De novo sensitivity metadata generation for cloud security
AssigneeNetskope, Inc.
InventorsKrishna Narayanaswamy, Ajay Agrawal
Life of this patent
Estimating the term…
Abstract
The technology disclosed presents an improved endpoint data loss prevention (DLP) solution, referred to herein as “small-footprint endpoint DLP (sf-EDLP),” which enforces security policies at endpoints by relying on previously generated sensitivity metadata, rather than by performing content sensitivity scans at the endpoints. Since content sensitivity scans are computationally intensive and time consuming, sf-EDLP leads to a significantly simpler implementation, reduced runtime computation, and a smaller memory footprint; making it suitable for computationally constrained environments such as modern mobile devices.
Claims20
A system including one or more processors coupled to memory, the memory loaded with computer instructions to enforce data loss prevention (DLP) policies at an endpoint without needing to perform content sensitivity scan at the endpoint or on server-side, the instructions, when executed on the processors, implement actions comprising:
- an endpoint traffic monitor that performs network traffic monitoring by parsing requests directed toward cloud-based services to determine that the requested cloud-based services are those that are previously identified as sensitive cloud-based services;
- a file system monitor that performs file system monitoring by detecting write system calls issued by a file system driver of the endpoint to determine download of one or more documents to the endpoint from the sensitive cloud-based services;
- a document classifier that labels the documents as sensitive based on a combination of
- the inference from the network traffic monitoring that the documents originated from the sensitive cloud-based services, and
- the inference from the file system monitoring that the documents were downloaded to the endpoint;
- a local metadata store at the endpoint that stores the sensitivity labels for the documents as sensitivity metadata;
- and
- an endpoint policy enforcer which, in response to detecting data egress events at the endpoint that would push data in a document from the endpoint to uncontrolled locations,
- determines that the document is sensitive based on looking up the sensitivity metadata for the document in the local metadata store and without scanning the document at the endpoint for sensitivity, and
- enforces a DLP policy at the endpoint based on the determination.
A system including one or more processors coupled to memory, the memory loaded with computer instructions to enforce data loss prevention (DLP) policies at an endpoint without needing to perform content sensitivity scan at the endpoint or on server-side, the instructions, when executed on the processors, implement actions comprising:
- an endpoint traffic monitor that performs network traffic monitoring by parsing requests directed toward cloud-based services to determine that the requested cloud-based services are those that are previously identified as sensitive cloud-based services;
- a file system monitor that performs file system monitoring by detecting write system calls issued by a file system driver of the endpoint to determine download of one or more documents to the endpoint from the sensitive cloud-based services;
- a document classifier that labels the documents as sensitive based on a combination of
- the inference from the network traffic monitoring that the documents originated from the sensitive cloud-based services, and
- the inference from the file system monitoring that the documents were downloaded to the endpoint;
- and
- wherein the sensitivity labels for the documents are stored as sensitivity metadata and used by an endpoint policy enforcer for responding to data egress requests and endpoint DLP policy enforcement in future without scanning the documents at the endpoint for sensitivity.
A computer-implemented method of enforcing data loss prevention policies at an endpoint without needing to perform content sensitivity scan at the endpoint or on server-side, the method including:
- combining network traffic monitoring of user interaction with cloud-based services identified as sensitive with file system monitoring of document download to the endpoint from the sensitive cloud-based services;
- the combination of the network traffic monitoring and the file system monitoring generating sensitivity metadata that labels documents downloaded to the endpoint from the sensitive cloud-based services as sensitive and persisting the sensitivity metadata in a local metadata store at the endpoint;
- and
- in response to detecting data egress events at the endpoint that would push data in a document from the endpoint to uncontrolled locations,
- determining that the document is sensitive based on looking up the sensitivity metadata for the document in the local metadata store and without scanning the document at the endpoint for sensitivity;
- and
- enforcing a data loss prevention policy at the endpoint based on the determination.
A non-transitory computer readable storage medium impressed with computer program instructions to enforce data loss prevention policies at an endpoint without needing to perform content sensitivity scan at the endpoint or on server-side, the instructions, when executed on a processor, implement a method comprising:
- combining network traffic monitoring of user interaction with cloud-based services identified as sensitive with file system monitoring of document download to the endpoint from the sensitive cloud-based services;
- the combination of the network traffic monitoring and the file system monitoring generating sensitivity metadata that labels documents downloaded to the endpoint from the sensitive cloud-based services as sensitive and persisting the sensitivity metadata in a local metadata store at the endpoint;
- and
- in response to detecting data egress events at the endpoint that would push data in a document from the endpoint to uncontrolled locations,
- determining that the document is sensitive based on looking up the sensitivity metadata for the document in the local metadata store and without scanning the document at the endpoint for sensitivity;
- and
- enforcing a data loss prevention policy at the endpoint based on the determination.
Dependencies are inferred from the claim text.