DATA ACCESS MONITORING AND CONTROL

Abstract

Methods for monitoring and controlling data access in a data processing system (400), comprising: In response to intercepting a response from a server (402) to an information request from a client entity (406), a security system agent (410, 504) installed on a server (402) separate from a security system (404, 502) applies (604) pattern matching using a predefined set of rules for sensitive data patterns (408) to identify at least one sensitive data access included in the response, the sensitive data access being associated with a part of the request; Determining (606) by the security system agent (410, 504) whether the at least one access to sensitive data matches one or more of the predefined set of rules for sensitive data patterns (408); In response to the fact that the at least one access to sensitive data matches one or more of the predefined set of rules for sensitive data patterns (408), the security system agent (410, 504) modifies (610) the request from the client by marking the at least one access to sensitive data as sensitive, thereby forming a modified request; and Sending (612) the modified request with at least one marked access to sensitive data to the security system (404, 502) by the security system agent (410, 504), causing the security system (404, 502) to process the modified request without access to the sensitive data associated with the at least one marked access to sensitive data in accordance with a security policy of the security system, due to the at least one marked access to sensitive data in the modified request.

Description

BACKGROUND

[0001] The present application relates generally to an improved data processing device and a method and, in particular, mechanisms for monitoring and controlling data access.

[0002] Security analytics is the process of using data collection, aggregation, and analysis tools for security monitoring and threat detection. Depending on the type of tools installed, security analytics solutions can incorporate large and diverse datasets into their detection algorithms. Security analytics data can be collected in various ways, including from: • Network traffic • Endpoint and user behavior data • Cloud resources • Business applications • Non-IT context data • Identity and access management data • External threat intelligence sources

[0003] Recent technological advancements in security analytics include adaptive learning systems that fine-tune detection models based on experience and insights, as well as anomaly detection logic. These technologies accumulate and analyze real-time data, including: • Asset metadata • Geographic location • Threat intelligence • IP context

[0004] These data formats can then be used both for immediate response to threats and for investigations.

[0005] US 2017 / 0149737A1 describes a method and associated computer system in which a compliance gateway component monitors requests in a virtual environment. If no sensitive data is found, the request is forwarded to the virtual machine. If the hypervisor detects that sensitive data is required for the operation, it blocks the execution to enforce data protection policies.

[0006] US 2012 / 0246696A1 describes a system and a computer-based method for enforcing security rules in existing enterprise databases. Database connection requests from third-party applications and users are intercepted and checked to determine whether security measures such as masking, obfuscation, or unmasking need to be applied. This ensures that sensitive data is only available to authorized users. SUMMARY

[0007] This summary is provided to present, in simplified form, a selection of concepts that are described in more detail below in the full description. This summary is not intended to identify key factors or essential features of the claimed subject matter, nor is it intended to limit the scope of the claimed subject matter.

[0008] In an illustrative embodiment, a method for monitoring and controlling data access is provided in a data processing system. The illustrative embodiment employs a security system agent, installed on a server separate from the security system, to perform pattern matching using a predefined set of rules for sensitive data patterns. This method aims to identify at least one sensitive data access contained in a response intercepted from a server to an information request from a client entity. In this illustrative embodiment, the security system agent determines whether the at least one sensitive data access matches one or more of the predefined set of rules for sensitive data patterns.In the illustrative embodiment, the security system agent modifies the client's request by marking the at least one access to sensitive data as sensitive. This results in the creation of a modified request because the at least one access to sensitive data matches one or more of the predefined set of rules for sensitive data patterns. In this illustrative embodiment, the security system agent sends the modified request with the at least one marked access to sensitive data to the security system. This causes the security system to process the modified request without accessing the sensitive data associated with the at least one marked access to sensitive data.

[0009] In further illustrative embodiments, a computer program product is provided that includes a computer-usable or readable medium containing a computer-readable program. When executed on a data processing unit, the computer-readable program causes the data processing unit to perform various operations and combinations of the operations outlined above with respect to the illustrative embodiment of the method.

[0010] In a further embodiment, a system or device is provided. The system or device can comprise one or more processors and a working memory connected to the one or more processors. The working memory can contain instructions which, when executed by the one or more processors, cause the one or more processors to perform various operations as well as combinations of the operations outlined above with respect to the illustrative embodiment of the method.

[0011] These and other features and advantages of the present invention are described in the following detailed description of the exemplary embodiments of the present invention or become apparent to the person skilled in the art against their background. BRIEF DESCRIPTION OF THE DRAWINGS

[0012] The invention, as well as a preferred use and further objectives and advantages, will best become apparent from a reference to the following detailed description of illustrative embodiments together with the accompanying drawings, wherein: Fig. Figure 1 shows a cloud computing node according to an embodiment of the present invention; Fig. Figure 2 shows a cloud computing environment according to an embodiment of the present invention; Fig. 3 shows abstraction model layers according to an embodiment of the present invention; Fig. Figure 4 shows an example of a functional block diagram of a data access, monitoring and control mechanism according to an illustrative embodiment; Fig. Figure 5 shows an example of the interaction between a security system and a security system agent according to an illustrative embodiment; Fig. Figure 6 shows a flowchart illustrating an example of a process performed by a security system agent when monitoring and controlling data access according to an illustrative embodiment; and Fig. Figure 7 shows a flowchart illustrating an example of a process carried out by a security system when monitoring and controlling data access according to an illustrative embodiment. DETAILED DESCRIPTION

[0013] Security analytics is the process of using data collection, aggregation, and analysis tools for security monitoring and threat detection. Security systems that perform transport-layer data analysis can intercept network packets transmitted between two instances. This interaction occurs between instances, such as a client and a server. Encryption algorithms render the information transmitted between these two instances unreadable unless the encryption keys are compromised or the encryption type is outdated or faulty. However, when sensitive information is sent across a network to be processed and stored by a monitoring system, such sensitive information can be compromised within the security system.Thus, the illustrative embodiments provide mechanisms that implement the identification of sensitive data by a security system agent before the data is sent to the security system (device) for processing. The security system agent is installed on a server monitored by the security system, such as a database server, a service platform, or the like.

[0014] Currently, when a client sends a request to the server for processing, the request can access sensitive data such as social security numbers, credit card information, patient data, geocoordinates, or similar information. Current security system agents intercept the response to the client, which contains the original request and the retrieved data, and forward this information over a network to the security system for processing. Existing procedures for handling security policies regarding the retrieved data are implemented within the security system.However, such sensitive data is not relevant for processing by the security system. Therefore, the mechanisms of the illustrative embodiments create an additional layer of security, ensuring that the risk of the sensitive data being compromised or viewed by someone without the appropriate authorization is reduced. Specifically, the illustrative embodiments provide mechanisms that identify access to sensitive data on the server before it is sent to the security system. In one embodiment, the security system agent identifies access to the sensitive data in the initial request, and no sensitive data is transmitted to the security system. Additionally, the security system uses the identification of access to the sensitive data in the response to detect data access breaches.In one embodiment, a machine learning model can be used to identify objects in the modified request sent to the security system as "security-relevant" and thus include them in a list of sensitive objects.

[0015] Before discussing in more detail the various aspects of the illustrative embodiments and the improved computer operations performed by them, it should first be noted that throughout this description the term "mechanism" is used to refer to elements of the present invention that perform various operations / steps, functions, and the like. As the term is used here, a "mechanism" can be an implementation of the functions or aspects of the illustrative embodiments in the form of a device, a procedure, or a computer program product. In the case of a procedure, the procedure is implemented by one or more units, devices, computers, data processing systems, or the like.In the case of a computer program product, the logic represented by computer code or instructions contained in or on the computer program product is executed by one or more hardware units to implement the functionality or perform the operations that are part of the particular “mechanism”.Thus, the mechanisms described herein can be implemented as specialized hardware, as software executed on hardware to configure the hardware to implement the specialized functionality of the present invention, which the hardware would otherwise not be able to perform, as software instructions stored on a medium in such a way that the instructions can be easily executed by hardware, in particular to configure the hardware to perform the functionality and specific computer operations described herein, as a procedure or method for executing the functions, or as a combination of any of the above.

[0016] The present description and the claims may use the expressions "one," "at least one of," and "one or more" with regard to certain features and elements of the illustrative embodiments. It should be noted that these expressions and formulations are intended to indicate that at least one of the specific feature or element is present in the respective illustrative embodiment, but that more than one may also be present. That is to say, these expressions / formulations are not intended to restrict the description or the claims to include only a single feature / element or to necessarily include several such features / elements. On the contrary, these expressions / formulations merely require at least a single feature / element, and the scope of the description and the claims also includes the possibility of several such features / elements.

[0017] Furthermore, it should be noted that the use of the term "engine," insofar as it is used here to describe embodiments and features of the invention, is not intended to restrict it to a specific implementation for achieving and / or performing the actions, steps, processes, etc., that are attributable to and / or performed by the engine. An engine may, but is not limited to, software, hardware, and / or firmware, or any combination thereof, that performs the specified functions, including, but not limited to, any use of a general-purpose and / or specialized processor in combination with suitable software that is loaded or stored in machine-readable memory and executed by the processor.Furthermore, unless otherwise specified, a name associated with a particular engine serves only as a simplified reference and is not intended to restrict it to a specific implementation. Moreover, any functionality attributed to an engine can be executed by multiple engines, integrated into or combined with the functionality of another engine of the same or a different type, or distributed across one or more engines with different configurations.

[0018] Furthermore, it should be noted that the following description uses a variety of different examples for various elements of the illustrative embodiments in order to further illustrate exemplary implementations of the illustrative embodiments and to facilitate understanding of the mechanisms of the illustrative embodiments. These examples are not to be understood as limiting and are not exhaustive with regard to the various possibilities for implementing the mechanisms of the illustrative embodiments. A person skilled in the art will understand, in light of the present description, that many other alternative implementations exist for these various elements, which can be used in addition to or instead of the examples given here, without deviating from the basic idea and scope of the present invention.

[0019] The illustrative embodiments can therefore be used in many different types of data processing environments. To provide a context for describing the specific elements and functionality of the illustrative embodiments, the following are presented: Fig. 1, Fig. 2 to Fig. 3. The following are exemplary environments in which aspects of the illustrative embodiments can be implemented. It should be noted that the Fig. 1, Fig. 2 to Fig. Figure 3 are merely examples and do not define or imply any limitations regarding the environments in which aspects or embodiments of the present invention may be implemented. Many modifications can be made to the environments shown without deviating from the basic concept and scope of the present invention.

[0020] It should be noted beforehand that, although this disclosure contains a detailed description of cloud computing, implementations of the teaching set forth herein are not limited to a cloud computing environment. Instead, embodiments of the present invention can be implemented together with any type of data processing environment, now known or hereafter invented.

[0021] Cloud computing is a service delivery model that enables seamless, on-demand network access to a shared pool of configurable computing resources (e.g., networks, network bandwidth, servers, processing power, main memory, storage, applications, virtual machines, and services) that can be rapidly provisioned and released with minimal management overhead or interaction with a service provider. This cloud model can include at least five properties, at least three service models, and at least four implementation models.

[0022] The properties are as follows: On-Demand Self-Service: A cloud user can unilaterally and automatically provide data processing functions such as server time and network storage as needed, without requiring human interaction with the service provider. Broad Network Access: Functions are available over a network, accessed through standard mechanisms that support use by heterogeneous thin or thick client platforms (e.g., mobile phones, laptops, and PDAs). Resource pooling: The provider's data processing resources are pooled to serve multiple users using a multi-tenant model, with various physical and virtual resources being dynamically allocated and reassigned as needed. There is a perceived location independence, as the user generally has no control over or knowledge of the exact location of the provided resources, but may be able to define a location at a higher level of abstraction (e.g., country, state, or data center). Rapid Elasticity: Features can be deployed quickly and elastically for rapid horizontal scaling (scale out), in some cases automatically, and released quickly for rapid scale-in. To the user, the available features often appear unlimited and can be purchased in any quantity at any time. Measured Service: Cloud systems automatically control and optimize resource usage by employing a measurement function at a certain level of abstraction appropriate for the type of service (e.g., storage, processing, bandwidth, and active user accounts). Resource utilization can be monitored, controlled, and reported, thereby creating transparency for both the provider and the user of the service.

[0023] The service models are as follows: Software as a Service (SaaS): The functionality provided to the user consists of using the provider's applications running in a cloud infrastructure. These applications are accessible from various client devices via a thin-client interface, such as a web browser (e.g., web-based email). The user does not manage or control the underlying cloud infrastructure, including the network, servers, operating systems, storage, or even individual application functions, with the possible exception of limited user-specific application configuration settings. Platform as a Service (PaaS): The function provided to the user is to deploy applications created or obtained by the user, using programming languages ​​and tools supported by the provider, within the cloud infrastructure. The user does not manage or control the underlying cloud infrastructure, including networks, servers, operating systems, or storage, but has control over the deployed applications and potentially over configurations of the application hosting environment. Infrastructure as a Service (IaaS): The functionality provided to the user consists of supplying processing, storage, networking, and other basic data processing resources, enabling the user to deploy and run any software, including operating systems and applications. The user does not manage or control the underlying cloud infrastructure but has control over operating systems, storage, deployed applications, and potentially limited control over selected network components (e.g., host firewalls).

[0024] The following are the deployment models: Private Cloud: The cloud infrastructure is operated solely for one organization. It can be managed by the organization or a third party and can be located on the organization's own premises or on external premises. Community Cloud: This cloud infrastructure is shared by multiple organizations and supports a specific user community with shared concerns (e.g., mission, security requirements, policies, and regulatory compliance considerations). It can be managed by the organizations themselves or a third party and can be located on-premises or external premises. Public Cloud: The cloud infrastructure is made available to the general public or a large industry group and is owned by an organization that sells cloud services. Hybrid Cloud: The cloud infrastructure is a composition of two or more clouds (private, community or public) that remain separate entities but are connected by a standardized or proprietary technology that enables data and application portability (e.g. cloud audience distribution for load balancing between clouds). A cloud computing environment is service-oriented, focusing on state independence, low coupling, modularity, and semantic interoperability. At the heart of cloud computing is an infrastructure that comprises a network of interconnected nodes.

[0025] In Fig. Figure 1 shows a block diagram of an example cloud computing node. Cloud computing node 100 is merely an example of a suitable cloud computing node and is in no way intended to limit the scope of use or functionality of embodiments of the invention described herein. Regardless, cloud computing node 10 can be implemented and / or perform any of the functionality specified above.

[0026] Cloud computing node 100 contains a computer system / server 102, which is operational with numerous other general-purpose or specialized data processing system environments or configurations. Examples of known data processing systems, environments, and / or configurations suitable for use with computer system / server 102 include, but are not limited to, personal computer systems, server computer systems, thin clients, thick clients, portable or laptop units, multiprocessor systems, microprocessor systems, set-top boxes, programmable consumer electronics, network PCs, minicomputer systems, mainframe systems, and distributed cloud computing environments comprising any of the aforementioned systems or units, and the like.

[0027] In general terms, a computer system / server 102 can be described by a computer system's executable instructions, such as program modules, which are executed by the computer system. Generally, program modules contain routines, programs, objects, components, logic, data structures, and so on, which perform specific tasks or implement certain abstract data types. Computer systems / servers 102 can operate in distributed cloud computing environments, where tasks are performed by remotely located processing units connected by a communication network. In a distributed cloud computing environment, program modules can reside in both local and remote storage media of the computer system, including short-term storage units.

[0028] As in Fig. Figure 1 shows computer system / server 102 in the cloud computing node 100 in the form of a universal data processing unit. The components of computer system / server 102 may, but are not limited to, one or more processors or processing units 104, a system memory 106, and a bus 108 that connects various system components, including the system memory 106, to a processor 104.

[0029] Bus 108 represents one or more of different types of bus structures, including a memory bus or memory control unit, a peripheral bus, an AGP bus, and a processor or local bus, any of which utilizes a variety of bus architectures. Non-restrictive examples of such architectures include the ISA (Industry Standard Architecture) bus, the micro-channel (MCA) bus, the EISA (Enhanced ISA) bus, the VESA (Video Electronics Standards Association) local bus, and the PCI (Peripheral Component Interconnect) bus.

[0030] Computer system / server 102 typically includes a variety of media readable by a computer system. Such media can be any available medium accessible to computer system / server 102, including both volatile and non-volatile media, removable and non-removable media.

[0031] The system memory 106 may include computer system-readable media in the form of volatile memory, such as main memory (RAM) 110 and / or cache 112. The computer system / server 102 may also include other removable / non-removable, volatile / non-volatile storage media of the computer system. By way of example only, the storage system 114 may be provided for reading from and writing to a non-removable non-volatile magnetic medium (not shown and commonly referred to as "hard disk storage"). Although not shown, a magnetic disk drive may be provided for reading from and writing to a removable, non-volatile magnetic disk (e.g., a "floppy disk"), and an optical disk drive may be provided for reading from or writing to a removable, non-volatile optical disk, such as a CD-ROM, DVD-ROM, or other optical media.In such cases, each of the aforementioned can be connected to bus 108 via one or more data media interfaces. As further shown and described below, the memory 106 can comprise at least one program product with a group (e.g., at least one) of program modules configured to perform the functions of embodiments of the invention.

[0032] As a non-limiting example, the memory 106 can store a program / utility 116 with a group (at least one) of program modules 118, as well as an operating system, one or more application programs, further program modules, and program data. The operating system, one or more application programs, other program modules, and program data, or a combination thereof, can each contain an implementation of a network environment. In general, the program modules 42 execute the functions and / or methodologies from embodiments of the invention as described herein.

[0033] The computer system / server 102 can also exchange data with one or more external units 120, such as a keyboard, a pointing device, a display 122, etc., one or more units that allow a user to interact with the computer system / server 102, and / or any units (e.g., network card, modem, etc.) that allow the computer system / server 102 to exchange data with one or more other data processing units. Such data exchange can take place via input / output (I / O) interfaces 124. Furthermore, the computer system / server 102 can exchange data with one or more networks, such as a local area network (LAN), a wide area network (WAN), and / or a public network (e.g., the Internet), via a network adapter 126. As shown, the network adapter 126 exchanges data with the other components of the computer system / server 102 via the bus 108.It should be noted that, although not shown, other hardware and / or software components could be used in conjunction with the Computer System / Server 102. Examples include, but are not limited to: microcode, device drivers, redundant processing units, external disk drive arrays, RAID systems, tape drives, and storage systems for data archiving, etc.

[0034] In Fig. Figure 2 illustrates a cloud computing environment 200. As shown, the cloud computing environment 200 has one or more cloud computing nodes 202 with which local data processing units used by cloud customers, such as a personal digital assistant (PDA) or mobile phone 204, desktop computer 206, laptop computer 208, and / or automotive computer system 210, can exchange data. The cloud computing nodes 202 can exchange data with each other. They can be grouped physically or virtually into one or more networks, such as private, community, public, or hybrid clouds (not shown), as described above, or a combination thereof. This enables the cloud computing environment 200 to offer infrastructure, platforms, and / or software as services, for which a cloud user does not need to maintain resources on a local data processing unit.It should be noted that the types of in . Fig. The data processing units 204-210 shown are for illustrative purposes only, and the data processing nodes 202 and the cloud computing environment 200 can exchange data with any type of computer unit via any type of network and / or any type of network-accessible connection (e.g., using a web browser).

[0035] Fig. Figure 3 shows a group of objects created by a cloud computing environment such as the Cloud Computing Environment 200. Fig. 2 functional abstraction layers provided. It should be noted beforehand that the in Fig. The components, layers, and functions shown in the three illustrations are to be understood as merely illustrative, and embodiments of the invention are not limited to these. As shown, the following layers and corresponding functions are provided: A hardware and software layer 302 contains hardware and software components. Examples of hardware components include mainframe computers, such as the zSeries. ® -Systems from IBM ® , Servers with RISC (Reduced Instruction Set Computer) architecture, in one example pSeries ® IBM xSeries systems ® -Systems from IBM, BladeCenter ® IBM systems, storage units, networks, and networking components. Examples of software components include network application server software, such as the WebSphere application server software. ® from IBM, and database software, in one example the database software DB2 ® from IBM. (IBM, zSeries, pSeries, xSeries, BladeCenter, WebSphere and DB2 are trademarks of International Business Machines Corporation, registered in many legal systems worldwide.)

[0036] The virtualization layer 304 provides an abstraction layer from which the following examples of virtual entities can be provided: virtual servers, virtual storage, virtual networks, including virtual private networks, virtual applications and operating systems, and virtual clients.

[0037] In one example, the 306 administration layer can provide the following functionalities. Resource provisioning provides dynamic procurement of compute resources and other resources used to perform tasks within the cloud computing environment. Metering and pricing provide cost monitoring for resources used within the cloud computing environment, as well as billing and invoicing for the use of these resources. In one example, these resources might include application software licenses. Security provides identity verification for cloud customers and tasks, as well as protection for data and other resources. A user portal provides access to the cloud computing environment for customers and system administrators. Quality of service (QoS) management provides allocation and management of cloud computing resources to ensure that required QoSs are met.Planning and implementing Service Level Agreements (SLAs) involves preparing and procuring cloud computing resources for which future demand is anticipated, in accordance with an SLA.

[0038] A workload layer 308 provides examples of the functionality for which the cloud computing environment can be used. Examples of workloads and functions that can be provided by this layer include: mapping and navigation; software development and lifecycle management; Provision of training in virtual classrooms; data analytics processing; transaction processing; and a security system agent. According to the illustrative embodiments, the security system agent, which can be implemented in the illustrative cloud computing environment or in any other type of currently known or future data processing environment, monitors access to highly sensitive information. That is, a client provides a security system with a predefined set of rules for sensitive data patterns. At startup, the security system determines whether a security system agent exists on a database server, service platform, or the like (hereafter referred to simply as a server) accessed by the client. If so, the security system sends the predefined set of rules for sensitive data patterns to the security system agent on the server.

[0039] When the client subsequently sends an information request, which may involve multiple different accesses and is received by the server, the server retrieves the data associated with each access and generates a response containing each access and the retrieved data associated with each access. The retrieved data associated with each access may be either sensitive or non-sensitive. Before the response is sent back to the client, a security system agent running on the server intercepts the response and applies pattern matching using a predefined set of rules for sensitive data patterns to identify any sensitive data in the response that matches the predefined set of rules for sensitive data patterns, such as credit card numbers, social security numbers, passwords, patient data, geographic location coordinates, or similar information.According to the illustrative embodiments, the security system agent is installed in the kernel of the server operating system. When applying pattern matching, the security system agent modifies the client's original request before forwarding it to the security system. If the security system agent identifies sensitive data that matches one or more of the predefined rules for sensitive data patterns, it marks the access that accessed the sensitive data in the original request as sensitive.The security system agent then allows the original response generated by the server, containing each access and the data retrieved for each access, to be sent back to the client. It then forwards the modified request to the security system, marking accesses associated with sensitive data and unmarked accesses associated with non-sensitive data. Thus, as illustrated in the examples, the security system agent identifies accesses to sensitive data and marks the access in the modified request as access to sensitive information.

[0040] When the security system receives the modified request sent by the security system agent, it recognizes the modified request as security-relevant due to the identification of flagged accesses. The security system then processes the modified request without accessing sensitive data. Specifically, the security system parses the objects in each access using a filter that identifies flags from the security system agent and processes each access. Furthermore, with regard to flagged objects, the security system parses each object associated with an access that the security system agent has flagged as accessing sensitive data. The security system extracts the object and adds it to a list of sensitive objects as an object containing sensitive data.

[0041] Even though in this example the object is added directly to the list of sensitive objects, not all objects identified as sensitive are immediately added to the list. To continue with the previous example, two additional requests are received. The first request contains a combined set of objects, including a first object that has already been marked as sensitive and a second object that is marked as sensitive because it is combined with the first object. The second request contains an object that matches the second object from the first request but has not been marked as sensitive by the security system agent.In the first of the two additional queries, the second object is identified as sensitive only because it is associated with the first object, which was known to be sensitive. This results in a false positive for a non-sensitive object. For example, through machine learning methods, rule-based applications, or similar techniques, the security system identifies query objects that are false positives, such as the second object in the second of the two additional queries, because the second object was not marked as sensitive by the security system agent. Thus, the security system would filter out objects that are incorrectly identified as sensitive simply because they are associated with another object identified as sensitive.After the security system has filtered out all "false positives", all remaining security-relevant objects that are not yet in the list of sensitive objects are added to the list of sensitive objects, which are then used by the security system as criteria for implementing one or more security policies.

[0042] A professional understands that the hardware in the Fig. 1-3 may vary depending on the implementation. In addition to or instead of the ones in the Fig. 1 and Fig. In addition to the hardware shown in Figure 3, other internal hardware or peripheral units such as flash memory, equivalent non-volatile memory, optical disk drives, and the like can be used. Furthermore, the processes of the illustrative embodiments can be applied to a different multiprocessor data processing system than the aforementioned SMP system without deviating from the basic concept and scope of the present invention.

[0043] Fig. Figure 4 shows an example of a functional block diagram of a data access, monitoring, and control mechanism according to an illustrative embodiment. The data processing system 400 includes a server 402 that accesses the security system 404 to obtain information in the form of analyses, reports, alerts, or the like. As mentioned earlier, the server 402 and the security system 404 can be located in a cloud computing environment, such as the cloud computing environment 200. Fig. 2 or in any other currently known or future developed type of data processing environment. Initially, Customer 406 establishes an account with the security system 404, providing a predefined set of rules 408 for sensitive data patterns to the security system 404. Then, at system startup, the security mechanism 404 determines whether the security system agent 410 is present on the server 402. If so, the security system 404 sends the predefined set of rules 408 for sensitive data patterns to the security system agent 410 on the server 402.

[0044] If the client 406 subsequently sends an information request to the server 402, which may involve multiple different accesses, the server 402 retrieves the data associated with each access and generates a response containing each access and the retrieved data associated with each access. The retrieved data associated with each access may be either sensitive or non-sensitive. Before the response generated by the server 402 is sent back to the client 406, the security system agent 410 performs pattern matching using the predefined set of rules 408 for sensitive data patterns to identify any sensitive data in the response that matches the predefined set of rules 408 for sensitive data patterns, such as credit card numbers, social security numbers, passwords, patient data, geographic location coordinates, or similar information.When applying pattern matching, the security system agent 410 modifies the original request from client 406 before sending it to security system 404. If security system agent 410 identifies an access to sensitive data that matches one or more of the predefined rules 408 for sensitive data patterns, it marks the access that accessed the sensitive data in the original request as sensitive. Security system agent 410 then allows the original response generated by server 402, containing each access and the data retrieved for each access, to be sent back to client 406. It then forwards the modified request, including the marked accesses associated with sensitive data accesses and the unmarked accesses associated with non-sensitive data accesses, to security system 404.This means that after at least one access to sensitive data has been identified in the response, the security system agent 410 in the original request to security system 410 marks the access in the original request as access to sensitive information, thereby forming a modified request.

[0045] When the 404 security system receives the modified request sent by the 410 security system agent, the 404 security system recognizes the modified request as security-relevant due to the identification of flagged accesses. The 404 security system then processes the modified request without accessing sensitive data. That is, the 404 security system parses the objects in each access using a filter that identifies flags from the 410 security system agent and processes each access. Furthermore, with regard to flagged objects, the 404 security system parses each object associated with an access that the 410 security system agent flagged as accessing sensitive data. The 404 security system extracts the object and adds it to a list of sensitive objects 420 as an object containing sensitive data.Furthermore, the 404 security system uses the Sensitive Objects List (420) as criteria for implementing security policies and / or other operations such as analyses (412), reports (414), alerts (416), or other information (418) related to the retrieved sensitive data and objects added to the Sensitive Objects List (420). For example, the 404 security system uses the identification of access to the sensitive data identified in the response to detect data access breaches.

[0046] Even though in this example the addition of the object to the sensitive objects list 420 occurs directly, not all objects identified as sensitive are immediately added to the sensitive objects list 420. That is, continuing the previous example, two additional requests are received. The first request contains a combined set of objects, including a first object that has already been marked as sensitive and a second object that is marked as sensitive because it is associated with the first object. The second request contains an object that matches the second object from the first request but is not marked as sensitive by the security system agent 410.In the first of the two additional queries, the second object is identified as sensitive only because it is associated with the first object, which was known to be sensitive. This results in a false positive for a non-sensitive object. For example, through machine learning methods, rule-based applications, or similar techniques, the security system identifies 404 query objects that are false positives, such as the second object, because in the second of the two additional queries, the second object was not marked as sensitive by the security system agent. Thus, the security system would filter out objects that are incorrectly identified as sensitive simply because they are associated with another object that was identified as sensitive.After the 404 security system has filtered out all "false positives", the 404 security system adds any remaining security-relevant objects that are not already in the sensitive objects list 420 to the sensitive objects list 420.

[0047] Fig. Figure 5 shows an example of the interaction between a security system and a security system agent according to an illustrative embodiment. As illustrated, the security system 502 receives a predefined set of rules for sensitive data patterns. The security system 502 sends the predefined set of sensitive data patterns to the security system agent 504, which resides on a server. The security system agent 504 monitors client / server responses and applies the predefined set of rules for sensitive data patterns, marking sensitive accesses in the original client request. The security system agent 504 then sends the modified request to the security system 502, with the modified request containing the marked sensitive data accesses (if any). The security system 502 then parses the modified request and extracts all objects.The 502 security system filters out non-sensitive objects and adds new sensitive objects to the list of sensitive objects.

[0048] Thus, the illustrative embodiments provide mechanisms that implement pattern masking of data identified as sensitive by a user via a security system agent before this data is sent to the security system (device) for processing. The security system agent is installed on a server monitored by the security system, such as a database server, a service platform, or the like.

[0049] The present invention may be a system, a method, and / or a computer program product. The computer program product may comprise a computer-readable storage medium (or media) on which computer-readable program instructions are stored to induce a processor to execute aspects of the present invention.

[0050] A computer-readable storage medium can be a physical unit capable of retaining and storing instructions for use by a unit to execute instructions. For example, a computer-readable storage medium can be an electronic storage unit, a magnetic storage unit, an optical storage unit, an electromagnetic storage unit, a semiconductor storage unit, or any suitable combination thereof, without limitation. A non-exhaustive list of more specific examples of computer-readable storage media includes the following: a portable computer disk, a hard disk, random-access memory (RAM), read-only memory (ROM), and erasable programmable read-only memory (EPROM).Flash memory), static random-access memory (SRAM), portable compact storage disk-read-only memory (CD-ROM), DVD (digital versatile disc), USB flash drive, floppy disk, a mechanically coded unit such as punched cards or raised structures in a groove on which instructions are stored, and any suitable combination thereof. A computer-readable storage medium shall not, in its use herein, be understood as volatile signals per se, such as radio waves or other freely propagating electromagnetic waves, electromagnetic waves propagating through a waveguide or other transmission medium (e.g., light pulses traveling through an optical fiber cable), or electrical signals transmitted by a wire.

[0051] The computer-readable program instructions described herein can be downloaded from a computer-readable storage medium to individual data processing units or, via a network such as the internet, a local area network, a wide area network, and / or a wireless network, to an external computer or external storage device. The network may include copper transmission cables, fiber optic transmission lines, wireless transmission, routing computers, firewalls, switching units, gateway computers, and / or edge servers. A network adapter card or network interface in each data processing unit receives computer-readable program instructions from the network and forwards them for storage on a computer-readable storage medium within the respective data processing unit.

[0052] Computer-readable program instructions for executing the steps of the present invention can be assembly instructions, ISA (Instruction Set Architecture) instructions, machine instructions, machine-dependent instructions, microcode, firmware instructions, state data, or either source code or object code written in any combination of one or more programming languages, including object-oriented programming languages ​​such as Java, Smalltalk, C++, etc., as well as conventional procedural programming languages ​​such as C or similar languages. The computer-readable program instructions can be executed entirely on the user's computer, partially on the user's computer, as a standalone software package, partially on the user's computer and partially on a remote computer, or entirely on the remote computer or server.In the latter case, the remotely located computer can be connected to the user's computer via any type of network, including a local area network (LAN) or a wide area network (WAN), or the connection can be established with an external computer (for example, via the internet using an internet service provider). In some embodiments, electronic circuits, including, for example, programmable logic circuits, field-programmable gate arrays (FPGAs), or programmable logic arrays (PLAs), can execute the computer-readable program instructions by using state information from the computer-readable program instructions to personalize the electronic circuits to perform aspects of the present invention.

[0053] Aspects of the present invention are described herein with reference to flowcharts and / or block diagrams or diagrams of methods, devices (systems), and computer program products according to embodiments of the invention. It is pointed out that each block of the flowcharts and / or block diagrams, as well as combinations of blocks in the flowcharts and / or block diagrams, can be executed by means of computer-readable program instructions.

[0054] These computer-readable program instructions can be provided to a processor of a computer or other programmable data processing device to create a machine such that the instructions executed by the processor of the computer or other programmable data processing device produce a means of implementing the functions / steps specified in the block(s) of the flowcharts and / or block diagrams. These computer-readable program instructions can also be stored on a computer-readable storage medium capable of controlling a computer, programmable data processing device, and / or other units to function in a particular way, such that the computer-readable storage medium on which instructions are stored has a manufactured product, including instructions specifying which aspects of the block(s) in the flowchart(s) are to be implemented.implement the function / step specified in the blocks of the flowchart and / or block diagrams.

[0055] The computer-readable program instructions can also be loaded onto a computer, other programmable data processing device, or other unit to cause the execution of a series of process steps on the computer or other programmable device or other unit in order to generate a process executed on a computer, such that the instructions executed on the computer, other programmable device, or other unit implement the functions / steps specified in the block(s) of the flowcharts and / or block diagrams or charts.

[0056] Fig. Figure 6 shows a flowchart illustrating an example of the process performed by a security system agent when monitoring and controlling data access according to an illustrative embodiment. At the beginning of the process, the security system agent receives a predefined set of rules for sensitive data patterns from a security system (step 602). In response to intercepting a response containing each access of a request and the retrieved data associated with each access from a server on which the security system agent is installed, the security system agent performs pattern matching using the predefined set of rules for sensitive data patterns to identify sensitive data included in the response to the client (step 604), such as credit card numbers, social security numbers, passwords, patient data, geographic location coordinates, or the like.The security system agent determines whether sensitive data matching one or more of the predefined rules for sensitive data patterns is present (step 606). If, in step 606, the security system agent determines that no sensitive data matching the predefined rules for sensitive data patterns is present, the security system agent forwards the response unchanged to the security system (step 608), at which point the process ends.

[0057] If, in step 606, the security system agent identifies sensitive data that matches one or more of the predefined rules for sensitive data patterns, it marks the identified accesses in the original request as sensitive, thus creating a modified request (step 610). The security system agent then forwards the modified request to the security system, containing the marked accesses associated with accesses to sensitive data and the unmarked accesses associated with accesses to non-sensitive data (step 612). The process then ends.

[0058] Fig.Figure 7 shows a flowchart illustrating an example of a process performed by a security system when monitoring and controlling data access according to an illustrative embodiment. At the start of the process, the security system receives a modified request from a security system agent (step 702). The security system recognizes the modified request as security-relevant due to the identification of flagged accesses (step 704). The security system processes the modified request without accessing sensitive data by parsing the objects in each access of the response using a filter that identifies flags from the security system agent (step 706). The security system then processes the modified request (step 708).

[0059] Additionally, the security system extracts objects associated with flagged access attempts from the modified request (step 710). For each extracted object, the security system determines whether the object actually accessed sensitive data or whether it is associated with an object that accessed sensitive data (step 712). If, in step 712, the object is associated with an object that represents access to sensitive data, the security system filters the object out as a false positive (step 714). If, in step 712, the object represents access to sensitive data, the security system adds the object to the list of sensitive objects (step 716). Starting with steps 714 and 716, the security system uses the list of sensitive objects as criteria for implementing one or more security policies (step 718), after which the process ends.

[0060] The flowcharts and block diagrams or charts in the figures illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments of the present invention. In this context, each block in the flowcharts or block diagrams or charts can represent a module, segment, or part of instructions that includes one or more executable instructions for performing the specific logical function(s). In some alternative embodiments, the functions specified in the block may occur in a different order than shown in the figures. For example, two blocks shown consecutively may in reality be executed essentially simultaneously, or the blocks may sometimes be executed in reverse order depending on the corresponding functionality.It should also be noted that each block of the block diagrams and / or flowcharts, as well as combinations of blocks in the block diagrams and / or flowcharts, can be implemented by special hardware-based systems that perform the specified functions or steps, or execute combinations of special hardware and computer instructions.

[0061] As mentioned above, it should be noted that the illustrative embodiments can be in the form of a purely hardware implementation, a purely software implementation, or an embodiment containing both hardware and software elements. In one exemplary embodiment, the mechanisms of the illustrative embodiments are implemented in software or program code, including, but not limited to, firmware, native software, microcode, etc.

[0062] A data processing system suitable for storing and / or executing program code contains at least one processor, which is directly or indirectly connected to main memory elements via a data transmission bus, such as a system bus. Main memory elements may include local main memory, large-scale memory, and cache memory used during the actual execution of the program code. These caches provide temporary storage of at least some program code to reduce the number of code retrievals from large-scale memory during execution. Main memory can be of various types, including, but not limited to, ROM, PROM, EPROM, EEPROM, DRAM, SRAM, flash memory, semiconductor memory, and the like.

[0063] Input / output (I / O) units (including, but not limited to, keyboards, displays, pointing devices, etc.) can be connected to the system either directly or via intermediary wired or wireless I / O interfaces and / or controllers or the like. Besides conventional keyboards, displays, pointing devices, and the like, I / O units can take many different forms, such as data transmission units connected by wired or wireless links, including, but not limited to, smartphones, tablet computers, touchscreen devices, speech recognition devices, and the like. Any known or future I / O unit is to be included within the scope of the illustrative embodiments.

[0064] The system can also be connected to network adapters to enable the data processing system to connect to other data processing systems or remotely located printers or storage units via intervening private or public networks. Modems, cable modems, and Ethernet cards are just some of the currently available types of network adapters for wired communication. Network adapters based on wireless data transmission can also be used, including, but not limited to, adapters for wireless communication according to 802.11 a / b / g / n, wireless Bluetooth adapters, and the like. All known or future network adapters are intended to be encompassed by the basic concept and scope of the present invention.

[0065] The description of the present invention has been set out for illustrative and descriptive purposes, but is not intended to be exhaustive or limited to the invention in the disclosed forms. Many modifications and variations are apparent to those skilled in the art, without deviating from the scope and basic concept of the described embodiments. The embodiment was chosen and described to best explain the basic concept of the invention and its practical application, and to enable those skilled in the art to understand the invention in various embodiments with different modifications suitable for the respective intended uses.The terminology used herein has been chosen to best explain the basic ideas of the embodiments, practical applications or technical improvements compared to technologies available on the market, or to enable the person skilled in the art to understand the embodiments disclosed herein.

Claims

[1] Methods for monitoring and controlling data access in a data processing system (400), comprising: In response to intercepting a response from a server (402) to an information request from a client entity (406), a security system agent (410, 504) installed on a server (402) separate from a security system (404, 502) applies (604) pattern matching using a predefined set of rules for sensitive data patterns (408) to identify at least one sensitive data access included in the response, the sensitive data access being associated with a part of the request; Determining (606) by the security system agent (410, 504) whether the at least one access to sensitive data matches one or more of the predefined set of rules for sensitive data patterns (408); In response to the fact that the at least one access to sensitive data matches one or more of the predefined set of rules for sensitive data patterns (408), the security system agent (410, 504) modifies (610) the request from the client by marking the at least one access to sensitive data as sensitive, thereby forming a modified request; and Sending (612) the modified request with at least one marked access to sensitive data to the security system (404, 502) by the security system agent (410, 504), causing the security system (404, 502) to process the modified request without access to the sensitive data associated with the at least one marked access to sensitive data in accordance with a security policy of the security system, due to the at least one marked access to sensitive data in the modified request. [2] Method according to claim 1, wherein the predefined set of rules for sensitive data patterns (408) is received by the security system (404, 502) and wherein the predefined set of rules for sensitive data patterns (408) is initially identified by a user of the client unit (406). [3] Method according to claim 1, wherein, in response to the security system (404, 502) receiving the modified request with the at least one marked access to sensitive data from the security system agent (410, 504), the method further comprises: Extracting all objects associated with each access from the modified request by the security system (404, 502); filtering out at least one object identified as a false positive by the security system (404, 502); and Adding remaining objects to a list of sensitive objects by the security system (404, 502). [4] Method according to claim 3, wherein filtering out the at least one object identified as a false positive comprises: Determining by the security system (404, 502) whether the at least one object is identified as a sensitive object because the at least one object is connected to another object that accesses sensitive data; and in response to the fact that the at least one object is identified as a sensitive object because the at least one object is associated with another object that accesses sensitive data, the security system (404, 502) filters out the at least one object as a false positive. [5] The method of claim 3, further comprising: The security system (404, 502) uses the list of sensitive objects as criteria for implementing one or more security policies. [6] Method according to claim 1, wherein the at least one access to sensitive data is access to credit card numbers and / or social security numbers and / or passwords and / or patient data and / or coordinates of geographical locations. [7] Method according to claim 1, further comprising: In response to the security system agent (410, 504) sending the modified request with at least one marked access to sensitive data to the security system (404, 502), allowing the response, including any retrieved data associated with each access, to be sent back to the client. [8] Computer program product comprising a computer-readable storage medium containing a computer-readable program for monitoring and controlling data access, wherein the computer-readable program, when executed on a security system agent (410, 504) of a unit installed in a server (402) separate from a security system (404, 502), causes the data processing unit to: In response to intercepting a response from a server (402) to an information request from a client entity (406), applying pattern matching using a predefined set of rules for sensitive data patterns (408) to identify at least one sensitive data access contained in the response, where the sensitive data access is associated with a part of the request; Determine whether the at least one access to sensitive data matches one or more of the predefined set of rules for sensitive data patterns (408); In response to the fact that at least one access to sensitive data matches one or more of the predefined set of rules for sensitive data patterns (408), modify the request from the client by marking the at least one access to sensitive data as sensitive, thereby forming a modified request; and Sending the modified request with at least one marked access to sensitive data to the security system (404, 502), causing the security system (404, 502) to process the modified request without access to the sensitive data associated with the at least one marked access to sensitive data in accordance with a security policy of the security system. [9] Computer program product according to claim 8, wherein the predefined set of rules for sensitive data patterns (408) is received by the security system (404, 502) and wherein the predefined set of rules for sensitive data patterns (408) is initially identified by a user of the client unit (406). [10] Computer program product according to claim 8, wherein in response to the security system (404, 502) receiving the modified request with the at least one marked access to sensitive data from the security system agent (410, 504), the security system (404, 502) does the following: Extract all objects associated with each access from the modified request; Filtering out at least one object identified as a false positive; and Add remaining objects to a list of sensitive objects. [11] Computer program product according to claim 10, wherein the filtering out of the at least one object identified as a false positive by the security system (404, 502) causes the security system (404, 502) to do the following: Determine whether the at least one object is identified as a sensitive object because the at least one object is associated with another object that accesses sensitive data; and In response to the fact that at least one object is identified as a sensitive object because at least one object is associated with another object that accesses sensitive data, filtering out at least one object as a false positive. [12] Computer program product according to claim 10, wherein the security system (404, 502) further performs the following: Using the list of sensitive objects as criteria for implementing one or more security policies. [13] Computer program product according to claim 8, wherein the at least one access to sensitive data is access to credit card numbers and / or social security numbers and / or passwords and / or patient data and / or coordinates of geographical locations. [14] Computer program product according to claim 8, wherein the computer-readable program further causes the data processing unit to: In response to the security system agent (410, 504) sending the modified request with at least one marked access to sensitive data to the security system (404, 502), allowing the response, including any retrieved data associated with each access, to be sent back to the client. [15] Security system agent (410) device installed on a server (402) separate from a security system (404, 502) for monitoring and controlling data access, comprising: a processor (104) and a memory (112) connected to the processor, wherein the memory (112) contains instructions which, when executed by the processor, cause the processor to: In response to intercepting a response from a server (402) to an information request from a client entity (406), apply pattern matching using a predefined set of rules for sensitive data patterns (408) to identify at least one sensitive data access included in the response, where the sensitive data access is associated with a part of the request; to determine whether the at least one access to sensitive data matches one or more of the predefined set of rules for sensitive data patterns (408); in response to the fact that the at least one access to sensitive data matches one or more of the predefined set of rules for sensitive data patterns (408), to modify the request from the client by marking the at least one access to sensitive data as sensitive, thereby forming a modified request; and to send the modified request with the at least one marked access to sensitive data to the security system (404, 502), causing the security system (404, 502) to process the modified request without access to the sensitive data associated with the at least one marked access to sensitive data in accordance with a security policy of the security system. [16] Security system agent (410) device according to claim 15, wherein the predefined set of rules for sensitive data patterns (408) is received by the security system (404, 502) and wherein the predefined set of rules for sensitive data patterns (408) is initially identified by a user of the client unit (406). [17] Security system agent (410) device according to claim 15, wherein in response to the security system (404, 502) receiving the modified request with the at least one marked access to sensitive data from the security system agent (410, 504), the security system (404, 502) does the following: Extract all objects associated with each access from the modified request; Filtering out at least one object identified as a false positive; and Add remaining objects to a list of sensitive objects. [18] Security system agent (410) device according to claim 17, wherein the filtering out of the at least one object identified as a false positive by the security system (404, 502) causes the security system (404, 502) to do the following: Determine whether the at least one object is identified as a sensitive object because the at least one object is associated with another object that accesses sensitive data; and In response to the fact that at least one object is identified as a sensitive object because at least one object is associated with another object that accesses sensitive data, filtering out at least one object as a false positive. [19] Security system agent (410) device according to claim 17, wherein the security system (404, 502) further performs the following: Using the list of sensitive objects as criteria for implementing one or more security policies. [20] Security system agent (410) device according to claim 15, wherein the instructions further cause the security system agent (410) device to: In response to the security system agent (410, 504) sending the modified request with at least one marked access to sensitive data to the security system (404, 502), allowing the response, including any retrieved data associated with each access, to be sent back to the client.

Images