Browser Isolation System for Agentless Data Loss Prevention
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing Data Loss Prevention (DLP) techniques face challenges such as requiring agent installations on end-user devices, failing to detect obfuscated or encrypted data, and not providing comprehensive protection against unauthorized data uploads.
Innovation Solution
A browser isolation system that prompts users for credentials to access file contents, applies policies based on file content analysis, and provides DLP services by isolating browsing activities, thereby preventing unauthorized data exfiltration.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If an agent application is installed on the end user's computing device to implement DLP, then data protection capability is improved, but device complexity and user burden increase
Solution Approach 1:
The patent extracts the DLP functionality from the end-user device by implementing it as a network edge proxy service. The proxy intercepts and analyzes uploads at the network level, removing the need for agent applications on user devices while maintaining comprehensive data protection capabilities.
Solution Approach 2:
The network edge proxy acts as an intermediary between users and external destinations. It mediates upload traffic by inspecting files before they leave the network, enabling DLP without requiring changes to end-user devices or applications.
2Speed
If network edge proxies analyze data in flight to prevent data loss, then real-time protection is improved, but detection accuracy deteriorates when data is obfuscated or encrypted
Solution Approach 1:
The system performs preliminary actions by intercepting and analyzing uploads before they complete transmission. The proxy examines files in flight, extracts credentials from obfuscated data, and blocks malicious uploads before they reach external destinations, maintaining both speed and accuracy.
Solution Approach 2:
The patent replaces traditional signature-based detection with credential extraction and analysis techniques. Instead of relying on predefined patterns, the system extracts and validates credentials from uploaded files, enabling accurate detection of obfuscated and encrypted data while maintaining real-time protection.
3Measurement precision
If the system prompts users for credentials to access file contents, then detection accuracy is improved, but user interaction complexity increases
Solution Approach 1:
The system implements self-service by automatically extracting and validating credentials from uploaded files without requiring user intervention. The proxy handles credential extraction, validation, and upload blocking autonomously, maintaining high detection accuracy while eliminating additional user interaction steps.
4Reliability
If the browser isolation system analyzes file contents to apply DLP policies, then data security is improved, but processing time increases
Solution Approach 1:
The system applies partial action by analyzing only the portions of files necessary for credential extraction and validation. The proxy focuses computational resources on extracting and validating credentials rather than performing exhaustive file analysis, maintaining security while reducing processing time for large files.
Data Source
AI summary
Providing policy check functionality to file uploads is disclosed. An attempted file upload is detected at a browser isolation system. A user of a client is prompted to provide a credential associated with the file and usable to access contents of the file. A policy is applied to the file upload.