Data leakage prevention for resource limited device

• US 8,286,253 B1
• Filed: 11/23/2009
• Issued: 10/09/2012
• Est. Priority Date: 11/23/2009
• Status: Active Grant

• Current Assignee: Trend Micro Inc.
• Original Assignee: Trend Micro Inc.
• Inventors: Lu, Minggang, Chang, Pei, Li, Jing, Fan, Tian, Zhu, Wen
• Primary Examiner(s): Jung, David Y
• Application Number:
  US12/623,934
• Time in Patent Office: 1,051 Days
• Field of Search: None
• US Class Current: 726/26
• CPC Class Codes: G06F 16/27 Replication, distribution or synchronisation of data between databases or within a distributed database system; Distributed database system architectures therefor
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database

Abstract

When a resource-limited device (such as a mobile telephone) joins a network associated with an enterprise, the agent in the device generates digital signatures for all the files in the device and sends them to an enterprise controller. The controller compares them to the global signature database; it filters out the sensitive digital signatures and feeds them back to the agent in the device. The agent receives the feedback of digital signatures and consolidates them into its own local signature database. The agent analyzes each file that is attempting to be output from the device according to the local signature database and DLP policy. If the signature of the file is present in the local database then the action to output file is blocked. If a new file is created on the device, the agent generates and sends its digital signature to the controller for inspection. If the signature is sensitive, this new digital signature will be placed into the local signature database. If the DLP controller updates the global signature database, the device will send its signatures once again for comparison.

Claims

1. A method of creating a local signature database on a mobile computing device, said method comprising:

identifying digital files present upon a mobile computing device, said mobile computing device subject to a DLP (data leakage prevention) policy of an enterprise;

for each of said digital files, calculating a unique digital signature on said mobile device;

sending said calculated digital signatures of said digital files over a communication link from said mobile device to a computer of said enterprise having a global signature database;

receiving, from said enterprise computer, an identification of a subset of said sent calculated digital signatures, said subset deemed by said enterprise to represent sensitive files; and

creating a local signature database on said mobile device using said subset of said sent calculated digital signatures, whereby said local signature database represents a subset of said digital files present upon said mobile device that may not be transferred from said mobile device.

2. A method as recited in claim 1 wherein said sensitive files are files decided by said enterprise that may not be made available outside of said enterprise.

3. A method as recited in claim 1 wherein said identification of a subset is a subset of said sent calculated digital signatures.

4. A method as recited in claim 1 wherein said identification of a subset is a plurality of serial numbers, each serial number uniquely identifying one of said sent calculated digital signatures of said subset.

5. A method as recited in claim 1 wherein said DLP policy indicates conditions in which said sensitive files may not be transferred from said mobile device.

6. A method as recited in claim 1 further comprising:

transferring said DLP policy from said enterprise computer to a database of said mobile device.

7. A method of screening a file on a mobile computing device, said mobile computing device subject to a DLP (data leakage prevention) policy of an enterprise, said method comprising:

determining that a triggering event has occurred on said mobile computing device, said triggering event including an identification of a digital file on said mobile device;

determining that said triggering event is an event covered by said DLP policy, said DLP policy being stored in a database on said mobile device;

determining a unique characteristic of said digital file;

searching a local signature database of said mobile device to determine whether said unique characteristic of said digital file is present within said local signature database, wherein said local signature database is a subset of calculated digital signatures sent by a computer of said enterprise having a global signature database; and

when it is determined that said unique characteristic is present within said local signature database, blocking said triggering event from occurring on said mobile device.

8. A method as recited in claim 7 wherein said characteristic of said digital file is a unique digital signature of said digital file.

9. A method as recited in claim 7 wherein said characteristic of said digital file is a file name of said digital file, a timestamp of said digital file, or a file name and a timestamp of said digital file.

10. A method as recited in claim 7 wherein said triggering event is a potential action by an operating system of said mobile device attempting to transfer said digital file from said mobile device.

11. A method as recited in claim 7 further comprising:

sending a violation notice to a computer of said enterprise that includes said triggering event and a destination associated with said triggering event.

12. A method as recited in claim 7 further comprising:

downloading said DLP policy from a computer of said enterprise to said mobile device.

13. A method as recited in claim 7 wherein said local signature database includes digital signatures of a subset of all computer files present on said mobile device.

14. A method of filtering digital signatures from a mobile computing device, said method comprising:

generating a database of digital signatures, each digital signature uniquely representing a computer file within an enterprise, wherein each of said computer files is deemed a sensitive file of said enterprise;

establishing a network connection between said enterprise and a mobile computing device, wherein said mobile computing device is subject to a DLP (data leakage prevention) policy of said enterprise;

receiving a plurality of digital signatures from said mobile device, said received digital signatures representing computer files present on said mobile device;

comparing said received digital signatures with said database of digital signatures; and

returning to said mobile computing device an identification of those received digital signatures that match with any of said database of digital signatures, wherein said mobile computing device is apprised of sensitive files of said enterprise.

15. A method as recited in claim 14 wherein said sensitive files are files decided by said enterprise that may not be made available outside of said enterprise.

16. A method as recited in claim 14 wherein said identification is those received digital signatures that match with any of said database of digital signatures.

17. A method as recited in claim 14 wherein said identification is a plurality of serial numbers, each serial number uniquely identifying one of said received digital signatures.

18. A method as recited in claim 14 wherein said DLP policy indicates conditions in which said sensitive files may not be transferred from said mobile device.

19. A method as recited in claim 14 further comprising:

downloading said DLP policy from a computer of said enterprise to said mobile device.

20. A method as recited in claim 14 wherein said network connection is a wireless connection.