SYSTEMS AND METHODS FOR APPLYING DATA LOSS PREVENTION POLICIES TO CLOSED-STORAGE PORTABLE DEVICES

• US 20150237070A1
• Filed: 04/04/2014
• Published: 08/20/2015
• Est. Priority Date: 02/20/2014
• Status: Active Grant

• Current Assignee: CA, Inc. (d/b/a CA Technologies) (Broadcom, Inc.)
• Original Assignee: Symantec Corporation (NortonLifeLock Inc.)
• Inventors: Manmohan, Sarin Sumit
• Granted Patent: US 9,100,440 B1
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: G06F 21/53 by executing in a restricted environment, e.g. sandbox or secure virtual machine
• CPC Class Codes: G06F 21/604 Tools and structures for managing or administering access control systems
• CPC Class Codes: G06F 21/606 by securing the transmission between two devices or processes
• CPC Class Codes: G06F 21/62 Protecting access to data via a platform, e.g. using keys or access control rules
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04W 12/08 Access security
• CPC Class Codes: H04W 12/37 Managing security policies for mobile devices or for controlling mobile applications

Abstract

A computer-implemented method for applying data loss prevention policies to closed-storage portable devices may include (1) injecting a data loss prevention component into at least one application process that is running on a computing device, (2) intercepting, via the data loss prevention component, an attempt by the application process to transfer a file to a closed-storage portable device that is connected to the computing device, (3) identifying a data loss prevention policy that applies to the attempt by the application process to transfer the file, (4) determining that the attempt by the application process to transfer the file violates the data loss prevention policy, and (5) performing a security action in response to determining that the attempt by the application process to transfer the file violates the data loss prevention policy. Various other methods, systems, and computer-readable media are also disclosed.

Claims

1. A computer-implemented method for applying data loss prevention policies to closed-storage portable devices, at least a portion of the method being performed by a computing device comprising at least one processor, the method comprising:

injecting, into at least one application process running on the computing device, a data loss prevention component that monitors Application Programming Interface (API) calls used by the application process;

intercepting, via the data loss prevention component that monitors API calls used by the application process, an attempt by the application process to transfer a file by calling an API that facilitates transferring the file from the computing device to a closed-storage portable device that is connected to the computing device via a closed-storage protocol, wherein the closed-storage portable device contains an internally managed file system that is not accessible to the computing device;

identifying a data loss prevention policy that applies to the attempt by the application process to transfer the file;

determining that the attempt by the application process to transfer the file violates the data loss prevention policy;

performing a security action in response to determining that the attempt by the application process to transfer the file violates the data loss prevention policy.

2. The computer-implemented method of claim 1, wherein injecting the data loss prevention component into the at least one application process that is running on the computing device comprises injecting the data loss prevention component into each application process running on the computing device.

3. The computer-implemented method of claim 1, wherein intercepting the attempt to transfer the file comprises suspending the attempt by the application process to transfer the file.

4. The computer-implemented method of claim 1, wherein determining that the attempt by the application process to transfer the file violates the data loss prevention policy comprises analyzing at least one of:

a temporal characteristic of the file;

a geolocation characteristic of the file;

a characteristic of an application responsible for creating the file;

a characteristic of a user responsible for creating the file;

a characteristic of content of the file.

5. The computer-implemented method of claim 1, wherein the API comprises at least one of:

an API used to create a stream object;

an API used to create a content object.

6. The computer-implemented method of claim 1, further comprising identifying and caching metadata associated with the attempt to call the API that identifies at least one of:

the file'"'"'s name;

a file path for the file;

the file'"'"'s size;

a device name associated with the closed-storage portable device;

a device identifier associated with the closed-storage portable device;

a device manufacturer associated with the closed-storage portable device.

7. The computer-implemented method of claim 6, further comprising uniquely identifying, by analyzing the cached metadata, at least one of:

the file;

the closed-storage portable device.

8. The computer-implemented method of claim 6, further comprising sending the metadata to a data loss prevention agent that uses the metadata to:

identify the data loss prevention policy that applies to the attempt by the application process to transfer the file;

determine that the attempt by the application process to transfer the file violates the data loss prevention policy.

9. The computer-implemented method of claim 1, wherein performing the security action comprises at least one of:

scanning the file for sensitive information;

blocking the attempt by the application process to transfer the file;

logging information about the attempt by the application process to transfer the file;

notifying a security administrator about the attempt by the application process to transfer the file.

21. The computer-implemented method of claim 1, wherein the closed-storage protocol comprises at least one of:

Media Transfer Protocol (MTP);

Picture Transfer Protocol (PTP).

10. A system for applying data loss prevention policies to closed-storage portable devices, the system comprising:

an injection module, stored in memory, that injects, into at least one application process running on a computing device, a data loss prevention component that monitors API calls used by the application process;

an interception module, stored in memory, that intercepts, via the data loss prevention component that monitors API calls used by the application process, an attempt by the application process to transfer a file by calling an API that facilitates transferring the file from the computing device to a closed-storage portable device that is connected to the computing device via a closed-storage protocol, wherein the closed-storage portable device contains an internally managed file system that is not accessible to the computing device;

an identification module, stored in memory, that identifies a data loss prevention policy that applies to the attempt by the application process to transfer the file;

a determination module, stored in memory, that determines that the attempt by the application process to transfer the file violates the data loss prevention policy;

a security module, stored in memory, that performs a security action in response to determining that the attempt by the application process to transfer the file violates the data loss prevention policy;

at least one processor configured to execute the injection module, the interception module, the identification module, the determination module, and the security module.

11. The system of claim 10, wherein the injection module injects the data loss prevention component into each application process running on the computing device.

12. The system of claim 10, wherein the interception module suspends the attempt by the application process to transfer the file.

13. The system of claim 10, wherein the determination module analyzes at least one of:

a temporal characteristic of the file;

a geolocation characteristic of the file;

a characteristic of an application responsible for creating the file;

a characteristic of a user responsible for creating the file;

a characteristic of content of the file.

14. The system of claim 10, wherein the identification module identifies and caches metadata associated with the attempt to call the API that identifies at least one of:

the file'"'"'s name;

a file path for the file;

the file'"'"'s size;

a device name associated with the closed-storage portable device;

a device identifier associated with the closed-storage portable device;

a device manufacturer associated with the closed-storage portable device.

15. The system of claim 14, wherein the identification module uniquely identifies, by analyzing the cached metadata, at least one of:

the file;

the closed-storage portable device.

16. The system of claim 14, wherein the identification module sends the metadata to a data loss prevention agent that uses the metadata to:

identify the data loss prevention policy that applies to the attempt by the application process to transfer the file;

determine that the attempt by the application process to transfer the file violates the data loss prevention policy.

17. The system of claim 10, wherein the security module performs the security action by performing at least one of:

scanning the file for sensitive information;

blocking the attempt by the application process to transfer the file;

logging information about the attempt by the application process to transfer the file;

notifying a security administrator about the attempt by the application to transfer the file.

18. A non-transitory computer-readable-storage medium comprising one or more computer-executable instructions that, when executed by at least one processor of a computing device, cause the computing device to:

inject, into at least one application process that is running on the computing device, a data loss prevention component that monitors API calls used by the application process;

intercept, via the data loss prevention component that monitors the API calls used by the application process, an attempt by the application process to transfer a file by calling an API that facilitates transferring the file from the computing device to a closed-storage portable device that is connected to the computing device via a closed-storage protocol, wherein the closed-storage portable device contains an internally managed file system that is not accessible to the computing device;

identify a data loss prevention policy that applies to the attempt by the application process to transfer the file;

determines that the attempt by the application process to transfer the file violates the data loss prevention policy;

perform a security action in response to determining that the attempt by the application process to transfer the file violates the data loss prevention policy.

19. The non-transitory computer-readable-storage medium of claim 18, wherein the one or more computer-executable instructions cause the computing device to inject the data loss prevention component into each application process running on the computing device.

20. (canceled)