System and method for managing data loss due to policy violations in temporary files

• US 8,671,080 B1
• Filed: 06/24/2011
• Issued: 03/11/2014
• Est. Priority Date: 09/18/2008
• Status: Active Grant

• Current Assignee: CA, Inc. (d/b/a CA Technologies) (Broadcom, Inc.)
• Original Assignee: Symantec Corporation (NortonLifeLock Inc.)
• Inventors: Upadhyay, Rajesh, Kessler, Dirk
• Primary Examiner(s): Corrielus, Jean M
• Application Number:
  US13/168,929
• Time in Patent Office: 991 Days
• Field of Search: 707/674, 707/821, 709/225, 709/224, 709/250, 726/1, 726/22, 726/26, 713/156
• US Class Current: 707/674
• CPC Class Codes: G06F 11/004 Error avoidance G06F11/07 and subgroups take precedence
• CPC Class Codes: G06F 21/552 involving long-term monitoring or reporting
• CPC Class Codes: G06F 21/556 involving covert channels, i.e. data leakage between processes inhibiting the analysis of circuitry or operation with measures against power attack G06F21/755
• CPC Class Codes: G06F 21/60 Protecting data
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: G06F 21/6245 Protecting personal data, e.g. for financial or medical purposes
• CPC Class Codes: G06F 21/6254 by anonymising data, e.g. decorrelating personal data from the owner's identification
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

A method and apparatus for managing data loss due to policy violations in temporary files is described. In one embodiment, the method includes monitoring, by a client agent, information content on a client for violations of a policy. The method further includes determining, by the client agent, that a violation of the policy has occurred for content of a temporary file of an application. In one embodiment, the policy violation of the temporary file is correlated, by the client agent, with an original file of the application.

Claims

1. A computer-implemented method comprising:

monitoring, by a client agent, information content on a client for violations of a policy;

determining, by the client agent, that a violation of the policy has occurred for content of a temporary file of an application, wherein the temporary file reflects an edited state of a corresponding original application file of the application;

correlating, by the client agent, the policy violation of the temporary file with the original application file of the application; and

reporting the policy violation with a name of the original application file, wherein correlating further comprises;

monitoring file system operations for the temporary file;

detecting that a first file system operation has occurred;

detecting that a second file system operation has occurred subsequent to the first file system operation; and

correlating the policy violation of the temporary file with the name of the original application file in response to detection of a sequence of the first and second file system operations.

2. The computer-implemented method of claim 1, wherein the reporting the policy violation comprises:

generating a report for the policy violation of the temporary file using the name of the original application file; and

sending the report to an entity.

3. The computer-implemented method of claim 2, further comprising:

monitoring the file system operations performed by a file system with a file system driver; and

reporting data indicating the monitored file system operations to a data loss prevention (DLP) agent of the client.

4. The computer-implemented method of claim 2, wherein the policy violation of the temporary file is correlated with the name of the original application file when the second file system operation occurs within a time limit relative to a time when the first file system operation occurs.

5. The computer-implemented method of claim 4, wherein the time limit is 50 milliseconds.

6. The computer-implemented method of claim 2, wherein the first file system operation is a close operation to close the temporary file, and the second operation is a rename operation to change a current name of the temporary file.

7. The computer-implemented method of claim 1, wherein the temporary file is a temporary copy of the original application file stored on a local storage medium of the client.

8. The computer-implemented method of claim 1, wherein the temporary file is a temporary copy of the original application file stored on a removable storage device coupled with the client.

9. The computer-implemented method of claim 1, wherein the temporary file is a temporary file for an application selected from the group consisting of a word processing application, a spreadsheet application, a presentation application, and a database application.

10. A computer readable storage medium that provides instructions, which when executed on a processing system cause the processing system to perform operations comprising:

monitoring, by a client agent, information content on a client for violations of a policy;

determining, by the client agent, that a violation of the policy has occurred for content of a temporary file of an application, wherein the temporary file reflects an edited state of a corresponding original application file of the application;

correlating, by the client agent, the policy violation of the temporary file with the original application file of the application and

reporting the policy violation with a name of the original application file, wherein correlating further comprises;

monitoring file system operations for the temporary file;

detecting that a first file system operation has occurred;

detecting that a second file system operation has occurred subsequent to the first file system operation; and

correlating the policy violation of the temporary file with the name of the original application file in response to detection of a sequence of file system operations that includes the first and second file system operations.

11. The computer readable storage medium of claim 10, wherein the reporting the policy violation comprises:

generating a report for the policy violation of the temporary file using the name of the original application file; and

sending the report to an entity.

12. The computer readable storage medium of claim 11, further comprising:

monitoring the file system operations performed by a file system with a file system driver; and

reporting the monitored file system operations to a data loss prevention (DLP) agent of the client.

13. The computer readable storage medium of claim 11, wherein the policy violation of the temporary file is correlated with the name of the original application file when the second file system operation occurs within a time limit relative to a time when the first file system operation occurs.

14. A client system comprising:

a memory to store information content; and

a processor coupled to the memory to cause a policy violation detector to monitor information content on the client system for violations of a policy, determine that a violation of the policy has occurred for content of a temporary file of an application, wherein the temporary file reflects an edited state of a corresponding original application file of the application, and wherein the policy violation monitor is to correlate the policy violation of the temporary file with the original application file of the application and report the policy violation with a name of the original application file, wherein the processor is configured to execute a file system driver to monitor file system operations performed by a file system and report the monitored file system operations to a file system connector of the client system, the file system connector to inform the policy violation detector of the file system operations performed on the temporary file, and the policy violation detector to detect that a first file system operation has occurred, detect that a second file system operation has occurred subsequent to the first file system operation, and correlate the policy violation of the temporary file with the name of the original application file in response to detection of a sequence of file system operations that includes the first and second file system operations.

15. The system of claim 14, wherein the policy violation detector is further to generate a report for the policy violation of the temporary file using the name of the original application file and to send the report to an entity.

16. The system of claim 14, wherein the temporary file is correlated with the name of the original application file by the detector when the second file system operation occurs within a time limit relative to a time when the first file system operation occurs.