 1510, a segment table 1520, an address book policy table 1530, an information barrier rule table 1540, and a filter table 1550 are shown. The account table 1500 includes an account identifier field 1502, an account credential field 1504, an address book policy identifier field 1505, a segment identifier field 1506, an account address list field 1507, and one or more account attribute fields 1508. 1..n In some aspects, the account table 1500 and / or the group table 1510 are included in an electronic organizational directory, such as a directory that implements a directory service. In various embodiments, the directory service is hosted via Lightweight Directory Access Protocol (LDAP) and / or Microsoft Active Directory.TM Technology provided.

[0137] The account identifier field 1502 uniquely identifies an account. In some embodiments, the account identifier field 1502 is similar to the following description of the account identifier field 1502. Fig.15 Other account identifier fields discussed above and / or FIG. 13A to FIG. 14B Other account identifier fields discussed are cross-referenced. Account credentials field 1504 can store one or more credentials for the account identified by account identifier field 1502. This can include, for example, the account name and / or password of the account. Address book policy identifier field 1505 identifies the address book policy to be applied to the account identified by account identifier 1502. In some embodiments, the address book policy is a Microsoft Active Directory address book policy. The address book policy is described below. Segment identifier field 1506 identifies the segment in which the account is included. Segments are further described below. Account address list field 1507 identifies the address list to which the account identified by account identifier 1502 belongs. For example, if the account is part of the "engineering" address list, the "engineering" address list is identified by field 1507.

[0138] Account attributes 1508 1..n Stores the values ​​of one or more attributes of an account. The attributes may include, for example, a title assigned to an individual of the account, a creation date of the account, a home geographic location of an individual of the account, or other attributes.

[0139] Group table 1510 includes an account identifier field 1512 and a group identifier field 1514. Account identifier field 1512 identifies an account, while group identifier field 1514 identifies a group of which an account (eg, 1512) is a member. A group including multiple accounts may appear in multiple rows of group table 1510.

[0140] Segment table 1520 includes segment identifier 1522, segment name 1524, and filter identifier 1526. Segment identifier 1522 uniquely identifies a segment. Segment name 1524 defines a name for a segment. In some embodiments, the segment name is used to reference the segment, for example, in a user interface. Filter id 1526 identifies a filter for the segment. Filters identify accounts (e.g., 1522) that are included in or excluded from a segment.

[0141] The address book policy table 1530 includes an address book policy identifier field 1532, a segment identifier 1533, an information barrier rule identifier field 1534, an accessible address list identifier field 1536, an inaccessible address list identifier field 1538, and a filtered address list identifier field 1539. The address book policy identifier field 1532 uniquely identifies the address book policy and is cross-referenced with the address book policy identifier field 1505 in some embodiments. The segment identifier 1533 identifies the segment (e.g., 1520) associated with the specific address book policy identified via 1532. The IB rule identifier field 1534 identifies the IB rule to be applied. The IB rules are defined in the information barrier rule table 1540 as described below. The accessible address list identifier field 1536 identifies an access list of zero or more address lists that identify accounts that can be communicated with. The inaccessible address list identifier field 1538 identifies a negative access list that identifies accounts that are not allowed to communicate with according to the ADP policy. Filter address list identifier field 1539 is a filter access list that identifies an address list that identifies accounts whose communications are filtered by the ADP policy. For example, in some embodiments, messages for accounts on the filter address list are checked to determine whether the message includes sensitive information. In some embodiments, if sensitive information is present in the message, the message is blocked by the policy, otherwise the message is allowed.

[0142] The information barrier (IB) rule table 1540 includes an IB rule identifier 1542, an IB rule name field 1544, an assigned segment identifier field 1546, a segment filter field 1547, a segment block field 1548, and a segment allow field 1549. The IB rule identifier field 1542 uniquely identifies a segment and, in some embodiments, is cross-referenced with the segment identifier field 1522. The IB rule name field 1544 defines a name for the IB rule identified by the policy identifier 1542. The IB rule name field 1544 may store a name for referring to the IB rule in one or more user interfaces implemented by one or more of the disclosed embodiments. The assigned segment identifier field 1546 identifies the segment to which the IB rule (identified by the IB rule id 1542) is applied. The segment filter field 1547 identifies zero or more segments (e.g., via zero or more segment identifiers cross-referenced with the segment identifier 1522) whose messages have been filtered before determining whether to allow communication with the identified segment (identified by the assigned segment identifier field 1546).

[0143] Segment blocked field 1548 identifies zero or more segments that are blocked from communicating with the segment identified by assigned segment identifier field 1546 (e.g., via zero or more segment identifiers cross-referenced with segment identifier 1522). Segment allowed field 1549 identifies zero or more segments (via zero or more segment identifiers cross-referenced with segment identifier 1522) that define accounts that are blocked from communicating with the account defined by assigned segment identifier field 1546. Note that there may be devices identified by both segment blocked field 1548 and segment allowed field 1549.

[0144] Filter table 1550 includes filter identifier field 1552 and filter field 1554. Filter identifier field 1552 uniquely identifies a filter and in some embodiments cross-references filter identifier field 1526 discussed above. Filter field 1554 stores a filter. For example, filter field 1554 may store a query that identifies one or more accounts of account table 1500.

[0145] The address list table 1560 includes an address list identifier 1562 and an account identifier 1564. The address list identifier 1562 uniquely identifies the address list. The account identifier 1554 identifies the account included in the address list.

[0146] Fig.16 An example user interface implemented in one or more of the disclosed embodiments is shown. The example user interface of FIG. 1600 is configured to list information barrier policies for a given tenant or account. Fig.16 The illustrated example shows two IB policies as 1602A and 1602B.

[0147] Fig.17 An example user interface is shown that may be implemented in one or more of the disclosed embodiments. Fig.17 The example user interface 1700 of FIG. 1700 is configured to receive input for defining an IB policy. The example user interface 1700 displays a sender packet filter name 1702 , a packet definition field 1704 , a receiver packet filter name 1706 , and a packet definition 1708 .

[0148] Fig.18 An example user interface is shown that may be implemented in one or more of the disclosed embodiments. Fig.18 The user interface 1800 is configured to display a history of tenant-wide application of a configuration policy. Two example log records of policy application are shown as 1802A and 1802B.

[0149] Some embodiments may provide a command line interface for initializing or setting the values ​​in the above data structures. For example, an exemplary command line based user interface for creating an organization segment is as follows:

[0150] New-OrganizationSegment-Name″Sales″-UserGroupFilter″Department-eq′Sales′″

[0151] New-OrganizationSegment-Name″Research″-UserGroupFilter″Department-eq′Research′″

[0152] New-OrganizationSegment-Name″Engineering″-UserGroupFilter

[0153] "Department-eq'Engineering'"

[0154] An example creation of an information barrier policy that blocks communication from "sales" to "reserach" is shown below:

[0155] New-InformationBarrierPolicy-Name″Sales-Research″-AssignedSegment

[0156] "Sales"-SegmentsBlocked"Research"-State Active

[0157] An example creation of an information barrier policy that blocks communication from "research" to "sales" is shown below:

[0158] New-InformationBarrierPolicy-Name″Research-Sales″-AssignedSegment″Research″-SegmentsBlocked″Sales″-State Active

[0159] Another example of an information barrier policy creation that allows the Research department to communicate only with Engineering. Note that this policy does not place any restrictions on Engineering:

[0160] New-InformationBarrierPolicy-Name″Research-Engineering″-AssignedSegment″Research″-SegmentsAllowed″Engineering″-State Active

[0161] Fig.19 is a flow chart of a method for generating a data structure to support an information barrier. Fig.19 One or more of the functions discussed in the process 1900 are performed by hardware processing circuitry. For example, instructions 2424 in memory 2404 and / or 2406 discussed below may configure processor 2402 to perform one or more of the functions discussed below. In some aspects, the process 1900 discussed below is performed by hardware processing circuitry. Figure 2B and 2C The IB service 224 or the IB service 256 discussed above is performed. In some aspects, the process 1900 is performed by Figure 2B The process 1900 is performed by any of the client modules 222A to 222B discussed above. Figure 2C The communication server(s) 254 in question execute.

[0162] As described above, the disclosed embodiments can generate a data structure for providing an effective identification of an information barrier between two accounts. By pre-establishing a list of accounts to define which accounts can and cannot communicate with each other, runtime performance is improved at the expense of certain configuration. Configuration is rarely performed, while the application of information barrier policies is performed in most communications, and therefore providing efficient runtime execution may be more important.

[0163] After start block 1905, process 1900 moves to operation 1910. In operation 1910, a first query is executed that selects a first account based on a first attribute value of the first account. For example, as described above, in some embodiments, by selecting a first account having one or more specific attribute values ​​(e.g., 1508 1..n ) to limit the segment.

[0164] In operation 1920, a first list of accounts is generated based on the first query. As discussed above, in some embodiments, segments are defined based on a query. The query is executed to identify accounts included in the segment. Fig.15 As discussed above, a particular segment (e.g., 1522) is defined based on a query or filter (e.g., 1526). A query is executed or run to identify the accounts included in the segment. In the example above, executing usergroupfilter "Department-eq 'sales'" may query for values ​​for the "department" attribute (e.g., 1508 1..n ). Operation 1920 generates an account list including the accounts identified by the query.

[0165] In operation 1930, a second query is executed that selects the second account based on the second attribute value of the second account. Continuing with the above example, New-OrganizationSegment-Name "Research"-UserGroupFilter "Department-eq 'Research'" limits the second query to accounts with a department attribute value equal to "Research". In contrast, New-InformationBarrierPolicy-Name "Research-Engineering"-

[0166] In operation 1940, a second account list is generated based on the results of the second query. The second account list includes accounts identified from the second query.

[0167] In operation 1950, an indication is generated regarding the second account list identifying accounts with which the first account is allowed to communicate. For example, as described above, an information barrier policy may be defined. Continuing with the above example, "New-InformationBarrierPolicy-Name "Sales-Research"-AssignedSegment "Sales"-SegmentsBlocked "Research"" indicates that communications from accounts included in the "sales" segment to accounts included in the "Research" segment are blocked. AssignedSegment "Research"-SegmentsAllowed "Engineering" determines that communications from accounts included in the "Research" segment to accounts included in the "engineering" segment are allowed. As described above with respect to Fig.15 As discussed, in an example embodiment, an account list indicating included and / or excluded accounts (eg, 1536 and / or 1538) is provided in the address book policy (eg, 1532). After operation 1950 is completed, process 1900 moves to end operation 1960.

[0168] Fig. 20 is a flow chart of a method for implementing an information barrier. Fig. 20 One or more of the functions discussed in the process 2000 may be performed by hardware processing circuitry. For example, instructions 2424 in memory 2404 and / or 2406 discussed below may configure processor 2402 to perform one or more of the functions discussed below. In some aspects, the process 2000 discussed below may be performed by hardware processing circuitry. Figure 2B and 2CThe IB service 224 or the IB service 256 discussed above is performed. In some aspects, the process 2000 is performed by Figure 2B The process 2000 may be performed by any of the client modules 222A to 222B discussed above. Figure 2C The communication server(s) 254 discussed execute.

[0169] After start operation 2005, process 2000 moves to operation 2010, which receives a communication from the first account to the second account. In operation 2020, it is determined that the second account is included in the allowed account list of the first account. For example, as described above, in some embodiments, one or more account lists are associated with an account. Fig.15 As shown, the association in some aspects is via address book policy (eg, via 1536 and / or 1538), but this need not be the case. In some aspects, the account list is allowed to be generated via the process 1900 described above.

[0170] In operation 2030, it is determined that the first account can communicate with the second account because the second account is included in the allowed account list.

[0171] In operation 2040, the communication from the first account is forwarded to the second account based on the determination of operation 2030. After operation 2040 is completed, process 2000 moves to end operation 2050.

[0172] Fig.21 is a flow chart of a method for responding to a query for information barrier information. Fig.21 One or more of the functions discussed in the process 2100 are performed by hardware processing circuitry. For example, instructions 2424 in memory 2404 and / or 2406 discussed below may configure processor 2402 to perform one or more of the functions discussed below. In some aspects, the process 2100 discussed below is performed by hardware processing circuitry. Figure 2B and 2C The IB service 224 or the IB service 256 discussed above is performed. In some aspects, the process 2100 is performed by Figure 2B The process 2100 is performed by any of the client modules in the client module 252A and / or client module 252B discussed above. Figure 2C The communication server(s) 254 discussed execute.

[0173] After start operation 2105, process 2100 moves to operation 2110, which receives a request for a communication status between the first account and the second account. As described above, IB service 224 and / or 256 can implement a rest interface that provides a communication status between the two accounts. The communication status is based on the information barrier policy established as described above. The request is received, for example, from a client-based communication application, as described above with respect to Figure 2B Alternatively, the request is received from a communication server, such as an instant messaging server, as described above in Figure 2C In some aspects, the request message received in operation 2110 may include the above Fig.13A One or more of the fields in question.

[0174] Operation 2120 determines whether the second account is included in the allowed account list (or excluded account list) of the first account. For example, as described above, one or more allowed account lists for a particular account are established (e.g., 1536 and / or 1538) for the account identified via ADP policy IDs 1532 and 1505 (at least in some embodiments).

[0175] In operation 2130, a response to the request is provided based on the determination. For example, IB service 224 and / or 256 may respond within the REST interface to indicate the communication status between the first account and the second account. Client module 222A or client module 222B or an application running on one or more communication servers (e.g., 254) may then allow or block communication from the first account to the second account based on the response. In some aspects, providing the response includes transmitting a message including the response to the device that initiated the request of operation 2110. In some aspects, the response provided in operation 2130 may include the above-mentioned Fig. 13B After operation 2130 is completed, process 2100 moves to end operation 2150.

[0176] Fig. 22 is a flow chart of a method for responding to a query for information barrier information. Fig. 22 One or more of the functions discussed in the process 2200 are performed by hardware processing circuitry. For example, instructions 2424 in memory 2404 and / or 2406 discussed below may configure processor 2402 to perform one or more of the functions discussed below. In some aspects, the process 2200 discussed below is performed by hardware processing circuitry. Figure 2B and 2C The IB service 224 or the IB service 256 discussed above is performed. In some aspects, the process 2200 is performed by Figure 2BAny of the client modules 222A to 222B discussed above is performed. In some aspects, the process 2200 is performed by Figure 2C The communication server(s) 254 discussed execute.

[0177] After start operation 2205, process 2200 moves to operation 2210, which receives a request for a list of allowed accounts for the first account. The received request requests a list of accounts that the first account is allowed to communicate with. In some aspects, the list of accounts is used to indicate the existence of these accounts to the first account in a user interface.

[0178] As described above, IB services 224 and / or 256 may implement a rest interface that provides a list of accounts with which the first account is allowed to communicate. The list of accounts is based on the information barrier policy established as described above. The request is received, for example, from a client-based communication application, as described above with respect to Figure 2B Alternatively, the request is received from a communication server, such as an instant messaging server, as described above in Figure 2C In some aspects, the request received in operation 2210 may include the above-mentioned message portion 1400 and Fig.14A One or more of the fields in question.

[0179] Operation 2220 determines allowed accounts for the first account. For example, operation 2220 can identify allowed accounts via an address book policy, for example, by cross-referencing an address book policy identifier associated with the account (e.g., 2205) and an address book policy data store (e.g., 2230). One or more allowed account lists are associated with the address book policy (e.g., 2236). One or more prohibited account lists are associated with the address book policy (e.g., 2238).

[0180] In operation 2230, a response to the request is provided based on the determination. For example, IB service 224 and / or 256 may respond within the REST interface to indicate a list of allowed accounts for the first account. The client communication application (e.g., running client module 222A or client module 222B) or the communication server application (e.g., running on (multiple) communication servers 254) may then display the list of allowed accounts in a user interface for the first account. Providing the response may include generating a response and / or transmitting a response to the device that initiated the request of operation 2210. In various aspects, the response discussed above with respect to operation 2230 may include the above with respect to message portion 1410 and Fig. 14B After operation 2230 is completed, process 2200 moves to end operation 2250.

[0181] Fig.23 is a flow chart of a method for applying an information barrier policy regarding sensitive information. Fig.23 One or more of the functions discussed in the process 2300 and described above are performed by hardware processing circuitry. For example, instructions 2424 in memory 2404 and / or 2406 discussed below may configure processor 2402 to perform one or more of the functions discussed below. In some aspects, the process 2300 discussed below is performed by hardware processing circuitry. Figure 2B and 2C The IB service 224 or the IB service 256 discussed above is performed. In some aspects, the process 2300 is performed by Figure 2B Any of the client modules 222A to 222B discussed above is performed. In some aspects, the process 2300 is performed by Figure 2C The communication server(s) 254 discussed execute.

[0182] In operation 2305, a first message is received. The message indicates a source address of a first source account and is addressed to a first destination account. In at least some embodiments, the first message is addressed to the first destination account via a "to" field of the message. In some embodiments, a "from" field of the message indicates the first source account. The first message includes first data. In some embodiments, the first data is an attachment to the first message, at least a portion of a body of the first message, or another portion of the first message.

[0183] In operation 2310, a first information barrier policy is identified based on the first source account and the first destination account. Fig.15 As discussed, some embodiments identify a policy to apply to a particular account (such as a first source account). In some embodiments, an account record (e.g., 1500) identifies a policy to apply to the account (e.g., via ADP Policy Identifier field 1505). In some embodiments, the policy identifies accessible accounts (e.g., via field 1536), inaccessible accounts (e.g., via 1538), and filtered accounts (e.g., via field 1539). Thus, in some embodiments, identifying the first information barrier policy includes: identifying whether the first destination account is included in one or more of the account lists identified by fields 1536, 1538, or 1539.

[0184] In operation 2315, it is determined that the first source account is prohibited from sending sensitive information to the first destination account. As described above, in some embodiments, operation 2315 includes identifying that the first destination account is included in the filtered address list identified by field 1539. Other embodiments identify that the first destination account is prohibited from sending sensitive information via an alternative technology. For example, if the first destination account is not included in the access list, the first source account is prohibited from sending any information to the first destination account. In some embodiments, the access list is retrieved from an address book policy.

[0185] In operation 2320, it is determined that at least a portion of the first data includes an indication of sensitive information. As described above, some embodiments evaluate a message or a portion of a message to determine whether the message or the portion has an indicator of sensitive information. For example, some embodiments operate a heuristic to find an indication of sensitive information. Some embodiments evaluate one or more regular expressions with respect to a portion of a message (or the entire message) to find an indication of sensitive information. As described above, for example, with respect to Figure 1B and / or Figure 1C As described, in some embodiments, DMC 108A or DMC 108B is used to detect an indication of sensitive information. In some embodiments, the indication of sensitive information generally indicates a probability that the message or portion includes sensitive information. The probability is greater than zero but less than one.

[0186] Thus, in some embodiments, to determine whether the portion or the entire message includes sensitive information, a data matching service is utilized, which checks the portion against a database of known sensitive information. Some embodiments encrypt or at least have the portion before sending it to the data matching service. If no exact match is found between the portion and the data used by the data matching service, some embodiments determine that the message does not include sensitive information.

[0187] In operation 2325, the search request is provided to the data matching service. In some embodiments, the data matching service is physically located on a different device than the device performing operation 2330. In this case, operation 2330 includes sending a network request to the data matching service. In some embodiments, providing the search request to the data matching service is conditional on the indication of sensitive information determined in operation 2320. In some embodiments, providing the search results includes transmitting a network message indicating the search request to the data matching service.

[0188] In operation 2330, a response is received from the data matching service. The response indicates whether an exact match for the portion was found in the database used as a basis by the data matching service (e.g., EDM search data store 125A or EDM search data store 125B). In some embodiments, the response indicates that sensitive information is not present in the portion. In other embodiments, the response indicates that sensitive information is indeed included in the portion.

[0189] In operation 2335, the response is decoded to identify that the portion does include sensitive information. In other words, in some embodiments, the data matching service searches the database for data that matches the portion. If found, a response is sent to indicate this. Otherwise, the response indicates that no match was found. In the specific case described in process 2300, the response indicates that the data matching service found a match. Since a match was found, operation 2335 determines that the portion includes sensitive information. Other embodiments of operation 2335 determine that sensitive information does not exist in the portion based on the response.

[0190] At operation 2340, the first message is processed based on the response. In particular, if the response indicates that the first message does not include sensitive information, some embodiments transmit the first message to the destination address of the message. If the response indicates that the first message includes sensitive information, some embodiments block or otherwise inhibit transmission of the first message to the first destination account based on an information barrier policy indicating that the first source account is prohibited from transmitting sensitive information to the first destination account.

[0191] In some embodiments, if the response indicates that the first message includes sensitive information, the process 2300 anonymizes the first message. For example, in some embodiments, the response specifically indicates which sub-portion of the portion is sensitive information. Then, in some embodiments, the process 2300 anonymizes the identified sub-portion. In these embodiments, the first message including the anonymized sub-portion is then sent to the first destination account.

[0192] Some embodiments of process 2300 include: receiving a second message within a secure environment. The second message has a first user account as a source account and a first destination account as a destination account. Therefore, the second message is addressed to the first destination account. Process 2300 analyzes the second message to identify any possible indications of sensitive information. For example, as described above, process 2300 can analyze the second message using one or more heuristics and / or regular expressions to identify possible sensitive information included in the second message. If an indication of sensitive information is found, process 2300 calls a data matching service to determine whether the indication of sensitive information identifies actual sensitive information. Alternatively, the indication of sensitive information may be a false positive, depending on the nature of the second message and / or the accuracy of the heuristics used. If the indication is a false positive, the matching service will not be able to locate matching data in its data store. A second response from the data matching service will indicate this situation.

[0193] Therefore, based on the second response, process 2300 determines whether the second message includes sensitive information. If the second message does not include sensitive information, the second message is transmitted or otherwise delivered to the first destination account. Note that in this case, the transmission of the second message is partially premised on the configuration of the first source account and the second destination account via an information barrier policy, such that communications from the first source account to the first destination account are prohibited from including sensitive information, but such transmissions are allowed in other cases. The disclosed embodiments take into account other information policies between the first source account and the first destination account. For example, an alternative policy may indicate that communications between the two accounts are not allowed, even if sensitive information is not present. Another alternative policy may allow communication even if sensitive information is present.

[0194] In some cases, the third message from the first source account to the first destination account does not include any indication of sensitive information. For example, the process 2300 evaluates the third message using one or more heuristics (such as, regular expressions) and does not identify any indication of sensitive information. Given an information barrier policy for communications from the first source account to the first destination account, in this case, the process 2300 transmits the third message to the first destination account.

[0195] In some embodiments, a fourth message is received. The fourth message is from a second source account and is addressed (e.g., via a "To" field) to a second destination account. Process 2300 identifies an information barrier policy between the second source account and the second destination account that allows communication between the two accounts, even if sensitive information is included. For example, such a policy may exist if the second source account is an employee and the second destination account is the employee's supervisor. In this case, in some embodiments, process 2300 does not check the indication of sensitive information of the fourth message. When the information barrier policy does not select how to process the message based on whether the message includes sensitive information, this suppression of the evaluation of the fourth message results in at least some savings in processor consumption. In addition, when the information barrier policy does not process the fourth message conditional on sensitive information, request / response communication with the data matching service is not required before processing (e.g., forwarding to its destination) the fourth message.

[0196] Some embodiments of process 2300 determine the first information barrier policy based on the group membership of one or more of the first source account and / or the first destination account. Figure 1D As discussed in and / or 1E, some embodiments may include policies that allow or prohibit a department of an organization (e.g., engineering) from communicating with another department within the organization (e.g., marketing). As discussed above, some embodiments maintain a mapping between individual accounts (e.g., a first source account or a first destination account) and groups (e.g., engineering or marketing). Fig.15 As discussed, one example embodiment maintains a grouping table 1510 to store such mappings.

[0197] Fig.24 A block diagram of an example machine 2400 on which any one or more of the techniques (e.g., methods) discussed herein may be performed is shown. In alternative embodiments, machine 2400 may operate as a standalone device or be connected (e.g., networked) to other machines. In a networked deployment, machine 2400 may operate in the capacity of a server machine, a client machine, or both in a server-client network environment. In one example, machine 2400 may act as a peer machine in a peer-to-peer (P2P) (or other distributed) network environment. Machine 2400 is a personal computer (PC), a tablet computer, a set-top box (STB), a personal digital assistant (PDA), a mobile phone, a smart phone, a network appliance, a network router, a switch or a bridge, a server computer, a database, a conference room device, or any machine capable of executing an instruction (sequential or otherwise) that specifies an action to be taken by the machine. In various embodiments, machine 2400 may perform the above-described Figures 1A to 23Further, while only one machine is illustrated, the term “machine” shall also be taken to include any collection of machines that individually or jointly execute an instruction (or multiple sets of instructions) to perform any one or more of the methodologies discussed herein, such as cloud computing, Software as a Service (SaaS), and other computer cluster configurations.

[0198] As described herein, examples may include logic or multiple components, modules, or mechanisms (hereinafter referred to as "modules"), or may operate on them. A module is a tangible entity (e.g., hardware) that is capable of performing a specified operation and is configured or arranged in a certain manner. In an example, a circuit is arranged in a particular manner (e.g., internally or relative to an external entity such as other circuits) as a module. In an example, all or part of one or more computer systems (e.g., independent client or server computer systems) or one or more hardware processors are configured by firmware or software (e.g., instructions, application parts, or applications) as a module for performing a specified operation. In an example, the software may reside on a non-transitory computer-readable storage medium or other machine-readable medium. In an example, the software causes the hardware to perform a specified operation when executed by the underlying hardware of the module.

[0199] Thus, the term "module" is understood to encompass a tangible entity that is physically constructed, specifically configured (e.g., hardwired), or temporarily (e.g., temporarily) configured (e.g., programmed) to operate in a specified manner or to perform part or all of any operation described herein. Consider an example where a module is temporarily configured, and each module does not need to be instantiated at any time. For example, where a module includes a general-purpose hardware processor configured using software, the general-purpose hardware processor is configured as correspondingly different modules at different times. The software can accordingly configure the hardware processor, for example, to constitute a specific module at one time and to constitute different modules at different times.

[0200] The machine (e.g., computer system) 2400 may include a hardware processor 2402 (e.g., a central processing unit (CPU), a graphics processing unit (GPU), a hardware processor core, or any combination thereof), a main memory 2404, and a static memory 2406, some or all of which may communicate with each other via an interconnect (e.g., a bus) 2408. The machine 2400 may also include a display unit 2410, an alphanumeric input device 2412 (e.g., a keyboard), and a user interface (UI) navigation device 2414 (e.g., a mouse). In an example, the display unit 2410, the input device 2412, and the UI navigation device 2414 are touch screen displays. The machine 2400 may additionally include a storage device (e.g., a drive unit) 2416, a signal generating device 2418 (e.g., a speaker), a network interface device 2420, and one or more sensors 2421, such as a global positioning system (GPS) sensor, a compass, an accelerometer, or other sensors. The machine 2400 may include an output controller 2428, such as a serial (e.g., universal serial bus (USB), parallel, or other wired or wireless (e.g., infrared (IR), near field communication (NFC), etc.) connection) to communicate with or control one or more peripheral devices (e.g., a printer, a card reader, etc.).

[0201] The storage device 2416 may include a machine-readable medium 2422 having stored thereon one or more data structure sets or instruction sets 2424 (e.g., software) embodying or utilized by any one or more of the techniques or functionality described herein. The instructions 2424 may also reside, completely or at least partially, within the main memory 2404, within the static memory 2406, or within the hardware processor 2402 during execution by the machine 2400. In an example, one or any combination of the hardware processor 2402, the main memory 2404, the static memory 2406, or the storage device 2416 may constitute a machine-readable medium.

[0202] Although the machine-readable medium 2422 is illustrated as a single medium, the term “machine-readable medium” may include a single medium or multiple media (eg, a centralized or distributed database, and / or associated caches and servers) configured to store one or more instructions 2424 .

[0203] The term "machine-readable medium" may include any medium capable of storing, encoding or carrying instructions executed by the machine 2400 and causing the machine 2400 to perform any one or more of the techniques of the present disclosure, or any medium capable of storing, encoding or carrying data structures used by such instructions or associated with such instructions. Non-limiting machine-readable medium examples may include solid-state memory and optical and magnetic media. Specific examples of machine-readable media may include: non-volatile memory, such as semiconductor memory devices (e.g., electrically programmable read-only memory (EPROM), electrically erasable programmable read-only memory (EEPROM)) and flash memory devices; disks, such as built-in hard disks and removable disks; magneto-optical disks; random access memory (RAM); solid-state drives (SSD); and CD-ROM and DVD-ROM disks. In some examples, the machine-readable medium may include non-transitory machine-readable media. In some examples, the machine-readable medium may include machine-readable media that is not a transient propagation signal.

[0204] The instructions 2424 may further be transmitted or received over the communication network 2426 via the network interface device 2420 using a transmission medium. The machine 2400 may communicate with one or more machines using any of a variety of transmission protocols (e.g., frame relay, Internet Protocol (IP), transmission control protocol (TCP), user datagram protocol (UDP), hypertext transfer protocol (HTTP), etc.). Example communication networks may include a local area network (LAN), a wide area network (WAN), a packet data network (e.g., the Internet), a mobile phone network (e.g., a cellular network), a plain old telephone (POTS) network, and a wireless data network (e.g., a wireless network called The Institute of Electrical and Electronics Engineers (IEEE) 802.11 series of standards, known as IEEE 802.16 standard series), IEEE 802.15.4 standard series, long term evolution (LTE) standard series, universal mobile telecommunication system (UMTS) standard series, peer-to-peer (P2P) network, etc. In an example, the network interface device 2420 may include one or more physical jacks (e.g., Ethernet, coaxial, or telephone jacks) or one or more antennas to connect to the communication network 2426. In an example, the network interface device 2420 may include multiple antennas to use at least one of single input multiple output (SIMO), multiple input multiple output (MIMO), or multiple input single output (MISO) technology for wireless communication. In some examples, the network interface device 2420 may use multi-user MIMO technology for wireless communication.

[0205] As described herein, examples may include logic or multiple components, modules, or mechanisms, or may operate on them. A module is a tangible entity (e.g., hardware) that is capable of performing a specified operation and is configured or arranged in a certain manner. In an example, a circuit is arranged in a particular manner (e.g., internally or relative to an external entity such as other circuits) as a module. In an example, all or part of one or more computer systems (e.g., independent client or server computer systems) or one or more hardware processors are configured by firmware or software (e.g., instructions, application parts, or applications) as a module for performing a specified operation. In an example, the software may reside on a machine-readable medium. In an example, the software causes the hardware to perform a specified operation when executed by the underlying hardware of the module.

[0206] Example 1 is a non-transitory computer-readable storage medium, comprising instructions that, when executed, configure a hardware processing circuit system to perform operations, the operations comprising: receiving, within a secure environment, a first message from a first source account and addressed to a first destination account, the first message comprising first data; identifying a first information barrier policy based on the first source account and the first destination account; determining, based on the first information barrier policy, that the first source account is prohibited from sending sensitive information to the first destination account; determining that a portion of the first data includes an indication of sensitive information; based on the indication of the sensitive information and the first source account being prohibited from sending sensitive information to the first destination account, transmitting a portion to a data matching service device; receiving a response from the data matching service device; identifying, based on the response, that the portion includes the sensitive information; and processing the first message based on the identification.

[0207] In Example 2, the subject matter of Example 1 can optionally include where processing the first message comprises: blocking transmission of the first message to the first destination account based on the identification.

[0208] In Example 3, the subject matter of any one or more of Examples 1 to 2 may optionally include processing a first message, wherein processing the first message includes: anonymizing sensitive information in the first message based on an identification and a first information barrier policy; and transmitting the first message to a first destination account based on the anonymization.

[0209] In Example 4, the subject matter of any one or more of Examples 1 to 3 optionally includes operations, which further include: within a secure environment, receiving a second message from a first source account and addressed to a first destination account, the second message including second data; determining that a second portion of the second data includes an indication of sensitive information; based on the indication of the sensitive information and the first source account being prohibited from sending sensitive information to the first destination account, transmitting the second portion to a data matching service device; receiving a second response from the data matching service device; identifying, based on the second response, that the second portion does not include the sensitive information; and based on the second portion not including the sensitive information, transmitting a second message to the first destination account.

[0210] In Example 5, the subject matter of any one or more of Examples 1 to 4 optionally includes operations, which further include: receiving, within a secure environment, a second message from a first source account and addressed to a first destination account, the second message including second data; determining that no sensitive information is present in the second data; based on the absence of the sensitive information, suppressing transmission of the second data to a data matching service device; and based on the absence of the sensitive information, transmitting the second message to the first destination account.

[0211] In Example 6, the subject matter of any one or more of Examples 1 to 5 optionally includes an operation, which further includes: within a secure environment, receiving a second message from a second source account and addressed to a second destination account, the second message including second data; identifying a second information barrier policy based on the second source account and the second destination account; determining, based on the second information barrier policy, that the second source account is allowed to send sensitive information to the first destination account; suppressing transmission of the second data to the data matching service device based on the second source account being allowed to send sensitive information to the second destination account; and transmitting a second message to the second destination account based on the second source account being allowed to send sensitive information to the second destination account.

[0212] In Example 7, the subject matter of any one or more of Examples 1 to 6 may optionally include where determining an indication that a portion includes sensitive information comprises: evaluating a regular expression about the portion, or identifying keywords in the portion.

[0213] In Example 8, the subject matter of any one or more of Examples 1 to 7 may optionally include wherein the data matching service device is configured to: compare the portion with second data in the data store, and determine that the portion includes sensitive information based on the comparison.

[0214] In Example 9, the subject matter of Example 8 may optionally include wherein the data matching service device is configured to: determine that the portion includes sensitive information if the portion exactly matches the second data.

[0215] In Example 10, the subject matter of any one or more of Examples 1 to 9 may optionally include the operations further comprising hashing or encrypting the portion before transmitting the portion to the data matching service device.

[0216] In Example 11, the subject matter of any one or more of Examples 1 to 10 optionally includes an operation, which further includes: determining a first group membership of a first source account; determining a second group membership of a first destination account, wherein the first information barrier policy is identified based on the first group membership and the second group membership.

[0217] In Example 12, the subject matter of any one or more of Examples 1 to 11 may optionally include wherein determining that the first source account is prohibited from sending sensitive information to the first destination account comprises determining that the first destination account is not identified on an access list of the first source account.

[0218] In Example 13, the subject matter of Example 12 may optionally include: wherein the access list is retrieved from an address book policy.

[0219] In Example 14, the subject matter of Example 13 may optionally include wherein the address book policy is a Microsoft Active Directory address book policy.

[0220] Example 15 is a system comprising: a hardware processing circuit system; one or more hardware memories storing instructions that, when executed, configure the hardware processing circuit system to perform operations, the operations comprising: receiving, within a secure environment, a first message from a first source account and addressed to a first destination account, the first message comprising first data; identifying a first information barrier policy based on the first source account and the first destination account; determining, based on the first information barrier policy, that the first source account is prohibited from sending sensitive information to the first destination account; determining that a portion of the first data includes an indication of sensitive information; based on the indication of the sensitive information and the first source account being prohibited from sending sensitive information to the first destination account, transmitting a portion to a data matching service device; receiving a response from the data matching service device; identifying, based on the response, the portion including the sensitive information; and processing the first message based on the identification.

[0221] In Example 16, the subject matter of Example 15 may optionally include wherein processing the first message comprises: blocking transmission of the first message to the first destination account based on the identification.

[0222] In Example 17, the subject matter of any one or more of Examples 15 to 16 optionally includes processing a first message, wherein processing the first message includes: anonymizing sensitive information in the first message based on an identification and a first information barrier policy; and transmitting the first message to a first destination account based on the anonymization.

[0223] In Example 18, the subject matter of any one or more of Examples 15 to 17 optionally includes operations, which further include: within a secure environment, receiving a second message from a first source account and addressed to a first destination account, the second message including second data; determining that a second portion of the second data includes an indication of sensitive information; based on the indication of the sensitive information and the first source account being prohibited from sending sensitive information to the first destination account, transmitting the second portion to a data matching service device; receiving a second response from the data matching service device; identifying, based on the second response, that the second portion does not include the sensitive information; and based on the second portion not including the sensitive information, transmitting a second message to the first destination account.

[0224] In Example 19, the subject matter of any one or more of Examples 15 to 18 optionally includes operations, which further include: receiving, within a secure environment, a second message from a first source account and addressed to a first destination account, the second message including second data; determining that no sensitive information is present in the second data; based on the absence of the sensitive information, suppressing transmission of the second data to a data matching service device; and based on the absence of the sensitive information, transmitting the second message to the first destination account.

[0225] In Example 20, the subject matter of any one or more of Examples 15 to 19 optionally includes operations, which further include: within a secure environment, receiving a second message from a second source account and addressed to a second destination account, the second message including second data; identifying a second information barrier policy based on the second source account and the second destination account; determining that the second source account is allowed to send sensitive information to the first destination account based on the second information barrier policy; suppressing transmission of the second data to the data matching service device based on the second source account being allowed to send sensitive information to the second destination account; and transmitting a second message to the second destination account based on the second source account being allowed to send sensitive information to the second destination account.

[0226] In Example 21, the subject matter of any one or more of Examples 15 to 20 may optionally include where determining an indication that a portion includes sensitive information comprises: evaluating a regular expression about the portion, or identifying keywords in the portion.

[0227] In Example 22, the subject matter of any one or more of Examples 15 to 21 may optionally include wherein the data matching service device is configured to: compare the portion with second data in the data store, and determine that the portion includes sensitive information based on the comparison.

[0228] In Example 23, the subject matter of Example 22 may optionally include wherein the data matching service device is configured to: determine that the portion includes sensitive information if the portion exactly matches the second data.

[0229] In Example 24, the subject matter of any one or more of Examples 15 to 23 may optionally include an operation further comprising: hashing or encrypting the portion before transmitting the portion to the data matching service device.

[0230] In Example 25, the subject matter of any one or more of Examples 15 to 24 optionally includes an operation, which further includes: determining a first group membership of a first source account; determining a second group membership of a first destination account, wherein the first information barrier policy is identified based on the first group membership and the second group membership.

[0231] In Example 26, the subject matter of any one or more of Examples 15 to 25 may optionally include wherein determining that the first source account is prohibited from sending sensitive information to the first destination account comprises determining that the first destination account is not identified on an access list of the first source account.

[0232] In Example 27, the subject matter of Example 26 can optionally include wherein the access list is retrieved from an address book policy.

[0233] In Example 28, the subject matter of Example 27 can optionally include wherein the address book policy is a Microsoft Active Directory address book policy.

[0234] Example 29 is a method comprising: within a secure environment, receiving a first message from a first source account and addressed to a first destination account, the first message including first data; identifying a first information barrier policy based on the first source account and the first destination account; determining, based on the first information barrier policy, that the first source account is prohibited from sending sensitive information to the first destination account; determining that a portion of the first data includes an indication of sensitive information; based on the indication of the sensitive information and the first source account being prohibited from sending the sensitive information to the first destination account, transmitting the portion to a data matching service device; receiving a response from the data matching service device; identifying, based on the response, that the portion includes the sensitive information; and processing the first message based on the identification.

[0235] In Example 30, the subject matter of Example 29 may optionally include wherein processing the first message comprises: blocking transmission of the first message to the first destination account based on the identification.

[0236] In Example 31, the subject matter of any one or more of Examples 29-30 optionally includes processing the first message, wherein processing the first message includes: anonymizing sensitive information in the first message based on the identification and the first information barrier policy; and transmitting the anonymized sensitive information to the first destination account.

[0237] In Example 32, the subject matter of any one or more of Examples 29 to Example 31 may optionally include: within a secure environment, receiving a second message from a first source account and addressed to a first destination account, the second message including second data; determining that a second portion of the second data includes an indication of sensitive information; based on the indication of the sensitive information and the first source account being prohibited from sending sensitive information to the first destination account, transmitting the second portion to a data matching service device; receiving a second response from the data matching service device; identifying, based on the second response, that the second portion does not include the sensitive information; and based on the second portion not including the sensitive information, transmitting a second message to the first destination account.

[0238] In Example 33, the subject matter of any one or more of Examples 29 to Example 32 may optionally include: within a secure environment, receiving a second message from a first source account and addressed to a first destination account, the second message including second data; determining that no sensitive information is present in the second data; based on the absence of the sensitive information, suppressing transmission of the second data to a data matching service device; and based on the absence of the sensitive information, transmitting the second message to the first destination account.

[0239] In Example 34, the subject matter of any one or more of Examples 29 to Example 33 may optionally include: within a secure environment, receiving a second message from a second source account and addressed to a second destination account, the second message including second data; identifying a second information barrier policy based on the second source account and the second destination account; determining, based on the second information barrier policy, that the second source account is allowed to send sensitive information to the first destination account; suppressing transmission of the second data to the data matching service device based on the second source account being allowed to send sensitive information to the second destination account; and transmitting a second message to the second destination account based on the second source account being allowed to send sensitive information to the second destination account.

[0240] In Example 35, the subject matter of any one or more of Examples 29 to 34 may optionally include where determining an indication that a portion includes sensitive information comprises: evaluating a regular expression about the portion, or identifying keywords in the portion.

[0241] In Example 36, the subject matter of any one or more of Examples 29 to 35 may optionally include wherein the data matching service device is configured to: compare the portion with second data in the data store, and determine that the portion includes sensitive information based on the comparison.

[0242] In Example 37, the subject matter of Example 36 may optionally include wherein the data matching service device is configured to: determine that the portion includes sensitive information if the portion exactly matches the second data.

[0243] In Example 38, the subject matter of any one or more of Examples 29 to 37 may optionally include hashing or encrypting the portion before transmitting the portion to the data matching service device.

[0244] In Example 39, the subject matter of any one or more of Examples 29 to 38 optionally includes determining a first group membership of a first source account; determining a second group membership of a first destination account, wherein the first information barrier policy is identified based on the first group membership and the second group membership.

[0245] In Example 40, the subject matter of any one or more of Examples 29 to 39 may optionally include wherein determining that the first source account is prohibited from sending sensitive information to the first destination account comprises determining that the first destination account is not identified on an access list of the first source account.

[0246] In Example 41, the subject matter of Example 40 may optionally include wherein the access list is retrieved from an address book policy.

[0247] In Example 42, the subject matter of Example 41 can optionally include wherein the address book policy is a Microsoft Active Directory address book policy.

[0248] Thus, the term "module" is understood to encompass a tangible entity that is physically constructed, specifically configured (e.g., hardwired), or temporarily (e.g., temporarily) configured (e.g., programmed) to operate in a specified manner or to perform part or all of any operation described herein. Consider an example where a module is temporarily configured, and each module does not need to be instantiated at any time. For example, where a module includes a general-purpose hardware processor configured using software, the general-purpose hardware processor is configured as correspondingly different modules at different times. The software can accordingly configure the hardware processor, for example, to constitute a specific module at one time and to constitute different modules at different times.

[0249] Various embodiments are implemented in whole or in part in software and / or firmware. The software and / or firmware may take the form of instructions contained in or on a non-transitory computer-readable storage medium. These instructions may then be read and executed by one or more processors to enable the execution of the operations described herein. The instructions are in any suitable form, such as, but not limited to, source code, compiled code, interpreted code, executable code, static code, dynamic code, etc. Such computer-readable media may include any tangible, non-transitory medium for storing information in a form readable by one or more computers, such as, but not limited to, read-only memory (ROM); random access memory (RAM); magnetic disk storage media; optical storage media; flash memory; etc.

Claims

1. A non-transitory computer-readable storage medium comprising instructions that, when executed, configure a hardware processing circuit to perform operations comprising: receiving, within a secure environment, a first message from a first source account and addressed to a first destination account, the first message comprising first data; identifying a first information barrier policy based on the first source account and the first destination account; determining, based on the first information barrier policy, that the first source account is prohibited from sending sensitive information to the first destination account; In response to determining that the first source account is prohibited from sending sensitive information to the first destination account, determining, by a data matching classifier DMC, an indication that a portion of the first data includes sensitive information; transmitting the portion to a data matching service device based on the indication of the sensitive information and the first source account being prohibited from sending sensitive information to the first destination account; receiving a response from the data matching service device; identifying, based on the response, that the portion includes sensitive information; as well as The first message is processed based on the identification.

2. The non-transitory computer-readable storage medium of claim 1 , wherein processing the first message comprises: Transmission of the first message to the first destination account is blocked based on the identification.

3. The non-transitory computer-readable storage medium of claim 1 , wherein processing the first message comprises: Anonymizing the sensitive information in the first message based on the identifier and the first information barrier strategy; as well as The anonymized sensitive information is transmitted to the first destination account.

4. The non-transitory computer-readable storage medium of claim 1 , the operations further comprising: receiving, within the secure environment, a second message from the first source account and addressed to the first destination account, the second message comprising second data; determining an indication that a second portion of the second data includes sensitive information; transmitting the second portion to the data matching service device based on the indication of the sensitive information and the first source account being prohibited from sending sensitive information to the first destination account; receiving a second response from the data matching service device; identifying, based on the second response, that the second portion does not include sensitive information; as well as Based on the second portion not including sensitive information, the second message is transmitted to the first destination account.

5. The non-transitory computer-readable storage medium of claim 1 , the operations further comprising: receiving, within the secure environment, a second message from the first source account and addressed to the first destination account, the second message comprising second data; Determining that no sensitive information exists in the second data; Based on the absence of sensitive information, suppressing transmission of the second data to the data matching service device; as well as Based on the absence of sensitive information, the second message is transmitted to the first destination account.

6. The non-transitory computer-readable storage medium of claim 1, the operations further comprising: receiving, within the secure environment, a second message from a second source account and addressed to a second destination account, the second message comprising second data; identifying a second information barrier policy based on the second source account and the second destination account; determining, based on the second information barrier policy, that the second source account is permitted to send sensitive information to the first destination account; Based on the second source account being allowed to send sensitive information to the second destination account, suppressing transmission of the second data to the data matching service device; as well as Based on the second source account being allowed to send sensitive information to the second destination account, the second message is transmitted to the second destination account.

7. The non-transitory computer-readable storage medium of claim 1 , wherein determining that the portion includes an indication of the sensitive information comprises: Evaluates a regular expression with respect to the portion, or identifies a keyword in the portion.

8. The non-transitory computer-readable storage medium of claim 1, wherein the data matching service device is configured to compare the portion with second data in a data store and determine that the portion includes sensitive information based on the comparison. 9 . The non-transitory computer-readable storage medium of claim 8 , wherein the data matching service device is configured to determine that the portion includes sensitive information if the portion exactly matches the second data.

10. The non-transitory computer-readable storage medium of claim 1, the operations further comprising: The portions are hashed or encrypted before being transmitted to the data matching service device.

11. The non-transitory computer readable storage medium of claim 1 , the operations further comprising: determining a first group membership of the first source account; A second group membership of the first destination account is determined, wherein the first information barrier policy is identified based on the first group membership and the second group membership.

12. A method performed by a hardware processing circuit, comprising: receiving, within a secure environment, a first message from a first source account and addressed to a first destination account, the first message comprising first data; identifying a first information barrier policy based on the first source account and the first destination account; determining, based on the first information barrier policy, that the first source account is prohibited from sending sensitive information to the first destination account; In response to determining that the first source account is prohibited from sending sensitive information to the first destination account, determining, by a data matching classifier DMC, an indication that a portion of the first data includes sensitive information; transmitting the portion to a data matching service device based on the indication of the sensitive information and the first source account being prohibited from sending sensitive information to the first destination account; receiving a response from the data matching service device; identifying, based on the response, that the portion includes sensitive information; as well as The first message is processed based on the identification.

13. The method according to claim 12, further comprising: receiving, within the secure environment, a second message from the first source account and addressed to the first destination account, the second message comprising second data; determining an indication that a second portion of the second data includes sensitive information; transmitting the second portion to the data matching service device based on the indication of the sensitive information and the first source account being prohibited from sending sensitive information to the first destination account; receiving a second response from the data matching service device; identifying, based on the second response, that the second portion does not include sensitive information; as well as Based on the second portion not including sensitive information, the second message is transmitted to the first destination account.

14. The method according to claim 12, further comprising: receiving, within the secure environment, a second message from the first source account and addressed to the first destination account, the second message comprising second data; Determining that no sensitive information exists in the second data; Based on the absence of sensitive information, suppressing transmission of the second data to the data matching service device; as well as Based on the absence of sensitive information, the second message is transmitted to the first destination account.

15. The method according to claim 12, further comprising: receiving, within the secure environment, a second message from a second source account and addressed to a second destination account, the second message comprising second data; identifying a second information barrier policy based on the second source account and the second destination account; determining, based on the second information barrier policy, that the second source account is permitted to send sensitive information to the first destination account; Based on the second source account being allowed to send sensitive information to the second destination account, suppressing transmission of the second data to the data matching service device; as well as Based on the second source account being allowed to send sensitive information to the second destination account, the second message is transmitted to the second destination account.

16. A system for an information barrier, comprising: Hardware processing circuit; One or more hardware memories storing instructions that, when executed, cause the hardware processing circuit to perform operations, the operations comprising: receiving, within a secure environment, a first message from a first source account and addressed to a first destination account, the first message comprising first data; identifying a first information barrier policy based on the first source account and the first destination account; determining, based on the first information barrier policy, that the first source account is prohibited from sending sensitive information to the first destination account; In response to determining that the first source account is prohibited from sending sensitive information to the first destination account, determining, by a data matching classifier DMC, an indication that a portion of the first data includes sensitive information; transmitting the portion to a data matching service device based on the indication of the sensitive information and the first source account being prohibited from sending sensitive information to the first destination account; receiving a response from the data matching service device; identifying, based on the response, that the portion includes sensitive information; and The first message is processed based on the identification.

17. The system of claim 16, wherein determining that the portion includes an indication of the sensitive information comprises: Evaluates a regular expression with respect to the portion, or identifies a keyword in the portion.

18. The system of claim 16, wherein the data matching service device is configured to compare the portion with second data in a data store and determine that the portion includes sensitive information based on the comparison.

19. The system of claim 18, wherein the data matching service device is configured to determine that the portion includes sensitive information if the portion exactly matches the second data.

20. The system of claim 16, the operations further comprising: determining a first group membership of the first source account; A second group membership of the first destination account is determined, wherein the first information barrier policy is identified based on the first group membership and the second group membership.

Images