Network-Aware Endpoint DLP via File System Filter
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current data loss prevention (DLP) solutions face challenges in visibility and performance, with network-based DLP lacking visibility into all events and endpoint DLP unable to associate DLP activities with network resources and applications.
Innovation Solution
Implementing a network-aware endpoint DLP system that uses a file system filter at the operating system level to intercept and manage web traffic events, associating these events with network source entities and making policy decisions based on evaluated policies.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Loss of information
If JavaScript code is injected to run on the client device for DLP controls, then DLP visibility and control capability are improved, but system performance and user experience deteriorate due to heavy computation resources required
Solution Approach 1:
The patent introduces a file system filter driver as an intermediary component that sits between the file system and applications. This filter driver monitors and controls file operations without requiring JavaScript injection into web browsers, thereby achieving DLP visibility while avoiding the heavy computation burden on client devices. The filter driver operates at the kernel level to intercept file system calls and enforce DLP policies efficiently.
2Ease of operation
If endpoint DLP solution is implemented without network integration, then client-side control capability is improved, but ability to associate DLP activities with network resources and applications deteriorates
Solution Approach 1:
The patent merges endpoint DLP capabilities with network awareness by integrating the file system filter driver with network monitoring functionality. The system combines local file operation monitoring with network traffic analysis, allowing DLP activities to be associated with both endpoint applications and network resources. This unified approach maintains ease of client-side operation while restoring network awareness through correlated event tracking.
3Use of energy by moving object
If network-based DLP solution is used without client presence, then system resource consumption is reduced, but visibility to all events deteriorates
Solution Approach 1:
The file system filter driver operates autonomously at the kernel level, self-managing the monitoring and control of file operations without requiring continuous client presence or heavy client-side processing. The driver captures file system events directly from the operating system, providing comprehensive event visibility while consuming minimal system resources compared to JavaScript-based solutions. The filter driver independently evaluates DLP policies and executes control actions without requiring client application involvement.
Data Source
AI summary
Methods for network aware endpoint data loss prevention (DLP) in web transactions are performed by systems and devices, which includes implementing DLP on endpoint devices and focuses on web traffic events from web browsers, while also associating the events to the network source entity. File download and upload events are intercepted from the operating system by a file system filter that determines the process creating events is a web browser based on process identifiers and comparing process names and process executable signatures. A uniform resource locator (URL) from a current tab or session is retrieved for the web browser. Policies for events are evaluated via a policy server or via cache, and additional data from the file is provided for policy decisions when necessary. DLP actions taken via the file system filter to block or allow events, including encrypting file data, are based on the policy decisions.