Method and system for policy based monitoring and blocking of printing activities on local and network printers

• US 8,446,607 B2
• Filed: 10/01/2007
• Issued: 05/21/2013
• Est. Priority Date: 10/01/2007
• Status: Active Grant

• Current Assignee: McAfee, LLC
• Original Assignee: McAfee, Inc. (McAfee, LLC)
• Inventors: Werner, Eran, Zucker, Elad
• Primary Examiner(s): Cato, Miya J
• Application Number:
  US11/905,420
• Publication Number:
  US 20090086252A1
• Time in Patent Office: 2,059 Days
• Field of Search: None
• US Class Current: 358/1.14
• CPC Class Codes: G06F 21/6281 at program execution time, where the protection is within the operating system

Abstract

A method and system for data loss prevention controls and protects sensitive data from being printed in an unauthorized manner. A method for controlling printing activities implemented in a computer system comprises intercepting a print job comprising print data intended for a printer driver, delaying performance of the print job, analyzing content of the print data to determine whether to allow or cancel the print job based on a security policy, and resuming or canceling the print job based on the analysis of the content of the print data.

Claims

1. A method comprising:

intercepting a print job, which is intended for a first printer driver, at a second printer driver, which interfaces with a data loss prevention agent;

identifying a user identity and an originating application associated with the print job;

analyzing content of print data to determine whether to allow or cancel the print job based on a security policy, wherein the security policy outlines which types of content are authorized for printing across a plurality of computer systems by certain members of an organization, and wherein the security policy outlines which types of content are prohibited from being printed by external systems outside the organization;

wherein the second printer driver prevents all data from reaching the first printer driver until the data loss prevention agent confirms that the print job is allowed; and

wherein if the print job is allowed, the second printer driver will send the print data to the first printer driver for printing.

2. The method of claim 1, wherein the print data comprises a representation of characters to be printed and the content of the print data is analyzed by:

determining whether the representation of characters to be printed is text data or other data;

when the representation of characters to be printed is other data, converting the other data to text data;

organizing the text data into lines of text; and

analyzing the organized text data using the security policy.

3. The method of claim 2, wherein the other data comprises glyphs and the glyphs are converted to text data by:

determining whether a mapping from glyph to text data is available;

when a mapping from glyph to text data is not available, generating a mapping from glyph to text data using a font of the glyphs; and

converting the glyphs to text data using the mapping from glyph to text data.

4. The method of claim 2, wherein the print data further comprises information identifying a location of each character of the text data and the text data is organized into lines of text by:

extracting the information identifying the location of each character of the text data; and

sorting the characters of the text data using the information identifying the location of each character of the text data.

5. The method of claim 1, wherein the content of the print data is analyzed using resources copied from the first printer driver for which the print job was intended.

6. A system comprising:

a processor; and

a memory operable to store computer program instructions executable by the processor such that the system is configured for;

intercepting a print job, which is intended for a first printer driver, at a second printer driver, which interfaces with a data loss prevention agent;

identifying a user identity and an originating application associated with the print job;

analyzing content of print data to determine whether to allow or cancel the print job based on a security policy, wherein the security policy outlines which types of content are authorized for printing across a plurality of computer systems by certain members of an organization, and wherein the security policy outlines which types of content are prohibited from being printed by external systems outside the organization;

wherein the second printer driver prevents all data from reaching the first printer driver until the data loss prevention agent confirms that the print job is allowed; and

wherein if the print job is allowed, the second printer driver will send the print data to the first printer driver for printing.

7. The system of claim 6, wherein the print data comprises a representation of characters to be printed and the content of the print data is analyzed by:

determining whether the representation of characters to be printed is text data or other data;

when the representation of characters to be printed is other data, converting the other data to text data;

organizing the text data into lines of text; and

analyzing the organized text data using the security policy.

8. The system of claim 7, wherein the other data comprises glyphs and the glyphs are converted to text data by:

determining whether a mapping from glyph to text data is available;

when a mapping from glyph to text data is not available, generating a mapping from glyph to text data; and

converting the glyphs to text data using the mapping from glyph to text data.

9. The system of claim 7, wherein the print data further comprises information identifying a location of each character of the text data and the text data is organized into lines of text by:

extracting the information identifying the location of each character of the text data; and

sorting the characters of the text data using the information identifying the location of each character of the text data.

10. The system of claim 6, wherein the content of the print data is analyzed using resources copied from the first printer driver for which the print job was intended, the resources copied when the data loss prevention agent is installed in the computer system.

11. The system of claim 6, wherein the second printer driver is installed in the computer system as a dynamic replacement driver for the intended first printer driver.

12. A computer program product including a non-transitory computer medium and computer instructions for performing operations, comprising:

intercepting a print job, which is intended for a first printer driver, at a second printer driver, which interfaces with a data loss prevention agent;

identifying a user identity and an originating application associated with the print job;

analyzing content of print data to determine whether to allow or cancel the print job based on a security policy, wherein the security policy outlines which types of content are authorized for printing across a plurality of computer systems by certain members of an organization, and wherein the security policy outlines which types of content are prohibited from being printed by external systems outside the organization;

wherein the second printer driver prevents all data from reaching the first printer driver until the data loss prevention agent confirms that the print job is allowed; and

wherein if the print job is allowed, the second printer driver will send the print data to the first printer driver for printing.

13. The computer program product of claim 12, wherein the print data comprises a representation of characters to be printed and the content of the print data is analyzed by:

determining whether the representation of characters to be printed is text data or other data;

when the representation of characters to be printed is other data, converting the other data to text data;

organizing the text data into lines of text; and

analyzing the organized text data using the security policy.

14. The computer program product of claim 13, wherein the other data comprises glyphs and the glyphs are converted to text data by:

determining whether a mapping from glyph to text data is available;

when a mapping from glyph to text data is not available, generating a mapping from glyph to text data; and

converting the glyphs to text data using the mapping from glyph to text data.

15. The computer program product of claim 13, wherein the print data further comprises information identifying a location of each character of the text data and the text data is organized into lines of text by:

extracting the information identifying the location of each character of the text data; and

sorting the characters of the text data using the information identifying the location of each character of the text data.

16. The computer program product of claim 12, wherein the content of the print data is analyzed using resources copied from the first printer driver for which the print job was intended.