Detecting sensitive data access by reporting presence of benign pseudo virus signatures

摘要

An owner of sensitive data is provided with a notification that the sensitive data has been located. To achieve this, the sensitive data is first modified to include one or more data strings that may appear to be suspect but are otherwise benign. These data strings, which are referred to herein as benign pseudo virus signatures (BPVSs), preferably are embedded throughout a piece of sensitive data according to a frequency distribution. When the sensitive data is examined by virus checking software, the benign pseudo virus signatures are detected as potential computer viruses. By using information associated with the signatures, the owner is identified, preferably using the assistance of an intermediary entity that acts as a registry for the BPVSs. Once the owner is identified, a notification is provided to the owner that the sensitive data has been located. Appropriate remedial action can then be taken.

主权项

1. A method to detect that sensitive data has been located, comprising:
embedding in the sensitive data one or more instances of a benign pseudo virus signature whose presence in the sensitive data does not impair a permitted use of the sensitive data; registering the benign pseudo virus signature; and receiving a notification that one or more instances of the benign pseudo virus signature have been detected in the sensitive data, wherein the notification indicates detection of the sensitive data and includes identifying information, the notification occurring as a result of a scan having been performed on the sensitive data that results in detection of a registered benign pseudo virus signature; the identifying information including an indication of a percentage of the sensitive data detected as being original, as determined by a number of instances of the benign pseudo virus signature detected in the scan; wherein at least one of the embedding, registering and receiving operations are carried out in software executing in a hardware element.