Methods and systems to implement fingerprint lookups across remote agents

Abstract

The present invention provides methods and systems to protect an organization's secure information from unauthorized disclosure. The present system uses protect agents installed across various egress points (e.g., email server, user's computer, etc.) to monitor information disclosed by a user. The present system also provides the use of fingerprint servers to remotely maintain a database of fingerprints associated with the organization's secure data. In one embodiment, the protect agents transmit fingerprints associated with the user's information to the fingerprint server utilizing a local network or the public internet. The protect agents then receive a comparison analysis from the fingerprint servers and execute appropriate security action based on the analysis. In one embodiment, a combination of the local network and public internet is utilized to achieve remote agent lookups.

What is claimed: 
     
         1 . A computer system for protecting an organization's secure information from unauthorized disclosure outside of an organization's protected computer environment, said computer system comprised of at least one computing device, said computer system further comprised of at least one instances of a protect agent installed and operating on at least one of the computing devices, said computer system comprising:
 a fingerprint server comprised of a data storage device further comprised of preexisting fingerprint representations of data files and associated encoded security actions;   at least one protect agents operating on the at least one computing devices, said protect agent adapted by logic to monitor the activity of each of an at least one computing device egress points, detect an attempt by the computing device to transmit a data file outside the monitored organization's protected computer environment using one of the at least one egress points, in response to said detection, transmitting at least one fingerprint representation of the data file to the fingerprint server prior to the data file being transmitted to the determined destination outside of the organization's protected computer environment, receiving, from the fingerprint server, a security action message selected by the fingerprint server matching the transmitted fingerprint against the preexisting fingerprints in the data storage device and selecting the security action associated with the matched fingerprint, and the protect agent adapted by logic to execute the security action encoded in the received security action message.   
     
     
         2 . The computer system of  1 , wherein the one of the at least one egress points is a printer. 
     
     
         3 . The computer system of  1 , wherein the one of the at least one egress points a removable data storage medium. 
     
     
         4 . The computer system of  claim 1 , wherein the one of the at least one egress points is an email server connected to the network. 
     
     
         5 . The computer system of  claim 1 , wherein the one of the at least one egress points is a print server connected to the network. 
     
     
         6 . The computer system of  claim 1 , wherein the one of the at least one egress points is a network appliance connected to the network. 
     
     
         7 . The computer system of  claim 1 , wherein the one of the at least one egress points is a data object residing in the computing device, said data object representing a portion of a document file selected by the user using a clipboard associated with a local operating system. 
     
     
         8 . The computer system of  claim 1 , where the protect agent is further adapted by logic to add to the data file, data comprising the data representing the security action. 
     
     
         9 . The computer system of  claim 8 , where the protect agent is further configured by logic to encrypt the at least one fingerprints prior to the transmission to the fingerprint server. 
     
     
         10 . The computer system of  claim 1 , wherein the environment includes a local network associated with the organization. 
     
     
         11 . The computer system of  claim 1 , wherein the network includes a public internet. 
     
     
         12 . The computer system of  claim 11 , wherein the fingerprint server is hosted and maintained by a hosted fingerprint service provider. 
     
     
         13 . The computer system of  claim 11 , wherein the network further includes a public internet. 
     
     
         14 . The computer system of  claim 1 , where the computer system is comprised of a plurality of fingerprint servers, wherein each of the plurality of the fingerprint servers includes the database of preexisting fingerprints. 
     
     
         15 . The computer system of  claim 14 , wherein the plurality of fingerprint servers are connected to the network. 
     
     
         16 . The computer system of  claim 1 ,  14 , where the protect agent is further configured by logic to select the fingerprint server to receive the data file in dependence on a load distribution. 
     
     
         17 . The computer system of  claim 14 , wherein one or more of the plurality of fingerprint servers are located in geographically diverse locations. 
     
     
         18 . The computer system of  claim 1 , wherein communication between the protect agent and the fingerprint server is by means of web service calls. 
     
     
         19 . A computer system for protecting an organization's secure information from unauthorized disclosure outside of an organization's protected computer environment, said computer system comprised of at least one computing device, said computer system further comprised of at least one instances of a protect agent installed and operating on at least one of the computing devices, said computer system comprising:
 a data storage device comprised of preexisting fingerprint representations of a plurality of data files and associated encoded security actions;   at least one protect agents operating on the at least one computing devices, said protect agent adapted by logic to monitor the activity of each of an at least one computing device egress points, detect an attempt by the computing device to transmit a data file outside the monitored organization's protected computer environment using one of the at least one egress points, in response to said detection, selecting from the data storage device a security action by generating a fingerprint of the data file and matching the generated fingerprint against the stored preexisting fingerprint representations.