Self-destructing content

Abstract

Protecting sensitive content, such as business critical documents or other computer files, is disclosed. In various embodiments, upon receiving an indication that a threat pattern associated with a content item has been matched, the protected content “self-destructs”, such as y rendering the content item inaccessible, e.g., at a client and or to a particular user or group of users.

What is claimed is: 
     
         1 . A method of protecting content, comprising:
 receiving, at a processor, an indication that a threat pattern associated with a content item has been matched, wherein the threat pattern includes an unauthorized attempt to access the content item; and   in response to receiving the indication that the threat pattern associated with the content item has been matched,
 sending, to a remote server, a latest version of the content item as stored at a client, and 
 auto-destructing the content item in a selected manner that corresponds to the matched threat pattern to render the content item inaccessible at the client. 
   
     
     
         2 . The method of  claim 1 , wherein the selected manner of auto-destructing the content item includes overwriting the content item as stored at the client. 
     
     
         3 . The method of  claim 1 , wherein the selected manner of auto-destructing the content item includes replacing the content item as stored at the client with an unusable format. 
     
     
         4 . The method of  claim 1 , wherein the selected manner of auto-destructing the content item includes deleting a security data required to access the content item as stored at the client. 
     
     
         5 . The method of  claim 4 , wherein the security data is associated with a key required to decrypt the content item. 
     
     
         6 . The method of  claim 1 , wherein the sending of the latest version of the content item as stored at the client comprises extracting the content item. 
     
     
         7 . The method of  claim 1 , further comprising monitoring attempts to access the content item to determine whether the threat pattern has been matched. 
     
     
         8 . The method of  claim 1 , further comprising configuring the client to monitor the content item as stored at the client to determine whether the threat pattern has been matched. 
     
     
         9 . The method of  claim 8 , wherein configuring the client to monitor the content item as stored at the client includes installing a critical content protection plugin at the client. 
     
     
         10 . The method of  claim 1 , wherein the indication that a threat pattern associated with a content item has been matched comprises an indication that an attempt has been made to access the content item at a time that was not an authorized time. 
     
     
         11 . The method of  claim 1 , wherein the indication that a threat pattern associated with a content item has been matched comprises an indication that an attempt has been made to access the content item using a system that was not an authorized system from which to access the content item. 
     
     
         12 . The method of  claim 11 , wherein the indication comprises at least in part an attempt to access the content item from an IP or other address that is not authorized. 
     
     
         13 . The method of  claim 1 , wherein the indication that a threat pattern associated with a content item has been matched comprises an indication that an attempt has been made to perform with respect to the content item an operation that is not authorized to be performed at the client. 
     
     
         14 . The method of  claim 13 , wherein the operation comprises one or more of the following: a cut operation; a copy operation; a file copy operation; an operation to open the content item using an application or reader that is not authorized; and attaching the content item to an email or other external communication. 
     
     
         15 . The method of  claim 1 , wherein the indication that a threat pattern associated with a content item has been matched comprises an indication that an attempt has been made to access the content item at a location that was not an authorized location. 
     
     
         16 . The method of  claim 1 , wherein before the content item is self-destructed, real time data of a party that attempted to access the content item is sent to one or more of a remote server or an administrator. 
     
     
         17 . The method of  claim 1 , wherein auto-destructing of the content item comprises replacing the content item with content in an unusable format. 
     
     
         18 . The method of  claim 1 , wherein auto-destructing of the content item comprises replacing the security data that is required to access the content item is rendered one or more of inaccessible, unusable, or unavailable at the client. 
     
     
         19 . A system, comprising:
 a storage device configured to store a content item; and   a processor coupled to the storage device and configured to:
 receive an indication that a threat pattern associated with the content item has been matched, wherein the threat pattern includes an unauthorized attempt to access the content item; and 
 in response to receiving the indication that the threat pattern associated with the content item has been matched,
 send, to a remote server, a latest version of the content item as stored at a client, and 
 auto-destruct the content item in a selected manner that corresponds to the matched threat pattern to render the content item inaccessible. 
 
   
     
     
         20 . The system of  claim 15 , wherein the selected manner of auto-destructing the content item includes replacing the content item as stored at the client with an unusable format. 
     
     
         21 . The system of  claim 15 , wherein the selected manner of auto-destructing the content item includes deleting a security data required to access the content item as stored at the client. 
     
     
         22 . The system of  claim 15 , wherein the processor is further configured to extract the content item in connection with sending the latest version of the content item to the remote server. 
     
     
         23 . The system of  claim 15 , wherein the processor is further configured to monitor attempts to access the content item to determine whether the threat pattern has been matched. 
     
     
         24 . A computer program product to protect content, the computer program product being embodied in a tangible non-transitory computer readable storage medium and comprising computer instructions for:
 receiving an indication that a threat pattern associated with a content item has been matched, wherein the threat pattern includes an unauthorized attempt to access the content item; and   in response to receiving the indication that the threat pattern associated with the content item has been matched,
 sending, to a remote server, a latest version of the content item as stored at a client, and 
 auto-destructing the content item in a selected manner that corresponds to the matched threat pattern to render the content item inaccessible at the client.