DLP Agent Intercepting Save Operations for Data Leakage Prevention
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Productivity software's 'Save to Web' features pose a risk of data leakage as they obscure content from data loss prevention monitoring tools, making it difficult to intercept and scan sensitive data being transmitted to unauthorized locations.
Innovation Solution
A data loss prevention (DLP) agent integrates with productivity applications to intercept file and network APIs, suspend save operations, retrieve in-memory file copies, encrypt them, and evaluate against security policies, allowing or blocking the save based on policy compliance.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If 'Save to Web' features are implemented to enable direct cloud storage integration and content sharing, then user productivity and collaboration capability are improved, but data leakage risk increases and security control is compromised
Solution Approach 1:
The patent introduces a DLP agent as an intermediary component that sits between the productivity application and the cloud storage service. This agent intercepts file transfer operations, scans content for sensitive data using pattern matching and heuristics, and enforces security policies by blocking or allowing transfers. This mediator enables both collaboration functionality and security control simultaneously.
Solution Approach 2:
The system performs preliminary security evaluation before allowing file transfers to occur. The DLP agent proactively scans files intended for cloud upload, evaluates them against security policies, and prevents problematic transfers before they happen. This preliminary action ensures security without blocking legitimate collaboration activities.
2Reliability
If DLP monitoring is implemented to scan and evaluate file content, then data security is improved, but the save operation speed and user experience are reduced
Solution Approach 1:
The DLP agent applies partial scanning by focusing on specific file types and content patterns most likely to contain sensitive data. Rather than exhaustive scanning of all files, the system uses targeted pattern matching and heuristics to evaluate only relevant portions of files, reducing scan time while maintaining security effectiveness.
Solution Approach 2:
The system creates a temporary copy of the file for scanning purposes, allowing the original file to remain unchanged and accessible. This copying approach enables parallel processing where the scan operates on the copy while the original can be quickly transferred if it passes initial checks, reducing the impact on save operation speed.
3Reliability
If comprehensive security scanning is performed on all files before transfer, then data loss prevention is improved, but device processing load and energy consumption increase
Solution Approach 1:
The DLP agent applies different scanning intensities and methods based on local characteristics of each file. Common file types with known structures receive lighter scanning, while unusual or high-risk file types receive more comprehensive analysis. This localized quality approach reduces overall processing load while maintaining security for critical files.
Solution Approach 2:
The system dynamically adjusts scanning parameters such as scan depth, pattern matching sensitivity, and evaluation thresholds based on file characteristics, user context, and organizational risk tolerance. This parameter adaptation allows the system to reduce processing load for low-risk scenarios while maintaining rigorous scanning when necessary.
Data Source
AI summary
Techniques presented herein describe data loss prevention (DLP) methods for saving a file to a destination over a network via an application, such as a productivity application having such features. A DLP agent injects components to the productivity application intercept save operations initiated by a user. When the user initiates a save operation for a file, the components suspend the operation and store a current version of the file (including unsaved file data) in a temporary location accessible to the DLP agent on disk. The DLP agent evaluates the current version of the file and file destination based on network and security policies to determine whether to allow or block the save operation.