Lightweight Data Leakage Detection for Mobile Devices
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Mobile operating systems, such as Android, lack provisions for detecting data leakage due to limited memory and processing resources, making it difficult for computer security products to effectively monitor and prevent unauthorized data transfer from mobile devices.
Innovation Solution
A lightweight engine is implemented on mobile computing devices to monitor outgoing communications for trap data, which is stored as fictitious contact information, allowing for detection of data leakage without complex content scanning or virus signatures, and a backend system alerts users when trap data is detected, even if data is encrypted.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If conventional computer security products are ported to mobile computing devices, then data leakage detection capability is improved, but device memory and processing resources are excessively consumed
Solution Approach 1:
The patent extracts the essential detection function from complex security products by implementing a lightweight engine that monitors only outgoing communications for trap data, separating this critical function from resource-intensive features like content scanning and virus signature databases
Solution Approach 2:
The patent changes the detection parameters by using predetermined trap data (such as trap email addresses or phone numbers) instead of comprehensive virus signatures, reducing the data size from megabytes to minimal fixed values while maintaining detection effectiveness
2Measurement precision
If comprehensive content scanning is implemented to detect data leakage, then detection precision is improved, but processing time and resource consumption increase
Solution Approach 1:
The patent performs preliminary action by pre-configuring trap data in the mobile device before potential data leakage occurs. The lightweight engine is pre-programmed with specific trap identifiers, enabling immediate detection without requiring comprehensive scanning when data transfer is attempted
Solution Approach 2:
The patent extracts only the essential detection function from complex security products by implementing a lightweight engine that monitors only outgoing communications for trap data, separating this critical function from resource-intensive features like content scanning and virus signature databases
3Reliability
If mobile operating system hooks are implemented to monitor read events, then detection capability is improved, but system complexity and compatibility issues increase
Solution Approach 1:
The patent uses an intermediary approach by introducing a lightweight engine that operates at the communication layer rather than requiring deep integration with the operating system's read event hooks. This intermediary monitors outgoing communications without needing to intercept or hook into system-level read events
Solution Approach 2:
The patent inverts the traditional detection approach by instead of monitoring read events to detect data theft, it monitors outgoing communications for trap data. This inversion shifts the detection point from the data access stage to the data transmission stage, avoiding the need for complex OS hooks
Data Source
AI summary
Trap data is stored in a mobile computing device. A lightweight engine monitors outgoing communications in the mobile computing device for the trap data. Data leakage is deemed to have been detected in the mobile computing device when an outgoing communication includes the trap data. A cloud service hosted by a backend system may also be monitoring for the trap data. In the case where the trap data is a trap e-mail address, the cloud service may monitor for an e-mail that is addressed to the trap e-mail address. In response to receiving the e-mail, the cloud service may consult a database to determine that the trap e-mail address is stored in the mobile computing device. Receiving the e-mail indicates that data leakage is occurring in the mobile computing device.