FIELD OF INVENTION

The present invention generally relates to cloud data security and, more particularly, to classification of the sensitivity of the data, field-level keyless encryption, identification and prevention of potential data loss/leaks and, delivery of notifications directly to the end user in real-time in the event of potential data loss or leak.

BACKGROUND

The protection of sensitive personal, health, finance data and valuable intellectual property has gained momentum in the wake of recent high-profile data breaches. The number of such data breach incidents is increasing steadily with no foreseeable end in sight. As cloud computing continues to gain popularity and more users store sensitive data on cloud-based software systems, data security has become increasingly vital to every organization which desires to comply with various regulatory requirements and retain a competitive advantage.

As a result, many organizations are now placing an increased focus on controlling access to data or encrypting the data stored in the cloud by deploying cloud data loss prevention (DLP) tools. However existing techniques used by cloud DLP tools fail to provide an efficient solution. This is primarily because cloud DLP tools usually monitor usage of cloud data and third-party apps at an organizational level and provide visibility only to cloud administrators and security analysts, leaving behind the end users who create or own the data. Cloud DLP tools do not have the capability of identifying and classifying the type of data that needs to be protected upon creation or before sharing it with others. In addition, cloud DLP tools place too much restriction on the data by encrypting the entire file or document, and thus create friction between data usage and its security. Last, the cloud DLP tools place the security of cloud data in the hands of cloud administrators or security analysts who may fail to detect important signals from the noise as they may lack context of the potential incident when compared to the end users.

Therefore, what is needed is, a simple yet comprehensive approach, which brings users of a cloud-based software system in to the effort along with the administrators to secure the data stored in the cloud.

SUMMARY

The object of the present invention is to provide users of a cloud-based software system (hereinafter referred to as a “cloud system”) such as Box®, Dropbox®, Google G Suite®, Slack®, Microsoft Office 365®, Salesforce®, etc., with a simple yet comprehensive system for and method of protecting sensitive personal, private, and business data from unauthorized use through classification of data; keyless encryption of sensitive content; identification, notification, and prevention of potential data loss/leak while the data is in use, in motion or at rest; and by educating users of the cloud system about the potential risks and remediation actions in real-time. An exemplary system for and method of securing the data stored in the cloud system comprises a Cloud Data Security system (CDS) that may encompass the necessary software and hardware.

Another object of the invention is to ‘decentralize’ data security. Currently, security of the data stored in a cloud system is controlled by administrators of the cloud system. When data is leaked or lost, the administrators have the ability to see the incident along with potentially hundreds of other such incidents daily. However, the administrators may not be able to quickly determine if an incident is a real threat vs. a false-positive as they may not have the required context to confirm the incident before significant damage is made to the organization. On the other hand, end users typically discover foul play very quickly on their own when they have the same level of visibility as of an administrator. It is thus much more efficient to engage end users in the data security process as they have the context to more quickly understand if something is truly suspicious. An exemplary embodiment is comprised of a system separate from, but residing on, the cloud and functioning on behalf of the end user. A user having access to the cloud system grants the permission to the cloud data security system allowing the user to monitor and secure data on their own, decentralizing the overall cloud data security process.

Another object of the invention is to use a ‘distributed’ approach which helps users of the cloud system take best actions that enhance security of the data by monitoring behaviors and actions of other users (also referred to as ‘peer knowledge’). In an exemplary embodiment, the Cloud Data Security system (CDS) provides recommendations to the user with regard to classification and optimal security settings where the recommendations are derived based on aggregated information collected through other user's actions or inputs; or based on actions taken by other users in similar organizations or roles. For example: by tracking actions of users who work in organizational types such as manufacturing, insurance, banking sector, etc., or departments such finance, HR, marketing etc. Other criteria for determining the recommendations may also include a user's location, language, the type of data they handle routinely, the type of classification and security settings which they apply to particular type of data, keywords, or data filters, etc. Additionally, similar criteria can be used to automatically protect the data stored in the cloud system using machine learning algorithms. For example, in an exemplary embodiment the cloud data security system scans contents of a user's file stored in the cloud system and applies classification markings and security settings to the file automatically based on what other users of the cloud data security system have prescribed in the past. In this exemplary embodiment, the Cloud Data Security system (CDS) aggregates and keeps track of what classifications and security settings have been most successful or have the best track record of keeping similar data safe in the cloud system. Such recommendations and automatic actions have the potential to further enhance proper security decisions amongst users.

Another object of the invention is to protect data stored in a cloud system by encrypting sensitive data and/or specific portions of a file stored in the cloud system. In an exemplary embodiment, the cloud data security system scans contents of a file stored in the cloud system and executes an algorithm that encrypts sensitive content with in the file in accordance with the organization's sensitive data filters, data security policies, data governance rules, and/or related controls. In an exemplary embodiment, this is done with a unique cryptographic hash that acts as a digital fingerprint. Once a file is altered, only the user, i.e. the owner of the file, can view, edit or decrypt the encrypted content.

Another object of the invention is to protect data stored in a cloud system based on data classification. In an exemplary embodiment, the cloud data security system (CDS) scans files stored in the cloud system and determines appropriate classification category based on sensitivity of the data relative to the risk. The classification category identified and presented to the user such that the user can take actions to necessary to secure the file. In another exemplary embodiment, CDS may categorize the data stored in a cloud system based on sensitivity of the data relative to the risk, and automatically assign optimal security settings in accordance with the organization's sensitive data filters, data security policies, data governance rules, and/or related controls.

Another object of the invention is to create an awareness and provide visibility to the risks associated with the data to the users of a cloud system by detecting potential threats and alerting the users in real-time. In certain exemplary embodiments, the cloud data security system detects if data stored in a cloud system gets tampered with and captures details such as who accessed the data, when they accessed it, and what took place. An alert is then sent to the user, in this case owner of data along with the administrator of the cloud system, by email, SMS, or a push notification etc., in real time. This alert is based on user preferences or in accordance with an organization's sensitive data filters, data security policies, data governance rules, and/or related controls.

Another object of the invention is to allow an end user of the cloud system to take actions to mitigate risks when they receive a potential data breach alert. For example, if an end user of the cloud system is informed that a file containing sensitive data has been tampered with, he/she may choose to delete the sensitive content or change the sharing settings to restrict access to the file.

It should be noted that many of the inventive concepts are applicable to data and files that are stored in locations other than cloud-based software systems. Therefore, the described and claimed exemplary embodiments should not be limited to just cloud-based software systems.

The invention herein described is capable of other embodiments and of being practiced and carried out in various ways which will be obvious to those skilled in the art. Also, it is to be understood that the phraseology and terminology employed herein are for the purpose of description and should not be regarded as limiting. As such, those skilled in the art will appreciate that the conception upon which this disclosure is based may readily be utilized as a basis for designing other systems for and methods of carrying out the several purposes of the present disclosed exemplary embodiments. It is important, therefore, that the claims be regarded as including such equivalent construction and methodology insofar as they do not depart from the spirit and scope of the present invention. As used in the claims to describe the various inventive aspects and embodiments, the term “comprises” or “comprising” means including, but not limited to, whatever follows the word “comprising”. Thus, use of the term “comprising” indicates that the listed elements are required or mandatory, but that other elements are optional and may or may not be present.

The object, features, and advantages of the present invention, as well as the advantages thereof over existing prior art, which will become apparent from the description to follow, are accomplished by the improvements described in this specification and hereinafter described in the following detailed description which fully discloses the invention, but should not be considered as placing limitations thereon.

