SYSTEM AND METHOD FOR PREVENTING DATA LOSS USING VIRTUAL MACHINE WRAPPED APPLICATIONS

• US 20110113467A1
• Filed: 11/10/2009
• Published: 05/12/2011
• Est. Priority Date: 11/10/2009
• Status: Active Grant

• Current Assignee: McAfee, LLC
• Original Assignee: McAfee, LLC
• Inventors: Agarwal, Sonali, Lawson Tarbotton, Lee Codel
• Granted Patent: US 9,552,497 B2
• Time in Patent Office: Days
• US Class Current: 726/1
• CPC Class Codes: G06F 21/128 involving web programs, i.e. using technology especially used in internet, generally interacting with a web browser, e.g. hypertext markup language [HTML], applets, java
• CPC Class Codes: G06F 21/53 by executing in a restricted environment, e.g. sandbox or secure virtual machine
• CPC Class Codes: G06F 21/6281 at program execution time, where the protection is within the operating system
• CPC Class Codes: H04L 63/0263 Rule management
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04L 63/205 involving negotiation or determination of the one or more network security mechanisms to be used, e.g. by negotiation between the client and the server or between peers or by selection according to the capabilities of the entities involved negotiation of communication capabilities H04L69/24

Abstract

A method in one example implementation includes selecting at least one criterion for controlling data transmission from within a virtual machine. At least one application is included within the virtual machine, which includes a policy module. The selected criterion corresponds to at least one policy associated with the policy module. The method also includes evaluating the selected criterion of the policy to permit an attempt to transmit the data from within the virtual machine. In more specific embodiments, the policy may include a plurality of criteria with a first selected criterion permitting transmission of the data to a first application and a second selected criterion prohibiting transmission of the data to a second application. In another specific embodiment, the method may include updating the policy module through an administration module to modify the selected criterion.

Claims

1. A method, comprising:

selecting at least one criterion for controlling data transmission from within a virtual machine, wherein at least one application is included within the virtual machine, and wherein the virtual machine includes a policy module, and wherein the selected criterion corresponds to at least one policy associated with the policy module; and

evaluating the selected criterion of the policy to permit an attempt to transmit the data from within the virtual machine.

2. The method of claim 1, further comprising:

updating the policy module through an administration module to modify the selected criterion.

3. The method of claim 1, further comprising:

maintaining a master image corresponding to a current version of the application;

comparing the application to the master image to determine if the application is current; and

updating the application if it is determined to not be current.

4. The method of claim 1, wherein the application is part of an application suite.

5. The method of claim 1, wherein the policy includes a plurality of selected criteria, with a first selected criterion permitting an attempt to transmit the data to a first other application and a second selected criterion prohibiting an attempt to transmit the data to a second other application.

6. The method of claim 1, wherein the selected criterion permits transmission of the data to a client device of one of a plurality of users if the client device is requesting access to the application from within a secured network environment, and prohibits transmission of the data to the client device if the client device is requesting access to the application from an unsecured network environment.

7. The method of claim 1, further comprising:

creating a log for recording an entry corresponding to data transmitted from the virtual machine.

8. The method of claim 1 further comprising:

creating protected buffers for manipulating the data within the virtual machine if the selected criterion of the policy prohibits transmission of the data, wherein the protected buffers cannot be accessed by applications outside the virtual machine.

9. The method of claim 1, further comprising:

accessing a mail client within the virtual machine;

sending an email message from the mail client within the virtual machine to a secure mail proxy;

evaluating whether an intended recipient of the email message is authorized to receive the data from the application within the virtual machine; and

extracting any data associated with the application from the email message if the intended recipient is not authorized to receive the data.

10. Logic encoded in one or more tangible media that includes code for execution and when executed by a processor is operable to perform operations comprising:

selecting at least one criterion for controlling data transmission from within a virtual machine, wherein at least one application is included within the virtual machine, and wherein the virtual machine includes a policy module, and wherein the selected criterion corresponds to at least one policy associated with the policy module; and

evaluating the selected criterion of the policy to permit an attempt to transmit the data from within the virtual machine.

11. The logic of claim 10, the processor being operable to perform operations further comprising:

updating the policy module through an administration module to modify the selected criterion.

12. The logic of claim 10, the processor being operable to perform operations further comprising:

maintaining a master image corresponding to a current version of the application;

comparing the application to the master image to determine if the application is current; and

updating the application if it is determined to not be current.

13. The logic of claim 10, wherein the policy includes a plurality of selected criteria, with a first selected criterion permitting an attempt to transmit the data to a first other application and a second selected criterion prohibiting an attempt to transmit the data to a second other application.

14. The logic of claim 10, wherein the selected criterion permits transmission of the data to a client device of one of a plurality of users if the client device is requesting access to the application from within a secured network environment, and prohibits transmission of the data to the client device if the client device is requesting access to the application from an unsecured network environment.

15. The logic of claim 10, the processor being operable to perform operations further comprising:

creating protected buffers for manipulating the data within the virtual machine if the selected criterion of the policy prohibits transmission of the data, wherein the protected buffers cannot be accessed by applications outside the virtual machine.

16. An apparatus, comprising:

at least one application operable in a system; and

a processor operable to execute instructions associated with the application, including;

selecting at least one criterion for controlling data transmission from within a virtual machine, wherein the one application is included within the virtual machine, and wherein the virtual machine includes a policy module, and wherein the selected criterion corresponds to at least one policy associated with the policy module; and

evaluating the selected criterion of the policy to permit an attempt to transmit the data from within the virtual machine.

17. The apparatus of claim 16, wherein the policy includes a plurality of selected criteria, with a first selected criterion permitting an attempt to transmit the data to a first other application and a second selected criterion prohibiting an attempt to transmit the data to a second other application.

18. The apparatus of claim 16, wherein the selected criterion permits transmission of the data to a client device of one of a plurality of users if the client device is requesting access to the application from within a secured network environment, and prohibits transmission of the data to the client device if the client device is requesting access to the application from an unsecured network environment.

19. The apparatus of claim 16 wherein the processor is operable to execute instructions further comprising:

creating protected buffers within the virtual machine for manipulating the data within the virtual machine if the selected criterion of the policy prohibits the data from being transmitted, wherein the protected buffers cannot be accessed by applications outside the virtual machine.

20. The apparatus of claim 16 wherein the processor is operable to execute instructions further comprising:

accessing a mail client within the virtual machine;

sending an email message from the mail client within the virtual machine to a secure mail proxy;

evaluating whether an intended recipient of the email message is authorized to receive data from the application within the virtual machine; and

extracting any data associated with the application from the email message if the intended recipient is not authorized to receive the data.