METHOD AND APARATUS FOR MANAGING THE TRANSFER OF SENSITIVE INFORMATION TO MOBILE DEVICES

• US 20140155028A1
• Filed: 11/30/2012
• Published: 06/05/2014
• Est. Priority Date: 11/30/2012
• Status: Active Grant

• Current Assignee: Forcepoint LLC
• Original Assignee: Forcepoint LLC
• Inventors: Daniela, Ramon, Ostrer, Mark, Stoler, Michael
• Granted Patent: US 9,241,259 B2
• Time in Patent Office: Days
• US Class Current: 455/411
• CPC Class Codes: H04L 51/212 using filtering or selective blocking
• CPC Class Codes: H04L 51/234 for tracking messages
• CPC Class Codes: H04L 51/58 Message adaptation for wireless communication
• CPC Class Codes: H04L 63/0227 Filtering policies mail message filtering H04L51/212
• CPC Class Codes: H04W 12/02 Protecting privacy or anonymity, e.g. protecting personally identifiable information [PII]
• CPC Class Codes: H04W 12/121 Wireless intrusion detection systems [WIDS]; Wireless intrusion prevention systems [WIPS]

Abstract

Methods and apparatus provide data loss protection for mobile devices. In one aspect, data is analyzed by a data loss protection server to determine if it is authorized by data loss protection policies to be transferred to a mobile device. The time necessary to analyze the data may exceed a mobile device timeout value. To prevent the mobile device from timing out, the DLP server may send one or more portions of a response to the mobile device at a time interval less than the mobile device timeout value. Some portions of the response may be sent before the analyzing of the data is completed.

Claims

1. A method of preventing the loss of sensitive data, comprising:

receiving a request via a network from a mobile device for data;

filtering a data set to produce a filtered data set, the filtering based, at least in part, on properties of the mobile device; and

sending a response to the mobile device via the network, the response based, at least in part, on the filtered data set.

2. The method of claim 1, wherein the properties of the mobile device include at least one of the mobile device model number, mobile device EUN, mobile device operating system, or mobile device location.

3. The method of claim 1, wherein the properties of the mobile device include whether the mobile device is communicating over a secure channel.

4. The method of claim 1, wherein filtering the data set comprises:

initiating filter processing of the data set to produce the filtered data; and

sending a plurality of portions of the response to the network request to the mobile device in separate network messages, at an interval that is less than a mobile device timeout value and greater than a timer value, while the filter processing of the data set is in progress.

5. The method of claim 4, wherein the mobile device timeout value is based on the operating system of the mobile device.

6. The method of claim 4, wherein each of the plurality of portions include four or less bytes of data and does not include data derived from the data set.

7. The method of claim 4, wherein the timer value is greater than 500 milliseconds.

8. The method of claim 1, wherein filtering the data set comprises

initiating filter processing of the data set to produce the filtered data set;

and

while the filter processing of the data set is incomplete;

setting a timer with a duration less than a mobile device timeout value,

receiving notification that the timer has expired, and

sending a portion of the response to the mobile device in response to expiration of the timer, wherein sending the response comprises completing transmission of the response in response to the completion of filter processing of the data set.

9. The method of claim 8, wherein a portion of the response comprises at least a portion of a http header.

10. The method of claim 8, wherein a portion of the response comprises a portion of a WBXML file.

11. The method of claim 8, further comprising:

sending a server request for the data set to a server in response to receiving the request from the mobile device; and

receiving the data set from the server in response to the server request.

12. The method of claim 1, wherein filtering the data set comprises:

determining that a received email message is not authorized to be transferred to the mobile device; and

sending a block notification message in response to the determining.

13. The method of claim 12, further comprising indicating the received email message is quarantined when sending the response to the mobile device.

14. The method of claim 12, further comprising:

receiving an indication that the received email message is authorized to be transferred to the mobile device after sending the response to the mobile device;

in response to the indication, sending a first network message to the mobile device, indicating a property of the received email message has changed from a first value to a second value;

receiving a second request from the mobile device for an email data set; and

sending a response to the mobile device including the received email message.

15. The method of claim 8, wherein the receiving notification, sending of a portion, and setting of a timer are iteratively performed until filter processing of the data set is complete.

16. The method of claim 15, wherein the portions do not include email message data or attachments from the data set.

17. The method of claim 1, wherein the request is an http or https request and the response comprises an http or https response.

18. The method of claim 1, wherein the request for data requests one or more of email data, contact data, task data, calendar data, or notes data.

19. An apparatus for preventing the loss of sensitive data on a mobile device, comprising:

a processor; and

a memory operatively coupled to the processor, the memory storing;

a mobile device communication module, configured to receive a request for data from the mobile device, and

a data processing module, configured to filter a data set to produce a filtered data set, the filtering based, at least in part, on properties of the mobile device, wherein the mobile device communication module is further configured to complete a response to the mobile device based, at least in part, on the filtered data set.

20. The apparatus of claim 19, wherein the data processing module is further configured to initiate filter processing of the data set to produce the filtered data set, and the apparatus further comprises:

a connection management module configured to send one or more portions of the response to the mobile device at time intervals less than a mobile device timeout value while the filter processing of the data set is incomplete,

wherein completing the response to the mobile device comprises sending a remaining portion of the response to the mobile device in response to the completion of filter processing of the data set.

21. An apparatus for preventing the loss of sensitive data on a mobile device, comprising:

means for receiving a request for data from the mobile device;

means for filtering an data set to produce a filtered data set, the filtering based, at least in part, on properties of the mobile device; and

means for sending a complete response to the mobile device based, at least in part, on the filtered data set.

22. The apparatus of claim 21, wherein the means for filtering of the data set comprises:

means for initiating filter processing of the data set to produce the filtered data set; and

means for sending a plurality of portions of the response to the network request to the mobile device in separate network messages, at an interval that is less than a mobile device timeout value while the filter processing of the data set is in progress.

23. A non-transitory computer readable medium, storing instructions that when executed by a processor perform a method of preventing the loss of sensitive data on a mobile device, the method comprising:

receiving a request for data from the mobile device;

filtering an data set to produce a filtered data set, the filtering based, at least in part, on properties of the mobile device; and

completing a response to the mobile device based, at least in part, on the filtered data set.

24. The computer readable medium of claim 23, wherein filtering of the data set comprises

initiating filter processing of the data set to produce the filtered data set;

sending a plurality of portions of the response to the network request to the mobile device in separate network messages, at an interval that is less than a mobile device timeout value while the filter processing of the data set is in progress,

wherein completing the response comprises sending a remaining portion of the response to the mobile device in response to the completion of filter processing of the data set.