Host-Based DLP Agent for Container Data Exfiltration Prevention
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Data exfiltration from data containers is challenging to prevent, especially in LINUX environments, as dynamically creating and configuring Data Loss Prevention (DLP) agents within containers is not practical, and accurately identifying context and providing DLP and device control is difficult.
Innovation Solution
A method that identifies processes running in data containers, intercepts exfiltration attempts via file system or network operations, and performs security actions such as blocking, encrypting, or limiting access to prevent data loss, using a single DLP agent external to the container, which monitors file system and network operations and applies DLP policies.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If DLP agents are installed inside each LINUX container to monitor applications, then data exfiltration can be detected with high accuracy, but the system complexity and deployment difficulty increase significantly
Solution Approach 1:
The patent introduces a host-based DLP agent that acts as an intermediary between the containerized application and the host system resources. This external agent monitors file system operations, network operations, and process operations without requiring installation inside the container, thus maintaining detection accuracy while reducing system complexity
Solution Approach 2:
The patent shifts the monitoring dimension from inside the container (traditional approach) to outside the container at the host level. By monitoring file system operations, network operations, and process operations from the host, the system achieves the same security goals without the complexity of internal agent deployment
2Adaptability or versatility
If DLP agents are dynamically created and configured in each LINUX OS container, then context-aware DLP can be provided, but the deployment becomes impractical and technically infeasible
Solution Approach 1:
The patent creates a universal host-based DLP agent that can monitor multiple containers simultaneously. This single agent provides context-aware DLP for all containerized applications by monitoring their operations at the host level, eliminating the need to deploy and configure separate agents in each container
Solution Approach 2:
The patent extracts the DLP monitoring functionality from inside the containers and places it at the host level. This externalization allows the DLP agent to monitor multiple containers without being constrained by individual container environments, making deployment practical and feasible
3Reliability
If the system monitors all file system and network operations to prevent data exfiltration, then security is enhanced, but the processing overhead and system performance may deteriorate
Solution Approach 1:
The patent implements selective monitoring of specific file system operations (open, read, write), network operations (socket creation), and process operations. By focusing on operations most likely to be used for data exfiltration rather than monitoring all operations, the system maintains high security while reducing processing overhead and preserving system performance
Data Source
AI summary
The disclosed computer-implemented method for preventing data loss from data containers may include (1) identifying, at a computing device, a process running in a data container on the computing device, (2) intercepting an attempt by the process to exfiltrate information from the computing device via at least one of a file system operation or a network operation, and (3) performing a security action to prevent the intercepted attempt. Various other methods, systems, and computer-readable media are also disclosed.