Method And System For Forensic Data Tracking

What is this patent about?

’300 is related to the field of data loss prevention and, more specifically, to systems that track the movement of data elements across authorized and unauthorized devices and users. Traditional security measures like firewalls and encryption often fail to prevent data breaches when data leaks outside the protected environment, for example, via USB drives or unauthorized cloud storage. Existing Data Loss Prevention (DLP) tools are not always effective, leaving sensitive data vulnerable once it escapes the protected environment.

The underlying idea behind ’300 is to embed forensic tracking mechanisms directly into data files, allowing their movement and usage to be monitored even after they have left the control of the originating organization. This is achieved by scanning files, classifying them based on their content, and then encoding them with unique identifiers or watermarks. When these encoded files are accessed, they report back to a central server, providing information about the endpoint, user, and time of access.

The claims of ’300 focus on a cloud-based forensic computing platform that receives metadata logs from endpoints, analyzes the data element tags within those logs, and determines a data classification for the files on those endpoints. The platform then predicts data breaches based on changes in data topology, such as spikes in user activity or data of a specific classification leaking onto unauthorized endpoints. The platform also identifies patterns of data use that constitute rule violations or deviations from normal behavior, such as an endpoint significantly increasing or decreasing its total number of files.

In practice, the invention involves deploying software agents on endpoints that scan files, classify them based on predefined text strings or patterns (e.g., ICD-9 codes for PHI data), and then encode them with forensic information. This encoding can take various forms, including transparent GIFs with embedded URLs, executable components that report back to the server, or printable watermarks. The agents then transmit metadata logs to a central cloud control server, which analyzes the data and generates alerts based on predefined policies and settings.

This approach differs from traditional DLP solutions by focusing on data provenance and providing visibility into data movement even outside the organization's direct control. Unlike encryption-based solutions that become ineffective once the data is decrypted on an unauthorized device, ’300 maintains awareness of the data's location and usage through its embedded tracking mechanisms. By analyzing patterns of data movement and identifying deviations from normal behavior, the platform can proactively predict and prevent data breaches.