# US 8,751,506 B2 · Personal computing device-based mechanism to detect preselected data > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 8,751,506 B2 - Document ID: US8751506B2 - Status: Granted - Kind: B2 - Application number: 13/246,774 - Filed: 2011-09-27 - Published: 2012-01-19 - Granted: 2014-06-10 - Earliest claimed: 2003-05-06 - Assignees: Symantec Corporation - Applicants: Kevin T. Rowney; Michael R. Wolfe; Mythili Gopalakrishnan; Vitall A. Fridman - Inventors: Kevin T. Rowney; Michael R. Wolfe; Mythili Gopalakrishnan; Vitall A. Fridman - Web page: https://patentgrep.com/patent/US8751506B2 ## CPC - G06Q 10/107: Computer-aided management of electronic mailing [e-mailing] - G06F 16/24568: {Data stream processing; Continuous queries} - G06F 21/554: {involving event detection and direct action} - G06Q: INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract A method and apparatus for detecting pre-selected data stored on a personal computing device is described. In one embodiment, contents of data storage media of a personal computing device are searched for pre-selected sensitive data. In one embodiment, if at least a portion of the pre-selected sensitive data is detected, a notification of the detection of the pre-selected data is sent to a system via a network. In another embodiment, if at least a portion of pre-selected sensitive data is detected, the access to this data is blocked. ## Claims ### Claim 1 A method comprising: identifying, by a client device, an index of database data to be protected, the database data comprising sensitive data elements and the index comprising positional information identifying relative placement of the sensitive data elements of the database data in relation to other sensitive data elements of the database data, wherein the index does not reveal the sensitive data elements of the database data, and wherein one or more entries in the index comprise a row number of a cell in the database data and a pre-generated hash or encryption of a sensitive data element in the cell in the database data; determining, by the client device, whether at least a portion of the database data is possibly contained within information content; and in response to determining that a portion of the database data is possibly contained within the information content, performing, by the client device, a search of the information content for at least a portion of the database data using the index, wherein performing the search of the information content comprises: searching the index to identify entries in the index that comprise pre-generated hashes or encryptions of the sensitive data elements that correspond to hashes or encryptions of content fragments from the information content; determining one or more groups of content fragments, wherein at least one group comprises content fragments associated with hashes or encryptions that correspond to pre-generated hashes or encryptions of entries in the index comprising a same row number; and determining that the received information content contains at least a portion of the database data if any group satisfies at least one criterion. ### Claim 2 (depends on 1) The method of claim 1, wherein the at least one criterion comprises a quantity threshold that is satisfied if any group comprises a quantity of content fragments that meets or exceeds the quantity threshold. ### Claim 3 (depends on 1) The method of claim 1, wherein each entry in the index further comprises a column number of the cell, and wherein the at least one criterion comprises a threshold that is satisfied if any group comprises content fragments from a number of different columns that meets or exceeds the threshold. ### Claim 4 (depends on 1) The method of claim 1, wherein determining the groups of content fragments comprises: parsing individual lines of text in the information content into the content fragments, wherein each content fragment is one of a word or a phrase; and for each individual line of text, performing the following: generating hashes of each of the content fragments in the line; comparing the hashes of the content fragments in the line to the pre-generated hashes to identify matching entries of the index; and arranging the content fragments in the line into the groups based on row numbers associated with the matching entries. ### Claim 5 (depends on 1) The method of claim 1, wherein the database data is maintained in at least one of a spreadsheet or a flat file, the method further comprising: determining that a portion of the information content matches a portion of the database data; and sending, to a server, a notification of the detection of the portion of the database data in the information content. ### Claim 6 (depends on 1) The method of claim 1, wherein determining that a portion of the database data is possibly contained within the information content comprises: searching a body of the information content for an expression comprising a predefined format using a search rule that defines the predefined format, wherein the expression comprising the predefined format is any one of an account number, a social security number, a credit card number, a phone number, a postal code, an email address, a currency amount, or a driver's license number; and determining that a region surrounding the expression may contain a portion of the database data, wherein the region surrounding the expression comprises a quantity of contiguous data fragments before the expression and a quantity of contiguous data fragments after the expression. ### Claim 7 (depends on 1) The method of claim 1, wherein the information content is a document stored on a storage medium of the client device. ### Claim 8 (depends on 1) The method of claim 1, wherein the index contains copies of at least some common strings and numbers from the database data. ### Claim 9 (depends on 1) The method of claim 1, wherein determining that a portion of the database data is possibly contained within the information content comprises determining that the information content comprises a sequence of content fragments that resembles column-formatted data. ### Claim 10 (depends on 1) The method of claim 1, wherein determining that a portion of the database data is possibly contained within the information content comprises determining that a word distribution in the information content resembles a statistical pattern that indicates a possible containment of the database data. ### Claim 11 A non-transitory computer readable storage medium including instructions that, when executed by a processing device, cause the processing device to perform operations comprising: identifying, by the processing device, an index of database data to be protected, the database data comprising sensitive data elements, the index comprising positional information identifying relative placement of the sensitive data elements of the database data in relation to other sensitive data elements of the database data, wherein the index does not reveal the sensitive data elements of the database data, and wherein one or more entries in the index comprise a row number of a cell of the database data and a pre-generated hash or encryption of a sensitive data element in the cell of the database data; determining, by the processing device, whether at least a portion of the database data is possibly contained within information content; and in response to determining that a portion of the database data is possibly contained within the information content, performing, by the processing device, a search of the information content for at least a portion of the database data using the index, wherein performing the search of the information content comprises: searching the index to identify entries in the index that comprise pre-generated hashes or encryptions of the sensitive data elements that correspond to hashes or encryptions of content fragments from the information content; determining one or more groups of content fragments, wherein at least one group comprises content fragments associated with hashes or encryptions that correspond to pre-generated hashes or encryptions of entries in the index comprising a same row number; and determining that the received information content contains at least a portion of the database data if any group satisfies at least one criterion. ### Claim 12 (depends on 11) The non-transitory computer readable storage medium of claim 11, wherein the at least one criterion comprises a quantity threshold that is satisfied if any group comprises a quantity of content fragments that meets or exceeds the quantity threshold. ### Claim 13 (depends on 11) The non-transitory computer readable storage medium of claim 11, wherein each entry in the index further comprises a column number of the cell, and wherein the at least one criterion comprises a threshold that is satisfied if any group comprises content fragments from a number of different columns that meets or exceeds the threshold. ### Claim 14 (depends on 11) The non-transitory computer readable storage medium of claim 11, wherein determining the groups of content fragments comprises: parsing individual lines of text in the information content into the content fragments, wherein each content fragment is one of a word or a phrase; and for each individual line of text, performing the following: generating hashes of each of the content fragments in the line; comparing the hashes of the content fragments in the line to the pre-generated hashes to identify matching entries of the index; and arranging the content fragments in the line into the groups based on row numbers associated with the matching entries. ### Claim 15 (depends on 11) The non-transitory computer readable storage medium of claim 11, wherein determining that a portion of the database data is possibly contained within the information content comprises determining that the information content comprises a sequence of content fragments that resembles column-formatted data. ### Claim 16 A computing device comprising: a memory to store instructions for protecting database data; and a processing device, coupled to the memory, to execute the instructions, wherein the processing device is to: identify an index of database data, the database data comprising sensitive data elements, the index comprising positional information identifying relative placement of the sensitive data elements of the database data in relation to other sensitive data elements of the database data, wherein the index does not reveal the sensitive data elements of the database data, and wherein one or more entries in the index comprise a row number of a cell in the database data and a pre-generated hash or encryption of a sensitive data element in the cell; determine whether at least a portion of the database data is possibly contained within information content; and in response to determining that a portion of the database data is possibly contained within the information content, perform a search of the information content for at least a portion of the database data using the index, wherein performing the search of the information content comprises: searching the index to identify entries in the index that comprise pre-generated hashes or encryptions of the sensitive data elements that correspond to hashes or encryptions of content fragments from the information content; determining one or more groups of content fragments, wherein at least one group comprises content fragments associated with hashes or encryptions that correspond to pre-generated hashes or encryptions of entries in the index comprising a same row number; and determining that the received information content contains at least a portion of the database data if any group satisfies at least one criterion.