Cloud Sync Data Loss Prevention via File System Filter Driver

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Cloud synchronization applications pose a risk of sensitive data leakage by allowing users to inadvertently upload enterprise data to personal accounts, which existing data loss prevention (DLP) solutions fail to adequately prevent.

Innovation Solution

A file system filter driver intercepts requests from cloud sync applications to upload files, evaluates files based on DLP policies, and blocks unauthorized uploads, using cryptographic hashes to minimize unnecessary analysis and prevent data leakage by determining if files have changed since last evaluation.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Ease of operation

If cloud sync application allows users to upload files to cloud storage service, then file synchronization and collaboration functionality is improved, but risk of sensitive data leakage to personal accounts increases

Engineering Contradiction:

Improvefile synchronization functionalityVSAvoiddata leakage risk

Core Design Contradiction:

Ease of operationVSObject-affected harmful factors

Solution Approach 1:

A file system filter driver is introduced as an intermediary component between the cloud sync application and the file system. This filter driver intercepts file upload requests, evaluates them against DLP policies, and blocks unauthorized transmissions to personal accounts while allowing legitimate enterprise account uploads, thus resolving the contradiction between maintaining sync functionality and preventing data leakage

Inventive Principle:

Principle #24Intermediary (Mediator)

Solution Approach 2:

The system performs preliminary evaluation of files before they are uploaded to cloud storage by checking file content against DLP policies and verifying account types. This preemptive measure prevents sensitive data from being uploaded to personal accounts in the first place, countering the data leakage risk before it can materialize

Inventive Principle:

Principle #9Preliminary anti-action

2Reliability

If DLP agent monitors and evaluates all file upload requests, then data loss prevention capability is improved, but system performance and I/O operations deteriorate

Engineering Contradiction:

Improvedata loss prevention capabilityVSAvoidsystem performance

Core Design Contradiction:

ReliabilityVSProductivity

Solution Approach 1:

The system uses cryptographic hashes of file content as a self-service mechanism to quickly determine whether a file has changed since the last DLP evaluation. If the hash matches a previously evaluated file, the system automatically skips re-evaluation, allowing the DLP agent to maintain high prevention capability while avoiding redundant processing and preserving system performance

Inventive Principle:

Principle #25Self-service

Data Source

PatentUS9928373B2Technique for data loss prevention for a cloud sync application

Publication Date: 2018.03.27 CA TECH INC

AI summary

Techniques describe preventing sensitive data from being misappropriated during an operation performed by a cloud synchronization application. A request from a cloud sync application to upload a file to a cloud storage service is intercepted. The file is currently stored on a client computer of an enterprise network. An account associated with the request is identified. The file is evaluated based on a data loss prevention policy and the account associated with the request. The request is blocked based on the evaluation.