Data loss prevention for mobile computing devices

• US 9,894,079 B2
• Filed: 04/25/2016
• Issued: 02/13/2018
• Est. Priority Date: 10/19/2012
• Status: Active Grant

• Current Assignee: McAfee, LLC
• Original Assignee: McAfee, LLC
• Inventors: Ahuja, Ratinder Paul Singh, Singh, Balbir, Bhattacharjee, Rajbir, Kulkarni, Dattatraya
• Primary Examiner(s): Eisner, Ronald
• Application Number:
  US15/137,649
• Publication Number:
  US 20160381037A1
• Time in Patent Office: 659 Days
• Field of Search: 455 261, 455410-415, 455565, 4554041, 4554042, 4554561-457, 34053913, 340988-996
• CPC Class Codes: G06F 21/53 by executing in a restricted environment, e.g. sandbox or secure virtual machine
• CPC Class Codes: G06F 2221/2111 Location-sensitive, e.g. geographical location, GPS
• CPC Class Codes: H04L 63/107 wherein the security policies are location-dependent, e.g. entities privileges depend on current location or allowing specific operations only from locally connected terminals
• CPC Class Codes: H04W 12/033 of the user plane, e.g. user's traffic
• CPC Class Codes: H04W 12/088 using filters or firewalls
• CPC Class Codes: H04W 12/37 Managing security policies for mobile devices or for controlling mobile applications
• CPC Class Codes: H04W 12/80 Arrangements enabling lawful interception [LI]
• CPC Class Codes: H04W 4/021 Services related to particular areas, e.g. point of interest [POI] services, venue services or geofences
• CPC Class Codes: H04W 4/029 Location-based management or tracking services

Abstract

System calls to a kernel of a mobile computing device are monitored. A particular system call is intercepted relating to input/output (I/O) functionality of the mobile computing device. A data loss prevention (DLP) policy is identified that is applicable to the particular system call. An action is performed on the particular system call based at least in part on the DLP policy.

Claims

1. At least one non-transitory machine accessible storage medium having instructions stored thereon, the instructions when executed on a machine, cause the machine to:

intercept a system call involving photograph data to a kernel of a mobile computing device;

identify a location-based data loss prevention (DLP) policy applicable to use of the photograph data, at least based on a detected location of the mobile computing device; and

perform an action on the intercepted system call at least based on the location-based DLP policy and the location of the mobile computing device.

2. The non-transitory storage medium of claim 1, wherein attempts to output the photograph data while the mobile computing device is located outside of a particular geographic location are blocked based on the location-based DLP policy.

3. The non-transitory storage medium of claim 1, wherein the kernel is a Linux kernel and the particular system call is intercepted by a Linux Security Module (LSM).

4. The non-transitory storage medium of claim 1, wherein the agent is an application installed on the mobile computing device.

5. The non-transitory storage medium of claim 4, wherein the agent interfaces with a remote security server for policy information corresponding to the mobile computing device.

6. The non-transitory storage medium of claim 1, wherein the agent logic is included in a security module interfacing with the kernel.

7. The non-transitory storage medium of claim 1, wherein the particular system call includes at least one of an output of the photograph data utilizing SMS, email, near field communication (NFC), BLUETOOTH™

, and WI-FI™

functionality of the mobile computing device.

8. The non-transitory storage medium of claim 1, wherein applications of the mobile computing device capable of utilizing the photograph data are run in a process virtual machine container.

9. The non-transitory storage medium of claim 1, wherein the photograph data includes video data.

10. A method comprising:

intercepting a system call involving photograph data to a kernel of a mobile computing device;

identifying a location-based data loss prevention (DLP) policy applicable to use of the photograph data, at least based on a detected location of the mobile computing device; and

performing an action on the intercepted system call at least based on the location-based DLP policy and the location of the mobile computing device.

11. The method of claim 10, wherein identifying the location-based DLP policy includes:

querying an agent on the mobile computing device for DLP policies applicable to the photograph data; and

receiving a result from the agent identifying whether DLP policies apply to the photograph data, the result identifying the location-based DLP policy.

12. The method of claim 10, wherein the location-based DLP policy restricts access to the photograph data outside of a particular geographic area.

13. The method of claim 12, wherein the particular geographic area is defined using a geofence.

14. The method of claim 12, wherein the particular geographic area corresponds to a location where the photograph data was created.

15. The method of claim 10, wherein the system call involves an input of the photograph data and the photograph data originates from a camera on the mobile computing device.

16. The method of claim 15, wherein the action includes tagging the photograph data with location information, wherein location-based DLP policies are enforced on the photograph data based on the tagged location information.

17. The method of claim 16, wherein the location information corresponds to a location where the photograph data was captured.

18. The method of claim 17, wherein the location information corresponds to geopositional data captured using the mobile computing device at the capturing of the photograph data.

19. The method of claim 16, further comprising:

receiving a subsequent system call involving the photograph data;

identifying the location data;

communicating the location data in connection with a query of the agent for DLP policies applicable to the photograph data; and

performing an action on the subsequent system call at least based on the tagging.

20. A system comprising:

a processor device;

a memory element; and

a security manager interfacing with a kernel and adapted, when executed by the processor device to;

intercept a system call involving photograph data to a kernel of a mobile computing device;

identify a location-based data loss prevention (DLP) policy applicable to use of the photograph data, at least based on a detected location of the mobile computing device; and

perform an action on the intercepted system call at least based on the location-based DLP policy and the location of the mobile computing device.