Computer File Metadata Segmentation Security System

Abstract

A collaborative security enforcement system for digital files is provided. A computing device detects a transfer of a digital file between a source device and a destination device in a given group of devices. The computing device generates a unique identifier (UID) for the transferred digital file. The computing device directs that information related to the digital file be stored in a record associated with the digital file, where the information includes (i) an identifier of the source device, (ii) an identifier of the destination device, and (iii) the generated UID. The computing device identifies the digital file as being tainted. In response to identifying the digital file as being tainted, the computing device identifies a source of the taint based at least in part on the stored information.

Description

[Technical field]

[0001] The present invention relates generally to the field of security systems, and more particularly to the monitoring of computer files by security systems. [Background technology]

[0002] The popularity of the digital world has enhanced the ability for users to exchange digital file content over networks. Typically, these file contents may contain malicious software that can disrupt the functionality of a computer system without identifying the source of the malicious software. Summary of the Invention [Means for solving the problem]

[0003] Embodiments of the present invention provide methods, systems, and computer program products.

[0004] A first embodiment encompasses a method for collaborative security enforcement for digital files. One or more processors detect a transfer of a digital file between a source device and a destination device in a given group of devices. One or more processors generate a unique identifier (UID) for the transferred digital file. One or more processors direct information related to the digital file to be stored in a record associated with the digital file, where the information includes (i) an identifier of the source device, (ii) an identifier of the destination device, and (iii) the generated UID. One or more processors identify that the digital file is tainted. In response to identifying that the digital file is tainted, one or more processors identify a source of the contamination based at least in part on the stored information.

[0005] A second embodiment includes a computer program product for collaborative security enforcement for digital files. The computer program product comprises one or more computer readable storage media and program instructions stored on the one or more computer readable storage media. The program instructions include program instructions for detecting a transfer of a digital file between a source device and a destination device in a given group of devices. The program instructions include program instructions for generating a unique identifier (UID) for the transferred digital file. The program instructions include program instructions for directing that information related to the digital file is stored in a record associated with the digital file, where the information includes (i) an identifier of the source device, (ii) an identifier of the destination device, and (iii) the generated UID. The program instructions include program instructions for identifying that the digital file is contaminated. The program instructions include program instructions for identifying a source of the contamination based at least in part on the stored information in response to identifying that the digital file is contaminated.

[0006] A third embodiment encompasses a computer system for collaborative security enforcement for digital files. The computer system comprises one or more computer processors, one or more computer readable storage media, and a plurality of program instructions stored on the computer readable storage media for execution by at least one of the one or more computer processors. The program instructions include program instructions for detecting a transfer of a digital file between a source device and a destination device in a given group of devices. The program instructions include program instructions for generating a unique identifier (UID) for the transferred digital file. The program instructions include program instructions for directing information related to the digital file to be stored in a record associated with the digital file, where the information includes (i) an identifier of the source device, (ii) an identifier of the destination device, and (iii) the generated UID. The program instructions include program instructions for identifying the digital file as being tainted. The program instructions include program instructions for identifying a source of the contamination based at least in part on the stored information in response to identifying the digital file as being tainted. [Brief description of the drawings]

[0007] [Figure 1] FIG. 1 is a functional block diagram of a computing environment in which a computing device identifies contaminated digital files through metadata backtracking in accordance with an exemplary embodiment of the invention. [Diagram 2] FIG. 2 illustrates an operational process for executing a system for generating anti-virus actions on a computing device in the environment of FIG. 1 according to an exemplary embodiment of the present invention. [Diagram 3]FIG. 3 illustrates a block diagram showing the transfer of one or more documents between users in the environment of FIG. 1 in accordance with an exemplary embodiment of the present invention. [Figure 4] FIG. 4 illustrates a cloud computing environment in accordance with at least one embodiment of the invention. [Diagram 5] FIG. 5 illustrates abstraction model layers in accordance with at least one embodiment of the invention. [Figure 6] FIG. 6 illustrates a block diagram of components of one or more computing devices in the computing environment illustrated in FIG. 1 according to an exemplary embodiment of the invention. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0008] Detailed embodiments of the present invention are disclosed herein with reference to the accompanying drawings. It should be understood that the disclosed embodiments are merely illustrative of potential embodiments of the present invention, which may take various forms. In addition, the examples given in connection with the various embodiments are intended to be illustrative, and not restrictive. Furthermore, the figures are not necessarily to scale, and some features may be exaggerated to show details of particular components. Therefore, specific structural and functional details disclosed herein should not be construed as limiting, but merely as representative basis for teaching those skilled in the art to variously use the present invention.

[0009] References herein to "one embodiment," "an embodiment," "exemplary embodiment," or the like are intended to indicate that the described embodiment may include a particular feature, structure, or characteristic, but that not all embodiments may include the particular feature, structure, or characteristic. Moreover, such phrases do not necessarily refer to the same embodiment. Moreover, when a particular feature, structure, or characteristic is described in connection with an embodiment, it is submitted that it is within the knowledge of one of ordinary skill in the art to affect such feature, structure, or characteristic in connection with other embodiments, whether or not expressly described.

[0010] An embodiment of the present invention recognizes that in a modern digital environment, users may exchange large amounts of digital files between computer systems over networks, and that the digital files may potentially contain contamination. An embodiment of the present invention further recognizes that the digital files may be shared through social media platforms, email servers, and the like. Additionally, an embodiment of the present invention recognizes the importance of scanning and analyzing files for contamination, and removing the contamination as necessary, and informing the user of the source of the contamination and which files may be corrupted.

[0011] An embodiment of the present invention recognizes that a user may not realize that a file contains contamination because, for example, anti-virus software or virus signatures may not be properly updated. Typically, a user may not realize that a digital file contains contamination until the digital file is shared from the user's computer system and another user's computer system becomes corrupted or an anti-virus identifies the contamination. An embodiment of the present invention provides a more efficient and effective system for backtracking and identifying the source of the contamination. Moreover, an embodiment of the present invention provides for analyzing the metadata of the digital file and proactively notifying the source to prevent further spread of the contamination and communicate where the corrupted digital file was shared with other users.

[0012] Embodiments of the present invention provide technical improvements over known solutions for computer system security. Embodiments of the present invention provide servers and systems that improve over conventional systems by providing a more secure and efficient system, thereby reducing downtime of the servers and systems when a compromise damages those servers and systems.

[0013] The present invention will now be described in detail below with reference to the accompanying figures.

[0014] 1 is a functional block diagram illustrating a computing environment, generally designated 100, in accordance with one embodiment of the present invention. Computing environment 100 includes computer system 120, client device 130, client device 136, client device 138, and storage area network (SAN) 140 connected via network 110. Computer system 120 includes security response program 122 and computer interface 124. Client device 130 includes client application 132 and client interface 134. Storage area network (SAN) 140 includes server application 142 and database 144.

[0015] In various embodiments of the present invention, computer system 120 is a computing device that can be a standalone device, a server, a laptop computer, a tablet computer, a netbook computer, a personal computer (PC), a personal digital assistant (PDA), a desktop computer, or any programmable electronic device capable of receiving, transmitting, and processing data. Generally, computer system 120 represents any programmable electronic device or combination of programmable electronic devices capable of executing machine-readable program instructions and communicating with various other computer systems (not shown). In another embodiment, computer system 120 represents a computing system that utilizes clustered computers and components to function as a single pool of seamless resources. Generally, computer system 120 can be any computing device or combination of computing devices that accesses various other computing systems (not shown) and can execute security response program 122 and computer interface 124. Computer system 120 can include internal and external hardware components, as described in more detail with respect to FIG. 6.

[0016] In this exemplary embodiment, the security response program 122 and the computer interface 124 are stored on the computer system 120. However, in other embodiments, the security response program 122 and the computer interface 124 are stored externally and accessed through a communications network, such as the network 110. The network 110 may be, for example, a local area network (LAN), a wide area network (WAN), such as the Internet, or a combination of the two, and may include wired, wireless, fiber optic, or any other connections known in the art. In general, the network 110 may be any combination of connections and protocols that support communication between the computer system 120, the client device 130, and the SAN 140, as well as various other computer systems (not shown), in accordance with the desired implementation of the invention.

[0017] 1, security response program 122, at least in part, has access to client application 132 and can communicate data stored on computer system 120 to client device 130, SAN 140, and various other computer systems (not shown). More particularly, security response program 122 defines users of computer system 120 that have access to data stored on client device 130 or database 144, or a combination thereof.

[0018] The security response program 122 is depicted in FIG. 1 for ease of explanation. In various embodiments of the present invention, the security response program 122 represents logical operations executed on the computer system 120, where the computer interface 124 manages the ability to view these logical operations managed and executed according to the security response program 122. In some embodiments, the security response program 122 represents a cognitive AI system that processes and analyzes input and output (I / O). Additionally, the security response program 122 operates to learn from the analyzed I / O when performing cognitive AI processing, and generate anti-virus actions in a series of program instructions for the user to remove contamination from digital files stored on the client device 130.

[0019] The computer system 120 includes a computer interface 124. The computer interface 124 provides an interface between the computer system 120, the client device 130, and the SAN 140. In some embodiments, the computer interface 124 can be a graphical user interface (GUI) or a web user interface (WUI) and can display text, documents, web browsers, windows, user options, application interfaces, and instructions for operation, and includes information (e.g., graphics, text, and sound) that a program presents to a user and control sequences that the user uses to control the program. In some embodiments, the computer system 120 accesses data communicated from the client device 130 or the SAN 140, or a combination thereof, through a client-based application running on the computer system 120. For example, the computer system 120 includes mobile application software that provides an interface between the computer system 120, the client device 130, and the SAN 140. In various embodiments, computer system 120 communicates a GUI or WUI to client device 130 for instruction and use by a user of client device 130 .

[0020] In various embodiments, the client device 130 is a computing device that can be a standalone device, a server, a laptop computer, a tablet computer, a netbook computer, a personal computer (PC), a personal digital assistant (PDA), a desktop computer, or any programmable electronic device capable of receiving, transmitting, and processing data. In general, the computer system 120 represents any programmable electronic device or combination of programmable electronic devices capable of executing machine-readable program instructions and communicating with various other computer systems (not shown). In another embodiment, the computer system 120 represents a computing system that utilizes clustered computers and components to function as a single pool of seamless resources. In general, the computer system 120 can be any computing device or combination of computing devices that accesses various other computing systems (not shown) and can execute the client application 132 and the client interface 134. The client device 130 can include internal and external hardware components, as described in more detail with respect to FIG. 6.

[0021] 1 for ease of explanation. In various embodiments of the invention, client application 132 represents logical operations executed on client device 130, where client interface 134 manages the ability to display these various embodiments, and client application 132 defines which users of client device 130 have access to data stored on computer system 120 or database 144, or a combination thereof.

[0022] Storage area network (SAN) 140 is a storage system that includes server application 142 and database 144. SAN 140 includes one or more of, but is not limited to, computing devices, servers, server clusters, web servers, databases, and storage devices. SAN 140 operates to communicate with computer system 120, client device 130, and various other computing devices (not shown) over a network, such as network 110. For example, SAN 140 communicates with security response program 122 to transfer data between computer system 120, client device 130, and various other computing devices (not shown) not connected to network 110. SAN 140 can be any computing device or combination of computing devices communicatively connected to a local IoT network, i.e., a network comprised of various computing devices, such as, but not limited to, computer system 120 and client device 130, to provide the functionality described herein. SAN 140 can include internal and external hardware components, as described with respect to FIG. 6. The present invention recognizes that Figure 1 may encompass any number of computing devices, servers, databases, or storage devices, or combinations thereof, and the present invention is not limited to only those depicted in Figure 1. Thus, in some embodiments, some of the features of computer system 120 are provided as part of SAN 140 or another computing device, or a combination thereof.

[0023] Additionally, in some embodiments, SAN 140 and computer system 120 represent or are part of a cloud computing platform. Cloud computing is a model or service delivery for enabling convenient, on-demand network access to a shared pool of configurable computing resources, such as networks, network bandwidth, servers, processing, memory, storage, applications, virtual machines, and one or more services that can be rapidly provisioned and released with minimal administrative effort or interaction with a service provider. The cloud model may have characteristics such as on-demand self-service, broad network access, resource pooling, rapid elasticity, and measured services, and can be represented by service models, such as the above-mentioned service models including the platform as a service (PaaS) model, infrastructure as a service (IaaS) model, and software as a service (SaaS) model, and can be implemented in various deployment models such as private cloud, community cloud, public cloud, and hybrid cloud. In various embodiments, SAN 140 represents, but is not limited to, a database or website that comprises data associated with weather patterns.

[0024] SAN 140 and computer system 120 are depicted in FIG. 1 for simplicity of illustration. However, it should be understood that in various embodiments, SAN 140 and computer system 120 can include any number of databases that are managed according to the functionality of security response program 122 and server application 142. Generally, database 144 represents data and server application 142 represents code that provides the ability to use and modify the data. In alternative embodiments, security response program 122 can also represent any combination of the aforementioned functionality where server application 142 has access to database 144. To illustrate various aspects of the present invention, an example of server application 142 is presented where security response program 122 represents one or more of, but is not limited to, dynamic seat selection for a user.

[0025] In some embodiments, server application 142 and database 144 are stored on SAN 140. However, in various embodiments, server application 142 and database 144 may be stored externally and accessed through a communications network, such as network 110, as described above.

[0026] The security response program 122 is depicted in FIG. 1 for ease of explanation. However, the computer system 120 may include any number of logic or programs or combinations thereof that are managed according to the security response program 122. In general, the computer system 120 manages access to the security response program 122 that represents a physical or virtual resource. In some embodiments, the security response program 122 represents code that includes certain information and that, when executed, enables the computer system 120 to take a particular action with respect to another physical or virtual resource or combinations thereof based on, but not limited to, the certain information. In other words, in such embodiments, the security response program 122 at least manages the ability of the computer system 120 to take various actions with respect to one or more physical or virtual resources or combinations thereof. In some embodiments, the security response program 122 may also embody any combination of the elements described above. To illustrate various aspects of the present invention, examples of the security response program 122 that include one or more of a user profile request, a temperature profile, and manual and IoT feedback are presented, but the implementation of the security response program 122 is not limited thereto. Embodiments of the present invention recognize that the security response program 122 may comprise other forms of transactions known in the art.

[0027] In various embodiments of the invention, a user of client device 130 utilizes at least client application 132 to transfer a digital file between various other users (e.g., client device 136 and client device 138) in computing environment 100. In various embodiments, client application 132 detects the digital file and communicates the digital file to the user based at least on a destination selected by the user of client device 130. In various embodiments of the invention, security response program 122 monitors the transfer of the digital file between the users.

[0028] An embodiment of the present invention provides a system for collaborative security enforcement for digital files, whereby the system backtracks to identify contamination (e.g., corrupted files, malware, etc.) that is disrupting and harming the user's system, and prohibits the source of the contamination from further spreading the corrupted digital file (e.g., a digital file that has been contaminated). In various embodiments, the security response program 122 tracks the source and destination to which the corrupted digital file was transferred, utilizing at least a checksum stored in the metadata of the digital file. In various embodiments, the security response program 122 backtracks using the checksum stored in the metadata, and notifies the source of the corrupted digital file stored on the computer system and provides instructions on how to safely remove the contamination from the user's computer system, and prohibits the user from forwarding the corrupted digital file to possible other users. In addition, the security response program 122 prohibits a user with the corrupted digital file that shares a similar checksum as the source from forwarding the corrupted digital file to other users. In various embodiments, security response program 122 represents an artificial intelligence (AI) method for monitoring metadata associated with the digital files for users in a collaborative environment, where the collaborative environment provides user identifiers and transfer of digital files between users. In various embodiments, operations performed by security response program 122 within the collaborative environment include, but are not limited to, (i) identifying file contents, (ii) scanning for contamination during and after transfer of digital files between users, and (iii) authorizing security authorizations of users when they transfer a single digital file between multiple computer systems (e.g., multiple users).In various embodiments, the security response program 122 further represents a logical operation, where the security response program 122 provides a unique identifier (UID) checksum for each digital file transferred between users.

[0029] In various embodiments, a user of a client device 130 utilizes a client application 132 to share a digital file with other users using a cloud-based server. In various embodiments, the computer system 120 and the SAN 140 are cloud-based servers, and the security response program 122 executing on the computer system 120 includes an AI. In various embodiments, the security system 120 analyzes whether a digital file communicated between users is corrupted. In various embodiments, the security response program 122 labels a digital file with a checksum value based at least on the metadata of the digital file. The security response program 122 stores the checksum on a database 144 for security and for backtracking if corruption is later detected on the digital file.

[0030] An embodiment of the present invention provides that the checksum is re-verified for each digital file when a digital file previously transferred between at least two users is prepared for or transferred between one or more additional users. In various embodiments, the security response program 122 re-verifies the checksum for each digital file when the digital file is transferred between one or more additional users. In various embodiments, when a second user receives the individual digital file, the security response program 122 re-verifies the checksum for the second transfer of the individual digital file by generating a second checksum associated with the digital file, and stores the second checksum in the metadata and stores a copy of the checksum on the database 144. In various embodiments, the security response program 122 identifies whether the checksums for the various transfers between users match. In various embodiments, if the security response program 122 identifies at least one checksum does not match the original checksum, the security response program 122 stores this data on the database 144 for subsequent identification of contamination associated with the individual digital file. An embodiment of the present invention recognizes that mismatched checksums are used by security response program 122 to backtrack through the metadata to identify the source of the contamination. In an alternative embodiment, mismatched checksums indicate that a user may have altered the digital file, and security response program 122 stores the mismatched checksum data in the metadata and on database 144.

[0031] In various embodiments, the security response program 122 represents anti-virus software or malicious execution detector and monitors for contamination stored on the client device 130 or various other computing devices in the collaborative system. An embodiment of the present invention recognizes that the client device 130 and various other computing devices in the collaborative environment (e.g., client device 136, client device 138) have anti-virus software downloaded and running on the computer system. If the security response program 122 detects contamination located on a digital file, the security response program 122 flags the checksum as a potential contamination and disseminates the data of the potential contamination to various anti-virus programs included in the collaborative environment. An embodiment of the present invention recognizes that any computing device that receives or downloads the flagged checksum is provided with anti-virus action with program instructions from the security response program 122 and instructs the user of the computing device 130 to disable the file.

[0032] In various embodiments, a first user uploads a digital file to the cloud-based server, and the security response program 122 analyzes the digital file and generates a checksum for the digital file and stores the checksum in the metadata for the file and on the database 144. An embodiment of the present invention provides user-based behavior detection, where the security response program 122 represents an AI and monitors user behavior with respect to digital files transferred and downloaded within the cloud-based server. In various embodiments, at least a second user downloads a digital file from the cloud-based server (e.g., database 144), and the security response program 122 generates a checksum associated with the second user's download of the digital file and stores the checksum in the metadata and on the database 144. In various embodiments, the security response program 122 analyzes the digital file to determine if the digital file is corrupted by contamination. In various embodiments, security response program 122 monitors the second user's activities and learns the user's behavior of the digital files that the second user downloads or transfers to various other users in the collaborative environment, or a combination thereof. In various embodiments, if the second user desires to transfer the same downloaded digital file to one or more other users, security response program 122 generates another checksum associated with the transfer and allows the various other users (e.g., client device 136, client device 138) to proceed with downloading the digital file without needing approval from security response program 122.

[0033] In various embodiments, the security response program 122 utilizes backtracking to prohibit the user from transferring or downloading the digital file that corrupts or transmits various other users' computer systems (e.g., client device 136, client device 138). In various embodiments, the security response program 122 identifies the source of the contamination by backtracking the metadata. The security response program 122 identifies the presence of the contamination and provides an anti-virus action with program instructions to remove the contamination from the user's computing device. Additionally, in various embodiments, the security response program 122 utilizes backtracking to identify various computing devices where the contamination exists and communicates an anti-virus action with program instructions to remove the contamination. Finally, the security response program 122 prohibits the user from transferring or uploading the corrupted digital file to other users in the cloud-based server to prevent the spread of the contamination.

[0034] FIG. 2 is a flow chart diagram 200 illustrating the operation of the security response program 122 in the computing environment 100 according to an exemplary embodiment of the present invention. FIG. 2 also illustrates certain interactions between the security response program 122 and the client application 132. In some embodiments, the operations illustrated in FIG. 2 incorporate the output of the security response program 122 executing on the computer system 120. It should be understood that FIG. 2 provides only an example of one implementation and does not imply any limitations with respect to the environments in which different embodiments may be implemented. Many modifications to the depicted environment may be made. In one embodiment, the sequence of operations in FIG. 2 may be performed in any order. In another embodiment, the sequence of operations depicted in FIG. 2 may be performed simultaneously. In addition, the sequence of operations depicted in FIG. 2 may be terminated at any operation. In addition to the features previously described, any operation depicted in FIG. 2 may be resumed at any time.

[0035] In operation 202, the security response program 122 generates a checksum based on the communication of the digital file between users. In various embodiments, the security response program 122 monitors the communication of the digital file between users. In various embodiments, users in a cloud-based server communicate digital files between each other. In addition, a user receiving the digital file can forward the digital file to one or more users in the cloud-based server. In various embodiments, the security response program 122 identifies when a user in the cloud-based server forwards a digital file between various other users. In response to identifying when a user forwards a digital file between various other users in the cloud-based server, the security response program 122 generates a checksum for each forwarding of the digital file. In various embodiments, the security response program 122 stores the checksum in the metadata of the digital file and on the database 144. An embodiment of the present invention allows the checksum to backtrack through the metadata to identify a source of contamination associated with the digital file, where the checksum value changes based at least on when the digital file has been altered. In various embodiments, the alteration of the digital file includes, but is not limited to, when corruption is appended to the digital file, when corruption overwrites a portion of the file code, or when a user alters the digital file (e.g., a user modifies a word document by adding or deleting characters in the word document).

[0036] The embodiment of the present invention further provides that the checksum value remains the same as the previous checksum value until the digital file is modified. In one example and embodiment, if a first user transfers the digital file to a second user, the security response program 122 generates a checksum value (ab) and stores this checksum value in the metadata of the digital file and on the database 144. In addition, if the second user does not modify the digital file and transfers the digital file to a third user, the security response program 122 generates at least a second checksum value (ab) that is the same as the previous checksum value that the second user generated when receiving the digital file. The embodiment of the present invention provides that the security response program 122 can distinguish between benign and malicious modifications, the security response program 122 analyzes the signature of the modified digital file. In various embodiments, if the signature of the modified digital file is modified by a recipient user, the security response program 122 accepts the modification by the recipient user as a benign modification to the digital file. Alternatively, in various embodiments, the security response program 122 analyzes the signature of the modified digital file and determines that the modified digital file has been modified by another user, an unknown user, or an unknown program other than the recipient user, and in response, the security response program 122 determines that malicious modification to the digital file has occurred (e.g., a virus or Trojan horse). In an alternative embodiment, when the second user modifies or corrupts the digital file or transfers the digital file to a third user when both modifications and corruption have occurred, the security response program 122 generates a second checksum (ac) that is different from the previous checksum value of the digital file received by the second user. In an alternative embodiment, the security response program 122 stores the second checksum value (ac) in the metadata of the digital file and on the database 144.In various embodiments, the security response program 122 utilizes the checksum value to identify the source of possible identified contamination associated with the digital file.

[0037] In operation 204, the security response program 122 detects contamination associated with the digital file. In various embodiments, a digital file communicated by a user in a cloud-based server is identified as containing contamination. In various embodiments, the security response program 122 labels the digital file containing the contamination as a corrupted digital file and stores this data on the database 144, as described above.

[0038] In operation 206, the security response program 122 verifies the checksum against historical file transfers of the digital file. In response to the security response program 122 identifying corruption associated with the digital file, the security response program 122 begins backtracking through the historical file transfers and verifies the checksum values ​​against each other to responsively identify the source of the corruption. In various embodiments, the security response program 122 identifies the most recent checksum value of the digital file where the corruption was identified, and the security response program 122 backtracks through the metadata to identify where the checksum value changes between user transfers. In various embodiments, the security response program 122 identifies when the checksum value changes between user transfers, and the security response program 122 determines that the user at the time the checksum value changed is the source of the corruption.

[0039] In one exemplary embodiment, security response program 122 identifies the above-mentioned contamination in digital file A. Security response program 122 further identifies the most recent checksum value (i.e., checksum value (ac)) associated with the corrupted digital file. In this exemplary embodiment, security response program 122 communicates with database 144 and retrieves historical file transfers of digital file A. In this exemplary embodiment, security response program 122 analyzes the historical file transfers and identifies various checksum values ​​associated with transfers of digital file A between various users. Security response program 122 identifies that the corrupted digital file associated with checksum value (ac) was transferred to the following users: user F, user G, user H, and user J. Additionally, security response program 122 identifies, through backtracking of the metadata of the digital file, that the checksum value changed after user D received the digital file from user Q, and security response program 122 identifies that user Q is the original user transferring the file and that the stored checksum value was checksum value (ab) when user D received the digital file from user Q. Security response program 122 determines that the source of the corrupted digital file originated from user D.

[0040] An embodiment of the present invention provides that a given digital file transferred between users is given a particular checksum value stored as metadata on a cloud-based database, and when the given digital file is transferred to at least another user at a third destination device (e.g., client device 130, client device 136, client device 138, etc.), the checksum value is recalculated and added to the metadata and cloud-based database, and security response program 122 compares the checksum values ​​between one or more transfers of the digital file.

[0041] An embodiment of the present invention provides that the security response program 122 utilizes two detection methods to detect malicious modification to digital files. In various embodiments, the malicious modification is detected by anti-virus software that can scan the incoming file delivered to the destination device (e.g., client device 130, client device 136, client device 138, etc.). In various other embodiments (or the same embodiment), the malicious modification is detected by the security response program 122 by analyzing the signature (e.g., metadata) of the modified file and determining whether the modified digital file was modified by an unknown user, a non-receiving user, or an unknown program. In these embodiments, the security response program 122 then identifies the contamination for the modified digital file based at least on the checksum value, and the security response program 122 flags that file and all other associated digital files whose checksum values ​​match.

[0042] In operation 208, security response program 122 generates a warning to the users affected by the contamination. In various embodiments, security response program 122, in response to identifying the source of the corrupted digital file, generates an anti-virus action with program instructions for the users affected by the contamination. In various embodiments, the anti-virus action includes program instructions that instruct a user to remove the contamination from the digital file or to completely remove the corrupted digital file from the user's computing device (e.g., client device 130). In various embodiments, security response program 122 communicates the anti-virus action with program instructions to each user identified by security response program 122 as having received the corrupted digital file. Additionally, in various embodiments, security response program 122 prohibits the users affected by the corrupted digital file from further forwarding the corrupted digital file until the contamination is removed from the computing device (e.g., client device 130).

[0043] FIG. 3 illustrates a block diagram 300 of a transaction history between users of a document, where the users transfer documents between each other, according to an exemplary embodiment of the present invention. An embodiment of the present invention recognizes that the documents may be digital files that are each stored in memory of the users' computing devices. FIG. 3 shows document A being transferred between user A 302, user B 306, and user C 310. In various embodiments, user A 302 transfers document A to user B 306 (304). In various embodiments, a checksum 314 is generated for document A 304 (i.e., aa), and the checksum 314 is stored on a checksum storage (e.g., database 144) for subsequent review. In various embodiments, user B 306 transfers document A to user C 310 (308). In various embodiments, a checksum 316 is generated for document A 308 (i.e., ab). In various embodiments, the checksum 316 (i.e., ab) generated for Document A 308 is stored on the checksum storage. An embodiment of the present invention recognizes that because the checksum changed from "aa" to "ab" between Document A 304 and Document A 308, a change to the digital file (e.g., Document A) was made by User B 306 before it was transferred to User C 310. Those skilled in the art will appreciate that FIG. 3 is depicted for illustrative simplicity and that embodiments of the present invention are not limited to what is depicted. An embodiment of the present invention recognizes that many transfers between users are possible and that one or more users may modify the document before contamination is attached to the document.

[0044] In various embodiments, the security response program 122 identifies corruption associated with document A 312 stored on the computing device of user C 310, where document A 312 is flagged as corrupted and a checksum 318 is generated (i.e., AB) and stored on the checksum storage. In various embodiments, the security response program 122 backtracks through the metadata of document A and identifies at least when the checksum value has changed between the transfers of the users in FIG. 3. An embodiment of the invention recognizes that a checksum value changes when (i) a user modifies a digital document (e.g., document A) and (ii) corruption is attached to document A. In various embodiments, the security response program 122 identifies that the checksum 316 value has changed when user B 306 transfers document A 308 to user C 310. In various embodiments, the security response program 122 analyzes the checksum 314 values ​​between User A 302 and User B 306 to verify that User A 302 is not the source of the contamination. The security response program 122 performs a malicious diagnostic analysis on the computing device of User B 306 and identifies the contamination on the computing device of User B 306. In various embodiments, the security response program 122 determines that the computing device of User B 306 is the source of the contamination based at least on the fact that the computing device of User B 306 is the initial source of the earliest change to Document A.

[0045] In an alternative embodiment, security response program 122 backtracks through the metadata to identify the source of the contamination. An embodiment of the present invention recognizes that security response program 122 analyzes the metadata of document A to identify the source of the contamination. In this alternative embodiment, security response program 122 identifies that the value of checksum 316 has changed between user B 306 and user C 310, and further identifies that contamination exists on the computing device of user B 306. Security response program 122 determines that the computing device of user B 306 is a potential source of the contamination, and to confirm, security response program 122 analyzes the computing device of user A 302 and the value of checksum 314. Security response program 122 analyzes the metadata and identifies that user A 302 is the initial transferor of document A 304 and the initial checksum 314 value. In this alternative embodiment, security response program 122 identifies the contamination as being present on the computing device of user A 302. Security response program 122 determines that the computing device of user A 302 is the source of the contamination, and security response program 122 further determines that user B 306 modified document A such that the checksum 316 value changed between user B 306 and user C 310.

[0046] Although the present disclosure includes detailed descriptions of cloud computing, it should be understood in advance that implementation of the teachings recited herein is not limited to a cloud computing environment. Rather, embodiments of the present invention can be implemented in conjunction with any other type of computing environment now known or later developed.

[0047] Cloud computing is a model of service delivery for enabling convenient, on-demand network access to a shared pool of configurable computing resources (e.g., networks, network bandwidth, servers, processing, memory, storage, applications, virtual machines, and services) that can be rapidly provisioned and released with minimal administrative effort or interaction with the service provider. The cloud model may include at least five characteristics, at least three service models, and at least four deployment models.

[0048] The features are as follows.

[0049] On-demand self-service: A cloud consumer can unilaterally provision computing capacity, such as server time and network storage, as needed, without the need for human interaction with the provider of the service.

[0050] Broad Network Access: Capabilities are available over the network and accessed via standard mechanisms that facilitate use by heterogeneous thin or thick client platforms (e.g., cell phones, laptops, and PDAs).

[0051] Resource Pooling: Provider computing resources are pooled to serve multiple consumers using a multi-tenant model, and various physical and virtual resources are dynamically allocated and reallocated according to demand. Consumers generally have no control or knowledge of the exact location of the provided resources, but are said to be location-independent in that they may be able to specify a location at a higher level of abstraction (e.g., country, state, or data center).

[0052] Rapid Elasticity: Capabilities can be provisioned quickly and elastically, sometimes automatically, quickly scaled out, quickly released and quickly scaled in. To the consumer, the capabilities available for provisioning are often unlimited and can be purchased in any quantity at any time.

[0053] Measured Services: Cloud systems automatically control and optimize resource usage by using metering capabilities at some level of abstraction appropriate to the type of service (e.g., storage, processing, bandwidth, and active user accounts). Resource usage can be monitored, controlled, and reported, providing transparency to both providers and consumers of the services being utilized.

[0054] The service model is as follows:

[0055] Software as a Service (SaaS): The capability offered to consumers to use a provider's applications running on a cloud infrastructure. The applications are accessible from a variety of client devices through a thin-client interface, e.g., a web browser (e.g., web-based email). The consumer does not manage or control the underlying cloud infrastructure, including networks, servers, operating systems, storage, or even individual application functions, with the possible exception of limited user-specific application configuration settings.

[0056] Platform as a Service (PaaS): A capability offered to a consumer to deploy consumer-created or acquired applications, created using programming languages ​​and tools supported by the provider, onto a cloud infrastructure. The consumer does not manage or control the underlying cloud infrastructure, e.g., including networks, servers, operating systems, or storage, but does have control over the deployed applications and, in some cases, the application-hosting environment configuration.

[0057] Infrastructure as a Service (IaaS): The capability offered to consumers to provision processing, storage, network, and other basic computing resources on which the consumer can deploy and run any software, which may include operating systems and applications. The consumer does not manage or control the underlying cloud infrastructure, but does have control over the operating systems, storage, deployed applications, and in some cases, limited control over selecting network components (e.g., host firewalls).

[0058] The deployment models are as follows:

[0059] Private Cloud: Cloud infrastructure is operated exclusively for an organization. The cloud infrastructure may be managed by the organization or a third party, and may be on-premises or off-premises.

[0060] Community Cloud: Cloud infrastructure is shared by several organizations and supports a particular community with common concerns (e.g., mission, security requirements, policies, and compliance considerations). The cloud infrastructure may be managed by the organizations or a third party, and may reside on-premise or off-premise.

[0061] Public Cloud: The cloud infrastructure is available to the general public or large industry groups and is owned by an organization that sells cloud services.

[0062] Hybrid Cloud: The cloud infrastructure remains a unique entity, but is a hybrid of two or more clouds (private, community, or public) brought together by standardized or specialized technologies that enable data and application portability (e.g., cloud bursting for load balancing between clouds).

[0063] A cloud computing environment is service oriented with a focus on statelessness, low coupling, modularity, and semantic interoperability. At the heart of cloud computing is an infrastructure that includes a network of interconnected nodes.

[0064] Referring now to FIG. 4, an exemplary cloud computing environment 50 is illustrated. As illustrated, the cloud computing environment 50 includes one or more cloud computing nodes 10 with which local computing devices used by cloud consumers, such as a personal digital assistant (PDA) or mobile phone 54A, a desktop computer 54B, a laptop computer 54C, or an automobile computer system 54N, or combinations thereof, may communicate. The nodes 10 may communicate with each other. They may be physically or virtually grouped in one or more networks, such as a private cloud, a community cloud, a public cloud, or a hybrid cloud, or combinations thereof, as described herein (not shown). This allows the cloud computing environment 50 to provide infrastructure, platform, or software, or combinations thereof, as a service without the cloud consumer having to maintain resources on the local computing device. It is understood that the types of computing devices 54A-54N illustrated are intended to be exemplary only, and that the computing nodes 10 and the cloud computing environment 50 communicate with any type of computerized device (e.g., using a web browser) over any type of network or network addressable connection or combinations thereof.

[0065] Referring now to Figure 5, a set of functional abstraction layers provided by cloud computing environment 50 (Figure 4) is shown. It should be understood that the components, layers and functions shown in Figure 5 are intended to be merely exemplary, and that embodiments of the present invention are not limited thereto. As shown, the following layers and corresponding functions are provided:

[0066] The hardware and software layer 60 includes hardware and software components. Examples of hardware components include mainframes 61, RISC (Reduced Instruction Set Computer) architecture based servers 62, servers 63, blade servers 64, storage devices 65, and networks and networking components 66. In some embodiments, the software components include network application server software 67 and database software 68.

[0067] The virtualization layer 70 provides an abstraction layer from which the following examples of virtual entities may be provided: virtual servers 71; virtual storage 72; virtual networks 73, including, for example, virtual private networks; virtual applications and operating systems 74; and virtual clients 75.

[0068] In one example, the management layer 80 may provide multiple functions described below. Resource provisioning 81 provides dynamic procurement of computing and other resources utilized to execute tasks within the cloud computing environment. Metering and pricing 82 provides cost tracking as resources are utilized within the cloud computing environment and billing or invoicing for the consumption of these resources. In one example, these resources may include application software licenses. Security provides identity verification for cloud consumers and tasks, and protection for data and other resources. User portal 83 provides access to the cloud computing environment for consumers and system administrators. Service level management 84 provides allocation and management of cloud computing resources such that required service levels are met. Service level agreement (SLA) planning and fulfillment 85 provides pre-provisioning and procurement of cloud computing resources where future requirements are predicted according to SLAs.

[0069] The workload tier 90 provides examples of functions for which the cloud computing environment may be utilized. Examples of workloads and functions that may be provided from this tier include mapping and navigation 91; software development and lifecycle management 92; providing virtual classroom instruction 93; data analytics processing 94; transaction processing 95; and providing soothing output 96.

[0070] 6 illustrates a block diagram 600 of components of computer system 120, client device 130, and SAN 140 in accordance with an exemplary embodiment of the invention. It should be understood that FIG. 6 is provided as only an example of one implementation and is not intended to imply any limitation with respect to the environments in which different embodiments may be implemented. Many modifications to the depicted environment may be made.

[0071] Computer system 120, client device 130, and SAN 140 each include a communications fabric 602 that provides communications between one or more computer processors 604, memory 606, persistent storage 608, communications units 610, and one or more input / output (I / O) interfaces 612. Communications fabric 602 may be implemented with any architecture designed to pass data or control information, or a combination thereof, between a processor (e.g., a microprocessor, communications and network processor, etc.), system memory, peripheral devices, and any other hardware components in the system. For example, communications fabric 602 may be implemented using one or more buses.

[0072] Memory 606 and persistent storage 608 are computer-readable storage media. In this embodiment, memory 606 includes random access memory (RAM) 614 and cache memory 616. In general, memory 606 may include any suitable volatile or non-volatile computer-readable storage media.

[0073] The security response program 122, computer interface 124, client application 132, client interface 134, server application 142, and database 144 are stored in persistent storage 608 for execution or access, or execution and access, by one or more of the respective computer processors 604 via one or more memories 606. In this embodiment, persistent storage 608 includes a magnetic hard disk drive. As an alternative to or in addition to a magnetic hard disk drive, persistent storage 608 can include a solid state hard drive, a semiconductor memory device, a read only memory (ROM), an erasable programmable read-only memory (EPROM), a flash memory, or any other computer readable storage medium capable of storing program instructions or digital information.

[0074] The media used by persistent storage 608 may be removable. For example, a removable hard disk may be used for persistent storage 608. Other examples include optical and magnetic disks, thumb drives, and smart cards, which are inserted into a drive for transfer onto another computer-readable storage medium that is also part of persistent storage 608.

[0075] In these examples, the communications unit 610 provides for communication with other data processing systems or devices comprising resources of the network 110. In these examples, the communications unit 610 comprises one or more network interface cards. The communications unit 610 may provide for communication through the use of either or both physical and wireless communications links. The security response program 122, the computer interface 124, the client application 132, the client interface 134, the server application 142, and the database 144 may be downloaded to the persistent storage 608 via the communications unit 610.

[0076] One or more I / O interfaces 612 allow for input and output of data to and from computer system 120, client device 130, and other devices that may be connected to SAN 140. For example, I / O interface 612 may provide a connection to external device 618, such as a keyboard, keypad, touch screen, or some other suitable input device, or combination thereof. External device 618 may also include portable computer-readable storage media, such as thumb drives, portable optical or magnetic disks, memory cards, and the like. Software and data used to practice embodiments of the present invention, such as security response program 122, computer interface 124, client application 132, client interface 134, server application 142, and database 144, may be stored on such portable computer-readable storage media and may be loaded onto persistent storage 608 via one or more I / O interfaces 612.

[0077] Display 620 provides a mechanism for displaying data to a user and may be, for example, a computer monitor or television screen.

[0078] The present invention may be a system, method, or computer program product, or any combination thereof. The computer program product may include one or more computer readable storage media having computer readable program instructions for causing a processor to perform aspects of the present invention.

[0079] The computer readable storage medium can be a tangible device capable of holding and storing instructions for use by an instruction execution device. The computer readable storage medium can be, for example, but not limited to, an electronic storage device, a magnetic storage device, an optical storage device, an electromagnetic storage device, a semiconductor storage device, or any suitable combination thereof. A non-exhaustive list of more specific examples of the computer readable storage medium includes the following: a portable computer diskette, a hard disk, a random access memory (RAM), a read only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), a static random access memory (SRAM), a portable compact disc read-only memory (CD-ROM), a digital versatile disk (DVD), a memory stick, a floppy disk, a mechanically encoded device such as a punch card or a ridge structure in a groove in which instructions are recorded, or any suitable combination thereof. As used herein, a computer-readable storage medium should not be construed as a transitory signal per se, such as an electric wave or other freely propagating electromagnetic wave, an electromagnetic wave propagating through a waveguide or other transmission medium (e.g., a light pulse passing through a fiber optic cable), or an electrical signal transmitted over an electrical wire.

[0080] The computer-readable program instructions described herein can be downloaded from a computer-readable storage medium to each computing device / processing device, or to an external computer or external storage device via a network, such as the Internet, a local area network, a wide area network, or a wireless network, or a combination thereof. The network may be comprised of copper transmission cables, optical transmission fiber, wireless transmission, routers, firewalls, switches, gateway computers, or edge servers, or a combination thereof. A network adapter card or network interface in each computing device / processing device receives the computer-readable program instructions from the network and transmits the computer-readable program instructions to the respective computing device / processing device for storage in a computer-readable storage medium.

[0081] The computer readable program instructions for carrying out the operations of the present invention may be either assembler instructions, instruction-set-architecture (ISA) instructions, machine instructions, machine-dependent instructions, microcode, firmware instructions, state setting data, configuration data for an integrated circuit, or source or object code written in any combination of one or more programming languages, such as object-oriented programming languages, such as Smalltalk, C++, and the like, conventional procedural programming languages ​​(e.g., the "C" programming language or similar programming languages). The computer readable program instructions may be executed entirely on the user's computer, partially on the user's computer, partially on the user's computer as a stand-alone software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In the latter scenario, the remote computer may be connected to the user's computer via any kind of network, such as a local area network (LAN) or a wide area network (WAN), or the connection may be to an external computer (e.g., through the Internet using an Internet Service Provider). In some embodiments, electronic circuitry, such as programmable logic circuits, field-programmable gate arrays (FPGAs), or programmable logic arrays (PLAs), may execute computer-readable program instructions by utilizing state information of the computer-readable program instructions to personalize the electronic circuitry to perform aspects of the invention.

[0082] Aspects of the present invention are described herein with reference to flowchart illustrations or block diagrams, or combinations thereof, of methods, apparatus (systems), and computer program products or computer programs according to embodiments of the present invention. It will be understood that each block of the flowchart illustrations or block diagrams, or combinations thereof, and combinations of blocks in the flowchart illustrations or block diagrams, or combinations thereof, can be implemented by computer readable program instructions.

[0083] These computer readable program instructions can be provided to a processor of a general purpose computer, special purpose computer, or other programmable data processing apparatus to produce a machine such that the instructions, executed by the processor of the computer or other programmable data processing apparatus, create means for implementing the functions / acts specified in one or more blocks of the flowchart illustrations or block diagrams, or combinations thereof. These computer readable program instructions can also be stored on a computer readable storage medium that can direct a computer, programmable data processing apparatus, or other device, or combinations thereof, to function in a particular manner, and a computer readable storage medium having instructions stored therein comprises an article of manufacture including instructions that implement an aspect of one or more specified functions / acts of the flowchart illustrations or block diagrams, or combinations thereof.

[0084] The computer readable program instructions may also be loaded onto a computer, other programmable data processing apparatus, or other device such that the instructions, which execute on a computer, other programmable data processing apparatus, or other device, implement the functions / acts identified in one or more blocks of the flowchart illustrations or block diagrams, or combinations thereof, to cause the computer, other programmable apparatus, or other device to perform a series of operational steps to generate a computer-implemented process.

[0085] The flowchart diagrams and block diagrams in the drawings illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products or computer programs according to various embodiments of the present invention. In this regard, each block in the flowchart diagrams or block diagrams may represent a module, segment, or portion of an instruction, which includes one or more executable instructions for implementing one or more specified logical functions. In some alternative implementations, the functions shown in the blocks may occur out of the order shown in the drawings. For example, two blocks shown in succession may actually be accomplished as one step performed simultaneously, substantially simultaneously, partially or fully in a time-overlapping manner, depending on the functions involved, or the blocks may be performed in the reverse order. It should be noted that each block of the block diagrams or flowchart diagrams or combinations thereof, as well as combinations of multiple blocks of the block diagrams or flowchart diagrams or combinations thereof, may be implemented by a special purpose hardware-based system that performs the specified functions or operations, or may execute a combination of special purpose hardware and computer instructions.

[0086] The programs described herein are identified based on the applications in which they are implemented in particular embodiments of the invention. It should be understood, however, that any specific program names herein are used merely for convenience, and thus the invention should not be limited to use only with any specific application identified or implied or identified and implied by such names.

[0087] It should be noted that one or more words, such as "Smalltalk," may be the subject of trademark rights in various jurisdictions around the world, and are used herein only in connection with products or services properly designated by trademarks, to the extent such trademark rights exist.

Claims

1. 1. A computer-implemented method, comprising: Detecting, by one or more processors, a transfer of a digital file between a source device and a destination device in a given group of devices; generating, by one or more processors, a unique identifier (UID) for the transferred digital file; one or more processors directing that information related to the digital file is stored in a record associated with the digital file, where the information includes (i) an identifier of the source device, (ii) an identifier of the destination device, and (iii) the generated UID; one or more processors identifying that the digital file is tainted; and In response to identifying the digital file as being corrupted, one or more processors identify a source of the corruption based at least in part on the stored information. Including, identifying the source of the contamination based at least in part on the stored information; backtracking, by the one or more processors, through the information stored in the record associated with the digital file until a change in UID is detected; and one or more processors identifying a source device associated with the detected change in UID as the source of the contamination. Including, The method.

2. 1. A computer-implemented method, comprising: Detecting, by one or more processors, a transfer of a digital file between a source device and a destination device in a given group of devices; generating, by one or more processors, a unique identifier (UID) for the transferred digital file; one or more processors directing that information related to the digital file is stored in a record associated with the digital file, where the information includes (i) an identifier of the source device, (ii) an identifier of the destination device, and (iii) the generated UID; one or more processors identifying that the digital file is tainted; and In response to identifying the digital file as being corrupted, one or more processors identify a source of the corruption based at least in part on the stored information. Including, the record associated with the digital file is stored within the digital file by the destination device; The method.

3. instructing the one or more processors on the given group of devices to perform an anti-virus operation, where the anti-virus operation removes the contaminated digital file; 3. The computer-implemented method of claim 1 or 2, further comprising:

4. one or more processors notifying the given group of devices that the digital file has been compromised; and instructing the one or more processors to prohibit further transfer of the tainted digital file within the given group of devices.

3. The computer-implemented method of claim 1 or 2, further comprising:

5. The contamination is Identified through anti-virus software; and / or by analyzing the information stored in the record associated with the digital file; 3. A computer-implemented method according to claim 1 or 2.

6. identifying the source of the contamination based at least in part on the stored information; backtracking, by the one or more processors, through the information stored in the record associated with the digital file until a change in UID is detected; and one or more processors identifying a source device associated with the detected change in UID as the source of the contamination.

3. The computer-implemented method of claim 2, comprising:

7. 3. The computer-implemented method of claim 1 or 2, wherein the record associated with the digital file is stored on a server, the server being communicatively connected to the given group of devices.

8. A computer program, comprising: program instructions for detecting a transfer of a digital file between a source device and a destination device in a given group of devices; program instructions for generating a unique identifier (UID) for the transferred digital file; program instructions directing that information related to the digital file be stored in a record associated with the digital file, the information including (i) an identifier of the source device, (ii) an identifier of the destination device, and (iii) the generated UID; program instructions for identifying the digital file as being tainted; and program instructions for identifying a source of the contamination based at least in part on the stored information in response to identifying the digital file as being corrupted. on one or more processors; identifying the source of the contamination based at least in part on the stored information; program instructions for backtracking the information stored in the record associated with the digital file until a change in UID is detected; and program instructions for identifying a source device associated with the detected change in UID as the source of the contamination Including, The computer program.

9. A computer program, comprising: program instructions for detecting a transfer of a digital file between a source device and a destination device in a given group of devices; program instructions for generating a unique identifier (UID) for the transferred digital file; program instructions directing that information related to the digital file be stored in a record associated with the digital file, the information including (i) an identifier of the source device, (ii) an identifier of the destination device, and (iii) the generated UID; program instructions for identifying the digital file as being tainted; and program instructions for identifying a source of the contamination based at least in part on the stored information in response to identifying the digital file as being corrupted. on one or more processors; the record associated with the digital file is stored within the digital file by the destination device; The computer program.

10. The stored program instructions include: program instructions for directing the given group of devices to perform an anti-virus operation, the anti-virus operation removing the contaminated digital file; 10. The computer program of claim 8 or 9, further comprising:

11. The stored program instructions include: program instructions for notifying the given group of devices that the digital file has been compromised; and program instructions to instruct the given group of devices to prohibit further transfer of the tainted digital file within the given group of devices; 10. The computer program of claim 8 or 9, further comprising:

12. The contamination is Identified through anti-virus software; and / or by analyzing the information stored in the record associated with the digital file; 10. A computer program according to claim 8 or 9.

13. identifying the source of the contamination based at least in part on the stored information; program instructions for backtracking the information stored in the record associated with the digital file until a change in UID is detected; and program instructions for identifying a source device associated with the detected change in UID as the source of the contamination 10. The computer program of claim 9, comprising:

14. 10. A computer program product as claimed in claim 8 or 9, wherein the record associated with the digital file is stored on a server, the server being communicatively connected to the given group of devices.

15. 1. A computer system, comprising: one or more computer processors; one or more computer-readable storage media; and a plurality of program instructions stored on the computer-readable storage medium for execution by at least one of the one or more processors; Equipped with The stored program instructions include: program instructions for detecting a transfer of a digital file between a source device and a destination device in a given group of devices; program instructions for generating a unique identifier (UID) for the transferred digital file; program instructions directing that information related to the digital file be stored in a record associated with the digital file, the information including (i) an identifier of the source device, (ii) an identifier of the destination device, and (iii) the generated UID; program instructions for identifying the digital file as being tainted; and program instructions for identifying a source of the contamination based at least in part on the stored information in response to identifying the digital file as being corrupted. Including, identifying the source of the contamination based at least in part on the stored information; program instructions for backtracking the information stored in the record associated with the digital file until a change in UID is detected; and program instructions for identifying a source device associated with the detected change in UID as the source of the contamination Including, The computer system.

16. 1. A computer system, comprising: one or more computer processors; one or more computer-readable storage media; and a plurality of program instructions stored on the computer-readable storage medium for execution by at least one of the one or more processors; It is equipped with The stored program instructions include: program instructions for detecting a transfer of a digital file between a source device and a destination device in a given group of devices; program instructions for generating a unique identifier (UID) for the transferred digital file; program instructions directing that information related to the digital file be stored in a record associated with the digital file, the information including (i) an identifier of the source device, (ii) an identifier of the destination device, and (iii) the generated UID; program instructions for identifying the digital file as being tainted; and program instructions for identifying a source of the contamination based at least in part on the stored information in response to identifying the digital file as being corrupted. Including, the record associated with the digital file is stored within the digital file by the destination device; The computer system.

17. The stored program instructions include: program instructions for causing the one or more processors to instruct the given group of devices to perform an anti-virus operation, where the anti-virus operation removes the contaminated digital file; 17. The computer system of claim 15 or 16, further comprising:

18. The stored program instructions include: program instructions for notifying the given group of devices that the digital file has been compromised; and program instructions to instruct the given group of devices to prohibit further transfer of the tainted digital file within the given group of devices; 17. The computer system of claim 15 or 16, further comprising:

19. The contamination is Identified through anti-virus software; and / or by analyzing the information stored in the record associated with the digital file; 17. A computer system according to claim 15 or 16.

20. The method of claim 1, further comprising: program instructions for identifying the source of the contamination based at least in part on the stored information, the program instructions comprising: program instructions for backtracking the information stored in the record associated with the digital file until a change in UID is detected; and program instructions for identifying a source device associated with the detected change in UID as the source of the contamination 20. The computer system of claim 16, comprising:

Images