Method and system for forensic data tracking

What is this patent about?

'092 is related to the field of data loss prevention (DLP) and, more specifically, to systems that track the movement and usage of data elements across authorized and unauthorized devices and users. Traditional DLP solutions often fail to prevent all data leakage, leaving sensitive data vulnerable once it escapes the protected environment. This patent addresses the need for a more comprehensive method to maintain visibility, auditability, and control over sensitive information, even after it leaves the direct control of an organization.

The underlying idea behind '092 is to embed forensic tracking mechanisms directly into data files, allowing their movement and usage to be monitored even outside of authorized environments. This is achieved by classifying data based on its content, encoding it with tracking information, and then logging its activity as it is accessed and shared. The system can then use this information to identify potential data breaches, policy violations, and other security risks.

The claims of '092 focus on a cloud-based forensic computing platform that receives metadata from endpoints, analyzes the data based on configured settings and criteria, determines if the data classification is inappropriate for the file on the endpoint, and then remediates the file by encrypting, deleting, or redacting the data. The platform uses data element tags to identify sensitive information within files and determine the appropriate data classification.

In practice, the invention involves scanning data files on endpoints, classifying them according to a data classification policy, and tagging them with metadata. The files can then be encoded with tracking information, such as a transparent GIF with an embedded URL, or by encrypting the file and requiring a decryption key from the cloud server. When the file is accessed, the tracking information reports back to the cloud control server, providing details about the file's location, user, and other relevant information. The system can then use this information to generate alerts, reports, and other insights.

This approach differs from traditional DLP solutions by focusing on data provenance and tracking data even after it has left the protected environment. Instead of simply preventing data from leaving the network, this invention provides a mechanism to monitor and control data throughout its lifecycle, regardless of where it is stored or who is accessing it. This allows organizations to maintain visibility and control over their sensitive information, even in the face of data breaches and other security incidents.