Smart bits
AssigneeCloudentity, Inc.
InventorNathanael Coffing
Life of this patent
Estimating the term…
Abstract
Systems and methods for intelligent data routing based on data type are provided. A proxy installed on a client device receives a data stream and scans the data stream for classification parameters associated with sensitive data. A data stream may be broken down, for example, to data packets, classified using known libraries containing characteristics of a classification, and routed based on applicable policies governing each classification. The routed data packets are constantly monitored and may be re-routed to a network designed to handle highly sensitive data, a network designed to handle data with high security risk, or to another applicable service infrastructure as needed, before reaching the intended recipient. The classification libraries may be updated based on the monitored data and change in classification of the data packet.
Claims20
A method for intelligent routing of data, the method comprising:
- installing a proxy on a client device in a communication network;
- monitoring data packets received at the client device via the proxy, wherein monitoring the received data comprises scanning each received data packet for one or more classification parameters associated with sensitive data;
- classifying a first data packet and a second data packet as sensitive based on the scan detecting the parameters associated with sensitive data;
- determining that the first data packet comprises payment card industry data, the second data packet comprises personally identifiable information data, and the payment card industry data is different from the personally identifiable information data,
- wherein the personally identifiable information data is required to flow through an application programming interface (API) gateway;
- and
- routing the first and the second data packets in accordance with one or more policies applicable to the sensitive data classification,
- wherein the routing comprises:
- transmitting the first data packet to an intrusion detection and prevention system that generates alerts in response to traffic in a cardholder data environment being compromised;
- and
- transmitting the second data packet to a web application firewall (WAF).
A system for intelligent routing of data, the system comprising:
- a proxy installed on a client device in a communication network, wherein the proxy is configured to:
- monitor data packets received at the client device via the proxy, wherein monitoring the received data comprises scanning each received data packet for one or more classification parameters associated with sensitive data;
- classify a first data packet and a second data packet as sensitive based on the scan detecting the parameters associated with sensitive data;
- determine that the first data packet comprises payment card industry data, the second data packet comprises personally identifiable information data, and the payment card industry data is different from the personally identifiable information data,
- wherein the personally identifiable information data is required to flow through an application programming interface (API) gateway;
- and
- route the first and the second data packets in accordance with one or more policies applicable to the sensitive data classification, wherein the routing comprises:
- transmitting the first data packet to an intrusion detection and prevention system that generates alerts in response to traffic in a cardholder data environment being compromised;
- and
- transmitting the second data packet to a web application firewall (WAF).
A non-transitory, computer-readable storage medium, having embodied thereon a program executable by a processor to perform a method for managing data stream identity, the method comprising:
- installing a proxy on a client device in a communication network;
- monitoring data packets received at the client device via the proxy, wherein monitoring the received data comprises scanning each received data packet for one or more classification parameters associated with sensitive data;
- classifying a first data packet and a second data packet as sensitive based on the scan detecting the parameters associated with sensitive data;
- determining that the first data packet comprises payment card industry data, the second data packet comprises personally identifiable information data, and the payment card industry data is different from the personally identifiable information data,
- wherein the personally identifiable information data is required to flow through an application programming interface (API) gateway;
- and
- routing the first and the second data packets in accordance with one or more policies applicable to the sensitive data classification,
- wherein the routing comprises:
- transmitting the first data packet to an intrusion detection and prevention system that generates alerts in response to traffic in a cardholder data environment being compromised;
- and
- transmitting the second data packet to a web application firewall (WAF).
Dependencies are inferred from the claim text.