WO2020245475A1

WO2020245475A1 - Method and computer programs for monitoring content uploaded/shared to computer applications or platforms

Info

Publication number: WO2020245475A1
Application number: PCT/ES2019/070384
Authority: WO
Inventors: Aruna Prem BIANZINO; Rames SARWAT SHAKER; Antonio BORDÓN VILLAR; Roberto ANTA RODRÍGUEZ
Original assignee: Telefonica Cybersecurity Tech S.L.
Priority date: 2019-06-05
Filing date: 2019-06-05
Publication date: 2020-12-10

Abstract

The invention relates to a method and computer programs for monitoring content uploaded/shared to computer applications or platforms. The method includes (a) a computing device taking at least one screenshot of the interface of a computer application or platform when a first user uploads or shares a file with at least one second user, on or via said computer application or platform; (b) the computing device extracting text from said captured image by applying an optical character recognition algorithm, and providing a text file; and (c) the computing device obtaining various types of information from said text file so as to reduce blind spots when monitoring the upload/sharing of the file.

Description

Method and computer programs for the monitoring of content uploaded / shared in applications or computer platforms

Technical field

The present invention relates generally to methods for the authenticity and integrity of documents. In particular, the invention concerns a method and computer programs for monitoring content uploaded / shared in applications or computer platforms that allow information to be shared with other users and / or to send information to another location.

Background of the invention

Today, there are many solutions that focus on the security of file sharing (that is, the file is encrypted before it is shared, transmitted through a secure channel, and decrypted after receipt, protecting it against unintended audiences. desired). Known solutions include commercial solutions such as FinalCode, which protects a file when shared, but cannot protect it against unwanted file sharing (eg, user error). Furthermore, the solutions available in general are not transparent to the end user, which forces them to configure the file / archive as protected, set permissions, etc. - generally focusing on the file and not the user - working only with limited file types, for example PDF, or on general visual / printable files, like the Locklizard PDF Security solution, which only works with PDF files.

Likewise, some patents and / or patent applications are known in the sector.

KR 20040008550-A describes a solution for securely sharing and monitoring documents between authorized users. The solution includes an infrastructure through which secret keys are distributed to users, as well as different modules, where users must log in and where files are stored. In general, this solution requires active user intervention, it only protects the desired files, actively configured by the user / system manager, and not any generic file shared by a generic user. In addition, this solution requires the end user to remember credentials, requires complex infrastructure and infrastructure management. Similar considerations apply to patent applications CN 103561034-A and CN 101989984-A. US 20130318589-A1 describes a solution to control the exchange of secret content within and across the boundaries of a company, depending on the needs of the user. This solution includes an infrastructure, including an exchange server where content is shared and stored. Furthermore, the solution requires user intervention to directly control what content they want to share and with whom, regulating only the specific content that has been previously registered in the specific solution.

US 20020171859-A1 describes a solution to protect confidential documents to be printed, through the use of a password system. This solution only works for visual files (that is, such as office or images, but not for generic data files, audios, databases, etc.). This solution only avoids file sharing through printing, not through social networks or messaging systems. Finally, this solution asks the end user to memorize multiple passwords in order to share the desired file and it is not transparent for them in their work functionalities.

Therefore, new solutions are needed to ensure the monitoring of content uploaded / shared in applications or computing platforms, for example instant messaging applications, information / file sharing applications between users, cloud data hosting platforms, networks social, etc.

Presentation of the invention

Examples of embodiments of the present invention, provide according to a first aspect, a method for monitoring content uploaded / shared in applications or computer platforms, such as instant messaging applications (for example Skype®, WhatsApp®, Google Hangouts® , Facebook Messenger®, etc.), social networks (for example, Facebook® or Instagram®), data / file sharing or hosting platforms (for example, Microsoft Teams®, Slack®, WeTransfer®, Google Drive®, Dropbox ®, Firefox Send®, etc.).

The proposed method comprises a) performing, by a computing device that includes one or more processors and at least one memory, a screenshot (it can capture more than one) of the interface of a computer application or a computer platform when a first user uploads or shares a file (with at least one second user) on or through said application or computing platform; b) extract, by the device computing, a text of said image captured by applying an optical character recognition algorithm, providing a text file; and c) obtaining, through the computing device, different information from said text file to reduce blind spots in monitoring the upload / sharing of said file.

That is, the present invention proposes a new solution to capture the image of the interface of an application or computer platform to identify a file shared / uploaded through said application / platform, and optionally also identify the eventual users with whom it is shared. the aforementioned file.

According to the present invention, said information obtained in step c) may include one or more of: file name, file type, file size, name or identifier of the first user, name or identifier of the second user (or group of users), instant of time in which the upload / sharing is performed and / or communication channel used, preview of the file, if applicable. That is, the computing device analyzes the text of the captured image in search of known positions (depending on the type of application / platform that is being used to upload / share the file) based on the file name, type, size, name of the user with whom it is shared, etc.

In particular, the screen capture is carried out automatically, for example at the instant of time in which the computing device detects an action of attaching, dragging or dropping said file on the interface.

In the case that the file is shared with a second user, said step a) may further comprise capturing a characteristic image (avatar) of one of the two users (or both). In the case that the file is shared with more than one user, the characteristic image can be captured from each of the members of the group of users with whom the file is shared.

In an exemplary embodiment, prior to performing step b), the screenshot made is stored in a memory of the computing device. Preferably, the storage is temporary.

In an exemplary embodiment, the information obtained in step c) is stored in a memory of the computing device. Likewise, the method may further comprise comparing said file name with a previously stored file of the same name (and / or size and type, and / or file preview), in order to verify whether it is a possible file. marked as sensitive to eventually generate an alarm. Furthermore, by recognizing the file, this activity can be added to its life cycle. Alternatively or complementary, the method may further comprise identifying actions on the uploaded / shared file and / or detecting possible inappropriate or unauthorized uses thereof.

Other embodiments of the invention disclosed herein also include computer program products for performing the steps and operations of the method proposed in the first aspect of the invention. More particularly, a computer program product is an embodiment having a computer-readable medium that includes computer program instructions encoded therein, which when executed on at least one processor of a computer system execute the operations outlined herein. document as embodiments of the invention.

In particular, said computer program product will be installed on the computing device of the user who shares the data with other users or who uploads the file, that is to say the first user as referred to above or user issuing the file.

Therefore, the present invention provides a transparent methodology for the end user, without affecting their functionality and need to share files and information, and without asking them to remember additional passwords and credentials, or to register the files a priori in a monitoring system. , allowing monitoring of any type of file, whether it is viewable or not, regardless of whether the file was shared intentionally or accidentally, and not requesting a complex infrastructure that supports the solution and that needs to be configured, and not requesting that the monitored files are stored on an external medium (for example, a server).

The present invention also represents an improvement in the detection of information leaks about files that belong to an organization and that are shared with other users, accidentally or intentionally, through channels that, by their nature, do not report these events. or they do not allow the obtaining of this data by other means (usually social networks and instant messaging systems, such as Skype®, Facebook®, etc.).

Brief description of the drawings The foregoing and other characteristics and advantages will be more fully understood from the following detailed description of some exemplary embodiments, merely illustrative and not limiting, with reference to the accompanying drawings, in which:

Fig. 1 illustrates a diagram of a method for monitoring uploaded / shared content in computer applications or platforms according to the present invention.

Fig. 2 schematically illustrates the concept of operation of the extraction method proposed for the extraction of information present in the screenshot according to an embodiment of the present invention.

Fig. 3A shows an example of the information captured in text from the interface of an application or computing platform. Fig. 3B shows an example of the text information, extracted raw.

Detailed description of the invention and some embodiments

With reference to Fig. 1, it shows an example of an embodiment of a method for monitoring uploaded / shared content in computer applications or platforms. The method in this case comprises making, by a computing device, such as a PC, a computing server, etc., of a first user (step 101), a screenshot of the interface of said application / computing platform such such as an instant messaging application (for example Skype®), a social network (for example Facebook®) or a platform for hosting data in the cloud (for example Dropbox®), among others, when said first user uploads or shares a file on or via application / platform. In step 102, the method comprises extracting a text from the captured image by applying an optical character recognition algorithm, for example an OCR algorithm, providing a text file (see Fig. 3A for an example). Finally, in step 103, the method comprises obtaining different information (see Fig. 3B for an example) from the text file to reduce blind spots in the monitoring of the upload / share of the file. In this way, it is possible to obtain real information about the upload (or upload) or file sharing actions carried out in said applications / computer platforms.

In the case of sharing, the file can be shared with more than one user, that is, with several users with whom communication is maintained through the aforementioned applications / platforms or even with a group. Likewise, the previous method in the aforementioned Step 101 may comprise capturing several screenshots, at different instants in time, or a sequence of screenshots.

The information obtained can include: file name, file type, file size, name or identifier of the first user, name or identifier of the second user (or group of users), instant of time in which the upload / share is performed , preview of the uploaded / shared file and / or communication channel used.

Fig. 2 schematically shows the previous step 102, that is, the methodology for extracting the information present in the screenshot.

The proposed method foresees making said screen capture automatically at the instant of time in which the computing device detects an action of attaching, dragging or dropping the file on said interface. This capture process is transparent to the first user and may or may not be configured to provide the first user with any information on the subject that should indicate the performance of said action.

On a visual level, the present invention also makes it possible to capture additional useful information such as, for example, an image / avatar of the first user, the second user (or group of users), or even both. It could even capture additional useful information such as the first page of the uploaded / shared file, if this is a text or visual document, for example a Word or a PDF.

In any of the above cases, the capture process will be limited to the exclusive search for the above information and will discriminate against any other information that is not helpful, that is not related to the described purpose or that is illegible.

The captured image, in an exemplary embodiment, will be temporarily stored in the computing device until it is sent to a centralized character recognition service, where the image will be processed to extract the detected characters and proceed to their subsequent normalization. Preferably, once the image is sent, it will be completely erased from the computing device. In other embodiments, the captured image can be stored permanently or for a long period of time (for example months or years).

Furthermore, the information obtained for the "File name" can be compared with an existing list of file names, where the names of all the files are stored, together with the operations that have been executed on them and any metadata. (timestamp, executing user, etc.). In addition, other characteristics of the file, such as size and type, can also be compared.

Once the name of the file and the user / alias performing the action (that is, the first user) have been collated, the invention will proceed to store this information (and eventually the rest of the collected metadata), associating it (if possible) with a parent file (source file), expanding the traceability information of the uploaded / shared file and activating or not other security mechanisms designed to protect the information (including eventual notification, blocking and compliance systems, etc., for example, in the case of uploading / sharing files marked as sensitive).

The proposed invention can be implemented in hardware, software, firmware or any combination thereof. If implemented in software, the functions can be stored in or encoded as one or more instructions or code on a computer-readable medium.

Computer-readable medium includes computer storage medium. The storage medium can be any available medium that can be accessed by a computer. By way of example, and not limitation, such computer-readable medium may comprise RAM, ROM, EEPROM, CD-ROM, or other optical disk storage, solid-state or magnetic disk storage, or other magnetic storage devices, or any other medium that can be used to carry or store desired program code in the form of instructions or data structures and that can be accessed by a computer. Disk (disk) and disk (disc), as used herein, include compact discs (CD), laser disc, optical disc, digital versatile disc (DVD), floppy disc, and Blu-ray disc where the discs ( disks) normally reproduce data magnetically, whereas discs (dises) reproduce data optically with lasers. Combinations of the above should also be included within the scope of computer-readable medium. Any processor and storage medium can reside in an ASIC. The ASIC can reside in a user terminal. Alternatively, the processor and storage medium can reside as discrete components in a user terminal.

As used herein, computer program products comprising computer-readable media include all forms of computer-readable medium except, to the extent that such medium is considered to be non-established transient propagation signals. The scope of the present invention is defined in the appended claims.

Claims

1. Method for monitoring content uploaded / shared in applications or computer platforms, the method comprises: a) taking at least one screen capture, by a computing device, of the interface of a computer application or a computer platform when a first user uploads or shares a file, with at least one second user, in or through said application or computer platform; b) extracting, by the computing device, a text from said captured image, which is at least one, by applying an optical character recognition algorithm, providing a text file; and c) obtaining, through the computing device, different information from said text file to reduce blind spots in monitoring the upload / sharing of the file.

The method of claim 1, wherein said information obtained in step c) includes one or more of: file name, file type, name or identifier of the first user, name or identifier of the second user, instant of time in which the upload / share is performed, file size, file preview and / or communication channel used.

3. The method of the preceding claims, wherein said capture is performed automatically at the instant of time in which the computing device detects an action of attaching, dragging or dropping said file on said interface.

4. The method of the preceding claims, wherein step a) further comprises capturing a characteristic image of the first user and / or the second user, wherein said characteristic images are included in the screenshot made.

5. The method of the preceding claims, wherein prior to performing step b), the screenshot made is stored in a memory of the computing device.

6. The method of claim 5, wherein said storage is temporary.

The method of claim 2, wherein the information obtained in step c) is stored in a memory of the computing device, and wherein the method comprises also compare the name of the uploaded / shared file with a previously stored file of the same name.

The method of claim 2, wherein the information obtained in step c) is stored in a memory of the computing device, and wherein the method further comprises identifying actions on the uploaded / shared file and / or detecting possible uses inappropriate or unauthorized of the same.

9. Computer program including code instructions that when implemented in a computing device implement a method according to any one of claims 1 to 8.