Secure data scanning method and system
AssigneeInternational Business Machines Corporation
InventorRobert John McCormack
Life of this patent
Estimating the term…
Abstract
A method of scanning secure data in a data store is performed in a manner that does not expose the scan data, the files being searched, or information about when matches occur between the scan data and the files. During the scan process, encrypted versions of searched files are compared to encrypted versions of match strings, and any resulting match data is encrypted before being written into a results file. In addition, to disguise when match entries are written, during the scan one or more encrypted dummy items are written into the results file.
Claims25
A method of scanning secure data in a data store, comprising.
- for each of a set of secure files, encrypting into a data string a sample of the secure file and associated metadata;
- storing the data strings in a container file;
- configuring a scan of the secure data by identifying a list of files;
- for each file on the list of files:
- comparing an encrypted version of the file against the data strings in the container file;
- determining if the encrypted version of the file matches any data strings in the container file;
- if the encrypted version of the file matches any data strings in the container file, encrypting information about the match into a results file;
- as the scan iterates through the files on the list of files, inserting into the results file an encrypted version of at least one dummy match item;
- and
- upon completion of the scan, inserting into the results file an encrypted version of the list of files.
An apparatus for scanning secure data in a data store, comprising:
- a processor;
- and
- computer memory holding computer instructions that, when executed by the processor, perform a method comprising:
- for each of a set of secure files, encrypting into a data string a sample of the secure file and associated metadata;
- storing the data strings in a container file;
- configuring a scan of the secure data by identifying a list of files;
- for each file on the list of files:
- comparing an encrypted version of the file against the data strings in the container file;
- determining if the encrypted version of the file matches any data strings in the container file;
- if the encrypted version of the file matches any data strings in the container file, encrypting information about the match into a results file;
- as the scan iterates through the files on the list of files, inserting into the results file an encrypted version of at least one dummy match item;
- and
- upon completion of the scan, inserting into the results file an encrypted version of the list of files.
A computer program product in a computer readable medium for use in a data processing system, the computer program product holding computer program instructions which, when executed by the data processing system perform a method of scanning secure files, comprising:
- for each of a set of secure files, encrypting into a data string a sample of the secure file and associated metadata;
- storing the data strings in a container file;
- configuring a scan of the secure data by identifying a list of files;
- for each file on the list of files:
- comparing an encrypted version of the file against the data strings in the container file;
- determining if the encrypted version of the file matches any data strings in the container file;
- if the encrypted version of the file matches any data strings in the container file, encrypting information about the match into a results file;
- as the scan iterates through the files on the list of files, inserting into the results file an encrypted version of at least one dummy match item;
- and
- upon completion of the scan, inserting into the results file an encrypted version of the list of files.
A method of scanning secure data, comprising.
- for each file of a list of files, comparing for a match an encrypted version of the file against a set of data strings, each of the data strings having been generated by applying a key to a sample of a secure file and associated metadata;
- encrypting into a results file information about any match;
- and
- inserting at random intervals into the results file an encrypted version of a dummy data item to disguise when matches have occurred.
An article comprising a tangible machine readable medium that stores a program, the program being executed by a machine to perform a method of scanning secure data, the method comprising:
- for each file of a list of files, comparing for a match an encrypted version of the file against a set of data strings, each of the data strings having been generated by applying a key to a sample of a secure file and associated metadata;
- encrypting into a results file information about any match;
- and
- inserting at random intervals into the results file an encrypted version of a dummy data item to disguise when matches have occurred.
Dependencies are inferred from the claim text.