Application group for implementing data transfer control

Abstract

According to an aspect, a method may include obtaining data loss prevention (DLP) restriction data, the DLP restriction data identifying a group resource identifier and restrictions on computer functions of a computing device associated with an organization, and the method may further include detecting a data transfer event to transfer data from a first application to a second application, identifying a group of applications using the group resource identifier, and applying the restriction to the computer functions when the first application is identified as belonging to the group of applications and the second application is identified as not belonging to the group of applications.

Description

[Technical field]

[0001] CROSS-REFERENCE TO RELATED APPLICATIONS This application is a continuation of and claims priority to U.S. Patent Application No. 18 / 064,089, filed December 9, 2022, which claims the benefit of U.S. Provisional Patent Application No. 63 / 266,142, filed December 29, 2021, the entire contents of which are incorporated herein by reference in their entirety. [Background technology]

[0002] Data loss prevention (DLP) software may be implemented by certain applications, websites, and / or third-party systems to minimize data leakage incidents. For example, a video conferencing application with DLP capabilities may detect restricted material and prevent actions from being taken regarding the restricted material, e.g., blocking a person from sharing the restricted material in a chat section or channel with external users. Computing devices associated with or managed by an organization may have a wide variety of applications, such as workspace applications (e.g., email, word processing apps, storage, calendar, etc.), video / messaging applications, productivity applications, social media applications, and various personal / enterprise applications. Traditionally, administrators may manually curate allow / block lists to restrict the transfer of data. However, as the number of applications increases, the amount and / or complexity of configuring DLP rules for individual applications may also increase, which may reduce the security of the computing device. Summary of the Invention

[0003] The present disclosure relates to a data loss prevention (DLP) system configured to enable an administrator to create one or more application groups, each application group identifying one or more applications, each application group being identifiable by a group resource identifier. Each application group defines a data transfer boundary, whereby an administrator may control the transfer of data within a particular application group and control the transfer of data out of (or into) a particular application group.

[0004] According to an aspect, a method may include obtaining data loss prevention (DLP) restriction data, the DLP restriction data identifying a group resource identifier and restrictions on computer functions of a computing device associated with an organization, and the method may further include detecting a data transfer event to transfer data from a first application to a second application, identifying a group of applications using the group resource identifier, and applying the restriction to the computer functions when the first application is identified as belonging to the group of applications and the second application is identified as not belonging to the group of applications.

[0005] According to an aspect, an apparatus comprises at least one processor and a non-transitory computer-readable medium storing executable instructions, which when executed by the at least one processor cause the at least one processor to obtain data loss prevention (DLP) restriction data, the DLP restriction data identifying a first group resource identifier, a second group resource identifier, and restrictions on computer functions of a computing device associated with the organization, and the executable instructions, when executed by the at least one processor, further cause the at least one processor to detect a data transfer event to transfer data from a first application to a second application, identify a group of the first application using the first group resource identifier, identify a group of the second application using the second group resource identifier, and apply restrictions to the computer functions in response to the first application being identified as belonging to the group of the first application and the second application being identified as belonging to the group of the second application.

[0006] According to an aspect, a non-transitory computer-readable medium stores executable instructions that, when executed by at least one processor, cause the at least one processor to perform operations. The operations include obtaining data loss prevention (DLP) restriction data, the DLP restriction data identifying a group resource identifier and restrictions on computer functions of a computing device associated with an organization, and the operations further include detecting a data transfer event for transferring data from a first application to a second application, identifying a group of applications using the group resource identifier, and applying restrictions to the computer functions when the first application is identified as belonging to the group of applications and the second application is identified as not belonging to the group of applications. The operations may include detecting a copy request from the first application, encrypting the data using an encryption key, storing the encryption key in a memory device, and generating clipboard data including the encryption key identifier and the encrypted data. The operations may include detecting a paste request from the second application and rendering a user interface (UI) object indicating that the clipboard function is blocked to transfer data from the first application to the second application. The group resource identifier includes a resource locator pattern.

[0007] In some examples, an apparatus includes at least one processor and a non-transitory computer-readable medium storing executable instructions, the executable instructions, when executed by the at least one processor, cause the at least one processor to obtain data loss prevention (DLP) restriction data, the DLP restriction data identifying a group resource identifier and restrictions on computer functions of a computing device associated with an organization, the executable instructions, when executed by the at least one processor, further cause the at least one processor to detect a data transfer event to transfer data from a first application to a second application, identify a group of applications using the group resource identifier, and determine whether to apply restrictions to the computer functions based on whether i) the first application is identified as belonging to the group of applications and the second application is identified as not belonging to the group of applications, or ii) the first application and the second application are identified as belonging to the group of applications. In some examples, a method and / or computer-readable medium product having the above operations is provided.

[0008] The details of one or more implementations are set forth in the accompanying drawings and the description below. Other features will be apparent from the description and drawings, and from the claims. [Brief description of the drawings]

[0009] [Figure 1A] 1 illustrates an example of an application group according to an aspect. [Figure 1B] 1 illustrates a data loss prevention system for controlling data transfer within and / or across application groups of managed computing devices associated with an organization, according to an embodiment. [Figure 1C] 1 illustrates an example of an application group according to an aspect. [Figure 1D]1 illustrates an example of data loss prevention (DLP) controls implemented by a managed computing device, according to an embodiment. [Figure 1E] 1 illustrates an example operation of an implementation engine of a computing device according to an aspect. [Figure 1F] 1 illustrates an example of clipboard data according to an embodiment. [Figure 1G] 1 illustrates an exemplary operation of an enforcement engine for a copy request according to an aspect. [Figure 1H] 13 illustrates an example operation of an implementation engine for a paste request according to an aspect. [Figure 1I] 1 illustrates an example of site isolation control for application groups according to an embodiment. [Diagram 2] 1 illustrates an example of an enforcement engine executable by a web browser application according to an aspect. [Figure 3A] 1 illustrates an example of an implementation engine executable by an operating system of a computing device according to an aspect. [Figure 3B] 1 illustrates an example of an operating system having an implementation engine according to an aspect. [Figure 4] 1 illustrates an example of an administrator user interface for defining application groups, according to an aspect. [Figure 5A] 1 illustrates an example of an administrator user interface for data transfer restrictions including application groups, according to an aspect. [Figure 5B] 13 illustrates an example of an administrator user interface for data transfer restrictions with application groups, according to another aspect. [Figure 6] 13 illustrates an example of an administrator user interface for data transfer restrictions with application groups, according to another aspect. [Figure 7] 1 illustrates a flowchart illustrating an example operation of a data loss prevention system according to an aspect. [Figure 8]FIG. 1 is a block diagram illustrating an example or representative computing device and associated elements that may be used to implement the systems and methods discussed herein, according to an aspect. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0010] The present disclosure relates to a data loss prevention (DLP) system that provides a technical solution of creating one or more application groups, each application group identifying one or more applications, each application group being identifiable by a group resource identifier. Each application group defines a data transfer boundary, whereby an administrator may control the transfer of data within a particular application group and control the transfer of data out of (or into) a particular application group. The DLP system provides the technical advantage of increasing enforcement of data transfer controls, reducing unauthorized data flows across data transfer boundaries, and / or the ability to enforce additional protections on applications within a particular application group. Additionally, the DLP system provides the technical advantage of reducing the complexity of configuring DLP restrictions across a wide variety of applications using group resource identifiers, which may be used in DLP controls generally to apply data transfer restrictions to application groups without the need to manually configure each application. Additionally, the technical advantages may include reduced complexity and / or reduced resource usage within a group (e.g., data transfers may be permitted within a particular group, thereby circumventing DLP control checks and restrictions on data transfer requests for the group).

[0011] Each application group is associated with data transfer properties that define data transfer controls for data transferred outside the application group (and / or within the application group) and / or data transfer controls for data transferred within applications in the particular application group. The data transfer properties can define restrictions on computer functions such as downloading / uploading files, clipboard functions (copy, cut, paste, etc.), printing, and / or screenshots, screencasts, and / or electronic privacy filters. A computer function can be an action performed by a computer on data that may be displayed in a user interface (e.g., transfer, capture, copy, store, or display, etc.). In some examples, the data transfer properties can indicate that data can be freely transferred between applications in a particular application group, but when transferring data from an application in the application group to an application (or a particular application group) outside the application group, the data transfer is restricted (e.g., block, warn, report, scan, etc.). In some examples, the data transfer properties can enable clipboard functions for data transferred within applications in a particular group, but disable clipboard functions for data transferred to applications (or a particular application group) outside the particular application group.

[0012] The creation of an application group creates a data transfer boundary, which is a virtual boundary that includes one or more applications. In some examples, the application group is defined by multiple application identifiers, each application identifier uniquely identifying a particular application. In some examples, the application identifier is a Uniform Resource Locator (URL). However, the application identifier may be any type of identifier that can uniquely identify an application, such as an executable file name or other identifier. The DLP system generates a group resource identifier that identifies the application group. In some examples, the group resource identifier is a URL pattern. In some examples, the group resource identifier may be interchangeable with the application identifier. For example, a group may include another group identifier as one of its components. In other words, an application group may include a list of one or more application identifiers, one or more of which may be another group resource identifier. The group resource identifier may be used within one or more DLP controls.

[0013] An administrator may define one or more DLP controls that can cause a computing device to report, restrict, modify, and / or block certain computer functions performed with respect to controlled content affected by a data transfer event. After the DLP controls are defined, they may be sent (e.g., uploaded) to one or more computing devices associated with the organization, for example, via a server computer, so that they can be implemented on each computing device. For example, the DLP controls may be sent (e.g., uploaded) to a server computer and then sent (e.g., downloaded) to the computing device(s). The sending (e.g., downloading) to the computing device may ensure that the DLP controls can be applied even when the device is offline. Furthermore, one or more of the DLP controls may be updated and these updates may be propagated to individual computing devices in a relatively fast manner, so that changes to the DLP controls may be quickly implemented at a local level, which may enhance the security of the computing device. In some examples, the DLP controls may not be sent (e.g., downloaded) to the computing device (e.g., the DLP controls are pre-configured on the computing device).

[0014] A DLP control may define a source location and / or destination location, a computer function (e.g., file download, file upload, copy, paste, screen capture, print, etc.), and a restriction on the computer function (e.g., block, report, warn, scan, edit, etc.). On the computing device, an enforcement engine may detect a data transfer event to transfer data from a source location to a destination location. If the source location identified by the data transfer event matches a source location in the DLP control, the enforcement engine may enable the restriction on the specified computer function.

[0015] The DLP control may specify a group resource identifier for each application group. In some examples, the enforcement engine may apply a data transfer restriction when the source location is an application that belongs to the application group identified by the group resource identifier and the destination location is an application that is not part of the application group. For example, the enforcement engine may use the group resource identifier to identify which applications are part of the application group. In some examples, the group resource identifier is a URL pattern, and the enforcement engine uses the URL pattern to obtain application identifiers that are part of the application group. If the source location of the data transfer event corresponds to one of the application identifiers, the enforcement engine may enable the specified restriction.

[0016] DLP systems may provide technical advantages in that they simplify extension and permission management. For example, application groups may include extension data that defines which extensions are allowed (or not allowed) to be installed for applications in the respective application group. In some examples, application groups are not associated with extension data, but rather DLP policies may define restrictions on extensions and reference one or more application groups by their group resource identifiers. Application groups may also include permission data that defines which device permissions are allowed (or not allowed) for each application. Instead of configuring which extensions and / or device permissions are allowed (or not allowed) for each individual application, management of extension and device permissions is simplified using application groups.

[0017] In some examples, the enforcement engine is executed by a web browser, but some clipboard functions may be executed by components of the operating system. Thus, in some examples, the system may encounter a technical problem of enforcing restrictions on computer functions executed by the web browser and one or more components (e.g., clipboard manager, window manager, etc.) of the operating system. Furthermore, when a copy request is detected, it is unknown whether the transfer of the content will be restricted because the destination location is not yet known. The DLP system provides a technical solution that encrypts clipboard data in response to detecting a copy request from a first application and stores an encryption key in a memory device. The clipboard data is transferred to a computer clipboard of the operating system, and the clipboard data includes the encrypted content, a source location that may identify the first application, and an encryption key identifier that enables retrieval of the encryption key from the memory device. For example, the encryption key identifier may identify the location of the encryption key. Upon detecting a paste request, the enforcement engine may detect the destination location (second application) and determine whether restrictions on the clipboard function are disabled / enabled based on, for example, the source location, the destination location, and the stored DLP controls. If enabled, the enforcement engine may use the encryption key identifier to retrieve the encryption key from the memory device and decrypt the encrypted content, which is then transferred to the second application.

[0018] 1A-1I illustrate an example data loss prevention (DLP) system 100 according to an embodiment. The DLP system 100 may define one or more application groups 125, where each application group 125 identifies one or more applications 142, and where each application group 125 is identifiable by a group resource identifier 113. Each application group 125 may represent a data transfer boundary, allowing an administrator to control the transfer of data within a particular application group 125 and to control the transfer of data out of (or into) a particular application group 125.

[0019] The DLP system 100 includes a computing device 132 associated with an administrator of an organization, where the administrator may define or select application groups 125, one or more DLP controls 118, and device identification data 120 that identifies which computing devices 152 are subject to the DLP controls 118. The DLP system 100 includes a server computer 102 having a DLP engine 114 configured to receive and store the application groups 125, the DLP controls 118, and the device identification data 120 on the server computer 102. The DLP system 100 includes one or more computing devices 152 (associated with the organization) configured to receive the DLP controls 118 (and in some examples, information from the application groups 125) from the DLP engine 114. The computing devices 152 include an enforcement engine 130 configured to implement the DLP controls 118 while a user is using the computing device 152, to control the transfer of data within a particular application group 125, and to control the transfer of data out of (or into) a particular application group 125.

[0020] Computing device 132 is configured to execute (at least in part) DLP application 135 that renders DLP interface 127 and defines application group 125, DLP control(s) 118, and / or device identification data 120 that identifies which computing devices 152 are subject to data transfer restrictions defined by DLP controls 118 and / or application groups 125. In some examples, DLP application 135 is (at least in part) a web application executable by a web browser to render DLP interface 127. In some examples, DLP application 135 is a native application installed and executed by an operating system of computing device 132.

[0021] An application group 125 may identify one or more applications 142 that may be executable by a computing device 152 associated with an organization. For example, the computing device 152 may be issued, owned, or managed by the organization. As shown in FIGS. 1A and 1C , the application group 125 may include application group 125-1, application group 125-2, and application group 125-3. However, an administrator may define one, two, three, or more than three application groups 125. An administrator may group certain applications according to one or more common attributes (e.g., trusted applications 142 in one application group 125, enterprise applications 142 in another application group 125, personal applications 142 in another application group 125, etc.).

[0022] Each application group 125 may identify two or more applications 142. As shown in FIG. 1A, application group 125-1 may identify application 142-1, application 142-2, and application 142-3. In some examples, application group 125-1 may include a group of applications related to a workspace product suite, such as email applications, word processing applications, spreadsheet applications, calendar applications, storage systems (e.g., online (cloud) storage systems). Application group 125-2 may identify application 142-4 and application 142-5. In some examples, application group 125-2 may include a group of applications related to enterprise applications, such as customer relationship management (CRM) applications, and other enterprise applications used by users of an organization. Application group 125-3 may identify application 142-6 and application 142-7. In some examples, application group 125-3 may include a group of applications that have a higher security risk (e.g., personal applications, open web applications, etc.).

[0023] As shown in FIG. 1C, the applications 142 of a particular application group 125 may be defined by the application identifiers 115 of the applications 142. In other words, the application group 125 may include a collection of application identifiers 115. As shown in FIG. 1C, the application group 125 may be defined by application identifier 115-1, application identifier 115-2, and application identifier 115-3. Although three application identifiers 115 are shown in FIG. 1C, the application group 125 may include one application identifier 115, two application identifiers 115, or any number greater than two. The application identifier 115 may be an identifier that uniquely identifies the particular application 142. In some examples, the application identifier 115 identifies the location of the application 142. In some examples, the application identifier 115 is a set of values ​​that may uniquely identify the particular application 142. In some examples, the application identifier 115 is a URL pattern and / or a URI pattern. In some examples, the application identifier 115 of an application group 125 identifies another application group 125 (e.g., a group nested within a group). In some examples, the nested group inherits the restrictions of the parent group.

[0024] Applications 142 may include any type of application configured to be executable (at least in part) by computing device 152. Applications 142 may include one or more browser applications. A browser application is a web browser configured to access information on the Internet. A browser application may launch one or more browser tabs in the context of one or more browser windows on display 148 of computing device 152. Applications 142 include one or more web applications. A web application may be an application program stored on a remote server (e.g., a web server) and delivered by a browser application (e.g., a browser tab) over network 150. In some examples, a web application is a progressive web application and may be stored (at least in part) on computing device 152 and used offline. Applications 142 may include one or more non-web applications (e.g., non-browser applications), which may be programs at least in part stored (e.g., locally stored) on computing device 152 and / or may be programs executable by operating system 154 of computing device 152. In some examples, non-web applications may be executable by (or run on) the operating system 154.

[0025] The applications 142 may include one or more browser applications. In some examples, the native applications are non-web applications. A native application is a software program developed for use on a particular platform or device or for a particular operating system. In some examples, the native applications are software programs developed for multiple platforms or devices. In some examples, the native applications are software programs developed for use on a mobile platform and / or configured to run on a desktop or laptop computer. In some examples, the applications 142 may include one or more mobile applications. A mobile application is a native application configured to run on a mobile operating system of a mobile computing device, such as a smartphone or tablet. In some examples, the mobile application may run on a larger device, such as a laptop or desktop computer. In some examples, the mobile application may include an Android application, a mobile iOS application, and / or a mobile Windows application configured to run on a mobile and / or desktop operating system. In some examples, the applications 142 may include one or more Linux applications (e.g., Linux applications in a virtualized environment).

[0026] In some examples, the application identifiers 115 of each application group 125 correspond to web applications (each identifiable by a different unique URL pattern, including a URI pattern). In some examples, the application identifiers 115 of each application group 125 correspond to one or more of: applications designed for mobile operating systems, applications designed for desktop operating systems, and / or native applications, which may include applications designed for mobile and desktop operating systems.

[0027] As shown in FIG. 1C , the application group 125 is associated with a group resource identifier 113. The group resource identifier 113 is an identifier that may uniquely identify a particular application group 125. The enforcement engine 130 and / or DLP engine 114 may use the group resource identifier 113 to quickly identify the application identifier 115 of each application group 125 and obtain information associated with each application group 125 (e.g., identity 119 associated with the application group 125, data transfer properties 157, extension data 121, device permission data 153, etc.). In some examples, the group resource identifier 113 includes a URL pattern 113a. The URL pattern 113a may be a URL that is different from any of the URL patterns associated with the application 142. In some examples, the DLP engine 114 generates the group resource identifier 113 in response to receiving the application identifier 115. In some examples, an administrator may add (or remove) application identifiers 115 so that applications 142 can be easily included (or removed) in and out of the group's data transfer boundaries (without configuring / unconfiguring data transfer restrictions for individual applications 142).

[0028] Each application group 125 may define one or more data transfer properties 157 related to the transfer of data within, from, and / or to the application group 125. The data transfer properties 157 may be defined by an administrator using the computing device 132. In some examples, the data transfer properties 157 (or portions thereof) are defined within the DLP controls 118. The data transfer properties 157 may indicate that data can be transferred between applications 142 of a particular application group 125. In some examples, the data transfer properties 157 may indicate that data transfer between applications 142 of a particular application group 125 is restricted (e.g., blocked, warned, reported, subject to scanning, etc.). In some examples, the data transfer properties 157 may indicate that data transfer is restricted between one application group 125 and another application group 125.

[0029] 1A, application group 125-1 may include a data transfer property 157-1 that prevents the transfer of data from application group 125-1 to application group 125-3. For example, data from any of application 142-1, application 142-2, or application 142-3 may be blocked from being transferred to application 142-6 or application 142-7. In some examples, application group 125-1 may include a data transfer property 157-2 that warns (but allows) the user when transferring data from application group 125-1 to application group 125-2.

[0030] Referring to FIG. 1C, an administrator may specify whether an identity 119 is associated with an application group 125. The identity 119 may be an identity that identifies a person, or a person's role, or a group / class / department within an organization. If the identity 119 is associated with an application group 125, the identity 119 is part of the organization's managed domain. For example, the identity 119 is an identifier that is also included as part of the organization's managed domain. The organization's managed domain includes users that are approved as part of the organization. If the identity 119 is associated with an application group 125, the data transfer restrictions may vary depending on whether the authentication credentials 151 of the user of the computing device 152 correspond to the identity 119 specified by the application group 125.

[0031] Computing device 152 may include or be communicatively connected to an identity authentication system 149 that can authenticate a user of computing device 152 (e.g., using a password, biometrics, a digital certificate, etc.), such as when a user of computing device 152 logs into computing device 152. In some examples, identity authentication system 149 is included in operating system 154 of computing device 152. In some examples, identity authentication system 149 (or portions thereof) is not executable by computing device 152, but computing device 152 communicates with identity authentication system 149 via network 150.

[0032] When the authentication credentials 151 are authenticated by the identity authentication system 149, they are compared to the identity 119 identified by the application group 125. If the user's authentication credentials 151 correspond to the identity 119, the data transfer property 157-2 may indicate that the user should be warned when transferring data from the application group 125-1 to the application group 125-2 (but the transfer should be allowed). If the user's authentication credentials 151 do not correspond to the identity 119 (which may mean the user logged into the computing device 152 using a personal account rather than their work account), the data transfer property 157-2 may indicate that the transfer of data from the application group 125-1 to the application group 125-2 should be blocked.

[0033] 1C, application groups 125 may include extension data 121 that defines which extensions 159 are enabled (or disabled) for applications 142 of the respective application groups 125. When an extension 159 is added to an application 142, the extension 159 adds features or functionality to the application 142. In some examples, the extension 159 may be HTML, CSS, and / or JavaScript based (in the case of a browser-based extension). In some examples, the extension 159 is a web browser extension. In some examples, the extension 159 is an add-in for a native application. In some examples, the extension 159 is a web application. As shown in FIG. 1B, the extension data 121 may identify extension 159-1, extension 159-2, and extension 159-3, and the extension data 121 may indicate whether the extension 159 is enabled or disabled for an application 142 of a particular application group 125. A user may be able to add extension 159-1 and extension 159-2 to any of the applications 142 in application group 125, but is prevented from adding extension 159-3 to any of the applications 142 in application group 125. In some examples, extension data 121 may indicate that only certain extensions 159 are enabled. In some examples, extension data 121 may indicate that only certain extensions 159 are disabled.

[0034] 1C , application groups 125 may include device permission data 153 that defines which device permissions 155 are enabled or disabled for applications 142 of each application group 125. When enabled, device permissions 155 allow access to certain system or device features of computing device 152. When disabled, device permissions 155 block certain system or device features of computing device 152. Device permissions 155 may include a wide range of permissions such as access to storage and personal information such as contacts, calendar appointments, location tracking, access to the device's internal camera and / or microphone, access to biometric sensors, access to communication interfaces (e.g., Bluetooth, Wi-Fi, Near Field Communication (NFC), making / receiving phone calls, sending / receiving text messages, etc.).

[0035] As shown in FIG. 1C , device permission data 153 may identify permission 155-1, permission 155-2, and permission 155-3, and may indicate whether device permission 155 is enabled or disabled. Device permission data 153 may indicate whether each device permission 155 is enabled or disabled. A user may accept permission 155-1 or permission 155-2 for any of the applications 142 in application group 125, but the user is prevented from accepting permission 155-3 for any of the applications 142 in application group 125. In some examples, device permission data 153 may indicate that only certain device permissions 155 are enabled. In some examples, device permission data 153 may indicate that only certain device permissions 155 are disabled. Instead of configuring which extensions 159 and / or device permissions 155 to enable / disable for each individual application 142 , management of extensions 159 and device permissions 155 is simplified through the use of application groups 125 .

[0036] 1B , the DLP engine 114 may receive DLP restriction data 116 from the computing device 132, where the DLP restriction data 116 includes DLP controls 118 and device identification data 120. In some examples, the DLP restriction data 116 includes information from the application group 125. The DLP engine 114 stores the DLP controls 118, the device identification data 120, and the application group 125 in a memory device 106 associated with the server computer 102. The DLP engine 114 may transmit the DLP controls 118 over the network 150 to the computing device 152 identified by the device identification data 120. In some examples, the DLP engine 114 may transmit information about the application group 125 to the computing device 152 identified by the device identification data 120.

[0037] The enforcement engine 130 of the computing device 152 is configured to receive DLP restriction data 116 from the DLP engine 114 of the server computer 102 over the network 150, the DLP restriction data 116 including the DLP control(s) 118. In some examples, the enforcement engine 130 receives information related to the application group 125 from the DLP engine 114. In some examples, the DLP restriction data 116 includes data transfer properties 157 of the application group 125 and restrictions on extensions 159 and device permissions 155. In some examples, the data transfer properties 157 are defined as part of one or more DLP controls 118. In some examples, the enforcement engine 130 is executable by a web browser application (e.g., one of the applications 142). In some examples, the enforcement engine 130 is executable by the operating system 154.

[0038] The enforcement engine 130 may store the DLP controls 118 in a memory device 158 associated with the computing device 152. In some examples, the enforcement engine 130 stores the application groups 125 in a memory device 158 associated with the computing device 152. The DLP engine 114 may receive and store the DLP control(s) 118 and / or application groups 125 in response to a user and / or administrator accepting, joining, or registering with the DLP system 100. In some examples, the user may be required to consent to the user of the DLP system 100. In some examples, the administrator identifies the computing device 152 in the DLP restriction data 116 and the DLP restriction data 116 is received and stored on the server computer 102, and the DLP controls 118 are configured to be delivered to the computing device 152. In some examples, the computing device 152 is pre-configured with the DLP control(s) 118 and / or application groups 125. For example, a user may be assigned or issued to computing device 152 DLP control(s) 118 and / or application groups 125 that are already stored in memory device 158. In some examples, in response to computing device 152 being activated (e.g., turned on) and connected to network 150, enforcement engine 130 is configured to communicate with DLP engine 114 to retrieve DLP controls 118 and / or application groups 125 and / or to retrieve any updates to DLP controls 118 and / or application groups 125.

[0039] 1D , the DLP control 118 may define a source location 172b, a destination location 174b, a name 176, a description 178, and one or more restrictions 111. Each restriction 111 may identify a computer function 126 and a corresponding enforcement level 128 (e.g., report, warn, data scan trigger, modify, and / or block). The enforcement level 128 specifies the level of restriction applied to the computer function 126. The source location 172b identifies the source of the content being controlled, which may be a group resource identifier 113. In some examples, if the source location 172a of the data transfer event 133 (detected by the enforcement engine 130) corresponds to the source location 172b of the DLP control 118, the computer function 126 is restricted as identified by the enforcement level 128. In some examples, data is restricted from being transferred if the source location 172b and destination location 174b of the data transfer event 133 match the source location 172b and destination location 174b of the DLP control 118, respectively.

[0040] The source location 172b can be one or more application identifiers 115 or one or more group resource identifiers 113. If an application identifier 115 is specified in the source location 172b of the DLP control 118, content from the corresponding application 142 is considered to be controlled. Restrictions 111 to computer functions 126 are applied by the enforcement engine 130 when the controlled content is part of a data transfer event 133. If a group resource identifier 113 is specified in the source location 172b of the DLP control 118, content from any of the applications 142 that are part of the application group 125 is considered to be controlled content and restrictions 111 to computer functions 126 are applied by the enforcement engine 130 when the controlled content is part of a data transfer event 133.

[0041] More generally, source location 172b can be any type of computer resource, such as application 142, a web resource identified by a web location, a storage device, an operating system (OS) user interface (or component). In some examples, enforcement engine 130 applies restriction 111 to computer function 126 if source location 172b corresponds to (e.g., matches) source location 172a of data transfer event 133. Source location 172a and source location 172b refer to the same term (and thus any description applies to both), except that source location 172a is the source of data that is the subject of data transfer event 133 and source location 172b is the identified source of DLP control 118.

[0042] In some examples, the DLP control 118 may not include a destination location 174b. In some examples, the DLP control 118 includes one or more destination locations 174b (e.g., blocked destinations) for one or more given source locations 172b. The destination location 174b may be one or more application identifiers 115 or one or more group resource identifiers 113. If the source location 172b identifies a group resource identifier 113 of an application group 125-1 and the destination location 174b identifies a group resource identifier 113 of an application group 125-2, data transfer is restricted from any of the applications 142 of the application group 125-1 to any of the applications 142 of the application group 125-2. More generally, the destination location 174b may be any type of computer resource, e.g., an application 142, a web resource identified by a web location, storage, an operating system (OS) user interface (or component).

[0043] The DLP control 118 may define a name 176. The name 176 may be used to present the notification (e.g., a UI object) to a user. In some examples, the DLP control 118 may define a description 178. The description 178 may be a short description that describes the computer functionality 126 that is restricted. The description 178 may be used to present the notification (e.g., a UI object) to a user.

[0044] Computer functions 126 may be user-initiated computer actions that may be taken with respect to controlled content (identified by source location 172b, or source location 172b and destination location 174b), and the controlled content may be disseminated digitally or physically to another location (e.g., displayed, forwarded, printed, etc.). Computer functions 126 may include several classes of computer functions, such as file transfer functions 136, clipboard functions 138, and / or screen content functions 140.

[0045] File transfer function 136 may be the transfer of content from one computer location to another, which may include downloading and / or uploading content from and / or to computing device 152. For example, if a user moves content (e.g., a file) from a managed access point, the organization may lose control over how that content is accessed and shared. Clipboard function 138 may refer to computer clipboard actions. Clipboard function 138 may allow cutting, copying, and pasting information from one location to another. The computer clipboard is a temporary location (e.g., a buffer) in the operating system 154 of computing device 152 that temporarily stores cut or copied data. Once data is stored on the clipboard, the data may be pasted into a new location. The computer clipboard may provide an application programming interface whereby a program may specify the actions of cut, copy, and paste. Using the computer clipboard, a user may transfer data within and / or between applications 142 and OS components.

[0046] The on-screen content functionality 140 may include screenshot functionality, screencast functionality, print functionality, and / or display screen functionality. In some examples, restrictions 111 on the screenshot functionality may prevent a user from taking a screenshot if the controlled content (defined by source location 172b) is rendered on the display 148. A screenshot (also called a screen capture or screen grab) is a digital image that shows the content (or a portion thereof) of a display 148. In some examples, restrictions 111 on the screenshot functionality may prevent a user from sharing / casting the display 148 if the controlled content (defined by source location 172b) is rendered on the display 148. Restrictions 111 on the print functionality may prevent a user from printing the controlled content (defined by source location 172b). Screencasting may include sharing at least a portion of the content of a display 148 with another display, which may include screen mirroring and / or screen sharing. In some examples, restrictions 111 on display screen capabilities may trigger the operating system 154 to enable an electronic privacy screen when controlled content (defined by source location 172b) is rendered on the display 148.

[0047] The enforcement engine 130 may modify the display screen capabilities such that the display 148 is configured as an electronic privacy screen. The modification of the display screen capabilities may change one or more display aspects of the display 148 such that the controlled content is less visible to people or devices around the computing device 152. In some examples, the display screen capabilities may reduce the viewing angle (e.g., viewing angle) of the display to allow the information on the display 148 to be viewed from a narrower angle (thereby preventing people from staring at the user's display 148 when viewing the controlled content (e.g., in public)). In some examples, the modification of the display screen capabilities includes enabling an electronic privacy screen. In other words, once the display screen capabilities are identified as being controlled by the DLP control 118, a filter may be applied to the display 148, thereby converting the display 148 into an electronic privacy screen, which reduces the viewing angle (and / or reduces the brightness of the display 148).

[0048] The enforcement level 128 may include report settings, alert settings, block settings, and / or data scan settings. If a reporting setting is specified for a particular computer function 126, the enforcement engine 130 may send a reporting event 131 containing information about the computer function 126 over the network 150 to the DLP engine 114, which is stored as DLP reporting data 122.

[0049] It should also be noted that controls may be provided to the user that allow the user to make choices both regarding whether and when the systems, programs, or features described herein may enable collection of user information (e.g., DLP report data 122), as well as whether the user is sent content or communications from the server.

[0050] If a reporting setting is specified for a particular computer function 126, the enforcement engine 130 does not restrict the particular computer function 126 (e.g., the user is still allowed to transfer files, print, screencast, screenshot, copy / paste, etc.). If a warning setting is specified for a particular computer function, the enforcement engine 130 may render a UI object that warns the user that content targeted by the particular computer function 126 includes controlled content. In some examples, if a warning setting is specified for a particular computer function 126, the enforcement engine 130 does not restrict the particular computer function 126. In some examples, if a warning setting is specified for a particular computer function 126, the enforcement engine 130 is configured to request receipt of a user gesture made with respect to a UI object to enable execution of the particular computer function 126 (e.g., clicking "ok" to enable printing).

[0051] If a block setting is specified for a particular computer function 126, the enforcement engine 130 is configured to disable the particular computer function 126. In some examples, if a data scan setting is specified for a particular computer function 126, the enforcement engine 130 may trigger an analysis of the content targeted by the computer function 126 by the content analyzer 108. In some examples, one enforcement level 128 is specified for a particular computer function 126. In some examples, multiple enforcement levels 128 may be specified for a particular computer function 126 (e.g., any combination of a report setting, a warning setting, and a block setting).

[0052] The content identifier 108 may be executable by the server computer 102. For example, the computing device 152 may transmit (e.g., upload) content subject to the computer function 126 to the server computer 102 over the network 150, and the content analyzer 108 of the server computer 102 is configured to determine whether the content includes restricted content. If so, the content analyzer 108 of the server computer 102 is configured to transmit a response to the enforcement engine 130, the response indicating whether the content includes restricted content. In some examples, the content analyzer 108 is executable by the computing device 152.

[0053] The content analyzer 108 may include a text scanner 112 configured to perform a scan of content to identify whether the content includes keyword(s). For example, the text scanner 112 may recognize text from a content source (e.g., a file, a web location, on-screen content, etc.) and determine whether the text includes or is associated with keyword(s). In some examples, the text scanner 112 is an optical character recognition (OCR) scanner.

[0054] The content analyzer 108 may include a machine learning (ML) model 110 that predicts whether the content is restricted content. In some examples, the content analyzer 108 is configured to run using an accelerator on the operating system 154. The accelerator can improve the performance of the ML models (including the content analyzer 108) running on the computing device 152. In some examples, the accelerator includes an application specific integrated circuit (ASIC) for neural network machine learning. In some examples, the ML model 110 is trained according to one or more ML techniques configured to identify restricted content using the content as input. In some examples, the ML model 110 may be trained according to parameters established by an organization or administrator, such that the ML model 110 may predict whether the content includes restricted content tailored to a particular organization.

[0055] 1E illustrates an example operation of the implementation engine 130. In operation 160, the implementation engine 130 may detect a data transfer event 133. The data transfer event 133 may refer to the transfer of data from one location to another, such as a file transfer event (e.g., upload / download), a clipboard event (e.g., cut / copy / paste), a screen detection event (e.g., a print request, a screencast event, a screenshot event, etc.). In some examples, the data transfer event 133 is generated by one of the applications 142 (e.g., a web browser). In some examples, the data transfer event 133 is generated by the operating system 154. In operation 162, the implementation engine 130 may derive at least one of a source location 172a and a destination location 174b from the data transfer event 133.

[0056] The enforcement engine 130 may determine whether any of the DLP controls 118 apply to the data transfer event 133 by comparing the source location 172a (and, in some examples, the destination location 174a) to the source location 172b (and, in some examples, the destination location 174b) of the DLP controls 118. In operation 164, the enforcement engine 130 may determine that the DLP controls 118 include a group resource identifier 113. Upon detecting the group resource identifier 113, the enforcement engine 130 may identify an application 142 associated with the application group 125 based on the group resource identifier 113. In some examples, the enforcement engine 130 may use the group resource identifier 113 to obtain any (or a portion of) the information of the application group 125 of FIG. 1B, such as the application identifier 115, the identity 119, the data transfer properties 157, the extension data 121, and / or the device permission data 153.

[0057] In some examples, the group resource identifier 113 is a URL pattern for which the enforcement engine 130 requests a list of application identifiers 115 associated with the group resource identifier 113 from the DLP engine 114. In some examples, the enforcement engine 130 may send a request 161 over the network 150 that includes the group resource identifier 113. The DLP engine 114 may derive the application identifiers 115 using the group resource identifier 113 and send a response 163 over the network 150 that includes the application identifiers 115 associated with the group resource identifier 113. In some examples, the response 163 may include any of the information described with reference to the application group 125 of FIG. 1B. For example, the response 163 may include the data transfer properties 157, the identity 119, the extension data 121, and / or the device permission data 153. In some examples, the application group 125 is stored on the computing device 152 and the enforcement engine 130 uses the group resource identifier 113 to obtain the application identifier 115, identity 119, data transfer properties, extension data 121, and / or device permission data 153 from the memory device 158.

[0058] In operation 168, the enforcement engine 130 may determine whether to apply the restriction 111 to the computer function 124. In some examples, the enforcement engine 130 may apply the restriction 111 to the computer function 124 when the source location 172a is an application 142 that is part of the application group 125 and the destination location 174a is an application that is not part of the application group 125. For example, the enforcement engine 130 may detect that the source location 172a of the data transfer event 133 corresponds to (e.g., matches) one of the application identifiers 115 of the application group 125. In some examples, the enforcement engine 130 may detect that the destination location 174a does not correspond to one of the application identifiers 115 of the application group 125 to which the restriction 111 for the computer function 124 applies. In some examples, the DLP control 118 identifies the destination location 174b, which is another group resource identifier 113. The enforcement engine 130 may obtain a list of the application identifiers 115 of the other group resource identifiers 113 and then determine whether the destination location 174 a corresponds to one of the application identifiers 115 of the other group resource identifiers 113 .

[0059] In some examples, the enforcement engine 130 may determine not to apply the restriction 111 to the computer function 124 when the source location 172a is an application 142 that is part of the application group 125 and the destination location 174b is another application that is part of the application. For example, using the list of application identifiers 115, the enforcement engine 130 may determine that the source location 172a includes one of the application identifiers 115 of the particular application group 125 and the source location 172b includes another one of the application identifiers 115 of the particular application group 125, and the enforcement engine 130 may determine not to apply the restriction 111 to the computer function 124.

[0060] 1F-1H illustrate an exemplary operation of enforcing restrictions on clipboard functions 138. In some examples, enforcement engine 130 is executed by a web browser, while some clipboard functions 138 may be executed by components of operating system 154. In some examples, data transfer event 133 includes a copy-paste event. As such, in some examples, the system may encounter technical problems enforcing restrictions 111 on computer functions 126 executed by one or more applications 142 (e.g., a web browser) and one or more components (e.g., a clipboard manager, a window manager, etc.) of operating system 154. Furthermore, when copy request 133a is detected, it is unclear whether the transfer of that content will be restricted because destination location 174b is not yet known. DLP system 100 provides a technical solution in which, in response to detection of copy request 133a from application 142-1 (wherein the copy request includes controlled content identified by source location 172b of DLP control 118), clipboard data 180 is encrypted and the encryption key is stored in memory device 158. Clipboard data 180 is transferred from application 142-1 to a computer clipboard 190 of operating system 154, where clipboard data 180 includes encrypted content 186, source location 172a, and encryption key identifier 184, which allows retrieval of encryption key 192 (e.g., identification of location). Upon detecting paste request 133b, enforcement engine 130 may detect destination location 174b and determine whether restriction 111 on clipboard functionality 138 is disabled / enabled. If enabled, enforcement engine 130 may retrieve encryption key 192 from memory device 158 using encryption key identifier 184 and decrypt encrypted content 186 using encryption key 192, and the content is transferred to application 142-2.

[0061] More specifically, with reference to FIG. 1G, in operation 171, the enforcement engine 130 may detect a copy request 133a. The enforcement engine 130 may derive a source location 172a from the copy request 133a. In this example, the source location 172a is application 142-1. In operation 173, the enforcement engine 130 may determine whether to apply data transfer restrictions to the copy request 133a. For example, the enforcement engine 130 may determine whether any of the DLP controls 118 apply to application 142-1. If the DLP controls 118 identify a group resource identifier 113 as the source location 172b, the enforcement engine 130 may use the group resource identifier 113 to identify an application identifier 115 associated with the application group 125. If one of the application identifiers 115 does not correspond to the application identifier 115-1 of application 142-1, the enforcement engine 130 may determine that the DLP controls 118 are not applied and the content subject to the copy request 133a is not encrypted. If one of the application identifiers 115 corresponds to application identifier 115-1 of application 142-1, enforcement engine 130 may apply DLP controls 118 to the content that is the subject of copy request 133a.

[0062] In operation 175, the enforcement engine 130 encrypts the content that is the subject of the copy request 133a using an encryption key 192. In operation 177, the enforcement engine 130 stores the encryption key 192 in the memory device 158. In operation 179, the enforcement engine 130 generates a unique key (e.g., encryption key identifier 184) that enables retrieval of the encryption key 192 from the memory device 158. In operation 181, the enforcement engine 130 generates clipboard data 180 that is transferred to a computer clipboard 190 of the operating system 154. The clipboard data 180 may include a clipboard format 182 (e.g., a custom clipboard format). The clipboard format 182 may define the type of information included in the clipboard data 180. In some examples, the clipboard data 180 includes a source location 172a (e.g., an application identifier 115-1 for application 142-1), an encryption key identifier 184, encrypted content 186, and a text field 188. The text field 188 may provide information to be included in a UI object (e.g., indicating that data transfer is blocked) displayed on the computing device 152 when a copy / paste operation is blocked.

[0063] 1H, in operation 183, the implementation engine 130 detects a paste request 133b. In response to the paste request 133b, in operation 185, the implementation engine 130 retrieves clipboard data 180 from a computer clipboard 190. As described above, the clipboard data 180 includes a source location 172a, an encryption key identifier 184, encrypted content 186, and a text field 188. In operation 187, the implementation engine 130 may use the encryption key identifier 184 to retrieve an encryption key 192 from a memory device 158. In operation 189, the implementation engine 130 may determine whether to allow the paste request 133b. For example, the implementation engine 130 may derive a destination location 174a from the paste request 133b (e.g., application 142-2). The enforcement engine 130 may determine whether any of the DLP controls 118 apply to the source location 172a and the destination location 174a of the copy request 133a and the paste request 133b. In some examples, if the application 142-2 is part of the same application group 125 as the application 142-1, the enforcement engine 130 may determine that the paste request is permitted. In operation 191, the enforcement engine 130 decrypts the encrypted content 186 using the encryption key and provides the content to the application 142-1. In some examples, if the application 142-2 is part of a different application group 125 than the application 142-1, the enforcement engine 130 may determine that the paste request is not permitted. In operation 193, the enforcement engine 130 may provide text in the text field 188 of the UI object rendered to the user, which indicates that the paste operation is not permitted. As will be appreciated, in some examples, the encryption key identifier 184 may be obtained (e.g., in operation 187) after it is determined (e.g., in operation 189) that the paste request is permitted.

[0064] In some examples, instead of using encryption / decryption techniques, the data 147 that is the subject of the copy request 133a is stored in the memory device 158 (e.g., unencrypted data) and a data identifier 137 is generated that is used to retrieve the data 147 from the memory device 158 (e.g., identifies the location of the data 147 within the memory device 158). The data identifier 137 may be similar to the encryption key identifier 184, except that the data identifier 137 is used to enable retrieval of the data 147 stored in the memory device 158. The clipboard data 180 may include the source location 172a, the data identifier 137, and in some examples, a text field 188.

[0065] The enforcement engine 130 may then derive the destination location 174a from the paste request 133b (e.g., application 142-2). The enforcement engine 130 may determine whether any of the DLP controls 118 apply to the source location 172a and the destination location 174a of the copy request 133a and the paste request 133b. In some examples, if the application 142-2 is part of the same application group 125 as the application 142-1, the enforcement engine 130 may determine that the paste request is permitted. The enforcement engine 130 may retrieve the data 147 from the memory device 158 using the data identifier 137. In some examples, if the application 142-2 is part of a different application group 125 than the application 142-1, the enforcement engine 130 may determine that the paste request is not permitted. The enforcement engine 130 may provide text in the text field 188 of the UI object rendered to the user that indicates that the paste operation is not permitted.

[0066] 1A and 1I, in some examples, the server computer 102 includes a site isolation module 199. The site isolation module 199 may enable site isolation 166 to provide an additional layer of security. When site isolation 166 is enabled, each website 165 loads and runs in a separate process 167, making it harder for malicious sites to circumvent security measures that exist to prevent data theft. Site isolation 166 locks each process 167 (e.g., a renderer process) to documents within a single site and filters certain cross-site data from each process. Site isolation 166 may block a process from receiving certain types of sensitive data from other sites, making it harder for malicious websites to steal data from other sites. In some examples, when site isolation 166 is not enabled, multiple websites (or browser tabs) may share a common process, thereby reducing the amount of computing resources (e.g., CPU, memory) used and avoiding duplicate tasks. However, while enabling site isolation 166 provides an additional layer of security, it also increases the amount of computing resources since each website 165 is launched and executed in a separate process 167 .

[0067] In some examples, the site isolation module 199 may receive information about the application group 125 and enable or disable site isolation 166 for the applications 142 of a particular application group 125 based on the level of trust of the group. Thus, the DLP system 100 may provide a technical advantage of reducing computing resources for applications in a trusted group, but enhancing security for applications in an untrusted group. For example, the application group 125-1 may include applications 142 (e.g., application 142-1, application 142-2) that already have sufficient security measures, and the application group 125-1 is defined to allow data to be freely transferred between the applications 142 of the application group 125-1, but data is restricted from being transferred out of the application group 125-1. In some examples, the site isolation module 199 may determine not to enable site isolation 166 for the applications 142 of the application group 125-1.

[0068] As shown in FIG. 1I, common process 167 may launch and run multiple websites (concurrently) from application 142-1, and common process 167 may launch and run multiple websites (concurrently) from application 142-2. In contrast, application group 125-2 may be an untrusted group (e.g., a collection of gaming applications, or personal applications using the open web, etc.). In some examples, application group 125-1 may be blocked or restricted from receiving data from application group 125-2. As shown in FIG. 1I, site isolation module 199 may determine to enable site isolation 166 for applications 142 (e.g., application 142-4, application 142-5) of application group 125-2. As shown in FIG. 1I, a separate process 167 launches and runs each website 165 from application 142-4, and a separate process 167 launches and runs each website 165 from application 142-5.

[0069] The site isolation module 199 may determine whether to enable or disable site isolation 166 for a particular application group 125 based on the application identifier 115 of the application group 125 and whether the application group 125 is associated with an identity 119, data transfer properties 157, extension data 121, and / or device permission data 153. For example, using the application identifier 115, the site isolation module 199 may determine that an application 142 of a particular application group 125 has one or more security features that do not require site isolation 166. In some examples, if an identity 119 is associated with the application group 125 and a user signing into the computing device 152 corresponds to the identity 119, the site isolation module 199 may disable site isolation 166 for the application group 125. However, if a user signing into the computing device is different from the identity 119, the site isolation module 199 may enable site isolation 166 for the application group 125. In some examples, if the DLP controls 118 and / or data transfer properties 157 indicate that a particular application group 125 is normally restricted from transferring data, the site isolation module 199 may enable site isolation 166 for the application group 125.

[0070] The computing device 152 may be any type of computing device that includes one or more processors 156, one or more memory devices 158, and an operating system 154 configured to execute (or assist in the execution of) one or more applications 142. In some examples, the computing device 152 includes a display 148. In some examples, the computing device 152 does not include a display 148. In some examples, the computing device 152 is a laptop or desktop computer. In some examples, the computing device 152 is a tablet computer. In some examples, the computing device 152 is a smartphone. In some examples, the computing device 152 is a wearable device. The display 148 is a display of the computing device 152. The display 148 may also include one or more external monitors connected to the computing device 152.

[0071] The operating system 154 is system software that manages computer hardware, software resources, and provides common services for computing programs. In some examples, the operating system 154 is an operating system designed for a larger display 148, such as a laptop or desktop (e.g., sometimes referred to as a desktop operating system). In some examples, the operating system 154 is an operating system for a smaller display 148, such as a tablet or smartphone (e.g., sometimes referred to as a mobile operating system).

[0072] The processor(s) 156 may be formed on a substrate configured to execute one or more machine-executable instructions, or portions of software, firmware, or a combination thereof. The processor(s) 156 may be semiconductor-based. That is, the processor may include semiconductor materials capable of executing digital logic. The memory device(s) 158 may include a main memory that stores information in a format that can be read and / or executed by the processor(s) 156. The memory device(s) 158 may include one or more random access memory (RAM) devices and / or one or more read-only memory (ROM) devices. The memory device(s) 158 may store applications (e.g., operating system 154, application 142, etc.) and modules (e.g., execution engine 130, content analyzer 108), which perform certain operations when executed by the processor 156.

[0073] Computing device 132 may be an example of computing device 152 and may include any of the features described with respect to computing device 152. For example, computing device 132 may be a laptop or desktop computer. In some examples, computing device 132 may be a tablet or smartphone. Computing device 132 may include one or more processors 139 and one or more memory devices 129. In some examples, computing device 132 is associated with an organizational administrator. For example, the administrator may be associated with an organization that owns or manages computing device 152. For example, computing device 152 (and computing device 132) may be a business-owned computing device, such as a work computer owned or managed by a user's company or a school computer owned or managed by a user's school.

[0074] The computing device 152 (and the computing device 132) may communicate with the server computer 102 via the network 150. The server computer 102 may be a computing device in the form of a number of different devices, such as, for example, a standard server, a group of such servers, or a rack server system. In some examples, the server computer 102 may be a single system that shares components such as a processor and memory. The network 150 may include the Internet and / or other types of data networks, such as a local area network (LAN), a wide area network (WAN), a cellular network, a satellite network, or other types of data networks. The network 150 may also include any number of computing devices (e.g., computers, servers, routers, network switches, etc.) configured to receive and / or transmit data within the network 150. The network 150 may further include any number of hardwired and / or wireless connections.

[0075] The server computer 102 may include one or more processors 104 formed on a substrate, an operating system (not shown), and one or more memory devices 106. The memory device 106 may represent any type (or types) of memory (e.g., RAM, flash, cache, disk, tape, etc.). In some examples (not shown), the memory device 106 may include external storage, e.g., memory that is physically separate from but accessible to the server computer 102. The server computer 102 may include one or more modules or engines that represent specially programmed software.

[0076] The ML model 110 is a predictive model. In some examples, the ML model 110 includes a neural network. The ML model 110 can be a group of interconnected nodes, with each node representing an artificial neuron. The nodes are connected to each other in layers, with the output of one layer becoming the input of the next layer. The ML model 110 transforms the input received by the input layer, transforms it through a series of hidden layers, and generates an output through the output layer. Each layer is composed of a subset of the set of nodes. The nodes of the hidden layer are fully connected to all the nodes of the previous layer and provide their output to all the nodes of the next layer. The nodes of a single layer work independently of each other (i.e., they do not share connections). The nodes of the output provide the transformed input to the requesting process. In some examples, the ML model 110 is a convolutional neural network, which is a neural network that is not fully connected. Thus, a convolutional neural network is less complex than a fully connected neural network. Convolutional neural networks may also utilize pooling or max pooling to reduce the dimensionality (and therefore complexity) of the data flowing through the neural network, thus reducing the level of computation required, making output computation in convolutional neural networks faster than in neural networks.

[0077] The ML model 110 includes a set of computational processes to receive a set of inputs (e.g., input values) and generate one or more outputs (e.g., output values). In some examples, the output value(s) may represent whether the content includes restricted content. The multiple layers may include an input layer, one or more hidden layers, and an output layer. In some examples, one or more of the outputs of the output layer represent possible predictions (e.g., whether the data includes restricted content). In some examples, the output of the output layer with the highest value represents the prediction.

[0078] In some examples, the ML model 110 is a deep neural network (DNN). For example, a deep neural network (DNN) may have one or more hidden layers disposed between an input layer and an output layer. However, the ML model 110 may be any type of artificial neural network (ANN), including a convolutional neural network (CNN). Neurons in one layer are connected to neurons in another layer via synapses. Each synapse is associated with a weight. The weight is a parameter in the ML model 110 that transforms the input data in the hidden layer. When an input enters a neuron, the input is multiplied by the weight value, and the resulting output is observed or passed to the next layer of the ML model 110. For example, each neuron has a value (e.g., an activation value) that corresponds to the activity of the neuron. The activation value may be, for example, a value between 0 and 1, or a value between -1 and +1. The value of each neuron is determined by the set of synapses that connect each neuron to other neurons in the previous layer. The value of a given neuron is related to the accumulated weighted sum of all neurons in the previous layer. In other words, the value of each neuron in the first layer is multiplied by a corresponding weight, and these values ​​are summed together to calculate the activation value of the neuron in the second layer. Furthermore, a bias may be added to the sum to adjust the overall activity of the neurons. Furthermore, the sum including the bias may be applied to an activation function that maps the sum to a range (e.g., 0 to 1). Possible activation functions may include (but are not limited to) rectified linear unit (ReLu), sigmoid, or hyperbolic tangent (TanH).

[0079] FIG. 2 illustrates an example of a computing device 252 having an enforcement engine 230 according to an aspect. In the example of FIG. 2, the enforcement engine 230 is executable by a web browser application 242a running on an operating system 254 of the computing device 252. In some examples, the web browser application 242a is configured to execute a web application 242a, which may be one of the applications 242 executable by the computing device 252. The web browser application 242 is a software program that allows a user to identify, access, and display web pages within browser windows and browser tabs. In some examples, an application group (e.g., application group 125 of FIGS. 1A-1I) may include different groups of web applications 242a executable (at least in part) by the web browser application 242a. The computing device 252 may be an example of the computing device 152 of FIGS. 1A-1I and may include any of the details described with reference to those figures. In some examples, web browser application 242a includes implementation engine 230, and web browser application 242a is configured to perform any of the functions of implementation engine 230. Implementation engine 230 is an example of implementation engine 130 of Figures 1A-1I and may include any of the details described with reference to those figures.

[0080] 3A and 3B illustrate an example of a computing device 352 having an enforcement engine 330, according to an embodiment. In the example of FIG. 3A and 3B, the enforcement engine 330 is executable by an operating system 354 of the computing device 352. The operating system 354 may include a storage 361, a clipboard manager 359, and a window manager 363. The storage 361 may store the DLP control 318. The operating system 354 may include one or more software containers 344 and a container manager 365 configured to manage system operations of the software containers 344. In some examples, instead of using software containers 344, the operating system 354 defines a virtual machine that is configured to launch and run the application 342. The window manager 363, clipboard manager 359, and storage 361 may communicate with the container manager 365 and the container 344 via an inter-process communication (IPC) link 393.

[0081] In some examples, the software container 344 includes one or more containers 344a configured to launch and run the native applications 342a, and one or more software containers 344b configured to launch and run the one or more virtual applications 342b. The software containers 344 may be instances of another operating system. In some examples, the software container 344a (or virtual machine) shares the OS kernel 313 with the operating system 354. In some examples, the software container 344b (or virtual machine) shares the OS kernel 313 with the operating system 354. In some examples, the software container 344a and the software container 344b share the same OS kernel 313. In some examples, the software container 344a, the software container 344b, and the operating system 354 do not share the OS kernel 313 with each other. The OS kernel 313 is the main interface between the hardware and processes of the computing device. The OS kernel 313 is the initial program that is loaded into memory before the boot loader. OS kernel 313 may run on device firmware 315, which runs on hardware firmware 317. Software container 344 (or virtual machine) may be a runtime platform that contains software dependencies required by an application to launch and run, such as a particular version of a programming language runtime and other software libraries that aid in the execution of the application.

[0082] In some examples, the container manager 365 is configured to intercept a data transfer event (e.g., data transfer event 133 of FIG. 1B) generated by one of the software containers 344 and extract content metadata from the data transfer event. The extracted content metadata may identify a source and / or destination of the content. In some examples, the container manager 365 may receive the DLP control 318 over the IPC link 393 and determine whether the source and / or destination of the content corresponds to one of the sources and / or destinations identified by the DLP control 318. In some examples, the container manager 365 may send the extracted metadata over the IPC link 393 to the operating system 354, which determines whether the source and / or destination of the content identified by the DLP control 318 corresponds to one of the sources and / or destinations.

[0083] In some examples, the operating system 354 is configured to intercept data transfer events sent over the IPC link, extract content metadata, and determine whether the source and / or destination of the content corresponds to one of the sources and / or destinations identified by the DLP control 318. In some examples, the OS kernel 313 is configured to intercept data transfer events generated by the operating system 354 and / or the container 344, extract content metadata, and determine whether the source and / or destination of the content corresponds to any of the sources and / or destinations identified by the DLP control 318.

[0084] In some examples, the window manager 363 is configured to detect a data transfer event involving on-screen content and extract content metadata from the display event. In some examples, the data transfer event is generated by one of the software containers (e.g., container 344a or container 344b) when the display content to be rendered changes and is received by the window manager 363 via the IPC link 393. The extracted content metadata may identify a source of the on-screen content. The window manager 363 may determine whether the source of the on-screen content extracted from the content metadata corresponds to (e.g., matches) a source identified by the DLP control 318. In some examples, the container manager 365 is configured to detect a display event involving on-screen content and extract content metadata from the display event. In some examples, the display event is generated by one of the software containers (e.g., container 344a or container 344b) when the display content to be rendered changes. The extracted content metadata may identify a source of the on-screen content. The container manager 365 may determine whether the source of the on-screen content extracted from the content metadata corresponds to (eg, matches) a source identified by the DLP control 318.

[0085] In some examples, the clipboard manager 359 is configured to detect a clipboard request that identifies a source and / or destination of content to be copied, cut, or pasted. The clipboard manager 359 may obtain the clipboard request and extract content metadata related to the source and / or destination of the content to be copied, cut, or pasted. The clipboard manager 359 may detect that the source and / or destination of the content extracted from the content metadata corresponds to (e.g., matches) a source and / or destination of the DLP control 318.

[0086] 4 illustrates an example of a DLP interface 427 for a DLP application on a computing device 432 associated with an organization's administrator. For example, the administrator may define a group name 401 for an application group and identify application identifiers 415 that belong to the application group. In some examples, the administrator may define a URL pattern for the group resource identifiers 413. In some examples, the URL pattern for the group resource identifiers 413 is automatically generated.

[0087] 5A and 5B show an example of a DLP interface 527 for a DLP application of a computing device 532 associated with an organizational administrator. For example, the administrator may add a group resource identifier 513 to a restriction that checks for restrictive content (e.g., triggers a data scan) if a data transfer event includes data from any application that belongs to an application group identified by the group resource identifier 513.

[0088] 6 illustrates an example of a DLP interface 627 for a DLP application of a computing device 632 associated with an organization's administrator. For example, the administrator may be able to add a group resource identifier 613 to restrict access (e.g., revoke permissions) to any of the applications in the application group identified by the group resource identifier 613.

[0089] FIG. 7 illustrates a flowchart 700 showing an example operation of a DLP system according to an embodiment. Although the flowchart 700 of FIG. 7 illustrates operations in a sequence, it will be understood that this is merely an example and that additional or alternative operations may be included. Additionally, the operations of FIG. 7 and related operations may be performed in a different order than illustrated, or in parallel or overlapping manner. The operations may define a computer-implemented method. Although the flowchart 700 is described with reference to the DLP system 100 of FIGS. 1A-1I, the flowchart 700 may be performed according to any of the figures discussed herein.

[0090] The operations of flowchart 700 may be performed by any of the computing devices discussed herein, including computing device 152. Operation 702 includes obtaining data loss prevention (DLP) restriction data 116, which identifies a group resource identifier 113 and restrictions on computer functions of computing device 152 associated with an organization. Operation 704 includes detecting a data transfer event 133 for transferring data from a first application to a second application. Operation 706 includes identifying a group 125 of applications using the group resource identifier 113. Operation 708 includes applying restrictions to the computer functions when the first application is identified as belonging to the application group and the second application is identified as not belonging to the group of applications.

[0091] According to some aspects, the operations may include detecting a copy request from a first application, encrypting data using an encryption key, storing the encryption key in a memory device, and generating clipboard data including an encryption key identifier and the encrypted data. In some examples, the operations may include detecting a paste request from a second application, retrieving an encryption key from a memory device using the encryption key identifier, determining whether to apply a restriction to the computer function, and decrypting the encrypted data using the encryption key in response to determining not to apply a restriction to the computer function. The operations may include not applying a restriction to the computer function when the first and second applications are identified as belonging to a group of applications. The restrictions on the computer function may include blocking a transfer of data from the first application to the second application. The restrictions on the computer function may include triggering a data scan to detect restricted content from data affected by the data transfer event. The operations may include transmitting data subject to the data transfer event to a server computer in response to the data scan being triggered, receiving an indication that the data includes restricted content, and blocking a transfer of data from the first application to the second application. The restriction on the computer functionality may include triggering a selectable user interface (UI) object that alerts a user about the transfer of data from the first application to the second application, and may include enabling the transfer of data from the first application to the second application in response to receiving a selection of the selectable UI object. The restriction on the computer functionality may include a restriction on a printing function. The group resource identifier may include a resource locator pattern.The group of applications is associated with a user identity, and the operations may include determining whether authentication credentials of a user of the computing device correspond to the user identity, and in response to the user's authentication credentials not corresponding to the user identity, applying restrictions to the computer function in response to identifying the first and second applications as belonging to the group of applications. The operations may include detecting a copy request from the first application, storing the data in the memory device, and generating clipboard data including a data identifier that identifies a location of the data in the memory device. The operations may include detecting a paste request from the second application, determining whether to apply restrictions to the computer function, and in response to determining not to apply restrictions to the computer function, retrieving the data from the memory device using the data identifier.

[0092] According to an aspect, an apparatus including at least one processor and a non-transitory computer-readable medium storing executable instructions, when executed by the at least one processor, causes the at least one processor to: obtain data loss prevention (DLP) restriction data, the DLP restriction data identifying a first group resource identifier, a second group resource identifier, and restrictions on computer functions of a computing device associated with the organization; detect a data transfer event to transfer data from a first application to a second application; identify a group of the first application using the first group resource identifier; identify a group of the second application using the second group resource identifier; and apply restrictions to the computer functions in response to the first application being identified as belonging to the group of the first application and the second application being identified as belonging to the group of the second application.

[0093] According to some aspects, the executable instructions include instructions that cause at least one processor to receive a request to add an extension to a first application, obtain extension data associated with the first group of applications using a first group resource identifier, the extension data indicating that the extension is disabled for any applications in the first group of applications, and restrict installation of the extension in response to the first application being identified as belonging to the first group of applications. The executable instructions include instructions that cause the at least one processor to obtain device permission data associated with the first group of applications using the first group resource identifier, the device permission data indicating that device permissions are disabled for any applications in the first group of applications, and disable device permissions for the first application in response to the first application being identified as belonging to the first group of applications. The executable instructions include instructions that cause the at least one processor to detect a copy request from a first application, encrypt data using an encryption key, store the encryption key in a memory device, and generate clipboard data including an encryption key identifier and the encrypted data. The executable instructions include instructions that cause the at least one processor to detect a paste request from a second application, and render a user interface (UI) object indicating that clipboard functionality is blocked for transferring data from the first application to the second application.

[0094] According to an aspect, a non-transitory computer-readable medium stores executable instructions that, when executed by at least one processor, cause the at least one processor to perform operations. The operations include obtaining data loss prevention (DLP) restriction data, the DLP restriction data identifying a group resource identifier and restrictions on computer functions of a computing device associated with an organization, detecting a data transfer event for transferring data from a first application to a second application, identifying a group of applications using the group resource identifier, and applying restrictions to the computer functions when the first application is identified as belonging to the group of applications and the second application is identified as not belonging to the group of applications. The operations may include detecting a copy request from the first application, encrypting the data using an encryption key, storing the encryption key in a memory device, and generating clipboard data including the encryption key identifier and the encrypted data. The operations may include detecting a paste request from the second application and rendering a user interface (UI) object indicating that the clipboard function is blocked to transfer data from the first application to the second application. The group resource identifier includes a resource locator pattern.

[0095] In some examples, an apparatus includes at least one processor and a non-transitory computer-readable medium storing executable instructions that, when executed by the at least one processor, cause the at least one processor to: obtain data loss prevention (DLP) restriction data, the DLP restriction data identifying a group resource identifier and a restriction on a computer function of a computing device associated with an organization; detect a data transfer event for transferring data from a first application to a second application; identify a group of applications using the group resource identifier; and determine whether to apply a restriction to the computer function based on whether i) the first application is identified as belonging to the group of applications and the second application is identified as not belonging to the group of applications, or ii) the first application and the second application are identified as belonging to the group of applications. In some examples, a method and / or computer-readable medium product having the above / below operations is provided.

[0096] In some aspects, the executable instructions include instructions that cause at least one processor to detect a copy request for data from a first application, encrypt the data from the first application using an encryption key, store the encryption key in a memory device, and generate clipboard data including the encrypted data and an encryption key identifier, the clipboard data enabling the encryption key to be retrieved from the memory device. The executable instructions include instructions that cause the at least one processor to detect a paste request from a second application, retrieve the encryption key from the memory device using the encryption key identifier, and decrypt the encrypted data using the encryption key in response to determining not to apply restrictions to computer functions based on the first application and the second application being identified as belonging to a group of applications. The executable instructions include instructions that cause at least one processor to: not apply a restriction to a computer function when the first application and the second application are identified as belonging to a group of applications; and / or to apply a restriction to a computer function when the first application is identified as belonging to the group of applications and the second application is identified as not belonging to the group of applications.

[0097] FIG. 8 illustrates examples of a general-purpose computing device 800 and a mobile computing device 850 that can be used with the techniques described herein. In some implementations, the computing device 152 of FIGS. 1A-1I is an example of a computing device 800 or a mobile computing device 850. The computing device 800 is intended to represent various types of digital computers, such as laptops, desktops, tablets, workstations, personal digital assistants, televisions, servers, blade servers, mainframes, and other suitable computing devices. The computing device 850 is intended to represent various types of mobile devices, such as personal digital assistants, mobile phones, smartphones, and other similar computing devices. The components illustrated herein, their connections and relationships, and their functions are for illustrative purposes only and are not intended to limit the implementations described and / or claimed in this document.

[0098] Computing device 800 includes a processor 802, a memory 804, a storage device 806, a high-speed interface 808 connecting to memory 804 and a high-speed expansion port 810, and a low-speed interface 812 connecting to a low-speed bus 814 and storage device 806. Processor 802 may be a semiconductor-based processor. Memory 804 may be a semiconductor-based memory. Each of components 802, 804, 806, 808, 810, and 812 are interconnected using various buses and may be mounted on a common motherboard or otherwise implemented as desired. Processor 802 may process instructions for execution within computing device 800, including instructions stored in memory 804 or storage device 806, to display graphical information for a GUI on an external input / output device, such as a display 816 connected to high-speed interface 808. In other implementations, multiple processors and / or multiple buses may be used as needed, along with multiple memories and memory types. Also, multiple computing devices 800 may be connected, each performing some of the required operations (eg, as a bank of servers, a group of blade servers, or a multi-processor system).

[0099] The memory 804 stores information within the computing device 800. In one implementation, the memory 804 is a volatile memory unit or units. In another implementation, the memory 804 is a non-volatile memory unit or units. The memory 804 may also be another form of computer-readable medium, such as a magnetic disk or an optical disk.

[0100] The storage device 806 can provide mass storage for the computing device 800. In one embodiment, the storage device 806 can be or include a computer-readable medium, such as a floppy disk device, a hard disk device, an optical disk device, or a number of devices including a tape device, a flash memory or other similar solid-state memory device, or a storage area network or other configuration of devices. The computer program product can be tangibly embodied in an information carrier. The computer program product can also include instructions that, when executed, perform one or more methods, such as those described above. The information carrier is a computer-readable or machine-readable medium, such as the memory 804, the storage device 806, or the memory of the processor 802.

[0101] The high-speed controller 808 manages the more bandwidth-intensive operations of the computing device 800, and the low-speed controller 812 manages the less bandwidth-intensive operations. Such an allocation of functions is merely exemplary. In one embodiment, the high-speed controller 808 is coupled to the memory 804, the display 816 (e.g., via a graphics processor or accelerator), and a high-speed expansion port 810 that can accept various expansion cards (not shown). In an embodiment, the low-speed controller 812 is coupled to the storage device 806 and the low-speed expansion port 814. The low-speed expansion port may include various communication ports (USB, Bluetooth, Ethernet, wireless Ethernet, etc.), and may connect, via a network adapter or the like, to one or more input / output devices such as a keyboard, a pointing device, a scanner, or a network device such as a switch or router.

[0102] The computing device 800 can be implemented in many different forms, as shown in the figure. For example, it may be implemented as a standard server 820, or multiple times in a group of such servers. It may also be implemented as part of a rack server system 824. It may also be implemented in a personal computer, such as a laptop 822. Alternatively, the components of the computing device 800 may be combined with other components in a mobile device (not shown), such as device 850. Each such device may include one or more computing devices 800, 850, and the entire system may be made up of multiple computing devices 800, 850 in communication with each other.

[0103] Computing device 850 includes components such as a processor 852, memory 864, input / output devices such as a display 854, a communications interface 866, and a transceiver 868. Device 850 may also be provided with a storage device, such as a microdrive or other device, to provide additional storage. Each of components 850, 852, 864, 854, 866, and 868 are interconnected using various buses, and some of the components may be mounted on a common motherboard or implemented in other manners as desired.

[0104] The processor 852 can execute instructions within the computing device 850, including instructions stored in the memory 864. The processor can be implemented as a chipset of chips including individual analog and digital processors. The processor can provide for coordination of other components of the device 850, such as control of a user interface, applications run by the device 850, and wireless communications by the device 850.

[0105] The processor 852 can communicate with a user via a control interface 858 and a display interface 856 connected to a display 854. The display 854 can be, for example, a TFT LCD (thin film transistor liquid crystal display) or an OLED (organic light emitting diode) display, or other suitable display technology. The display interface 856 can include suitable circuitry for driving the display 854 to present graphical and other information to the user. The control interface 858 can receive and convert commands from the user for transmission to the processor 852. Additionally, an external interface 862 can be provided in communication with the processor 852 to enable short-range communication between the device 850 and other devices. The external interface 862 can, for example, provide wired communication in some implementations and wireless communication in other implementations, and multiple interfaces can also be used.

[0106] The memory 864 stores information within the computing device 850. The memory 864 can be implemented as one or more of one or more computer-readable media, one or more volatile memory units, or one or more non-volatile memory units. An expansion memory 874 can also be provided and connected to the device 850 via an expansion interface 872, which can include, for example, a SIMM (single in-line memory module) card interface. Such expansion memory 874 can provide additional storage space for the device 850 or can also store applications or other information for the device 850. In particular, the expansion memory 874 can include instructions for performing or supplementing the above processes, and can also include security information. Thus, for example, the expansion memory 874 can be provided as a security module for the device 850 and can be programmed with instructions that enable secure use of the device 850. Furthermore, secure applications can also be provided via the SIMM card, along with additional information, such as identification information, that is placed on the SIMM card in an unhackable manner.

[0107] The memory may include, for example, flash memory and / or NVRAM memory, as discussed below. In one embodiment, the computer program product is tangibly embodied in an information carrier. The computer program product includes instructions that, when executed, perform one or more methods, such as those described above. The information carrier is a computer or machine readable medium, such as memory 864, expansion memory 874, or memory of processor 852, and may be received, for example, via transceiver 868 or external interface 862.

[0108] The device 850 may communicate wirelessly via a communication interface 866, which may include digital signal processing circuitry if necessary. The communication interface 866 may provide for communication in various modes or protocols, such as GSM voice calls, SMS, EMS, or MMS messaging, CDMA, TDMA, PDC, WCDMA, CDMA2000, or GPRS, among others. Such communication may occur, for example, via a radio frequency transceiver 868. Additionally, short-range communication may occur using Bluetooth, Wi-Fi, or other such transceivers (not shown). Additionally, a Global Positioning System (GPS) receiver module 870 may provide additional navigation and location related wireless data to the device 850, which may be used as needed by applications executing on the device 850.

[0109] Device 850 may also perform voice communications using audio codec 860, which may receive voice information from a user and convert it into usable digital information. Audio codec 860 may likewise generate sounds that are heard by the user, such as through a speaker in a handset of device 850. Such sounds may include voice telephone calls, recorded sounds (e.g., voice messages, music files, etc.), and sounds generated by applications running on device 850.

[0110] The computing device 850 may be implemented in many different forms, as shown in the figure. For example, it may be implemented as a mobile phone 880. It may also be implemented as part of a smartphone 882, a personal digital assistant, or another similar mobile device.

[0111] Various implementations of the systems and techniques described herein may be realized in digital electronic circuitry, integrated circuits, specially designed ASICs (application-specific integrated circuits), computer hardware, firmware, software, and / or combinations thereof. These various implementations may include implementation in one or more computer programs executable and / or interpretable by a programmable system including at least one programmable processor, which may be special-purpose or general-purpose, coupled to receive data and instructions from the storage system, and to transmit data and instructions to the storage system.

[0112] These computer programs (also known as programs, software, software applications or codes) contain machine instructions for a programmable processor and may be implemented in high-level procedural and / or object-oriented programming languages ​​and / or assembly / machine languages. As used herein, "machine-readable medium" and "computer-readable medium" refer to any computer program product, apparatus and / or device (e.g., magnetic disks, optical disks, memory, programmable logic circuits (PLDs)) used to provide machine instructions and / or data to a programmable processor, including non-transitory machine-readable media that receive machine instructions as machine-readable signals. The term "machine-readable signal" refers to any signal used to provide machine instructions and / or data to a programmable processor.

[0113] To provide interaction with a user, the systems and techniques described herein may be implemented on a computer having a display device (e.g., a CRT or LCD monitor) for displaying information to the user, and a keyboard and pointing device (e.g., a mouse or trackball) by which the user may provide input to the computer. Other types of devices may also be used to provide interaction with a user, for example, feedback provided to the user may be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback), and input from the user may be received in any form, including acoustic, verbal, or tactile input.

[0114] The systems and techniques described herein may be implemented in a computing system that includes a back-end component (e.g., as a data server), or that includes a middleware component (e.g., an application server), or that includes a front-end component (e.g., a client computer having a graphical user interface or a web browser through which a user can interact with an embodiment of the systems and techniques described herein), or a combination of such back-ware, middleware, or front-end components. The components of the system may be interconnected by digital data communication (e.g., a communications network) in any form or medium of non-transitory nature. Examples of communications networks include a local area network ("LAN"), a wide area network ("WAN"), and the Internet.

[0115] A computing system may include clients and servers. Clients and servers are generally remote from each other and typically interact through a communication network. The relationship of client and server arises by virtue of computer programs running on the respective computers and by virtue of having a client-server relationship to each other.

[0116] In this specification and the appended claims, the singular forms "a," "an," and "the" do not exclude plural references unless expressly stated otherwise. Furthermore, conjunctions such as "and," "or," and "and / or" are inclusive unless the context clearly dictates otherwise. For example, "A and / or B" includes A alone, B alone, and A and B. Furthermore, the connecting lines or connectors shown in the various figures presented are intended to illustrate example functional relationships and / or physical or logical connections between the various elements. Many alternative or additional functional relationships, physical connections, or logical connections may exist in a practical device. Furthermore, unless an element is specifically described as "essential" or "critical," no article or component is essential to the practice of the embodiments disclosed herein.

[0117] Without being limiting, terms such as approximately, substantially, generally, etc. are used herein to indicate that an exact value or range is not required or need not be specified. As used herein, the terms discussed above will have a readily and immediately applicable meaning to those of ordinary skill in the art.

[0118] Additionally, use of terms herein such as top, bottom, upper, bottom, side, end, front, rear, etc. are used with reference to the orientation currently discussed or illustrated, and it is to be understood that when they are discussed with respect to another orientation, such terms must be correspondingly modified.

[0119] Furthermore, in this specification and the appended claims, the singular forms "a," "an," and "the" do not exclude plural references unless expressly stated otherwise. Furthermore, conjunctions such as "and," "or," and "and / or" are inclusive unless the context clearly dictates otherwise. For example, "A and / or B" includes A alone, B alone, and A and B.

[0120] Although certain exemplary methods, apparatus, and articles of manufacture are described herein, the scope of coverage of this patent is not limited thereto. The terminology used herein is for the purpose of describing particular aspects and is not intended to be limiting. On the contrary, this patent covers all methods, apparatus, and articles of manufacture that fairly fall within the scope of the claims.

Claims

1. 1. A computer-implemented method, comprising: obtaining data loss prevention (DLP) restriction data, the DLP restriction data identifying group resource identifiers and restrictions on computer functions of computing devices associated with the organization, the computer-implemented method further comprising: Detecting a data transfer event for transferring data from a first application to a second application; identifying a group of applications using the group resource identifier; determining that the first application is included in the group of applications and that the second application is not included in the group of applications; and applying the restriction to the computer functionality in response to the first application being determined to be included in the group of applications and the second application being determined to be not included in the group of applications; 4. A computer-implemented method comprising:

2. the data transfer event is a copy and paste event, and the computer-implemented method further comprises: detecting a copy request from the first application; encrypting the data from the first application using an encryption key; storing the encryption key in a memory device; and 2. The computer-implemented method of claim 1, further comprising generating clipboard data including the encrypted data and an encryption key identifier, the encryption key identifier configured to retrieve the encryption key from the memory device.

3. detecting a paste request from the second application; retrieving the encryption key from the memory device using the encryption key identifier; and in response to the first application and the second application being identified as belonging to the group of applications, decrypting the encrypted data using the encryption key; The computer-implemented method of claim 2 , further comprising:

4. determining that the first application and the second application are included in the group of applications; and in response to determining that the first application and the second application are included in the group of applications, not applying the restriction to the computer functionality; The computer-implemented method of claim 1 , further comprising:

5. The computer-implemented method of claim 1 , wherein the restriction on the computer functionality includes blocking a transfer of the data from the first application to the second application.

6. The computer-implemented method of claim 1 , wherein the restriction on the computer functionality includes triggering a data scan to detect restricted content from the data affected by the data transfer event.

7. responsive to the data scan being triggered, transmitting the data that is subject to the data transfer event to a server computer; receiving an indication that the data includes the restricted content; and blocking the transfer of the data from the first application to the second application; The computer-implemented method of claim 6 , further comprising:

8. the restriction on the computer functionality includes triggering a selectable user interface (UI) object that alerts a user to the transfer of the data from the first application to the second application; The computer-implemented method of claim 1 , further comprising: enabling the transfer of the data from the first application to the second application in response to receiving a selection of the selectable UI object.

9. The computer-implemented method of claim 1 , wherein the restrictions on the computer functionality include restrictions on a printing functionality.

10. The computer-implemented method of claim 1 , wherein the group resource identifier comprises a resource locator pattern.

11. the group of applications is associated with a user identity; determining that the first application and the second application are included in the group of applications; determining whether authentication credentials of a user of the computing device correspond to the user identity; and applying the restriction to the computer functionality in response to identifying the first application and the second application as belonging to the group of applications in response to determining that the authentication credentials of the user do not correspond to the user identity and that the first application and the second application are included in the group of applications; The computer-implemented method of claim 1 , further comprising:

12. detecting a copy request from the first application; storing the data in a memory device; and generating clipboard data including a data identifier identifying a location of the data on the memory device; The computer-implemented method of claim 1 , further comprising:

13. detecting a paste request from the second application; determining whether to apply the restriction to the computer function; and in response to determining that the restriction does not apply to the computer function, retrieving the data from the memory device using the data identifier; The computer-implemented method of claim 12 further comprising:

14. An apparatus comprising: At least one processor; and a non-transitory computer-readable medium storing executable instructions that, when executed by the at least one processor, cause the at least one processor to: and obtaining data loss prevention (DLP) restriction data, the DLP restriction data identifying a first group resource identifier, a second group resource identifier, and restrictions on computer functionality of a computing device associated with an organization, the executable instructions when executed by the at least one processor further cause the at least one processor to: Detecting a data transfer event for transferring data from a first application to a second application; identifying a group of a first application using the first group resource identifier; identifying a group of a second application using the second group resource identifier; and applying the restriction to the computer functionality in response to the first application being identified as belonging to the first group of applications and the second application being identified as belonging to the second group of applications; A device that performs the above function.

15. The executable instructions include instructions that cause the at least one processor to: receiving a request to add an extension to the first application; and causing the at least one processor to use the first group resource identifier to obtain extension data associated with the first group of applications, the extension data indicating that the extension is disabled for any application in the first group of applications. in response to the first application being identified as belonging to the first group of applications, restricting installation of the extension; The apparatus of claim 14 .

16. The executable instructions include instructions that cause the at least one processor to: and obtaining device permission data associated with the first group of applications using the first group resource identifier, the device permission data indicating that device permissions are invalid for any application in the first group of applications, the instructions further including: revoke the device permissions of the first application in response to the first application being identified as belonging to the group of first applications; The apparatus of claim 14 .

17. The executable instructions include instructions that cause the at least one processor to: detecting a copy request from the first application; storing the data in a memory device; and generating clipboard data including a data identifier identifying a location of the data on the memory device; The apparatus of claim 14 .

18. The executable instructions include instructions that cause the at least one processor to: detecting a paste request from the second application; and Rendering a user interface (UI) object indicating that a clipboard function is blocked for transferring the data from the first application to the second application; The apparatus of claim 14 .

19. A non-transitory computer-readable medium storing executable instructions that, when executed by at least one processor, cause the at least one processor to perform operations, the operations including: and obtaining data loss prevention (DLP) restriction data, the DLP restriction data identifying group resource identifiers and restrictions on computer functions of computing devices associated with the organization, the operations further comprising: Detecting a data transfer event for transferring data from a first application to a second application; identifying a group of applications using the group resource identifier; determining that the first application is included in the group of applications and that the second application is not included in the group of applications; and applying the restriction to the computer functionality in response to the first application being determined to be included in the group of applications and the second application being determined to be not included in the group of applications; A non-transitory computer readable medium comprising:

20. The operation includes: detecting a copy request from the first application; storing the data in a memory device; and generating clipboard data including a data identifier identifying a location of the data on the memory device; 20. The non-transitory computer readable medium of claim 19, further comprising:

21. The operation includes: detecting a paste request from the second application; determining whether to apply the restriction to the computer function; and in response to determining that the restriction does not apply to the computer function, retrieving the data from the memory device using the data identifier; 21. The non-transitory computer-readable medium of claim 20, further comprising:

22. 20. The non-transitory computer-readable medium of claim 19, wherein the group resource identifier comprises a resource locator pattern.

23. An apparatus comprising: At least one processor; and a non-transitory computer-readable medium storing executable instructions that, when executed by the at least one processor, cause the at least one processor to: and obtaining data loss prevention (DLP) restriction data, the DLP restriction data identifying group resource identifiers and restrictions on computer functions of computing devices associated with an organization. The executable instructions, when executed by the at least one processor, further cause the at least one processor to: Detecting a data transfer event for transferring data from a first application to a second application; identifying a group of applications using the group resource identifier; and determining whether to apply the restriction to the computer capability based on whether i) the first application is identified as belonging to the group of applications and the second application is identified as not belonging to the group of applications, or ii) the first application and the second application are identified as belonging to the group of applications; A device that performs the above function.

24. The executable instructions include instructions that cause the at least one processor to: detecting a copy request for data from the first application; encrypting the data from the first application using an encryption key; storing the encryption key in a memory device; and 24. The apparatus of claim 23, further comprising generating clipboard data including the encrypted data and an encryption key identifier, the clipboard data enabling retrieval of the encryption key from the memory device.

25. The executable instructions include instructions that cause the at least one processor to: detecting a paste request from the second application; retrieving the encryption key from the memory device using the encryption key identifier; and in response to determining not to apply the restriction to the computer functionality based on identifying the first application and the second application as belonging to the group of applications, decrypting the encrypted data using the encryption key; 25. The apparatus of claim 24,

26. The executable instructions include instructions that cause the at least one processor to: not applying the restriction to the computer functionality when the first application and the second application are identified as belonging to the group of applications; or applying the restriction to the computer functionality when the first application is identified as belonging to the group of applications and the second application is identified as not belonging to the group of applications; The apparatus of claim 23 .

Images