US 8,572,758 B1Granted

DLP-enforced loss scanning, sequestering, and content indexing

AssigneeSymantec Corporation

InventorThomas G. Clifford

Life of this patent

Estimating the term…

Loading patent…

Abstract

A system and method is disclosed for implementing a data loss prevention (DLP) system configured to protect sensitive data in conjunction with corresponding content indexing (CI) metadata. In response to detecting a data loss risk, such as to data at rest (e.g., stored on a file system) and/or to data in motion (e.g., data being transmitted across a network) the system may perform any number of data loss prevention actions, including sequestering the data. The system may utilize an interface to a content indexing system in order to discover CI metadata associated with the data and sequester the CI metadata associated with the data. One or more common sequestration rules may be applied to the sequestration of the data and of the metadata. For example, the data and metadata may be encrypted using the same key and/or sequestered in the same location.

Claims14

Dependent claims

A non-transitory computer-readable storage medium, storing program instructions to implement:

content indexing software, wherein the context indexing software is executable by a computer system to index a plurality of files, wherein for each respective file of the plurality of files, said indexing includes determining contents of the respective file and creating corresponding content indexing (CI) metadata for the respective file which describes the contents of the respective file and enables search operations to be performed on the respective file without accessing the contents of the respective file;
and
data loss prevention software, wherein the data loss prevention software is executable by the computer system to:
monitor the plurality of files for data loss prevention, wherein said monitoring includes detecting that a particular file of the plurality of files presents a data loss risk;
in response to said detecting that the particular file presents the data loss risk:
query the content indexing software to discover the corresponding CI metadata for the particular file;
and
sequester the particular file and the corresponding CI metadata for the particular file, wherein in performing said sequestering the data loss prevention software is executable by the computer system to apply a common sequestration rule to both the particular file and to the corresponding CI metadata for the particular file.

5 more elements

A computer system comprising:

one or more processors;
and
memory storing content indexing software and data loss prevention software;
wherein the context indexing software is executable by the one or more processors to index a plurality of files, wherein for each respective file of the plurality of files, said indexing includes determining contents of the respective file and creating corresponding content indexing (CI) metadata for the respective file which describes the contents of the respective file and enables search operations to be performed on the respective file without accessing the contents of the respective file;
and
wherein the data loss prevention software is executable by the one or more processors to:
monitor the plurality of files for data loss prevention, wherein said monitoring includes detecting that a particular file of the plurality of files presents a data loss risk;
in response to said detecting that the particular file presents the data loss risk:
query the content indexing software to discover the corresponding CI metadata for the particular file;
and
sequester the particular file and the corresponding CI metadata for the particular file, wherein in performing said sequestering, the data loss prevention software is executable by the one or more processors to apply a common sequestration rule both to the particular file and to the corresponding CI metadata for the particular file.

8 more elements

Dependencies are inferred from the claim text.