US 10,097,582 B2 · Secure data redaction and masking in intercepted data interactions

Abstract

A system, and computer program product for modifying intercepted data interactions are provided in the illustrative embodiments. At a security application executing in a security data processing system, an intercepted packet of data arranged according to a protocol is received from an intercepting agent executing in an intercepting data processing system. A security policy is applied to the intercepted packet. In an instruction according to a coding grammar, a modification of the intercepted packet is encoded. The instruction is suited for the encoding under a circumstance of the modifying. The instruction is sent to the intercepting agent. The intercepting agent at the intercepting data processing system performs the modification according to the security policy and independently of the protocol.

Drawings

Claims7

Dependent claims

A computer usable program product for use with a security data processing system and an intercepting data processing system that is a separate structure from the security data processing system, the product comprising:

a computer readable storage device;
and
computer usable code stored in the computer readable storage device;
wherein the computer usable code includes code for:
receiving, by the security data processing system and from an intercepting agent executing in the intercepting data processing system, an intercepted packet;
applying, by the security data processing system, a security policy to the intercepted packet to determine whether data of the intercepted packet is non-compliant with a set of security policy(ies);
receiving, by the security data processing system, an indication of a network condition and a plurality of coding grammars, the indication of the network condition including a network traffic throughput metric, wherein the selected coding grammar comprises a representation of a combination of an operation and a data fragment, the combination being positioned at a position in the intercepted packet;
selecting, by the security data processing system, a selected coding grammar from the plurality of coding grammars based, at least in part, upon the network traffic throughput metric;
responsive to a determination that data of the intercepted packet is non-compliant with a set of security policy(ies), generating, by the security data processing system and according to the selected coding grammar, an instruction designed to cause a modification of the intercepted packet to make a revised packet that is compliant with the set of security policy(ies);
and
sending the instruction from the security data processing system to the intercepting agent.

8 more elements

A computer system comprising:

an intercepting data processing sub-system;
and
a security data processing system;
wherein the security data processing sub-system is structured, programmed and connected in data communication to:
receive, from an intercepting agent executing in the intercepting data processing sub-system, an intercepted packet,
apply a security policy to the intercepted packet to determine whether data of the intercepted packet is non-compliant with a set of security policy(ies),
receive an indication of a network condition and a plurality of coding grammars, the indication of the network condition including a network traffic throughput metric,
select a selected coding grammar from the plurality of coding grammars based, at least in part, upon the network traffic throughput metric, wherein the selected coding grammar comprises a representation of a combination of an operation and a data fragment, the combination being positioned at a position in the intercepted packet;
responsive to a determination that data of the intercepted packet is non-compliant with a set of security policy(ies), generate, according to the selected coding grammar, an instruction designed to cause a modification of the intercepted packet to make a revised packet that is compliant with the set of security policy(ies), and
send the instruction to the intercepting agent;
and
wherein the intercepting data processing sub-system is structured, programmed and connected in data communication to apply, by the intercepting agent, the instruction received from the security data processing sub-system to modify a copy of the intercepted packet according to the instruction whereby the copy of the intercepted packet is compliant with the set of security policy(ies).

9 more elements

Dependencies are inferred from the claim text.

Description10,103 words

Summary506 words

#The present invention relates generally to a system, and computer program product for ensuring security compliance of inter-system transactions. More particularly, the present invention relates to a system, and computer program product for secure data redaction and masking in intercepted data interactions.

#A data processing system (system) interacts with another data processing system using a data network. Generally, during the interaction, one of the systems sends data, which the other system receives. The interacting systems exchange data in this manner any number of times, in any suitable form, and in any suitable sequence.

#A request-response transaction is an example of data interactions between two or more systems. For example, one system (requesting system) can send data in the form of a request message. The other system (responding system) receives the data of the request message. The responding system sends data of the information requested in the request message. The requesting system receives the data of the requested information. Many request-response transactions can occur in this manner between the requesting system and the responding system. Generally, the requesting role and the responding role are specific to a transaction, and can reverse in another transaction.

Brief description of the drawings12 figures

#The novel features believed characteristic of the invention are set forth in the appended claims. The invention itself, however, as well as a preferred mode of use, further objectives and advantages thereof, will best be understood by reference to the following detailed description of the illustrative embodiments when read in conjunction with the accompanying drawings, wherein:

#FIG. 1 depicts a block diagram of a network of data processing systems in which illustrative embodiments may be implemented;

#FIG. 2 depicts a block diagram of a data processing system in which illustrative embodiments may be implemented;

Detailed description9,277 words

#A protocol packet (packet) contains data that is arranged according to a protocol specification and is transmitted from one system and received by another system during a data interaction. A database packet is a non-limiting example of a protocol packet that is structured according to a database protocol, such as SAP HANA DB wire protocol, MongoDB wire protocol, or MS SQL TDS, and is exchanged between a database client and a database server during a database transaction according to the database protocol between the two systems. A cloud application protocol packet is another non-limiting example of a protocol packet that is structured according to a protocol, such as HADOOP RPC, THRIFT, or Google Protocol Buffers, and is exchanged between a cloud client and a cloud server during a data interaction according to the cloud application protocol between the participating systems. A data packet is another non-limiting example of a protocol packet that is structured according to Transmission Control Protocol/Internet Protocol (TCP/IP) and is exchanged during TCP/IP communication between a pair of participating systems. Any trademarks in the protocol names belong to their respective owners.

#Generally, within the scope of the illustrative embodiments, data content (data, content, or data content) in a protocol packet can be organized, structured, or arranged according to any suitable protocol. Furthermore, any type or size of data can be included in the protocol packet without limitation. Additionally, within the scope of the illustrative embodiments, the protocol packets can be transmitted using any protocol, or can participate in any protocol without limitation.

#The illustrative embodiments recognize that a protocol packet can include data that can be sensitive, protected, or otherwise subject to restricted access. Such data is collectively referred to as restricted data. Therefore, data interactions are often governed by one or more security policies to ensure that those interactions are in compliance with the rules, restrictions, limitations, or conditions of one or more security policies governing the restricted data.

Facts

Application

14/553,235Filed 25 Nov 2014

Published

US 2016/0149954 A126 May 2016

Granted

9 Oct 2018

Term ends

25 Nov 2034

Estimated · how

20 years from earliest known nonprovisional domestic filing plus recorded patent term adjustment. Maintenance-fee lapses, terminal disclaimers and statutory extensions have not been checked. The continuity chain may be incomplete; this is not an enforceability determination.

Classification6 codes

H04L 63/166
Implementing security features at a particular protocol layer: at the transport layer
H04L 63/20
Network architectures or network communication protocols for network security: for managing network security; network security policies in general
H04L 63/0245
Filtering policies: filtering by information in the payload
H04L 67/61
Scheduling or organising the servicing of application requests, e.g. requests for application data transmissions using the analysis and…: taking…

Secure data redaction and masking in intercepted data interactions

Life of this patent

Secure data redaction and masking in intercepted data interactions

Life of this patent

Life of this patent

Abstract

Drawings

Drawings

Claims7

Description10,103 words

Drawings

Classification6 codes

Life of this patent

Description10,103 words