Method, computer program, and security system agent device for monitoring and controlling data access

Abstract

To provide a method for monitoring and controlling data access.SOLUTION: A security system agent responds to intercepting a response from a server to an information request from a client device, applies pattern matching using a predefined set of sensitive data pattern rules to identify at least one sensitive data access contained in the response. In response to the identification of at least one sensitive data access that matches one or more of the predefined set of sensitive data pattern rules, the security system agent modifies the request from a client by marking the at least one sensitive data access as a sensitive, thereby forming a modified request, and transmits the modified request to a security system. The security system performs processing of the modified request.SELECTED DRAWING: Figure 5

Description

[Technical Field]

[0001] FIELD OF THE INVENTION This application relates generally to improved data processing apparatus and methods, and more particularly to mechanisms for monitoring and controlling data access. [Background technology]

[0002] Security analytics is the process of using data collection, aggregation, and analytical tools for security monitoring and threat detection. Depending on the type of tools installed, security analytics solutions can incorporate large and diverse data sets into their detection algorithms. Security analytics data can be collected in several ways, including: network traffic, Endpoint and user behavior data; Cloud resources, Business applications, Non-IT contextual data, Identity and access management data; External threat intelligence sources.

[0003] Recent technological advances in security analytics include adaptive learning systems that fine-tune detection models based on experience and learning, and anomaly detection logic. These technologies accumulate and analyze real-time data, including: Asset Metadata Geolocation Threat Intelligence IP context.

[0004] These types of data can then be used for both immediate threat response and investigation. Summary of the Invention [Problem to be solved by the invention]

[0005] The present invention aims to provide a method, a computer program, and a security system agent device for monitoring and controlling data access. [Means for solving the problem]

[0006] This Summary is provided to introduce a selection of concepts in a simplified form that are further described herein in the Detailed Description. This Summary is not intended to identify key elements or essential features of the claimed subject matter, nor is it intended to be used to limit the scope of the claimed subject matter.

[0007] In one exemplary embodiment, a method for monitoring and controlling data access in a data processing system is provided. In the exemplary embodiment, in response to intercepting a response from a server to a request for information from a client device, a security system agent installed on a server separate from the security system applies pattern matching using a predefined set of sensitive data pattern rules to identify at least one sensitive data access included in the response. In the exemplary embodiment, the security system agent determines whether the at least one sensitive data access matches one or more of the predefined set of sensitive data pattern rules. In the exemplary embodiment, in response to the security system agent matching the at least one sensitive data access with one or more of the predefined set of sensitive data pattern rules, the security system agent modifies the request from the client by marking the at least one sensitive data access as sensitive, thereby forming a modified request. In an exemplary embodiment, a security system agent transmits the modified request along with the at least one marked sensitive data access to the security system, thereby causing the security system to process the modified request without accessing the sensitive data associated with the at least one marked sensitive data access due to the at least one marked sensitive data access in the modified request.

[0008] In another exemplary embodiment, a computer program product is provided having a computer usable medium or computer readable medium having a computer readable program that, when executed on a computing device, causes the computing device to perform various and combinations of the operations outlined above with respect to the exemplary embodiment of the method.

[0009] In yet another exemplary embodiment, a system / apparatus is provided that may include one or more processors and a memory coupled to the one or more processors, the memory including instructions that, when executed by the one or more processors, cause the one or more processors to perform various and combinations of the operations outlined above with respect to the exemplary embodiment of the method.

[0010] These and other features and advantages of the present invention are described in, or will become apparent to those skilled in the art in view of, the following detailed description of the invention and the illustrative embodiments thereof.

[0011] The invention, together with its preferred mode of use and further objects and advantages, will best be understood by reference to the following detailed description of the invention of illustrative embodiments when read in conjunction with the accompanying drawings. [Brief explanation of the drawings]

[0012] [Figure 1] FIG. 1 illustrates a cloud computing node according to one embodiment of the present invention. [Figure 2] FIG. 2 illustrates a cloud computing environment according to one embodiment of the present invention. [Figure 3] FIG. 3 illustrates abstraction model layers according to one embodiment of the present invention. [Figure 4] FIG. 4 illustrates an example functional block diagram of a data access and monitoring and control mechanism according to an exemplary embodiment. [Figure 5] FIG. 5 provides an example of an interaction between a security system and a security system agent, according to an exemplary embodiment. [Figure 6] FIG. 6 illustrates a flowchart showing one example of operations performed by a security system agent in monitoring and controlling data access, according to an exemplary embodiment. [Figure 7]FIG. 7 illustrates a flowchart showing one example of operations performed by a security system in monitoring and controlling data access, according to an exemplary embodiment. DETAILED DESCRIPTION OF THE INVENTION

[0013] Security analysis is the process of using data collection, aggregation, and analysis tools for security monitoring and threat detection. A security system performing data analysis at the transport level may intercept network packets transferred between two instances. This interaction occurs between multiple instances, such as a client and a server. Encryption algorithms render information transferred between these two instances unreadable unless the encryption key is compromised or the encryption type is outdated or flawed. However, when sensitive information is transmitted over a network and processed and stored by a monitoring security system, such sensitive information may be compromised by the security system. Therefore, exemplary embodiments provide a mechanism for implementing sensitive identification via a security system agent before transmitting data to a security system (appliance) for processing. The security system agent is installed on a server monitored by the security system, such as a database server or a service platform.

[0014] Currently, when a client sends a request / query to a server for processing, the request may access sensitive data, such as social security numbers, credit cards, patient records, geolocation coordinates, etc., which is retrieved by the server. A current security system agent intercepts the response to the client, including the original request and the retrieved data, and then transmits the original request and the retrieved data over a network to the security system for processing. Existing methods for processing security policies associated with the accessed data are implemented in the security system. However, such sensitive data is not involved in processing by the security system; therefore, the mechanism of the exemplary embodiment creates an additional layer of security that ensures that the risk of sensitive data being compromised or viewed by someone without appropriate privileges is reduced. That is, the exemplary embodiment provides a mechanism for identifying access to sensitive data at the server before it is transmitted to the security system. In one embodiment, access to sensitive data is identified by a security system agent in the original request, and the sensitive data is not transmitted to the security system. Additionally, the security system uses the identification of access to sensitive data identified in the response to detect data access violations. In one embodiment, a machine learning model may be used to identify objects in modified requests sent to the security system as "security sensitive" and therefore added to a list of sensitive objects.

[0015] Before beginning the discussion of various aspects of the exemplary embodiments and the improved computer operations performed by the exemplary embodiments, it should first be understood that throughout this detailed description of the present invention, the term "mechanism" will be used to refer to elements of the present invention that perform various operations, functions, etc. As used herein, the term "mechanism" may be an implementation of a function or aspect of the exemplary embodiments in the form of an apparatus, a procedure, or a computer program product. In the case of a procedure, the procedure is implemented by one or more devices, apparatus, computers, data processing systems, etc. In the case of a computer program product, the logic represented by computer code or instructions embodied in or on the computer program product is executed by one or more hardware devices to implement the function or perform the operations associated with the particular "mechanism." Thus, the mechanisms described herein may be implemented as specialized hardware, software executing on the hardware, thereby configuring the hardware to implement specialized functionality of the present invention that the hardware could not otherwise perform, such that software instructions are readily executable by the hardware, thereby specifically configuring the hardware to perform the described functionality and specific computer operations, or procedures or methods for performing the functionality, or any combination of the above, described herein.

[0016] The description and claims may use the words "a," "a," "at least one," and "one or more" in reference to particular features and elements of exemplary embodiments. It should be understood that these words and phrases are intended to state that there is at least one of a particular feature or element present in a particular exemplary embodiment, but that there can also be a plurality. That is, these words / phrases are not intended to limit the description or claims to a single feature / element present or to require that a plurality of such features / elements be present. To the contrary, these words / phrases require only at least a single feature / element, and there can be a plurality of such features / elements within the description and claims.

[0017] Furthermore, when used herein in connection with describing embodiments and features of the present invention, it should be understood that the use of the term "engine" is not intended to limit any particular implementation to accomplish and / or perform actions, steps, processes, etc., e.g., actions, steps, processes, etc., resulting from or performed by the engine, or a combination thereof. An engine may be, but is not limited to, software, hardware, or firmware, or a combination thereof, that performs a particular function, including, but not limited to, the use of a processor, general or specialized, or a combination thereof, in combination with appropriate software that is loaded or stored in machine-readable memory and executed by the processor. Furthermore, any name associated with a particular engine is for convenience of reference, unless otherwise specified, and is not intended to limit the specific implementation. In addition, any functionality attributed to an engine may be equally performed by multiple engines, incorporated into or combined with the functionality of another engine of the same or different type, or both, or distributed across one or more engines in various configurations.

[0018] In addition, it should be understood that the following description uses multiple different examples of various elements of the exemplary embodiments to further illustrate exemplary implementations of the exemplary embodiments and to aid in understanding the mechanisms of the exemplary embodiments. These examples are intended to be non-limiting and do not exhaust the various possibilities for implementing the mechanisms of the exemplary embodiments. In light of this description, it will be apparent to those skilled in the art that there are many other alternative implementations for these various elements that could be used in addition to or in place of the examples provided herein without departing from the spirit and scope of the present invention.

[0019] Accordingly, the exemplary embodiments may be utilized in many different types of data processing environments. To provide a context for the description of certain elements and functionality of the exemplary embodiments, Figures 1-3 are provided herein below as exemplary environments in which aspects of the exemplary embodiments may be implemented. It should be understood that Figures 1-3 are merely examples, and are not intended to assert or imply any limitation with regard to the environments in which aspects or embodiments of the present invention may be implemented. Many modifications to the depicted environments may be made without departing from the spirit and scope of the present invention.

[0020] Although this disclosure includes detailed descriptions related to cloud computing, it should be understood that implementation of the teachings recited herein is not limited to a cloud computing environment. Rather, embodiments of the present invention can be implemented in conjunction with any other type of computing environment now known or later developed.

[0021] Cloud computing is a service delivery model for enabling convenient, on-demand network access to a shared pool of configurable computing resources (e.g., networks, network bandwidth, servers, processing, memory, storage, applications, virtual machines, and services) that can be rapidly provisioned and released with minimal administrative effort or interaction with the service provider. The cloud model can include at least five characteristics, at least three service models, and at least four deployment models.

[0022] The features are as follows:

[0023] On-demand self-service: Cloud consumers can unilaterally provision computing capacity, such as server time and network storage, as needed without the need for human interaction with the provider of the service.

[0024] Broad network access: Functionality is available over the network and accessed via standard mechanisms that facilitate use by heterogeneous thin or thick client platforms (e.g., mobile phones, laptops, and PDAs).

[0025] Resource Pooling: A provider's computing resources are pooled to serve multiple consumers using a multi-tenant model, and various physical and virtual resources are dynamically allocated and reallocated according to demand. Consumers generally have no control or knowledge of the exact location of the provided resources, but are said to be location-independent in that they may be able to identify a location at a higher level of abstraction (e.g., country, state, or data center).

[0026] Rapid Elasticity: Capabilities can be quickly and elastically provisioned, sometimes automatically, quickly scaled out, quickly released and quickly scaled in. To the consumer, the capabilities available for provisioning are often unlimited and can be purchased in any quantity at any time.

[0027] Measured Services: Cloud systems automatically control and optimize resource usage by using metering capabilities at some level of abstraction appropriate to the type of service (e.g., storage, processing, bandwidth, and active user accounts). Resource usage can be monitored, controlled, and reported, providing transparency to both providers and consumers of the services being used.

[0028] The service model is as follows:

[0029] Software as a Service (SaaS): The ability to offer consumers the ability to use a provider's applications running on a cloud infrastructure. The applications are accessible from a variety of client devices through a thin-client interface, such as a web browser (e.g., web-based email). The consumer does not manage or control the underlying cloud infrastructure, including the network, servers, operating systems, storage, or even individual application functions, with the possible exception of limited user-specific application configuration settings.

[0030] Platform as a Service (PaaS): The capability offered to a consumer to deploy consumer-created or acquired applications, created using programming languages and tools supported by the provider, onto a cloud infrastructure. The consumer does not manage or control the underlying cloud infrastructure, including the network, servers, operating systems, or storage, but does have control over the deployed applications and, in some cases, the application-hosting environment configuration.

[0031] Infrastructure as a Service (IaaS): The capability offered to consumers to provision processing, storage, network, and other basic computing resources on which they can deploy and run any software, which may include operating systems and applications. The consumer does not manage or control the underlying cloud infrastructure, but does have control over the operating system, storage, deployed applications, and in some cases, limited control over the selection of network components (e.g., host firewalls).

[0032] The deployment models are as follows:

[0033] Private Cloud: Cloud infrastructure is operated exclusively for an organization. The cloud infrastructure may be managed by the organization or a third party, and may reside on-premises or off-premises.

[0034] Community Cloud: Cloud infrastructure is shared by several organizations and supports a specific community with common concerns (e.g., mission, security requirements, policies, and compliance considerations). The cloud infrastructure may be managed by the organizations or a third party and may reside on-premises or off-premises.

[0035] Public Cloud: Cloud infrastructure is available to the general public or large industry groups and is owned by organizations that sell cloud services.

[0036] Hybrid Cloud: A cloud infrastructure is a blend of two or more clouds (private, community, or public) that remain unique entities but are brought together by standardized or proprietary technologies that enable data and application portability (e.g., cloud bursting for load balancing between clouds).

[0037] A cloud computing environment is service oriented with a focus on statelessness, low coupling, modularity, and semantic interoperability. At the heart of cloud computing is an infrastructure comprising a network of interconnected nodes.

[0038] 1, a schematic diagram of an example cloud computing node is shown. Cloud computing node 100 is merely one example of a suitable cloud computing node and is not intended to suggest any limitation as to the scope of use or functionality of the embodiments of the present invention described herein. Regardless, cloud computing node 100 may be implemented or perform, or may be implemented and perform, any of the functions described above.

[0039] Within cloud computing node 100 is computer system / server 102, which operates in many other general-purpose or special-purpose computing system environments or configurations. Examples of well-known computing systems, environments, or configurations, or combinations thereof, that may be suitable for use with computer system / server 102 include, but are not limited to, personal computer systems, server computer systems, thin clients, thick clients, handheld or laptop devices, multiprocessor systems, microprocessor-based systems, set-top boxes, programmable consumer electronics, network PCs, minicomputer systems, mainframe computer systems, and distributed cloud computing environments that include any of the above systems or devices.

[0040] The computer system / server 102 may be described in the general context of computer system-executable instructions, such as program modules, executed by a computer system. Generally, program modules may include routines, programs, objects, components, logic, data structures, etc. that perform particular tasks or implement particular abstract data types. The computer system / server 102 may be practiced in distributed cloud computing environments where tasks are performed by remote processing devices that are linked through a communications network. In a distributed cloud computing environment, program modules may be located in both local and remote computer system storage media including, for example, memory storage devices.

[0041] 1, computer system / server 102 within cloud computing node 100 is shown in the form of a general-purpose computing device. Components of computer system / server 102 may include, but are not limited to, one or more processors or processing units 104, system memory 106, and a bus 108 connecting various system components, including system memory 106, to processor 104.

[0042] Bus 108 may represent any one or more of several types of bus structures, including a memory bus or memory controller, a peripheral bus, an accelerated graphics port, and a processor or local bus using any of a variety of bus architectures. By way of example, and without limitation, such architectures include an Industry Standard Architecture (ISA) bus, a Micro Channel Architecture (MCA) bus, an Enhanced ISA (EISA) bus, a Video Electronics Standards Association (VESA) local bus, and a Peripheral Component Interconnect (PCI) bus.

[0043] Computer system / server 102 typically includes a variety of computer system-readable media. Such media can be any available media that can be accessed by computer system / server 102 and includes both volatile and nonvolatile media, removable and non-removable media.

[0044] The system memory 106 may include computer system-readable media in the form of volatile memory, such as random access memory (RAM) 110 or cache memory 112, or a combination thereof. The computer system / server 102 may further include other removable / non-removable, volatile / non-volatile computer system storage media. By way of example only, the storage system 114 may provide for reading from and writing to a non-removable, non-volatile magnetic medium (not shown, typically referred to as a "hard drive"). Although not shown, a magnetic disk drive may be provided for reading from and writing to a removable, non-volatile magnetic disk (e.g., a "floppy disk"), and an optical disk drive may be provided for reading from or writing to a removable, non-volatile optical disk, such as a CD-ROM, DVD-ROM, or other optical media. In such cases, each may be connected to the bus 108 by one or more data media interfaces. As further depicted and described below, the memory 106 may include at least one program product having a set (e.g., at least one) program module configured to perform the functions of an embodiment of the present invention.

[0045] By way of example and not limitation, a program / utility 116 having a set (e.g., at least one) program module 118, as well as an operating system, one or more application programs, other program modules, and program data, may be stored in memory 106. Each of the operating system, one or more application programs, other program modules, and program data, or some combination thereof, may comprise an implementation of a networking environment. The program modules 42 generally perform the functions or methodologies, or combinations thereof, of embodiments of the present invention described herein.

[0046] The computer system / server 102 may also communicate with one or more external devices 120, such as a keyboard, pointing device, display 122, one or more devices that allow a user to interact with the computer system / server 102, or any device (e.g., a network card, modem, etc.) that allows the computer system / server 102 to communicate with one or more other computing devices, or combinations thereof. Such communication may occur via an input / output (I / O) interface 124. Furthermore, the computer system / server 102 may communicate with one or more networks, such as a local area network (LAN), a general wide area network (WAN), or a public network (e.g., the Internet), or combinations thereof, via a network adapter 126. As shown, the network adapter 126 communicates with other components of the computer system / server 102 via a bus 108. It should be understood that, although not shown, other hardware or software components, or combinations thereof, may be used in conjunction with the computer system / server 102. Examples include, but are not limited to, microcode, device drivers, redundant processing units, external disk drive arrays, RAID systems, tape drives, and data archive storage systems.

[0047] Referring now to FIG. 2, an exemplary cloud computing environment 200 is shown. As shown, the cloud computing environment 200 includes one or more cloud computing nodes 202 with which local computing devices used by cloud consumers, such as a personal digital assistant (PDA) or mobile phone 204, a desktop computer 206, a laptop computer 208, or an automobile computer system 210, or any combination thereof, may communicate. The cloud computing nodes 202 may communicate with each other. They may be physically or virtually grouped into one or more networks (not shown), such as a private cloud, community cloud, public cloud, or hybrid cloud, or any combination thereof, as described above. This allows the cloud computing environment 200 to provide infrastructure, platform, or software, or any combination thereof, as a service without the cloud consumer having to maintain resources on their local computing device. The types of computing devices 204-210 shown in FIG. 2 are intended to be illustrative only, and it will be understood that computing node 202 and cloud computing environment 200 can communicate with any type of computerized device via any type of network or network-addressable connection (e.g., using a web browser) or combination thereof.

[0048] Referring now to Figure 3, there is shown a set of functional abstraction layers provided by a cloud computing environment, such as cloud computing environment 200 of Figure 2. It should be understood in advance that the components, layers, and functions shown in Figure 3 are intended to be illustrative only, and that embodiments of the present invention are not limited thereto. As shown, the following layers and corresponding functions are provided:

[0049] The hardware and software layer 302 includes hardware and software components. Examples of hardware components include mainframes, such as IBM® zSeries® systems, servers based on RISC (reduced instruction set computer) architecture, such as IBM® pSeries® systems, IBM® xSeries® systems, and IBM® BladeCenter® systems, storage devices, and networks and networking components. Examples of software components include network application server software, such as IBM® WebSphere® application server software, and database software, such as IBM® DB2® database software. (IBM®, zSeries®, pSeries®, xSeries®, BladeCenter®, WebSphere®, and DB2® are trademarks of International Business Machines Corporation, registered in many jurisdictions worldwide.)

[0050] The virtualization layer 304 provides an abstraction layer over which the following examples of virtual entities can be provided: virtual servers; virtual storage; virtual networks, including virtual private networks, for example; virtual applications and operating systems; and virtual clients.

[0051] In one example, the management layer 306 may provide the functions described below: Resource provisioning provides dynamic procurement of computing and other resources utilized to execute tasks within the cloud computing environment. Metering and pricing tracks costs as resources are utilized within the cloud computing environment and invoices or bills for the consumption of these resources. In one example, these resources may include application software licenses. Security provides identity verification of cloud consumers and tasks, as well as protection of data and other resources. A user portal provides access to the cloud computing environment for consumers and system administrators. Service level management provides allocation and management of cloud computing resources so that required service levels are met. Service level agreement (SLA) planning and fulfillment provides proactive provisioning and procurement of cloud computing resources in anticipation of future requirements according to SLAs.

[0052] The workload layer 308 provides examples of functions for which a cloud computing environment may be utilized. Examples of workloads and functions that may be provided from this layer include mapping and navigation, software development and lifecycle management, virtual classroom education provision, data analysis processing, transaction processing, and security system agents. According to an exemplary embodiment, a security system agent, which may be implemented in the illustrated cloud computing environment or in any other type of computing environment now known or later developed, monitors access to sensitive information. That is, a client provides a predefined set of sensitive data pattern rules to the security system. At startup, the security system determines whether a security system agent exists on a database server, service platform, etc. (hereinafter simply referred to as a server) accessed by the client. If so, the security system sends the predefined set of sensitive data pattern rules to the security system agent on the server.

[0053] Subsequently, when a client sends a request for information, which may include multiple different accesses, the server retrieves data associated with each access and generates a response including each access and the retrieved data associated with each access, where the retrieved data associated with a particular access may be either confidential or non-confidential. Before the response is returned to the client, a security system agent running on the server intercepts the response and applies pattern matching using a predefined set of confidential data pattern rules to identify confidential data included in the response that matches the predefined set of confidential data pattern rules, such as credit card numbers, social security numbers, passwords, patient records, or geolocation coordinates. According to an exemplary embodiment, the security system agent is installed in the server's operating system kernel. In applying the pattern matching, the security system agent modifies the original request from the client before the original request is sent to the security system, where if the security system agent identifies any sensitive data that matches one or more of the predefined set of sensitive data pattern rules, the security system agent marks the accesses in the original request that accessed the sensitive data as sensitive. The security system agent then returns the original response generated by the server, including each access and the retrieved data associated with each access, to the client, and sends the modified request to the security system along with marked accesses associated with accesses to sensitive data and unmarked accesses associated with accesses to non-sensitive data. Thus, according to an exemplary embodiment, the security system agent identifies accesses to sensitive data and marks the accesses in the modified request as having accessed sensitive information.

[0054] When the security system receives the modified request sent by the security system agent, it recognizes the modified request as security-sensitive because of the marked access identification. The security system then processes the modified request without accessing any sensitive data. That is, the security system analyzes the objects in each access using a filter that identifies the marking from the security system agent and processes each access. Furthermore, for any marked objects, the security system analyzes any objects associated with the access that were marked by the security system agent as being accesses to sensitive data. The security system extracts the objects and adds them to a list of sensitive objects as objects containing sensitive data.

[0055] In this example, adding the object to the list of sensitive objects is straightforward, but not all objects identified as sensitive are immediately added to the list of sensitive objects. Taking the previous example a step further, two additional requests are received: a first request with a combined set of objects, including a first object already marked as sensitive and a second object marked as sensitive because it is combined with the first object; and a second request with an object that matches the second object in the first request, but that has not been marked as sensitive by the security system agent. However, in the first of the two additional requests, the second object is only identified as sensitive because it is combined with the first object, which is known to be sensitive, resulting in a false positive for a non-sensitive object. Thus, the security system filters out any such objects that are falsely identified as sensitive simply because they are linked to another object that is identified as sensitive. After the security system filters out any "false positives," if any, any remaining security-critical objects not already included in the list of sensitive objects are added to the list of sensitive objects, which are subsequently used by the security system as the basis for implementing one or more security policies.

[0056] Those skilled in the art will appreciate that the hardware in Figures 1-3 may vary depending on the implementation. Other internal hardware or peripheral devices, such as flash memory, equivalent non-volatile memory, or optical disk drives, may be used in addition to or in place of the hardware depicted in Figures 1-3. Additionally, the methods of the exemplary embodiments may be applied to multiprocessor data processing systems other than the SMP system described above without departing from the spirit and scope of the present invention.

[0057] FIG. 4 illustrates an example functional block diagram of a data access and monitoring and control mechanism according to an exemplary embodiment. Data processing system 400 includes a server 402 that accesses a security system 404 to obtain information in the form of analysis, reports, alerts, etc. As previously described, server 402 and security system 404 may be implemented in a cloud computing environment, such as cloud computing environment 200 of FIG. 2, or in any other type of computing environment now known or later developed. Initially, a client 406 establishes an account with security system 404, which includes client 406 providing a predefined set of sensitive data pattern rules 408 to security system 404. Next, upon system startup, security system 404 determines whether a security system agent 410 exists on server 402. If so, security system 404 sends the predefined set of sensitive data pattern rules 408 to security system agent 410 on server 402.

[0058] Subsequently, when a client 406 sends a request for information to the server 402, which may include multiple different accesses, the server 402 retrieves data associated with each access and generates a response including each access and the retrieved data associated with each access, where the retrieved data associated with a particular access may be either sensitive or non-sensitive. Before the response generated by the server 402 is returned to the client 406, a security system agent 410 applies pattern matching using the predefined set of sensitive data pattern rules 408 to identify sensitive data, if any, included in the response that matches the predefined set of sensitive data pattern rules 408, such as credit card numbers, social security numbers, passwords, patient records, geolocation coordinates, etc. In applying the pattern matching, security system agent 410 modifies the original request from client 406 before the original request is sent to security system 404, such that if security system agent 410 identifies accesses to sensitive data that match one or more of the predefined set of sensitive data pattern rules 408, if any, security system agent 410 marks the accesses that accessed the sensitive data in the original request as sensitive. Security system agent 410 then allows the original response generated by server 402, including each access and search data associated with each access, to be returned to client 406, and forwards the modified request to security system 404, along with the marked accesses associated with accesses to the sensitive data and the unmarked accesses associated with accesses to non-sensitive data. That is, after identifying at least one access to sensitive data in the response, security system agent 410 marks the accesses in the original request as having accessed sensitive information in the original request sent to security system 404, thereby forming a modified request.

[0059] When security system 404 receives the modified request sent by security system agent 410, security system 404 recognizes the modified request as security-sensitive because of the marked access identification. Security system 404 then processes the modified request without accessing sensitive data, if any. That is, security system 404 analyzes the objects in each access using a filter that identifies the marking from security system agent 410 and processes each access. Furthermore, for marked objects, security system 404 analyzes the objects, if any, associated with the access that were marked by security system agent 410 as accessing sensitive data. Security system 404 extracts the objects and adds them to list of sensitive objects 420 as objects containing sensitive data. Additionally, security system 404 uses list of sensitive objects 420 as a basis for implementing security policies or other information 418 (e.g., analysis 412, report 414, alert 416, or other information 418 related to the sensitive data accessed, and objects added to list of sensitive objects 420, etc.), or a combination thereof. For example, security system 404 uses the identification of access to sensitive data identified in the modified request to detect data access violations.

[0060] In this example, adding the object to the list of sensitive objects 420 is straightforward, but not all objects identified as sensitive are immediately added to the list of sensitive objects 420. That is, taking the previous example a step further, two additional requests are received: a first request having a combined set of objects, including a first object that is already marked as sensitive and a second object that is marked as sensitive because it is combined with the first object; and a second request having an object that matches the second object of the first request, but that has not been marked as sensitive by security system agent 410. However, in the first of the two additional requests, the second object is only identified as sensitive because it is combined with the first object, which is known to be sensitive, resulting in a false positive for a non-sensitive object. In the second of the two add requests, security system 404, e.g., through machine learning techniques, rule engine applications, etc., identifies the requested object, e.g., the second object, to be a false positive because the second object was not marked as sensitive by the security system agent. Thus, the security system filters out any such objects that were erroneously identified as sensitive simply because they are connected to another object that has been identified as sensitive. After security system 404 filters out any "false positives," if any, security system 404 adds any remaining security-critical objects, if any, that are not already included in list of sensitive objects 420 to list of sensitive objects 420.

[0061] FIG. 5 provides an example of interaction between a security system and a security system agent, according to an exemplary embodiment. As shown, security system 502 receives a predefined set of sensitive data pattern rules. Security system 502 sends the predefined set of sensitive data patterns to security system agent 504, which resides on a server. Security system agent 504 monitors client / server responses, applies the predefined set of sensitive data pattern rules, and marks sensitive accesses in the original request from the client. Security system agent 504 then sends the modified request to security system 502, where the modified request includes the marked sensitive data accesses (if any). Security system 502 then parses the modified request and extracts all objects. Security system 502 filters out non-sensitive objects, if any, and adds new sensitive objects, if any, to the list of sensitive objects.

[0062] Thus, the exemplary embodiment provides a mechanism to implement pattern masking of data identified by a user as sensitive before sending this data to the security system (appliance) for processing via a security system agent that is installed on a server monitored by the security system, e.g., a database server, a service platform, etc.

[0063] The present invention may be a system, method, or computer program product, or any combination thereof, which may include one or more computer-readable storage media having computer-readable program instructions for causing a processor to perform aspects of the present invention.

[0064] The computer-readable storage medium can be a tangible device capable of holding and storing instructions for use by an instruction execution device. The computer-readable storage medium can be, for example, but not limited to, an electronic storage device, a magnetic storage device, an optical storage device, an electromagnetic storage device, a semiconductor storage device, or any suitable combination thereof. A non-exhaustive list of more specific examples of computer-readable storage media includes the following: a portable computer diskette, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), a static random access memory (SRAM), a portable compact disc read-only memory (CD-ROM), a digital versatile disk (DVD), a memory stick, a floppy disk, a mechanically encoded device such as a punch card or a ridge structure in a groove in which instructions are recorded, or any suitable combination thereof. As used herein, a computer-readable storage medium should not be construed as a transitory signal per se, such as an electric wave or other freely propagating electromagnetic wave, an electromagnetic wave propagating through a waveguide or other transmission medium (e.g., a light pulse passing through a fiber optic cable), or an electrical signal transmitted over an electrical wire.

[0065] The computer-readable program instructions described herein can be downloaded from a computer-readable storage medium to an individual computing device / processing device or to an external computer or external storage device via a network, such as the Internet, a local area network, a wide area network, or a wireless network, or a combination thereof. The network may be comprised of copper transmission cables, fiber optic transmission cables, wireless transmissions, routers, firewalls, switches, gateway computers, or edge servers, or a combination thereof. A network adapter card or network interface in each computing device / processing device receives the computer-readable program instructions from the network and transmits the computer-readable program instructions to the individual computing device / processing device for storage in a computer-readable storage medium.

[0066] The computer-readable program instructions for carrying out operations of the present invention may be either assembler instructions, instruction-set-architecture (ISA) instructions, machine instructions, machine-dependent instructions, microcode, firmware instructions, state-setting data, configuration data for an integrated circuit, or source or object code written in any combination of one or more programming languages, such as object-oriented programming languages (e.g., Java, Smalltalk, C++, etc.), conventional procedural programming languages (e.g., the "C" programming language or similar programming languages), etc. The computer-readable program instructions may be executed entirely on a user's computer, partially on a user's computer, partially on a user's computer as a stand-alone software package, partially on a user's computer and partially on a remote computer, or entirely on a remote computer or server. In the latter scenario, the remote computer may be connected to the user's computer via any type of network, such as a local area network (LAN) or a wide area network (WAN), or the connection may be to an external computer (e.g., over the Internet using an Internet Service Provider). In some embodiments, electronic circuits, such as programmable logic circuits, field-programmable gate arrays (FPGAs), or programmable logic arrays (PLAs), may execute computer-readable program instructions by utilizing state information of the computer-readable program instructions to personalize the electronic circuit to perform aspects of the invention.

[0067] Aspects of the present invention are described herein with reference to flowchart illustrations or block diagrams, or combinations thereof, of methods, apparatus (systems), and computer program products according to embodiments of the invention. It will be understood that each block of the flowchart illustrations or block diagrams, or combinations thereof, and combinations of blocks in the flowchart illustrations or block diagrams, or combinations thereof, can be implemented by computer-readable program instructions.

[0068] These computer-readable program instructions may be provided to a processor of a computer or other programmable data processing apparatus, such that the instructions, executing on the processor of the computer or other programmable data processing apparatus, generate means for implementing the functions / acts identified in one or more blocks of the flowcharts or block diagrams, or combinations thereof, to produce a machine. These computer-readable program instructions may also be stored in a computer-readable storage medium that can direct a computer-programmable data processing apparatus or other device, or combinations thereof, to function in a particular manner, such that the computer-readable storage medium having stored thereon instructions includes an article of manufacture containing instructions that implement aspects of the functions / acts identified in one or more blocks of the flowcharts or block diagrams, or combinations thereof.

[0069] The computer-readable program instructions may also be loaded onto a computer, other programmable data processing apparatus, or other device such that the instructions, which execute on the computer, other programmable data processing apparatus, or other device, implement the functions / operations identified in one or more blocks of the flowcharts or block diagrams, or combinations thereof, causing the computer, other programmable apparatus, or other device to perform a series of operational steps to generate a computer-implemented process.

[0070] 6 illustrates a flowchart showing an example of operations performed by a security system agent when monitoring and controlling data access, according to an exemplary embodiment. When the operation begins, the security system agent receives a predefined set of sensitive data pattern rules from the security system (step 602). In response to intercepting a response containing requested accesses and retrieved data associated with each access from the server on which the security system agent is installed, the security system agent applies pattern matching using the predefined set of sensitive data pattern rules to identify sensitive data contained in the response to the client, such as credit card numbers, social security numbers, passwords, patient records, geolocation coordinates, etc. (step 604). The security system agent determines whether any sensitive data matches one or more of the predefined set of sensitive data pattern rules (step 606). If, in step 606, the security system agent determines that no sensitive data matches the predefined set of sensitive data pattern rules, the security system agent forwards the response to the security system as is (step 608). The process then ends.

[0071] If, in step 606, the security system agent identifies sensitive data that matches one or more of a predefined set of sensitive data pattern rules, the security system agent marks the identified accesses in the original request as sensitive, thereby forming a modified request (step 610). The security system agent then forwards the modified request to the security system, along with the marked accesses associated with accesses to sensitive data and the unmarked accesses associated with accesses to non-sensitive data (step 612). The process then ends.

[0072] 7 illustrates a flowchart showing one example of operations performed by a security system in monitoring and controlling data access, according to an exemplary embodiment. When the operation begins, the security system receives a modified request from a security system agent (step 702). The security system recognizes the modified request as security-sensitive because of the marked access identification (step 704). The security system processes the modified request without accessing sensitive data, if any, by analyzing the objects in each access in the response using a filter that identifies the marking from the security system agent (step 706). The security system then processes the modified request (step 708).

[0073] In addition, the security system extracts objects associated with marked accesses from the modified request (step 710). For each extracted object, the security system determines which object actually accessed sensitive data or which object is linked to an object that accessed sensitive data (step 712). If, in step 712, the object is linked to an object that is an access to sensitive data, the security system filters out the object as a false positive (step 714). If, in step 712, the object is an access to sensitive data, the security system adds the object to the list of sensitive objects (step 716). From steps 714 and 716, the security system uses the list of sensitive objects as the basis for implementing one or more security policies (step 718). The process then ends.

[0074] The flowcharts and block diagrams in the figures illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments of the present invention. In this regard, each block in the flowcharts or block diagrams may represent a module, segment, or portion of instructions, which includes one or more executable instructions for implementing one or more specified logical functions. In some alternative implementations, the functions shown in the blocks may occur out of the order shown in the figures. For example, two blocks shown in succession may actually be accomplished as a single step performed simultaneously, substantially simultaneously, partially, or fully in a time-overlapping manner, depending on the functionality involved, or the blocks may be performed in the reverse order. It should also be noted that each block of the block diagrams or flowchart diagrams or combinations thereof, and combinations of multiple blocks in the block diagrams or flowchart diagrams or combinations thereof, may be implemented by a special-purpose hardware-based system that performs the specified functions or operations, or may execute a combination of special-purpose hardware and computer instructions.

[0075] As noted above, it should be understood that the exemplary embodiments can take the form of an entirely hardware embodiment, an entirely software embodiment, or an embodiment containing both hardware and software elements. In one example embodiment, the mechanisms of the exemplary embodiments are implemented in software or program code, which includes, but is not limited to, firmware, resident software, microcode, etc.

[0076] A data processing system suitable for storing and / or executing program code includes, for example, at least one processor coupled directly or indirectly via a communications bus, e.g., a system bus, to memory elements. The memory elements may include local memory used during the actual execution of the program code, bulk storage, and cache memory that provides temporary storage of at least some program code to reduce the number of times the code must be retrieved from bulk storage during execution. The memory may be of various types, including, but not limited to, ROM, PROM, EPROM, EEPROM, DRAM, SRAM, flash memory, solid-state memory, etc.

[0077] Input / output devices, or I / O devices, (including but not limited to keyboards, displays, pointing devices, etc.) can be connected to the system directly or through intervening wired or wireless I / O interfaces or controllers, or combinations thereof. I / O devices can take many different forms other than conventional keyboards, displays, pointing devices, etc., such as communication devices connected via wired or wireless connections, including but not limited to smartphones, tablet computers, touchscreen devices, voice recognition devices, etc. Any known or later-developed I / O devices are intended to be within the scope of exemplary embodiments.

[0078] Network adapters may also be coupled to the system to enable the data processing system to connect to other data processing systems or remote printers or storage devices through intervening private or public networks. Modems, cable modems, and Ethernet cards are just a few of the network adapters currently available for wired communications. Wireless communication-based network adapters may also be utilized, including, but not limited to, 802.11a / b / g / n wireless communication adapters, Bluetooth® wireless adapters, and the like. Any known or later-developed network adapter is intended to be within the spirit and scope of the present invention.

[0079] The descriptions of various embodiments of the present invention are presented for illustrative purposes but are not intended to be exhaustive or to be limited to the disclosed embodiments. Similarly, examples of features or functions of embodiments of the present disclosure described herein, whether used in describing a particular embodiment or described as an example, are not intended to limit the embodiments of the present disclosure described herein or to limit the disclosure to the examples described herein. Many modifications and variations will be apparent to those skilled in the art without departing from the scope and spirit of the described embodiments. The terms used herein have been selected to explain the principles of the embodiments, practical applications or technical improvements to commercially available technology, or to enable those skilled in the art to understand the embodiments disclosed herein.

Claims

1. 1. A method for monitoring and controlling data access in a data processing system, comprising: In response to intercepting a response from the server to a request for information from a client device, a security system agent installed on a server separate from the security system applies pattern matching using a predefined set of sensitive data pattern rules to identify at least one sensitive data access included in the response; the security system agent determining whether the at least one sensitive data access matches one or more of the predefined set of sensitive data pattern rules; In response to the at least one sensitive data access matching one or more of the predefined set of sensitive data pattern rules, the security system agent modifies the request from the client by marking the at least one sensitive data access as sensitive, thereby forming a modified request; and the security system agent sending the modified request along with the at least one marked sensitive data access to the security system, thereby causing the security system to process the modified request without accessing sensitive data associated with the at least one marked sensitive data access due to the at least one marked sensitive data access in the modified request. The method comprising:

2. 2. The method of claim 1, wherein the predefined set of sensitive data pattern rules is received from the security system and the predefined set of sensitive data pattern rules is initially identified by a user of the client device.

3. in response to the security system receiving the modified request along with the at least one marked sensitive data access from the security system agent; the security system extracting from the modified request all objects associated with each access; the security system filtering out at least one object identified as a false positive; and The security system adds the remaining objects, if any, to a list of sensitive objects. The method of claim 1 or 2, further comprising:

4. filtering out at least one object identified as a false positive; the security system determining whether the at least one object is identified as a sensitive object because the at least one object is coupled to another object that accesses sensitive data; and and in response to the at least one object being identified as the sensitive object because the at least one object is coupled to another object that accesses sensitive data, the security system filters out the at least one object as a false positive. The method of claim 3, comprising:

5. The security system uses a list of sensitive objects as a basis for implementing one or more security policies. The method of claim 3 further comprising:

6. The method of any one of claims 1 to 5, wherein the at least one sensitive data access is access to one or more of a credit card number, a social security number, a password, a patient record, or geolocation coordinates.

7. and in response to transmitting the modified request with the at least one marked sensitive data access to the security system, the security system agent is permitted to return a response to the client including obtained data associated with each access. The method of any one of claims 1 to 6, further comprising:

8. A computer program for monitoring and controlling data access, which, when executed on a device security system agent installed on a server separate from the security system, In response to intercepting a response from the server to a request for information from a client device, applying pattern matching using a predefined set of sensitive data pattern rules to identify at least one sensitive data access included in the response; determining whether the at least one sensitive data access matches one or more of the predefined set of sensitive data pattern rules; modifying the request from the client by marking the at least one sensitive data access as sensitive in response to the at least one sensitive data access matching one or more of the predefined set of sensitive data pattern rules, thereby forming a modified request; and Sending the modified request along with the at least one marked sensitive data access to the security system, thereby causing the security system to process the modified request without accessing sensitive data associated with the at least one marked sensitive data access due to the at least one marked sensitive data access in the modified request. The computer program causes a computing device to execute the above.

9. 9. The computer program product of claim 8, wherein the predefined set of sensitive data pattern rules is received from the security system and wherein the predefined set of sensitive data pattern rules is initially identified by a user of the client device.

10. In response to the security system receiving the modified request with the at least one marked sensitive data access from the device security system agent, the security system: Extracting all objects associated with each access from the modified request; filtering out at least one object identified as a false positive; and If so, add the remaining objects to the list of sensitive objects.

10. A computer program according to claim 8 or 9.

11. filtering out at least one object identified as a false positive by the security system; determining whether the at least one object is identified as a sensitive object because the at least one object is coupled to another object that accesses sensitive data; and filtering out at least one object as a false positive in response to the at least one object being identified as the sensitive object because the at least one object is coupled to another object that accesses sensitive data. The computer program product of claim 10, which causes the security system to:

12. 11. The computer program product of claim 10, wherein the security system is further operative to use the list of sensitive objects as criteria for implementing one or more security policies.

13. 13. The computer program product of claim 8, wherein the at least one sensitive data access is access to one or more of a credit card number, a social security number, a password, a patient record, or geolocation coordinates.

14. and in response to transmitting the modified request with the at least one marked sensitive data access to the security system, being allowed to return a response to the client including the obtained data associated with each access. The computer program according to any one of claims 8 to 13, which causes the computing device to execute the following:

15. A security system agent device installed on a server separate from the security system for monitoring and controlling data access, a processor, and a memory coupled to the processor It is equipped with When executed by the processor, In response to intercepting a response from the server to a request for information from a client device, applying pattern matching using a predefined set of sensitive data pattern rules to identify at least one sensitive data access included in the response; determining whether the at least one sensitive data access matches one or more of the predefined set of sensitive data pattern rules; modifying the request from the client by marking the at least one sensitive data access as sensitive in response to the at least one sensitive data access matching one or more of the predefined set of sensitive data pattern rules, thereby forming a modified request; and Sending the modified request along with the at least one marked sensitive data access to the security system, thereby causing the security system to process the modified request without accessing sensitive data associated with the at least one marked sensitive data access due to the at least one marked sensitive data access in the modified request. The security system agent device, wherein the memory contains instructions that cause the processor to perform.

16. 16. The security system agent appliance of claim 15, wherein the predefined set of sensitive data pattern rules is received from the security system and wherein the predefined set of sensitive data pattern rules is initially identified by a user of the client device.

17. In response to the security system receiving a separate request from the security system agent along with the at least one marked sensitive data access, the security system: Extracting all objects associated with each access from the modified request; filtering out at least one object identified as a false positive; and If so, add the remaining objects to the list of sensitive objects.

17. A security system agent device according to claim 15 or 16.

18. the security system filtering out the at least one object identified as a false positive; determining whether the at least one object is identified as a sensitive object because the at least one object is coupled to another object that accesses sensitive data; and filtering out at least one object as a false positive in response to the at least one object being identified as the sensitive object because the at least one object is coupled to another object that accesses sensitive data.

20. The security system agent device of claim 17, wherein the security system agent device performs the following:

19. 19. A security system agent device according to claim 17 or 18, wherein the security system is further operative to use the list of sensitive objects as criteria for implementing one or more security policies.

20. The instruction: and permitting, in response to sending the modified request with the at least one marked sensitive data access to the security system, a response including obtained data associated with each access to be returned to the client. The security system agent device according to any one of claims 15 to 19, wherein the security system agent device is caused to perform the following.

Images