Network aware endpoint data loss protection for Web transactions

Abstract

A method for network aware endpoint data loss protection (DLP) in Web transactions is performed by a system and device, the method including implementing the DLP on an endpoint device and concentrating on Web traffic events from a Web browser while also associating the events with a network source entity. File download and upload events are intercepted from an operating system by a file system filter that determines that a process that creates the event is a Web browser based on a process identifier and compares a process name with a process executable signature. A uniform resource locator (URL) from the current tag or session is retrieved for the Web browser. Policy of the event is evaluated via a policy server or via a cache, and additional data from the file is provided for policy decisions if necessary. DLP actions taken via a file system filter to block or allow events, including encrypted file data, are decided based on a policy.

Description

Background Art

[0001] Current data loss prevention (DLP) solutions are either network-based (e.g., through a proxy), or endpoint-based (e.g., present on the client computer). Network-based solutions lack visibility into all events without the client present. Some solutions utilize injected JavaScript code (from Oracle) to run on the client device to emulate or enforce client-side controls. This JavaScript code can affect performance and user experience when browsing websites, and requires significant computing resources from the DLP provider and host. On the other hand, endpoint DLP solutions cannot associate DLP activities such as downloads and uploads with network resources and applications due to the complexity involved. Summary of the invention

[0002] This Summary is provided to introduce a selection of concepts in a simplified form that are further described below in the Detailed Description. This Summary is not intended to identify key features or essential features of the claimed subject matter, nor is it intended to be used to limit the scope of the claimed subject matter.

[0003] A method for network-aware endpoint data loss prevention (DLP) in web transactions is performed by a system and device, including implementing DLP on an endpoint device and focusing on web traffic events from a web browser while associating the events with a network source entity. File download and upload events are intercepted from the operating system by a file system filter, which determines that the process that created the event is a web browser based on a process identifier and compares the process name and process executable signature. The uniform resource locator (URL) from the current tab or session is retrieved from the web browser by querying an open tab database. The policy of the event is evaluated via a policy server or cache, and additional data from the file is provided for policy decisions when necessary. DLP actions taken via the file system filter to block or allow the event (including encrypting the file data) are based on the policy decision.

[0004] Further features and advantages of various examples as well as structures and operations will be described in detail below with reference to the accompanying drawings. Note that these ideas and techniques are not limited to the specific examples described herein. Such examples are presented herein for illustrative purposes only. Based on the teachings contained herein, other examples will be apparent to those skilled in the relevant art. BRIEF DESCRIPTION OF THE DRAWINGS

[0005] The accompanying drawings, which are incorporated herein and form a part of the specification, illustrate embodiments of the present application and, together with the description, further serve to explain the principles of the embodiments and enable those skilled in the relevant art to make and use the embodiments.

[0006] Figure 1 A block diagram of a system for network-aware endpoint data loss prevention (DLP) in Web transactions is shown according to an example embodiment.

[0007] Figure 2 A block diagram of a computing system configured for network-aware endpoint DLP in Web transactions is shown according to an example embodiment.

[0008] Figure 3 A flow diagram of network-aware endpoint DLP in web transactions is shown according to an example embodiment.

[0009] Figure 4 A flow diagram of network-aware endpoint DLP in web transactions is shown according to an example embodiment.

[0010] Figure 5 A flow diagram of network-aware endpoint DLP in web transactions is shown according to an example embodiment.

[0011] Figure 6 A flow diagram of network-aware endpoint DLP in web transactions is shown according to an example embodiment.

[0012] Figure 7 A flow diagram of network-aware endpoint DLP in web transactions is shown according to an example embodiment.

[0013] Figure 8 A flow diagram of network-aware endpoint DLP in web transactions is shown according to an example embodiment.

[0014] Fig. 9 A block diagram is shown of an example mobile device that can be used to implement an embodiment.

[0015] Fig.10 A block diagram of an example computing device that may be used to implement an embodiment is shown.

[0016] The features and advantages of the embodiments will become more apparent from the detailed description set forth below in conjunction with the accompanying drawings, in which the same reference numerals identify corresponding elements throughout. In the accompanying drawings, the same reference numerals generally indicate identical, functionally similar, and / or structurally similar elements. The drawing in which an element first appears is indicated by the leftmost digit in the corresponding reference numeral. DETAILED DESCRIPTION I. Introduction

[0017] The following detailed description discloses a number of embodiments. The scope of this patent application is not limited to the disclosed embodiments, but covers combinations of the disclosed embodiments and modifications to the disclosed embodiments.

[0018] References in the specification to "one embodiment," "an embodiment," "an example embodiment," etc. indicate that the described embodiment may include a particular feature, structure, or characteristic, but every embodiment may not necessarily include the particular feature, structure, or characteristic. Furthermore, such phrases do not necessarily refer to the same embodiment. Furthermore, when a particular feature, structure, or characteristic is described in conjunction with an embodiment, such feature, structure, or characteristic may be implemented in conjunction with other embodiments, whether or not explicitly described.

[0019] In the discussion, unless otherwise indicated, adjectives such as "substantially," "approximately," and "about" modifying a feature or condition or relational characteristic of a feature of an embodiment of the present disclosure are understood to mean that the condition or characteristic is defined within an acceptable tolerance for the operation of the embodiment for its intended application.

[0020] Furthermore, it should be understood that the spatial descriptions used herein (e.g., "above," "below," "up," "left," "right," "lower," "top," "bottom," "vertical," "horizontal," etc.) are for illustrative purposes only, and that actual implementations of the structures and diagrams described herein may be spatially arranged in any orientation or manner. Additionally, the drawings may not be provided to scale, and the orientation or organization of the elements of the drawings may vary in embodiments.

[0021] Many exemplary embodiments are described below. It should be noted that any section / subsection headings provided herein are not intended to be limiting. Embodiments are described throughout this document, and any type of embodiment may be included under any section / subsection. In addition, the embodiments disclosed in any section / subsection may be combined in any manner with any other embodiments described in the same section / subsection and / or different sections / subsections.

[0022] Section II below describes example embodiments for network-aware endpoint DLP in web transactions. Section III below describes example mobile and computing device embodiments that can be used to implement features of the embodiments described herein. Section IV below describes other examples and advantages, and Section V provides some concluding remarks. II. Example Aspects of Network-Aware Endpoint DLP in Web Transactions

[0023] Data loss prevention (DLP) technology provides different network-based and endpoint-based implementations for protecting data in network and Internet communications. DLP solutions strive to minimize data leakage and malicious content infiltration of computing systems and networks. The embodiments of this article provide network-aware endpoint DLP, which can achieve the advantages of both network-based and endpoint-based DLP in Web transactions without causing the disadvantages of either side.

[0024] One example of these embodiments is to implement a file system filter at the operating system (OS) level. However, it should be noted that the example implementation is not restrictive but illustrative in nature. The file system filter can reside in the kernel of the OS or reside in both the kernel and user space, which can provide additional flexibility for executing operational calls for network-aware endpoint DLP in web transactions.

[0025] Embodiments herein provide for implementing DLP on an endpoint or client device and focus on web traffic events from a web browser, such as file reads and file writes at the endpoint device. While web traffic events are the focus because they involve the endpoint, the described DLP solution is also able to associate these events at the endpoint with network source entities, of which previous endpoint solutions were unaware. File download events corresponding to writes by the endpoint device and file upload events corresponding to reads by the endpoint device are intercepted from the OS and file system by a file system filter. As described above, the file system filter resides at the OS level, at least partially in the system kernel.

[0026] The file system filter determines whether the process that creates or causes the event is a web browser application. The file system filter makes these determinations based on at least a comparison of the process identifier associated with the intercepted event and the process name and the process executable signature. The file system filter identifies and retrieves the uniform resource locator (URL) of the web browser application that is determined to create or cause the event from the current label or session. The URL can be retrieved by querying the open label database of the web browser application or the web browser application itself, by reading the current session file of the web browser application, by reading the URL from the OS-level metadata file including the source information of the downloaded file, etc. The policy of the event is evaluated via a policy server or via a cache for repeated transactions, and additional data in the file is provided for policy decisions when necessary. File data for download events is buffered, rather than stored persistently, to be provided to the policy server. The DLP action taken via the file system filter blocks or allows the event, including encrypting the file data based on the policy decision.

[0027] Existing DLP solutions have several shortcomings. Network-based DLP solutions alone cannot see all DLP events. That is, because not all downloads and / or uploads are transmitted "as is" or "inline", network-based solutions lack the ability to identify various DLP events during network transmission. In addition, some existing network-based DLP solutions utilize JavaScript to perform client-side DLP controls, but this affects the performance of loading and interacting with web pages on the client side, and also requires a large resource investment to modify all JavaScript code sent from all protected applications. Client-side DLP exists to alleviate these problems, but it also has its own shortcomings. Although endpoint DLP solutions are able to check DLP controls on the client side, such implementations cannot associate DLP events with web activities, which prevents endpoint DLP solutions from considering remote device identities.

[0028] Therefore, in order to avoid the above problems, the described network-aware endpoint DLP in Web transactions implemented via a file system filter supports both client-side DLP event awareness and operations and techniques for identifying relevant network-side information required for DLP policy determination and operation without generating and injecting additional code into network transmissions. Therefore, the embodiments of this document provide solutions to improve the system via network-aware endpoint DLP in Web transactions. These and other embodiments will be further described in detail below in conjunction with the accompanying drawings and the following sections / subsections.

[0029] Systems, devices, and apparatuses may be configured in various ways for network-aware endpoint DLP in web transactions. For example, Figure 1 is a block diagram of a system 100 according to an embodiment. According to an embodiment, the system 100 is configured for network-aware endpoint DLP in Web transactions. Figure 1 As shown, system 100 includes a remote computing device 102 (also referred to herein as “remote device” 102), a policy server 104, and a client computing device 108 (also referred to herein as “client device” 108) that communicate with each other via a network 110 in an embodiment. It should be noted that in various embodiments, there are different numbers of remote devices, client devices, networks, and / or policy servers, and in addition, depending on the embodiment, Figure 1 Any combination of the systems and / or components shown in are present in the system 100. For example, embodiments of the system 100 with cloud-based and / or network-based systems and devices are included herein, where the embodiments enable network-aware endpoint DLP to perform DLP in Web and / or other Web transactions.

[0030] In an embodiment, the network 110 includes different numbers and / or types of communication links connecting computing devices and hosts / servers, such as, but not limited to, the Internet, wired or wireless networks and portions thereof, point-to-point connections, local area networks, enterprise networks, cloud networks, etc. For example, as exemplarily shown, the network 110 may include the Internet, a cloud-based platform or architecture, an enterprise network, etc., and may include remote devices 102 and / or policy servers 104 at one or more geographic locations. In another example, the network 110 may be a cloud-based platform network and / or an enterprise network to which the remote device 102 and / or the client device 106 are connected via the Internet or another network. In addition, the remote device 102, the policy server 104, and / or the client device 106 may be implemented in any number or combination of network types.

[0031] In an embodiment, the remote device 102 includes one or more server computers or computing devices, which may include one or more distributed or "cloud-based" servers. In an embodiment, the remote device 102 is associated with or is part of a cloud-based service platform, and in some embodiments, the remote device 102 includes a local server in addition to or in place of a cloud-based server. The remote device 102 in various embodiments includes any number, type, or combination of other computing devices and / or computing systems, including terminals, personal computers, laptops, tablet devices, smart phones, personal digital assistants, servers, game consoles, etc., and may include internal / external storage devices for hosting services and / or applications, and / or otherwise making any type of information, data, files, programs, etc. available to client devices such as client devices 106. In addition, in various embodiments, the remote device 102 is any number, type, or combination of computing devices and / or computing systems, and any type of information, data, files, programs, and / or the like can be transmitted from the client device 106 to the remote device 102.

[0032] The remote device 102 is configured to host and execute any type of service and / or application accessed / utilized by the user of the client device 102, which service and / or application may include the transmission of data, information, files, etc., such as a DB server application, an email application / service, a document sharing service, a productivity application, etc. (not shown for brevity and illustrative clarity), and in some aspects, the remote device 102 may store and / or transmit malware / code, such as viruses, malware, etc. The remote device 102 may be a computing device or system of a cloud-based platform that hosts services, applications, etc. for tenants. According to an embodiment, the remote device 102 also includes additional components (not shown for brevity and illustrative clarity), including but not limited to components and subcomponents of other devices and / or systems described herein, such as Figure 2, Fig. 9 and / or Fig.10 shown.

[0033] The policy server 104 includes one or more server computers or computing devices, which may include one or more distributed or "cloud-based" servers. In an embodiment, the policy server 104 is associated with or is part of a cloud-based service platform, and in some embodiments, in addition to or in place of a cloud-based server, the policy server 104 also includes a local server. The policy server 104 is configured to store policies and host a policy engine that evaluates events to comply with policies as described herein. As an illustrative example, a policy can be implemented via a policy server 104 that prohibits events such as uploading or downloading certain types of files, data, information, etc. (allowing or blocking such events) based on at least one or more factors (including but not limited to: the identity or type of the service / application of the remote device associated with the event, the content of the file or its content portion, data, information, etc., the identity of the user of the client device, etc.). The policy server 104 is configured to receive the above factors from the client device 106 and return a policy decision and / or determination mark. In an embodiment, the policy server 104 is configured to request additional portions of files, data, information, etc. to make a policy decision and / or determination.

[0034] In an embodiment, the client device 106 includes one or more computers or computing devices. In various embodiments, the client device 106 includes any number, type, or combination of other computing devices and / or computing systems, including terminals, personal computers, laptops, tablet devices, smart phones, personal digital assistants, servers, game consoles, etc., and may include internal / external storage devices for accessing services and / or applications, and / or otherwise uploading and / or downloading any type of information, data, files, programs, etc. to a remote device, such as the remote device 102. In an embodiment, the client device 106 is associated with a cloud-based service platform, where the client device 106 is a member of a lease. In addition, as described above, the client device 106 is configured to communicate with the remote device 102 via a Web browser application for electronic communication executed at the client device 106. The client device 106 can be configured to execute any type of operating system (OS) and any type of Web browser application.

[0035] like Figure 1As shown, the client device 106 includes a file system filter 108. In an embodiment, the file system filter 108 is an OS-level driver or filter that can reside in the kernel and / or user space of the OS implemented by the client device 106. The file system filter 108 is configured to intercept upload and download events initiated via a web browser application of the client device 106. For example, an upload event corresponds to a file read from the file system of the client device 106 OS, while a download event corresponds to a file write to the file system. These events are intercepted by the OS-level file system filter 108 to determine whether the web browser application initiated these events, and if so, to facilitate determining the processing of the events according to the policy requirements of the network-aware endpoint DLP at the client device 106. Further details about the file system filter 108 are provided below.

[0036] The client device 106 also includes additional components (not shown for the sake of brevity and illustrative clarity), including but not limited to components and subcomponents of other devices and / or systems herein, for example, as described below. Figure 2 , Fig. 9 and / or Fig.10 shown.

[0037] As noted and described herein, according to embodiments, the computing devices and systems are applicable to any type of system for network-aware endpoint DLP in web transactions. An example of the above implementation is a network or "cloud" implementation, application or service in a network architecture / platform. According to embodiments, a cloud platform includes a set of networked computing resources, including servers, routers, etc., which are configurable, shareable, provide data security, and can be accessed through a network such as the Internet. Cloud applications / services in various embodiments (such as those hosted by a remote computing device 102, etc.) are configured to run on these computing resources, typically running on an operating system running on the resources, for entities accessing the application / service locally and / or through a network. The cloud platform is configured to support multi-tenancy, where a software service based on the cloud platform serves multiple tenants, each of which includes one or more users who share common access to the software service of the cloud platform. In addition, the cloud platform is configured to support virtual machine hypervisors implemented as hardware, software and / or firmware, which run virtual machines (simulated computer systems, including operating systems) for tenants. The hypervisor presents a virtual operating platform to the tenant. In some embodiments herein, tenants of cloud-based implementation services may utilize network-aware endpoint DLP in web transactions to communicate with cloud-based servers and hosts, as described herein.

[0038] Client devices, such as client device 106, are configured in various ways to enable network-aware endpoint DLP in Web transactions via file system filter 108. For example, referring now to Figure 2 , a block diagram of a system 200 for implementing network-aware endpoint DLP in Web transactions according to an example embodiment is shown. The system 200 is configured as Figure 1 An embodiment of the system 100 is shown, for example, as a client device 106. The system 200 is described below and can be referenced Figure 1 The devices, systems, components, etc. described in the system 100.

[0039] System 200 includes computing system 202, which is an embodiment of a system, server, or computing device that implements the described file system filter and is any type of computing device or computing system as referenced elsewhere herein or otherwise known. Figure 2 As shown, computing system 202 includes one or more processors ("processors") 204, one or more of memory and / or other physical storage devices ("memory") 206, and one or more network interfaces ("network interfaces") 226. Computing system 202 includes OS 212 and web browser application 222. In an embodiment, although not shown for brevity and clarity, computing system 202 includes Figure 2 The additional software, applications and / or additional components shown in , as would be understood by a person skilled in the relevant art having the benefit of this disclosure.

[0040] According to an embodiment, the system 200 also includes additional components (not shown for the sake of brevity and illustrative clarity), including but not limited to components and subcomponents of other devices and / or systems described herein, as well as the following description of Fig. 9 and / or Fig.10 Those components and subcomponents described.

[0041] Processor 204 and memory 206 may be any type of processor circuitry and memory, respectively, described herein, and / or as will be understood by a person skilled in the relevant art having the benefit of the present disclosure. Processor 204 and memory 206 may each include one or more processors or memories, different types of processors or memories, remote processors or memories, and / or distributed processors or memories, respectively. Processor 204 may be a multi-core processor configured to execute more than one processing thread simultaneously, and the cores of processor 204 may be grouped with portions of memory 206. Processor 204 may include circuitry configured to execute computer program instructions, such as, but not limited to, embodiments of OS 212 and / or Web browser application 222, including one or more components as described herein, which may be implemented as computer program instructions to perform network-aware endpoint DLP in Web transactions as described herein.

[0042] The memory 206 may include a volatile storage portion, such as a random access memory (RAM), a cache, etc., and / or a persistent storage portion, such as a hard drive, a non-volatile RAM, etc., to store or be configured to store computer program instructions / code as described herein, as well as to store other information and data described in the present disclosure, including but not limited to OS212, kernel 210, file system filter 208, files associated with the file system 214, a process list 216, origin metadata 218, a daemon / API 220, a web browser application 222, browser data 224 and / or browser certificates and hash values ​​228, including one or more of its components as described herein, etc.

[0043] Network interface 226 may be any type or number of wired and / or wireless network adapters, modems, etc. configured to enable system 200 including computing system 202 to communicate with other systems via a network such as network 110. Figure 1 Communicate with other devices and / or systems of system 100 (including cloud networks, such as communications between computing system 202 and other devices, systems, hosts, etc.).

[0044] As described herein and as will be understood by persons skilled in the relevant art, web browser application 222 may be any type of web browser application / program configured to enable a user of computing system 202 to communicate with a remote device (e.g., a computer) via the Internet or other network. Figure 1 For example, the web browser application 222 may be Microsoft Windows® from Microsoft Corporation in Redmond, Washington. Browser, from Mozilla Corporation in San Francisco, California browser, from Apple Inc. in Cupertino, California browser, from Google Inc. in Mountain View, California The web browser application 222 executes in the system memory of the memory 206 and can store browser data 224 in the memory 206. The browser data 224 includes session / tab information for a given type of browser application, including information and data describing the current / active session, tab, instance, etc. of the web browser application 222. The browser data 224 can be updated in real time or near real time to accurately track the activities of the web browser application 222. Although a single web browser application is shown for the web browser application 222, this is for the purpose of illustrative clarity, considering that there are two or more web browser applications 222 for the embodiments herein.

[0045] Also associated with the web browser application 222 are browser certificates and hash values ​​228, which may be persisted in the memory 206. The browser certificates and hash values ​​228 include a list or other type of data structure of publisher certificates and hash values ​​corresponding to the identity of the web browser application 222 and the instance, session, and / or label thereof, and enable the file system filter 208 to verify and / or identify the instance, session, and / or label as a process that initiates or causes an event to be intercepted and processed in a web transaction for network-aware endpoint DLP, as described herein.

[0046] OS 212 may be any type of operating system and configured to be executed by computing system 202. OS 212 may be any version of Microsoft Corporation of Redmond, Washington. Apple Inc. in Cupertino, California its mobile device version, or any other operating system, such as and others Variant. In the context of a version of , the file system filter 208 may include a "minifilter" driver in the OS kernel that communicates with the file system 214 to invoke the driver's filtering functionality. Although the embodiments herein may be described and / or illustrated for a particular OS, it should be understood that similar and / or equivalent implementations of different OS aspects may be considered under the same description techniques for network-aware endpoint DLP in Web transactions. That is, the exemplary descriptions herein are non-limiting and are used to illustrate various aspects of network-aware endpoint DLP in Web transactions across different platforms and implementations without limitation.

[0047] OS 212 includes a file system 214, which is a file system configured to manage the formatting and persistent storage of data, information, and files in memory 206 of computing system 202, and a process list 216, which is a list of processes currently running on processor 204 and information associated with such processes (e.g., process identifiers, execution paths, etc.) stored in memory 206. OS 212 may also maintain metadata of the origin of files in source metadata 218, including the source origin of downloaded files such as associated URLs, and source metadata 218 may be persistently stored by OS 212 in memory 206, for example. In the context of a particular OS platform, source metadata 218 may be stored in Version In the extended attributes of the file system, In OS versions that use, for example, the New Technology File System (NTFS), the source metadata 218 may be stored in a default file system, such as Figure 2 The file system 214 in the source metadata 218. Portions of the source metadata 218 (such as the URL) may be stored at the OS level as extended file attributes and / or low-level hidden attributes of the downloaded file.

[0048] OS 212 also includes a kernel 210 running in the kernel space of OS 212, as will be understood by those skilled in the art. Kernel 210 includes file system filter 208. File system filter 208 is a network-aware OS-level driver or filter that can be Figure 1 208. For clarity and brevity of illustration, the file system filter 208 is shown as being located within the kernel 210, but the file system filter 208 may also have components outside of the kernel space residing in the user space of the OS 212, or a combination of kernel space and user space components. For example, the OS 212 may include a daemon / API 220, which includes a user space daemon configured to perform the functions and operations of the file system filter 208, including API calls for information and / or operations, and event control when the file system filter 208 intercepts events, as described herein. Equivalently, in some embodiments, for example, in In the context of Can be used to call information from the Web browser application 222, which is Exposed to

[0049] When requests to read and write files are sent to the file system 214 via the OS 212, the file system filter 208 is configured to intercept these requests (as events) and retain them if necessary so that policy determinations can be made for them. In an embodiment, the interception component of the file system filter 208 may reside in the kernel 210, while other components reside in the user space of the OS 212, for example, in the daemon process / API 220. The event may be retained when the file system filter 208 identifies that the initiator or cause of the event is a web browser (such as a web browser application 222). If the initiator of the event is determined to be a web browser application 222, the file system filter 208 is configured to retrieve a uniform resource locator (URL) corresponding to the event and the web browser application 222, and perform one or more DLP actions for the event. The DLP actions taken may be based on policy determinations, such as via a cached policy tag or by a resource such as a DLP application. Figure 1 The policy server 104 in the policy server 208 is configured to provide the URL and file data to the policy server so that the policy server can make policy determinations and receive such determinations when policy determinations are made.

[0050] Further details about the file system filter 208 are provided below. For example, we will now describe Figure 3 and 4 .

[0051] Figure 3 A flowchart 300 for network-aware endpoint DLP in web transactions is shown according to an example embodiment. Figure 2 Flowchart 300 is provided in the context of file system filter 208. Figure 4 A flow chart 400 is shown for network-aware endpoint DLP in web transactions according to an example embodiment. Figure 1 The system 100 and / or Figure 2 The system 200 in (e.g., via the file system filter 208) according to the flowchart 300 and the flowchart 400 (which may be Figure 3 300 embodiment) is run.

[0052] Based on the following description, other structural and operational examples will be apparent to those skilled in the relevant art. Figure 1 System 100 and Figure 2 The system 200 is described in flowchart 300 and flowchart 400 .

[0053] As described above, flowchart 300 illustrates file system filter 208. As shown, file system filter 208 includes event interceptor 302, event controller 304, and API 306. In an embodiment, event controller 304 and / or one or more APIs 306 may reside in the user space of OS 212, for example, in the above-described Figure 2 daemon / API 220, and the file system filter 208 is configured to communicate directly and / or indirectly (e.g., via API calls of API 306) with Figure 1 The policy server 104 and Figure 2 The OS 212 and the Web browser application 222 communicate with the user space components.

[0054] Now turn to Figure 4 , flowchart 400 begins at step 402. In step 402, an event is intercepted in the OS, which event is a read of a file or a write of a file. For example, event interceptor 302 is configured to intercept a file system (e.g., Figure 2 The event interceptor 302 includes a hook or other mechanism for monitoring calls to the file system to detect reads and writes to files managed by the file system that may be initiated by the Web browser application 222. The inclusion of a file system filter 208 in the OS 212 (e.g., at the kernel 210) enables such monitoring by the file system filter 208. When an event 308 is detected, event information 310 associated with the event 308, such as but not limited to a file name, a process identifier of the process that initiated the event 308, etc., is determined from the event 308 and passed from the event interceptor 302 to the event controller 304, which is configured to manage or process events intercepted by the event interceptor 302 of the file system filter 208, such as event 308.

[0055] As shown in flowchart 300, event controller 304 is configured to make calls 312 to API 306 when performing network-aware endpoint DLP in a Web transaction. In an embodiment, call 312 to API 306 may be made to one of API 306 in place of, in conjunction with, and / or in addition to call 312 from event controller 304 by event interceptor 302 to communicate with the event controller 304. Figure 1 The policy server 104 in the OS 212 and the components of the user space in the OS 212 (e.g., as described above for Figure 2 described) and Figure 2In the example, the event interceptor 302 and / or the event controller 304 may call one of the APIs 306 to call the user space (e.g., the file system 214) and / or the Web browser application 222 in the OS 212 to suspend or retain the read or write operation associated with the event 308 after the interception performed in the above step 402.

[0056] Reference again Figure 4 , the flowchart 400 continues at step 404, where it is determined that the process executing at the computing device and causing the event to occur is an instance of a web browser application. For example, the event controller 304 makes one or more calls 312 to the API 306 based at least on the event information 310 to retrieve information related to the process that initiated the event 308. In response, the API 306 issues a call 314 to retrieve information associated with the call 312 (and provided back via the return of the call 314), which was requested by the event controller 304. As an example, the call 312 to the API 306 can cause the API 306 to issue a call 314 to the user space of the OS 212 to determine the process identifier of the event 308 based at least on the interception and event information 310. Based at least on the determined process identifier, the instance of the web browser application 222 that caused the event 308 can be identified.

[0057] Continuing with flowchart 400, in step 406, a uniform resource locator (URL) corresponding to the event and the instance of the web browser application is retrieved. For example, based on at least the instance of the web browser application 222 associated with the event 308 determined in step 404, the URL of the event and the instance, label, and / or session of the web browser application 222 may also be determined. In an embodiment, the URL is determined according to one or more of different methods / techniques. For example, the URL may be read Figure 2 The browser data 224 in the web browser application 222 may be queried, and / or may be read, for example, via the API 306 Figure 2 The source metadata 218 in, as described in further detail below.

[0058] Finally, with respect to flowchart 400, in step 408, a data loss prevention (DLP) action is performed for the event based on at least the URL and the identifier of the file. For example, event controller 304 is configured to perform a DLP action for event 308. The DLP action taken may be based on at least the URL and the file identifier (e.g., file name, file type, etc.), and may also be based on the content of the file. In an embodiment, the URL and file identifier and / or content of the file being written or read may be examined via policy server 104 by utilizing a cached policy or cached policy decision to determine a DLP action to be taken for event 308, including but not limited to allowing event 308 to complete, blocking event 308 from completing, etc., as described in further detail below.

[0059] We will now describe Figure 5 . Figure 5 A flow chart 500 is shown for network-aware endpoint DLP in web transactions according to an example embodiment. Figure 1 The system 100 and / or Figure 2 The system 200 in FIG. 1 operates (eg, via the file system filter 208) according to the flowchart 500, which may be Figure 3 Flowchart 300 and Figure 4 Based on the following description, other structural and operational examples will be apparent to those skilled in the relevant art.

[0060] As noted above with respect to file system filter 208 in flowchart 300 and step 404 of flowchart 400, determining that web browser application 222 caused event 308 includes determining a process identifier for event 308 and identifying web browser application 222 based on the process identifier. Flowchart 500 includes further details regarding these operations and begins at step 502.

[0061] In step 502, to determine the process identifier, the process identifier is extracted from the event. For example, the event controller 304 in the flowchart 300 may receive the event information 310 of the event 308 from the event interceptor 302, as described in step 402 of the flowchart 400. The event controller 304 is configured to extract the process identifier from the event information 310.

[0062] In an example embodiment, the remaining steps of flowchart 500 provide example operations for identifying an instance of a web browser application based at least on a process identifier.

[0063] In step 504, the OS is queried for an executable path for the process identifier. For example, event controller 304 in flowchart 300 is configured to use the process identifier extracted from step 502 to execute one of API calls 312 of API 306, wherein one of API calls 314 queries OS 212, for example in user space, using the extracted process identifier, wherein OS 212 tracks executing processes in process list 216 and returns an executable path for the process from process list 216 based on at least the process identifier, as well as a hash value and a browser certificate of the instance of web browser application 222 executing as the process.

[0064] In step 506, a process having a hash value and a certificate associated therewith is identified based at least on the executable path. For example, the event controller 304 is configured to identify a process based at least on the executable path, and in an embodiment, to identify a process based on a certificate and / or a hash value. As described above, the web browser application 222 has data and information that is persistently stored in the memory 206 as a browser certificate and a hash value 228. The event controller 304 may also identify a process using the hash value and the browser certificate returned with the executable path. Once a process is identified, the hash value and the browser certificate returned with the executable path may be used to verify whether the identified process is an instance, a tab, a session, etc. of the web browser application 222.

[0065] In step 508, the hash value and certificate of the process are compared to information in a predetermined data structure of the web browser application in memory. For example, the browser certificate and hash value 228 in the user space of OS 212 can be queried through one of the calls 312 to API 306 to retrieve one of the API calls 314 with the hash value and certificate of the process. The hash value and certificate of the process in step 506 are compared to the entries in the predefined data structure of the web browser application in memory 206 to determine if there is a match. A match positively verifies that the identified process is an instance, tab, session, etc. of the web browser application 222.

[0066] Therefore, it is determined that the process executing at the computing device and causing event 308 to occur is an instance of web browser application 222 .

[0067] Embodiments of network-aware endpoint DLP for web transactions herein also include determining a remote device (e.g., Figure 1As described herein, an upload event corresponds to the reading of a file to be transferred from a client device (e.g., client device 106, computing system 202, etc.) to a remote device via a web browser application 222, while a download event corresponds to the writing of a file to be transferred from a remote device to a client device via a web browser application 222. Because the techniques herein enable "network-aware" endpoint DLP in web transactions, the URL of the application, service, etc. at the remote device is used for DLP considerations. The URL can be determined in a variety of ways without departing from the overall DLP process set forth in this specification. In this context, the following will now be described. Figure 6 .

[0068] Now go to Figure 6 , shows a flowchart 600 for network-aware endpoint DLP in web transactions according to an example embodiment. Figure 1 The system 100 and / or Figure 2 The system 200 in FIG. 1 (eg, via the file system filter 208) operates according to a flowchart 600, which may be Figure 3 Flowchart 300 and Figure 4 4. The embodiment of flowchart 400 of FIG. 400 is described, for example, according to the file system filter 208 and step 406 of flowchart 400 in the view of flowchart 300. Other structural and operational examples will be apparent to persons skilled in the relevant art(s) based on the following description.

[0069] According to an embodiment, flowchart 600 includes step 602, step 604, and step 606, and one or more of these steps may be optionally performed to perform step 406 of flowchart 400. Flowchart 600 may follow step 404 in flowchart 400 described above.

[0070] In step 602, the current session file of the web browser application is read and the URL is retrieved therefrom. Figure 2 and Figure 3 , when determining the instance of the Web browser application 222, can be read via one of the calls 312 to the API 306 from the event controller 304. Figure 2 , and the call of the related call 314 retrieves the URL from the browser data 224, as described above for flowchart 300. In an embodiment, the call of the call 314 includes identification information for the instance of the web browser application 222, so that the call can find the corresponding URL in the browser data 224.

[0071] In step 604, one or more open instances of the web browser application are queried via an application programming interface exposed to the OS. For example, the web browser application 222 is queried via one of the calls 312 to the API of the API 306 from the event controller 304, and the relevant call 314 retrieves the URL from the corresponding instance, tab, session, etc. of the web browser application 222, as noted above with respect to the flowchart 300. In an embodiment, the call of the call 314 includes identification information for the instance of the web browser application 222, so that the call can find the corresponding URL in the appropriate instance, tab, session, etc. of the web browser application 222.

[0072] In step 606, the URL is read from the OS-level metadata file including the source information of the downloaded file. For example, OS 212 can maintain and update metadata for the file source of the downloaded file in source metadata 218, including the source source of the downloaded file and the associated URL, for persistent storage of source metadata 218 in memory 206. Figure 2 The source metadata 218 in the source metadata 218 can be read via one of the calls 312 to the API of the API 306 from the event controller 304, and the related call 314 retrieves the URL from the source metadata 218, as noted above with respect to the flowchart 300. In an embodiment, the call to call 314 includes identification information of the file, so that the call can find the corresponding URL of the downloaded file in the source metadata 218.

[0073] After completing one or more optional steps of flowchart 600 , the process of flowchart 400 may proceed to step 408 .

[0074] It should be noted that although three optional steps are provided for flowchart 600, this set of steps should not be considered unique to the embodiments of the present invention, and the optional steps performed may be selected based on a specific operating scenario based on at least the following factors, such as but not limited to the event source, web browser application type, version, etc., operating system type, version, etc. and / or the like.

[0075] In various embodiments of network-aware endpoint DLP in web transactions, a policy server may be used to determine the DLP actions to take for a given event. Figure 1As described herein, the policy server 104 is configured to store policies and host a policy engine that evaluates whether an event complies with a policy as described herein. The policy may be implemented via the policy server 104, which prohibits events such as uploading or downloading certain types of files, data, information, etc. (allowing or blocking such events) based on at least one or more factors (including, but not limited to: the identity or type of the service / application of the remote device 102 associated with the event, the content of the file or its content portion, data, information, etc., the identity of the user of the client device 106, etc.). In this context, the following will describe Figure 7 and Figure 8 .

[0076] Figure 7 Flowchart 700 for network-aware endpoint DLP in web transactions according to an example embodiment is shown. Flowchart 700 Figure 1 The policy server 104 and Figure 2 is provided in the context of the file system filter 208. Figure 8 A flow chart 800 is shown for network-aware endpoint DLP in web transactions according to an example embodiment. Figure 1 The system 100 and / or Figure 2 The system 200 in FIG. 1 operates (e.g., via the file system filter 208) according to the flowchart 700 and the flowchart 800 (which may be Figure 7 Flowchart 700 and Figure 4 An embodiment of flowchart 400, such as step 408 of flowchart 400).

[0077] Other structural and operational examples will be apparent to persons skilled in the relevant art(s) based on the following description. Flowchart 700 and flowchart 800 are described below.

[0078] Figure 7 700 in the flowchart 700 includes a buffer 799, which in an embodiment is part of the memory 206 of the system 200. The buffer 799 is configured to buffer data of files associated with events for downloading / writing files, as described herein, without persistently storing the data / files. The buffer 799 can be of any size, and in an embodiment, can be configured to be a certain size, such as 50MB (although as described above, any other size of the buffer 799 can be considered), which makes it possible to buffer a certain amount of files, thereby achieving policy decision decisions, while still limiting the amount of buffered files to consider performance and / or resource utilization. The size of the buffer 799 is configurable in an embodiment.

[0079] In flowchart 700, file system filter 208 provides the URL and file identifier to policy server 104, which is configured to evaluate the DLP policy for the event, such as for Figure 3 The event 308 described in the flowchart 300 in FIG. The URL and file identifier described above with respect to the preceding figure can be provided as policy metadata 702 to the policy server 104 to make a policy decision on the event. In an embodiment, the provisioning of policy metadata 702 is performed by calling an API of API 306 and placing a corresponding API call, as described similarly above with respect to the flowchart 300.

[0080] In some scenarios, the policy server 104 is able to determine a policy decision 716 based on the provided policy metadata 702, and in such cases, provide the policy decision 716 to the file system filter 208 to take a DLP action based thereon, as described in further detail below. In other embodiments, the policy server 104 may require additional information to make its policy decision. For example, a request 704 for additional event information is transmitted from the policy server 104 to the file system filter 208. The request 704 may specify that data of a file associated with the event is provided to the policy server 104 to evaluate the policy.

[0081] For an upload event of reading a file from a client system, the file system filter satisfies the request 704, for example, via the API 306 as described herein, sending an instruction 706 to the file system 214. The instruction 706 specifies that the file is to be provided to the policy server 104, and a communication 708 including the file is provided to the policy server 104 in the file system 214. In some embodiments, a portion of the file is provided to the policy server 104, and additional iterations of the request 704, the instruction 706, and the communication 708 may be performed. Thus, the policy server 104 is able to determine a policy decision 716 and provide it to the file system filter 208.

[0082] For a download event that writes a file to the client system, request 704 is implemented by the file system filter, for example, via API 306 as described herein, to send instructions 710 to the web browser application 222, which can generate an "open" system call to initiate the beginning of the writing of the file observed by the file system filter 208. That is, the instruction 710 specifies that a "write" operation is to be performed on the file to be written to the buffer 799, and the operation begins with "open". The specified write operation can be an operation that writes a relatively small amount of file data 712 to the buffer 799 at a time. That is, multiple iterations of the write operation can be performed by reissuing instructions 710 until the size limit of the buffer 799 is reached or until the entire file is buffered, for example, when the file system filter 208 detects a "close" system call.

[0083] The file system filter 208 may use the monitoring signal 713 or other equivalent indicator of the buffer capacity to determine how many such write operations have been performed. In one embodiment, the file system filter 208 may track the number of write operations performed by the Web browser application 222 and determine the amount of file data written to the buffer 799 given the size of each write operation, rather than using the monitoring signal. In response to the entire file being written to the buffer 799, or the buffer 799 being filled, a communication 714 including at least a portion of the file is provided from the buffer 799 to the policy server 104. Thus, the policy server 104 is able to determine a policy decision 716 and provide it to the file system filter 208.

[0084] Now go to Figure 8 , flowchart 800 includes steps 802, 804, 806, and 808, and according to an embodiment, one or more of these steps may be optionally performed to perform step 408 of flowchart 400 to take DLP actions for the event. Flowchart 800 may follow step 406 in flowchart 400 described above.

[0085] In step 802, the event is allowed to complete. For example, policy server 102 may return a policy decision indicating that event 308 is allowed to complete as a DLP action taken for event 308. File system filter 208 releases the hold on the read or write operation associated with event 308 and performs the operation.

[0086] In step 804, the event is blocked from completion. For example, policy server 102 may return a policy decision indicating that event 308 is not allowed to complete and is blocked as a DLP action taken for event 308. The hold on the read or write operation associated with event 308 is released by file system filter 208, and the operation is discarded.

[0087] In step 806, data of the file associated with the event is encrypted. For example, policy server 102 may return a policy decision that allows event 308 to complete, as described for step 802, but requires that data associated with the file be encrypted for upload or download of the file. As will be appreciated by those skilled in the relevant art having the benefit of this disclosure, the file data may be buffered and encrypted prior to completion of the upload or download operation. Although not explicitly described for the sake of brevity, any type of encryption method is contemplated herein and may be performed via software and / or hardware (e.g., via a trusted platform module (TPM) or other mechanism).

[0088] In step 808, a buffer storing at least a portion of a file associated with the event is released, and the event is a write to the file. For example, as described above, a request to provide file data to policy server 104 may be received when policy server 104 requires additional information to make a policy decision. In these cases, for example, for a download / write event, the file data may be received from web browser application 222 and buffered by buffer 799 without persistently storing the file data. Referring also to flowchart 700, buffer 799 is released when a policy decision allows or blocks a download / write event for file data requested by policy server 104. Additionally, the file data in buffer 799 may be encrypted via buffer 799 before being released. III. Example Computing Device Embodiments

[0089] The embodiments described herein may be implemented in hardware or hardware in combination with software and / or firmware. For example, the embodiments described herein may be implemented as computer program codes / instructions configured to be executed in one or more processors and stored in a computer-readable storage medium. Alternatively, the embodiments described herein may be implemented as hardware logic / circuits.

[0090] As described herein, the embodiments described include but are not limited to Figure 1 System 100 and Figure 2The system 200 in, and any components and / or subcomponents described herein, and any operations and portions of the processes / flowcharts described herein, and / or other examples described herein, may be implemented in hardware or firmware or hardware with any combination of software and / or firmware, including being implemented as computer program code configured to be executed in one or more processors and stored in a computer-readable storage medium, or being implemented as hardware logic / circuitry, such as being implemented together in a system on a chip (SoC), a field programmable gate array (FPGA), an application specific integrated circuit (ASIC), a trusted platform module (TPM), etc. A SoC may include an integrated circuit chip that includes one or more of a processor (e.g., a microcontroller, a microprocessor, a digital signal processor (DSP), etc.), a memory, one or more communication interfaces, and / or other circuits and / or embedded firmware to perform its functions.

[0091] The embodiments described herein may be implemented in one or more computing devices similar to the mobile systems and / or computing devices in the fixed or mobile computer embodiments, including one or more features of the mobile systems and / or computing devices described herein and alternative features. The description of the computing devices provided herein is provided for illustrative purposes and is not intended to be limiting. As known to those skilled in the art, the embodiments may be implemented in other types of computer systems.

[0092] The embodiments described herein may be implemented in one or more computing devices similar to the mobile systems and / or computing devices in the fixed or mobile computer embodiments, including one or more features of the mobile systems and / or computing devices described herein and alternative features. The description of the computing devices provided herein is provided for illustrative purposes and is not intended to be limiting. As known to those skilled in the art, the embodiments may be implemented in other types of computer systems.

[0093] Fig. 9 900 is a block diagram of an exemplary mobile system 900 including a mobile device 902 that can implement the embodiments described herein. For example, the mobile device 902 can be used to implement any of the systems, clients, or devices or components / subcomponents thereof in the foregoing sections. Fig. 9 As shown, the mobile device 902 includes various optional hardware and software components. Any component in the mobile device 902 can communicate with any other component, although all connections are not shown for ease of illustration. The mobile device 902 can be any of a variety of computing devices (e.g., a cellular phone, a smart phone, a handheld computer, a personal digital assistant (PDA), etc.), and can allow wireless two-way communication with one or more mobile communication networks 904 (such as a cellular or satellite network) or with a local area network or a wide area network.

[0094] The mobile device 902 may include a controller or processor 910 (e.g., a signal processor, microprocessor, ASIC, or other control and processing logic circuit) for performing tasks such as signal encoding, data processing, input / output processing, power control, and / or other functions. An operating system 912 may control the allocation and use of components of the mobile device 902 and provide support for one or more application programs 914 (also referred to as "applications" or "apps"). Application programs 914 may include common mobile computing applications (e.g., email applications, calendars, contact managers, web browsers, messaging applications) and any other computing applications (e.g., word processing applications, mapping applications, media player applications).

[0095] The mobile device 902 may include a memory 920. The memory 920 may include a non-removable memory 922 and / or a removable memory 924. The non-removable memory 922 may include RAM, ROM, flash memory, a hard disk, or other well-known memory devices or technologies. The removable memory 924 may include a flash memory or a subscriber identity module (SIM) card, which is well known in the GSM communication system or other well-known memory devices or technologies (e.g., "smart cards"). The memory 920 may be used to store data and / or code for running the operating system 912 and the application 914. Example data may include web pages, text, images, sound files, video data, or other data sent to and / or received from one or more network servers or other devices via one or more wired or wireless networks. The memory 920 may be used to store subscriber identifiers, such as international mobile subscriber identities (IMSIs) and equipment identifiers, such as international mobile equipment identifiers (IMEIs). Such identifiers may be sent to network servers to identify users and devices.

[0096] A plurality of programs may be stored in the memory 920. These programs include an operating system 912, one or more application programs 914, and other program modules and program data. Examples of such application programs or program modules may include, for example, Figure 1 System 100 and Figure 2 The system 200 in and any components and / or subcomponents described herein and the flowcharts / flowcharts described herein (including portions thereof) and / or computer program logic (e.g., computer program code or instructions) of one or more of the other examples described herein.

[0097] The mobile device 902 may include a mobile TPM 992. As will be appreciated by those skilled in the relevant art having benefit of the present disclosure, the mobile TPM 992 may be a mobile device equivalent embodiment of a TPM. For example, the mobile TPM 992 may be configured to perform one or more functions or operations of the TPM of various embodiments herein.

[0098] The mobile device 902 may support one or more input devices 930, such as a touch screen 932, a microphone 934, a camera 936, a physical keyboard 938, and / or a trackball 940, and one or more output devices 950, such as a speaker 952 and a display 954. Other possible output devices (not shown) may include piezoelectric or other tactile output devices. Some devices may serve more than one input / output function. For example, a touch screen 932 and a display 954 may be combined in a single input / output device. The input device 930 may include a natural user interface (NUI).

[0099] One or more wireless modems 960 may be coupled to an antenna (not shown) and may support two-way communication between the processor 910 and external devices, as is well known in the art. The modem 960 is shown in a general form and may include a cellular modem 966 for communicating with the mobile communication network 904 and / or other radio-based modems (e.g., Bluetooth 964 and / or Wi-Fi 962). The at least one wireless modem 960 is typically configured to communicate with one or more cellular networks, such as a GSM network for data and voice communications within a single cellular network, between cellular networks, or between a mobile device and a public switched telephone network (PSTN).

[0100] The mobile device 902 may also include at least one input / output port 980, a power source 982, a satellite navigation system receiver 984, such as a global positioning system (GPS) receiver, an accelerometer 986, and / or a physical connector 990, which may be a USB port, an IEEE 1394 (Firewire) port, and / or an RS-232 port. The illustrated components of the mobile device 902 are not required or all, as any component may be deleted and other components may be added as will be appreciated by those skilled in the art.

[0101] In an embodiment, the mobile device 902 is configured to implement any of the above-described features of the flowcharts herein. Computer program logic for performing any operations, steps, and / or functions described herein may be stored in the memory 920 and executed by the processor 910 .

[0102] Fig.10An exemplary implementation of a computing device 1000 in which various embodiments may be implemented is depicted. For example, the embodiments described herein may be implemented in one or more computing devices or systems similar to computing device 1000, or in multiple instances of computing device 1000 in a fixed or mobile computer embodiment that includes one or more features and / or alternative features of computing device 1000. The description of computing device 1000 provided herein is provided for illustrative purposes and is not intended to be limiting. As known to those skilled in the art, embodiments may be implemented in other types of computer systems, servers, and / or clusters, etc.

[0103] like Fig.10 As shown, computing device 1000 includes one or more processors referred to as processor circuit 1002, system memory 1004, and bus 1006 that couples various system components including system memory 1004 to processor circuit 1002. Processor circuit 1002 is an electrical and / or optical circuit implemented as a central processing unit (CPU), microcontroller, microprocessor, and / or other physical hardware processor circuit in one or more physical hardware circuit device elements and / or integrated circuit devices (semiconductor material chips or dies). Processor circuit 1002 can execute program code stored in a computer-readable medium, such as program code of an operating system 1030, application programs 1032, other programs 1034, etc. Bus 1006 represents any one or more of several types of bus structures, including a memory bus or memory controller, a peripheral bus, an accelerated graphics port, and a processor or local bus using any of various bus architectures. System memory 1004 includes read-only memory (ROM) 1008 and random access memory (RAM) 1010. A basic input / output system 1012 (BIOS) is stored in ROM 1008 .

[0104] The computing device 1000 also has one or more of the following drives: a hard disk drive 1014 for reading from and writing to a hard disk, a disk drive 1016 for reading from or writing to a removable disk 1018, and an optical drive 1020 for reading from or writing to a removable optical disk 1022 (such as a CD ROM, DVD ROM, or other optical media). The hard disk drive 1014, the disk drive 1016, and the optical drive 1020 are connected to the bus 1006 via a hard disk drive interface 1024, a disk drive interface 1026, and an optical drive interface 1028, respectively. The drives and their associated computer-readable media provide non-volatile storage of computer-readable instructions, data structures, program modules, and other data for the computer. Although a hard disk, a removable disk, and a removable optical disk are described, other types of hardware-based computer-readable storage media may be used to store data, such as flash memory cards, digital video disks, RAM, ROM, and other hardware storage media.

[0105] A plurality of program modules may be stored on a hard disk, a magnetic disk, an optical disk, a ROM, or a RAM. The programs include an operating system 1030, one or more application programs 1032, other programs 1034, and program data 1036. The application programs 1032 or other programs 1034 may include, for example, computer program logic (e.g., computer program code or instructions) for implementing the embodiments described herein, such as but not limited to Figure 1 System 100 and Figure 2 The system 200 in, and any components and / or subcomponents described herein, and the flowcharts / flowcharts described herein, including portions thereof and / or other examples described herein.

[0106] A user may enter commands and information into the computing device 1000 through input devices such as a keyboard 1038 and a pointing device 1040. Other input devices (not shown) may include a microphone, a joystick, a game pad, a satellite dish, a scanner, a touch screen and / or touchpad, a voice recognition system for receiving voice input, a gesture recognition system for receiving gesture input, etc. These and other input devices are typically connected to the processor circuit 1002 through a serial port interface 1042 coupled to the bus 1006, but may be connected by other interfaces, such as a parallel port, a game port, or a universal serial bus (USB).

[0107] Display screen 1044 is also connected to bus 1006 via an interface such as video adapter 1046. Display screen 1044 may be external to computing device 1000 or incorporated into computing device 1000. Display screen 1044 may display information, as well as be a user interface for receiving user commands and / or other information (e.g., by touch, finger gestures, a virtual keyboard, etc.). In addition to display screen 1044, computing device 1000 may also include other peripheral output devices (not shown), such as speakers and printers.

[0108] The computing device 1000 is connected to a network 1048 (e.g., the Internet) through an adapter or network interface 1050, a modem 1052, or other means for establishing communications over the network. The modem 1052 may be internal or external and may be connected to the bus 1006 via the serial port interface 1042, such as a serial bus. Fig.10 As shown, or another interface type including a parallel interface may be used to connect to bus 1006.

[0109] TPM 1054 can be connected to bus 1006 and can be any embodiment of a TPM as will be understood by those skilled in the relevant art having the benefit of this disclosure. For example, TPM 1054 can be configured to perform one or more functions or operations of the TPM of various embodiments herein.

[0110] As used herein, the terms "computer program medium", "computer readable medium", "computer readable storage medium", and "computer readable storage device" are used to refer to physical hardware media. Examples of such physical hardware media include hard disk drives 1014, removable disks 1018, removable optical disks 1022, other physical hardware media (such as RAM, ROM, flash memory cards, digital video disks, zip disks, MEMs, nanotechnology-based storage devices), and other types of physical / tangible hardware storage media (including Fig.10 The computer readable medium and / or storage medium is distinguished from and does not overlap with the communication medium and propagation signal (excluding the communication medium and the propagation signal). The communication medium contains computer readable instructions, data structures, program modules, or other data in a modulated data signal (such as a carrier wave). The term "modulated data signal" refers to a signal having one or more characteristics set or changed in a manner that encodes the information in the signal. By way of example and not limitation, the communication medium includes wireless media such as acoustic, RF, infrared and other wireless media and wired media. Embodiments also relate to such communication media, which are separate from and do not overlap with the embodiments for computer readable storage media.

[0111] As described above, computer programs and modules (including application programs 1032 and other programs 1034) can be stored on a hard disk, disk, optical disk, ROM, RAM or other hardware storage medium. Such computer programs can also be received via network interface 1050, serial port interface 1042 or any other interface type. Such computer programs, when executed or loaded by an application, enable computing device 1000 to implement the features of the embodiments discussed herein. Therefore, such computer programs represent controllers of computing device 1000.

[0112] Embodiments also relate to computer program products including computer codes or instructions stored on any computer readable medium or computer readable storage medium. Such computer program products include hard drives, optical drives, memory device packages, portable memory sticks, memory cards, and other types of physical storage hardware. IV. Additional Examples and Advantages

[0113] As described, systems and devices embodying the techniques of this document may be configured and enabled in various ways to perform their respective functions for network-aware endpoint data loss prevention (DLP) in Web transactions. In an embodiment, one or more steps or operations of any flowchart and / or flowchart described herein may not be performed. In addition, steps or operations other than those in any flowchart and / or flowchart described herein may be performed. In addition, in an example, one or more operations of any flowchart and / or flowchart described herein may be performed out of order, in an alternating order, or partially (or completely) simultaneously with each other or with other operations.

[0114] As described herein, systems, devices, components and the like of the embodiments configured to perform the functions and / or operations are also considered to perform such functions and / or operations.

[0115] According to the described embodiments of network-aware endpoint DLP for use in web transactions, the endpoint DLP solution is network-aware, thereby providing knowledge to local clients to associate network activity with uploads and downloads, while also having knowledge of client-side activity. In addition, the described embodiments provide both network-side and client-side knowledge without injecting code previously required to handle recent changes in web transport formats, thereby reducing computational and bandwidth overhead. The embodiments herein utilize unique implementations and methods for network-aware endpoint DLP in network transactions that were not previously applicable to software-based DLP solutions, let alone the specific embodiments described herein that are performed at the OS level by file system filters. The described embodiments are also applicable to different types of web browser applications and operating system types.

[0116] In some alternative embodiments, the library may be injected into a running process (eg, an application) to force the process to perform the functions and operations associated with the embodiments described herein.

[0117] The additional examples and embodiments described in this section may be applicable to the examples disclosed in any other sections or subsections of the present invention.

[0118] Embodiments in this specification provide systems, devices, and methods for network-aware endpoint DLP in web transactions. For example, a method performed by a file system filter in an operating system (OS) of a computing device is described herein for such embodiments. The method includes intercepting an event in the OS, the event being a read or write to a file, determining that a process executing at the computing device and causing the event to occur is an instance of a web browser application, retrieving a uniform resource locator (URL) corresponding to the event and the instance of the web browser application, and performing a data loss prevention (DLP) action for the event based at least on the URL and an identifier of the file.

[0119] In an embodiment of the method, determining that the process executing at the computing device and causing the event to occur is an instance of a web browser application includes: determining a process identifier for the event based at least on the interception and event information; and identifying the instance of the web browser application based at least on the process identifier.

[0120] In an embodiment of the method, determining a process identifier includes extracting the process identifier from an event, and identifying an instance of a web browser application includes: querying an OS for an executable path for the process identifier; identifying the process based at least on the executable path, the process having a hash value and a certificate associated therewith; and comparing the hash value and the certificate of the process to information in a predetermined data structure of the web browser application in memory.

[0121] In an embodiment of the method, retrieving the URL includes at least one of: reading a current session file of the web browser application and retrieving the URL therefrom, querying the web browser application for one or more open instances thereof via an application programming interface exposed to the OS, or reading the URL from an OS-level metadata file that includes source information of the downloaded file.

[0122] In an embodiment, the method includes providing the URL and file identifier to a policy server prior to performing the DLP action, the policy server being configured to evaluate the DLP policy for the event and, in response to providing the URL and file identifier, receiving an indication of a DLP action to perform from the policy.

[0123] In this embodiment, the method includes, prior to receiving an indication of a DLP action to be performed, receiving a request for additional information from a policy server and providing at least a portion of a file associated with the event to the policy server.

[0124] In an embodiment of the method, the event is a write to a file, and providing at least a portion of the file includes enabling an instance of a web browser application to initiate a download of the file, and buffering at least a portion of the file during the download for provision to a policy server while preventing at least a portion of the file from being saved to persistent storage at the computing device.

[0125] In an embodiment of the method, the DLP action includes at least one of: allowing the event to complete, preventing the event from completing, encrypting data of a file associated with the event, or releasing a buffer storing at least a portion of a file associated with the event, the event being a write to the file.

[0126] A computing system is also described herein. In an embodiment, the system includes at least one memory storing program code, and a processing system including one or more processors, the one or more processors being configured to receive the program code from the at least one memory, and in response to at least receiving the program code, perform an operation. The operation includes intercepting an event in the OS, the event being a read or write of a file, determining that a process executing at a computing device and causing the event to occur is an instance of a Web browser application, retrieving a uniform resource locator (URL) and an instance of the Web browser application corresponding to the event, and performing a data loss prevention (DLP) action for the event based at least on the URL and an identifier of the file.

[0127] In an embodiment of the computing system, determining that a process executing at a computing device and causing an event to occur is an instance of a web browser application includes determining a process identifier of the event based at least on the intercept and event information, and identifying the instance of the web browser application based at least on the process identifier.

[0128] In this embodiment, determining a process identifier includes extracting the process identifier from an event, and identifying an instance of a web browser application includes querying an OS for an executable path for the process identifier, identifying a process based at least on the executable path, the process having a hash value and a certificate associated therewith, and comparing the hash value and the certificate of the process to information in a predefined data structure of the web browser application in a memory of the computing system.

[0129] In an embodiment of the computing system, retrieving the URL comprises at least one of: reading a current session file of the web browser application and retrieving the URL therefrom, querying the web browser application for one or more open instances of it via an application programming interface exposed to the OS, or reading the URL from an OS-level metadata file that includes source information for the downloaded file.

[0130] In an embodiment of the computing system, the processing system is configured to, in response to at least receiving the program code and before performing the DLP action: provide the URL and the file identifier to a policy server, the policy server being configured to evaluate the DLP policy for the event and, in response to providing the URL and the file identifier, receive from the policy an indication of a DLP action to perform.

[0131] In this embodiment, the processing system is configured to, in response to at least receiving the program code and prior to receiving an indication of a DLP action to be performed: receive a request for additional information from a policy server and provide at least a portion of a file associated with the event to the policy server.

[0132] In this embodiment, the event is a write to a file, and providing at least a portion of the file includes enabling an instance of a web browser application to initiate a download of the file and buffering at least a portion of the file during the download for provision to a policy server while preventing at least a portion of the file from being saved to persistent storage at the computing device.

[0133] In an embodiment of the computing system, the DLP action includes at least one of: allowing the event to complete, preventing the event from completing, encrypting data of a file associated with the event, or releasing a buffer storing at least a portion of a file associated with the event, the event being a write to the file.

[0134] Also described is a computer-readable storage medium having program instructions recorded thereon, the program instructions when executed by a processing system, a file system filter in an operating system (OS) performing a method. The method includes intercepting an event in the OS, the event being a read or write to a file, determining that a process executing at a computing device and causing the event to occur is an instance of a web browser application, retrieving a uniform resource locator (URL) to which the event and the instance of the web browser application correspond, and performing a data loss prevention (DLP) action for the event based on at least the URL and an identifier of the file.

[0135] In an embodiment of the computer-readable storage medium, determining that a process executing at a computing device and causing an event to occur is an instance of a web browser application includes determining a process identifier for the event based at least on the intercept and event information, and identifying the instance of the web browser application based at least on the process identifier.

[0136] In an embodiment of the computer-readable storage medium, retrieving the URL includes at least one of: reading a current session file of the web browser application and retrieving the URL therefrom; querying the web browser application for one or more open instances thereof via an application programming interface exposed to the OS; or reading the URL from an OS-level metadata file that includes source information of the downloaded file.

[0137] In an embodiment of the computer-readable storage medium, the event is a write to a file, and the method further includes: before performing the DLP action: providing the URL and the file identifier to a policy server, the policy server being configured to evaluate a DLP policy for the event; receiving a request for additional information from the policy server; providing at least a portion of the file associated with the event to the policy server, including: enabling an instance of a web browser application to initiate a download of the file, and buffering at least a portion of the file during the download for provision to the policy server, while preventing at least a portion of the file from being saved to a persistent storage device at the computing device; and receiving an indication of the DLP action to be performed from the policy in response to providing the URL and the file identifier. V. Conclusion

[0138] Although various embodiments of the disclosed subject matter have been described above, it should be understood that they are presented by way of example only and not limitation. Those skilled in the relevant art will appreciate that various changes in form and details may be made therein without departing from the spirit and scope of the embodiments defined in the appended claims. Therefore, the breadth and scope of the disclosed subject matter should not be limited by any of the above-described exemplary embodiments, but should be limited only in accordance with the following claims and their equivalents.

Claims

1. A method performed by a file system filter in an operating system (OS) of a computing device, the method comprising: Intercepting an event in the OS, the event being a read or write of a file; determining that the process executing at the computing device and causing the event to occur is an instance of a Web browser application; Retrieving a uniform resource locator (URL) corresponding to the event and the instance of the Web browser application; as well as A data loss prevention (DLP) action is performed for the event based on at least the URL and an identifier of the file.

2. The method of claim 1 , wherein the determining that the process executing at the computing device and causing the event to occur is the instance of the web browser application comprises: determining a process identifier for the event based at least on the interception and event information; as well as The instance of the web browser application is identified based at least on the process identifier.

3. The method of claim 2, wherein said determining said process identifier comprises extracting said process identifier from said event; as well as Wherein the identifying the instance of the Web browser application comprises: querying the OS for an executable path for the process identifier; identifying the process based at least on the executable path, the process having a hash value and a certificate associated therewith; and The hash value and the certificate of the process are compared to information in a predefined data structure of a web browser application in memory.

4. The method of claim 1, wherein the retrieving the URL comprises at least one of: Reading the current session file of the web browser application and retrieving the URL therefrom; querying the web browser application for one or more open instances thereof via an application programming interface exposed to the OS; or The URL is read from an OS-level metadata file that includes information about the source of the downloaded file.

5. The method according to claim 1, before performing the DLP action, further comprising: providing the URL and the file identifier to a policy server, the policy server being configured to evaluate a DLP policy for the event; as well as receiving, in response to said providing said URL and said file identifier, an indication of said DLP action to be performed from said policy; The DLP action includes at least one of the following: allowing said event to complete; prevents said event from completing; encrypting data of the file associated with the event; or A buffer storing at least a portion of the file associated with the event, the event being the write to the file, is released.

6. The method of claim 5, prior to receiving the indication of the DLP action to be performed, further comprising: receiving a request for additional information from the policy server; as well as At least a portion of the file associated with the event is provided to the policy server.

7. The method of claim 6, wherein the event is the writing of the file; as well as Wherein providing at least a portion of the file comprises: enabling the instance of the Web browser application to initiate downloading of the file; as well as The at least a portion of the file is buffered during the downloading for provision to the policy server while preventing the at least a portion of the file from being saved to persistent storage at the computing device.

8. A computing system comprising: at least one memory storing program code; as well as A processing system, comprising one or more processors, configured to receive the program code from the at least one memory, and in response to at least receiving the program code: Intercepting an event in the OS, the event being a read or write of a file; determining that a process executing at the computing system and causing the event to occur is an instance of a Web browser application; Retrieving a uniform resource locator (URL) corresponding to the event and the instance of the Web browser application; as well as A data loss prevention (DLP) action is performed for the event based on at least the URL and an identifier of the file.

9. The computing system of claim 8, wherein the determining that the process executing at the computing system and causing the event to occur is the instance of the web browser application comprises: determining a process identifier for the event based at least on the interception and event information; as well as The instance of the web browser application is identified based at least on the process identifier.

10. The computing system of claim 9, wherein said determining said process identifier comprises extracting said process identifier from said event; as well as Wherein the identifying the instance of the Web browser application comprises: querying the OS for an executable path for the process identifier; identifying the process based at least on the executable path, the process having a hash value and a certificate associated therewith; and The hash value and the certificate of the process are compared to information in a predefined data structure of a web browser application in a memory of the computing system.

11. The computing system of claim 8, wherein said retrieving said URL comprises at least one of: Reading the current session file of the web browser application and retrieving the URL therefrom; querying the web browser application for one or more open instances thereof via an application programming interface exposed to the OS; or The URL is read from an OS-level metadata file that includes information about the source of the downloaded file.

12. The computing system of claim 8, wherein in response to at least receiving the program code and prior to the performing the DLP action, the processing system is configured to: providing the URL and the file identifier to a policy server, the policy server being configured to evaluate a DLP policy for the event; as well as receiving, in response to said providing said URL and said file identifier, an indication of said DLP action to be performed from said policy; in, The DLP action includes at least one of the following: allowing said event to complete; prevents said event from completing; encrypting data of the file associated with the event; or A buffer storing at least a portion of the file associated with the event, the event being the write to the file, is released.

13. The computing system of claim 12, wherein in response to at least receiving the program code, and prior to receiving the indication of the DLP action to be performed, the processing system is configured to: receiving a request for additional information from the policy server; and The at least a portion of the file associated with the event is provided to the policy server.

14. The computing system of claim 13, wherein the event is the write to the file; as well as Wherein providing at least a portion of the file comprises: enabling the instance of the Web browser application to initiate downloading of the file; as well as The at least a portion of the file is buffered during the downloading for provision to the policy server while preventing the at least a portion of the file from being saved to persistent storage at the computing system.

15. A computer-readable storage medium having program instructions recorded thereon, wherein when the program instructions are executed by a processing system, the method executed by a file system filter in an operating system (OS) according to any one of claims 8 to 14 is executed.

Images