Method and system for forensic data tracking

What is this patent about?

'200 is related to the field of data loss prevention (DLP) and, more specifically, to systems that track the movement of data elements both within and outside of authorized enterprise environments. Traditional security measures like firewalls and encryption often fail to prevent data breaches, especially when data leaks outside protected environments via methods like USB drives or unauthorized cloud storage. Existing DLP tools have limitations, creating a need for more comprehensive data tracking and control.

The underlying idea behind '200 is to provide a system that can track data elements even after they have left the protected environment. This is achieved by classifying data based on its content, tagging it with metadata, and potentially encoding it with forensic information. The system then monitors the movement and usage of this data across various devices and users, both authorized and unauthorized, providing visibility and control over sensitive information.

The claims of '200 focus on a cloud-based forensic computing platform that receives metadata from endpoints, analyzes the data based on configured settings, determines if the data classification is appropriate for the file, and reports the results to an administrator. The platform includes components for analytics, reporting, alerts, business logic, and databases for policies, users, metadata, and settings. The endpoints have software agents capable of detecting, classifying, deleting, encrypting, and redacting data.

In practice, the invention involves scanning files on endpoints, classifying them based on their content (e.g., presence of ICD-9 codes for PHI data), and tagging them with metadata. The files can also be encoded with techniques like transparent GIFs containing URLs that report back to the cloud control server when the file is opened. This allows the system to track the file's movement even if it's copied to an unauthorized device or shared with an unauthorized user. The system can then generate alerts and reports based on the tracked data.

The invention differentiates itself from prior approaches by focusing on data provenance -- understanding the context, origin, and history of data. Unlike traditional DLP tools that primarily focus on preventing data from leaving the protected environment, this system provides visibility and control even after a breach has occurred. By encoding files with forensic information and tracking their movement, the system enables organizations to understand how data is being used and shared, even outside of their direct control, allowing for more effective incident response and compliance.