DLP Policy Enforcement via Parent-Child Process Tracking
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional data-loss-prevention (DLP) systems face challenges in applying policies to multiple-process applications and hosted applications, leading to improper access control due to their inability to identify and manage parent-child relationships between processes, resulting in unintended access restrictions or permissions.
Innovation Solution
The system identifies parent-child relationships between applications and processes at runtime, maintaining a list of controlled applications and processes, detecting access attempts, and applying DLP policies accordingly to ensure proper access control without manual administrator intervention.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Device complexity
If a DLP system monitors only the process created when an application is launched, then the monitoring is simple, but DLP policies cannot be properly applied to multiple-process applications and hosted applications
Solution Approach 1:
The patent segments the monitoring approach by distinguishing between host processes and hosted applications, and between parent processes and child processes. It creates separate tracking mechanisms for each process type and their relationships, allowing precise identification of which process should have which DLP policy applied without monitoring all processes uniformly.
Solution Approach 2:
The patent introduces intermediary data structures (process lists, application lists, parent-child relationship tracking) that mediate between the raw process monitoring data and the DLP policy application logic. These intermediaries maintain the complex relationships without requiring the policy enforcement logic to directly handle all process interactions.
2Reliability
If a DLP system applies policies to all processes, then comprehensive coverage is achieved, but policies may be incorrectly applied to unrelated processes
Solution Approach 1:
The patent applies local quality by assigning different DLP policies to different processes based on their specific relationship to applications. Each process receives a policy tailored to its actual function and parent-child relationship, rather than a blanket policy applied uniformly. This ensures accurate policy application while maintaining manageable complexity through localized decision-making.
3Reliability
If manual identification of additional processes is required, then precise policy application is possible, but administrative overhead increases
Solution Approach 1:
The patent implements self-service by enabling the DLP system to automatically identify, track, and manage parent-child relationships between processes and applications. The system autonomously builds and maintains process lists and application lists, and automatically determines which processes should have which policies applied without requiring manual administrator intervention for each process identification.
Solution Approach 2:
The patent performs preliminary action by establishing and maintaining process lists and application lists in advance, tracking parent-child relationships before policy enforcement is needed. This pre-computation and pre-organization of process information enables rapid, accurate policy application without requiring manual process identification at the time of enforcement.
Data Source
AI summary
A computer-implemented method for applying data-loss-prevention policies. The method may include (1) maintaining a list of applications whose access to sensitive data is controlled by data-loss-prevention (DLP) policies, (2) detecting an attempt by a process to access sensitive data, (3) determining that the process has a parent-child relationship with an application within the list of applications, and (4) applying, based at least in part on the determination that the process has the parent-child relationship with the application, a DLP policy associated with the application to the process in order to prevent loss of sensitive data. Various other methods, systems, and computer-readable media are also disclosed.