Method and system for policy based monitoring and blocking of printing activities on local and network printers

• US 20090086252A1
• Filed: 10/01/2007
• Published: 04/02/2009
• Est. Priority Date: 10/01/2007
• Status: Active Grant

• Current Assignee: McAfee, LLC
• Original Assignee: McAfee, Inc. (McAfee, LLC)
• Inventors: Werner, Eran, Zucker, Elad
• Granted Patent: US 8,446,607 B2
• Time in Patent Office: Days
• US Class Current: 358/1.140
• CPC Class Codes: G06F 21/6281 at program execution time, where the protection is within the operating system

Abstract

A method and system for data loss prevention controls and protects sensitive data from being printed in an unauthorized manner. A method for controlling printing activities implemented in a computer system comprises intercepting a print job comprising print data intended for a printer driver, delaying performance of the print job, analyzing content of the print data to determine whether to allow or cancel the print job based on a security policy, and resuming or canceling the print job based on the analysis of the content of the print data.

Claims

1. A method for controlling printing activities implemented in a computer system comprising:

intercepting a print job comprising print data intended for a printer driver;

delaying performance of the print job;

analyzing content of the print data to determine whether to allow or cancel the print job based on a security policy; and

resuming or canceling the print job based on the analysis of the content of the print data.

2. The method of claim 1, wherein the print data comprises representation of characters to be printed and the content of the print data is analyzed by:

determining whether the representation of characters to be printed is text data or other data;

when the representation of characters to be printed is other data, converting the other data to text data;

organizing the text data into lines of text; and

analyzing the organized text data using the security policy.

3. The method of claim 2, wherein the other data comprises glyphs and the glyphs are converted to text data by:

determining whether a mapping from glyph to text data is available;

when a mapping from glyph to text data is not available, generating a mapping from glyph to text data using a font of the glyphs; and

converting the glyphs to text data using the mapping from glyph to text data.

4. The method of claim 2, wherein the print data further comprises information identifying a location of each character of the text data and the text data is organized into lines of text by:

extracting the information identifying the location of each character of the text data; and

sorting the characters of the text data using the information identifying the location of each character of the text data.

5. The method of claim 1, wherein the content of the print data is analyzed using resources copied from the printer driver for which the print job was intended.

6. A system for controlling printing activities in a computer system comprising:

a processor operable to execute computer program instructions;

a memory operable to store computer program instructions executable by the processor; and

computer program instructions stored in the memory and executable to implement;

a data loss prevention printer driver to intercept a print job comprising print data intended for a printer driver, to delay performance of the print job, and to resume or cancel the print job based on an analysis of the content of the print data

a data loss prevention agent to analyze content of the print data to determine whether to allow or cancel the print job based on a security policy.

7. The system of claim 6, wherein the print data comprises representation of characters to be printed and the data loss prevention agent analyzes the content of the print data by:

determining whether the representation of characters to be printed is text data or other data;

when the representation of characters to be printed is other data, converting the other data to text data;

organizing the text data into lines of text; and

analyzing the organized text data using the security policy.

8. The system of claim 7, wherein the other data comprises glyphs and the glyphs are converted to text data by:

determining whether a mapping from glyph to text data is available;

when a mapping from glyph to text data is not available, generating a mapping from glyph to text data; and

converting the glyphs to text data using the mapping from glyph to text data.

9. The system of claim 7, wherein the print data further comprises information identifying a location of each character of the text data and the text data is organized into lines of text by:

extracting the information identifying the location of each character of the text data; and

sorting the characters of the text data using the information identifying the location of each character of the text data.

10. The system of claim 6, wherein the data loss prevention agent analyzes the content of the print data using resources copied from the printer driver for which the print job was intended, the resources copied when the data loss prevention agent is installed in the computer system.

11. The system of claim 6, wherein the data loss prevention printer driver is installed in the computer system as a dynamic replacement driver for the intended printer driver.

12. A computer program product for performing data transfer comprising:

a computer readable storage medium;

computer program instructions, recorded on the computer readable storage medium, executable by a processor, for performing the steps of

intercepting a print job comprising print data intended for a printer driver;

delaying performance of the print job;

analyzing content of the print data to determine whether to allow or cancel the print job based on a security policy; and

resuming or canceling the print job based on the analysis of the content of the print data.

13. The computer program product of claim 12, wherein the print data comprises representation of characters to be printed and the content of the print data is analyzed by:

determining whether the representation of characters to be printed is text data or other data;

when the representation of characters to be printed is other data, converting the other data to text data;

organizing the text data into lines of text; and

analyzing the organized text data using the security policy.

14. The computer program product of claim 13, wherein the other data comprises glyphs and the glyphs are converted to text data by:

determining whether a mapping from glyph to text data is available;

when a mapping from glyph to text data is not available, generating a mapping from glyph to text data; and

converting the glyphs to text data using the mapping from glyph to text data.

15. The computer program product of claim 13, wherein the print data further comprises information identifying a location of each character of the text data and the text data is organized into lines of text by:

extracting the information identifying the location of each character of the text data; and

sorting the characters of the text data using the information identifying the location of each character of the text data.

16. The computer program product of claim 12, wherein the content of the print data is analyzed using resources copied from the printer driver for which the print job was intended.