Data loss prevention for mobile computing devices

#This disclosure relates in general to the field of security and, more particularly, to managing applications in a mobile device based on location.

#With the rising use of mobile devices, new challenges have emerged in the field of data loss prevention (or “DLP”). Mobile devices often have a host of information and functionalities not usually found on traditional desktops and devices, such as global positioning systems (GPS), cameras, near field communication (NFC), and so on. Such functionality can also introduce new types of sensitive data that can potentially be leaked. The situation is complicated further by the tendency for mobile devices to be constantly connected to communication networks via a variety of different channels such as voice, GPRS, 3G, 4G, SMS, data, Bluetooth™, etc. In such instances, the variety of data that can be leaked can be more diverse, as well as the opportunities for leaks to occur. Additionally, some mobile device platforms make content inspection difficult through strict containerization and coarse grained permission models, among other roadblocks. The trend of “bring your own devices” or BYOD has further concerned administrators and IT personnel tasked with providing uniform security solutions and managing control of sensitive enterprise data, among other examples.

#FIG. 1 is a simplified schematic diagram of an example system including a data loss prevention (DLP) policy server in accordance with one embodiment;

#FIG. 2 is a simplified block diagram of an example system including an example mobile user device and DLP server in accordance with one embodiment;

#FIG. 3 is a simplified block diagram representing illustrating an example suite of DLP solutions that can be deployed in connection with one or more mobile user devices in accordance with one embodiment;

#Like reference numbers and designations in the various drawings indicate like elements.

#In some implementations, an example data loss prevention (DLP) solution can be provided for mobile user computing devices, for instance, through a kernel security manager such as a Linux™ security manager (LSM). An LSM service can work across various applications of the mobile device, provide for a flexible policy framework, and preserve configurations of mobile device applications and subsystems, among other example features.

#Traditional DLP tools and systems can protect against various types of data inappropriately leaving (or entering) a system. Data types can include data-in-motion, such as email, web posts, network traffic, instant messaging, among others. Data-in-motion can be enforced, for instance, through solutions deployed at ingress and/or egress points of a system's network. Data types can further include data-at-rest data types such as shared files, databases, storage at desktop and laptop computers within a system, among other examples. Discovery and fingerprinting solutions can be utilized in connection with data-at-rest. Additionally, data-in-use types can include data stored or output via removable media, printers, graphical displays, etc. and DLP enforcement can take place at endpoint computing devices where such data egress can take place. Accordingly, traditional DLP solutions can employ a variety of solutions to protect against the various causes and forms of data loss within a system. Additionally, DLP solutions can enforce DLP policies based on analyses of the content and context of data detected as exiting or entering a system. Further, DLP solutions can make use of a variety of probes such as file system probes, email probes, network probes, HTTP probes, printer probes, to detect DLP events. Such probes and corresponding hooks can be difficult to implement however in modern mobile computing device platforms and operating systems. Mobile operating systems can constitute closed universes. Mobile devices can further possess CPU, memory, battery, and performance limitations that are unique to mobile devices. Further, mobile devices can typically possess more potential attack channels than traditional computing devices, including attack channels provided through SMS, 4G, Bluetooth™, NFC, Wi-Fi™, SD cards, among other examples. Further, additional data loss vulnerabilities can emerge as mobile device applications and users rely ever more on cloud-based and other web-provided and distributed services, among other examples.