Data Loss Prevention for Closed-Storage Portable Devices
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional data loss prevention systems are ineffective in monitoring and applying policies to closed-storage portable devices that use protocols like MTP or PTP, as these devices manage their own file systems, preventing endpoints from accessing or controlling the storage, thereby allowing potential data leaks.
Innovation Solution
Injecting data loss prevention components into application processes on computing devices to intercept and monitor attempts to transfer files to closed-storage portable devices, identifying and caching metadata to apply relevant policies and perform security actions when violations are detected.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If conventional data loss prevention software monitors file system activity on endpoints, then data transfers to mass-storage devices can be effectively controlled, but data transfers to closed-storage devices cannot be monitored or controlled
Solution Approach 1:
The patent introduces an intermediary component that sits between the application and the closed-storage device. This intermediary monitors and controls file operations by intercepting API calls (such as CreateFile, ReadFile, WriteFile) before they reach the closed-storage device, enabling data loss prevention without requiring direct access to the device's internal file system.
Solution Approach 2:
The patent shifts the monitoring approach from the file system level (which is inaccessible for closed-storage devices) to the application programming interface level. By operating at this different dimensional level, the system can intercept and control file operations to closed-storage devices without needing to access their internal file systems.
2Reliability
If organizations prohibit the use of smartphones and portable devices, then data leaks via these devices are prevented, but legitimate and harmless use of such devices is hampered
Solution Approach 1:
The patent applies different levels of monitoring and control to different devices and applications. Rather than a blanket prohibition or uniform control, the system can selectively monitor specific file operations to specific closed-storage devices based on their sensitivity and the context of use, allowing legitimate operations while blocking potentially harmful ones.
Solution Approach 2:
The system continuously monitors file operations to closed-storage devices and provides feedback control by dynamically allowing or blocking operations based on real-time analysis. This enables the system to adapt to actual usage patterns, permitting legitimate operations while preventing data leaks, rather than using static prohibitive rules.
Data Source
AI summary
A computer-implemented method for applying data loss prevention policies to closed-storage portable devices may include (1) injecting a data loss prevention component into at least one application process that is running on a computing device, (2) intercepting, via the data loss prevention component, an attempt by the application process to transfer a file to a closed-storage portable device that is connected to the computing device, (3) identifying a data loss prevention policy that applies to the attempt by the application process to transfer the file, (4) determining that the attempt by the application process to transfer the file violates the data loss prevention policy, and (5) performing a security action in response to determining that the attempt by the application process to transfer the file violates the data loss prevention policy. Various other methods, systems, and computer-readable media are also disclosed.