# US 11,451,587 B2 · De novo sensitivity metadata generation for cloud security > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 11,451,587 B2 - Document ID: US11451587B2 - Status: Granted - Kind: B2 - Application number: 16/737,759 - Filed: 2020-01-08 - Published: 2020-05-07 - Granted: 2022-09-20 - Earliest claimed: 2016-03-11 - Assignees: Netskope, Inc. - Applicants: Netskope, Inc. - Inventors: Krishna Narayanaswamy; Ajay Agrawal - Web page: https://patentgrep.com/patent/US11451587B2 ## CPC - G06F 21/6245: {Protecting personal data, e.g. for financial or medical purposes} - H04L 63/20: {for managing network security; network security policies in general (filtering policies H04L63/0227)} - G06F 16/285: {Clustering or classification} - G06F 16/951: Indexing; Web crawling techniques - G06F 21/6209: {to a single file or object, e.g. in a secure envelope, encrypted and accessed using a key, or with access control rules appended to the object itself} - H04L 63/0245: {Filtering by information in the payload} - H04L 63/0281: {Proxies} - H04L 63/10: {for controlling access to devices or network resources} - H04L 63/104: {Grouping of entities} - H04L 63/105: {Multiple levels of security} - H04L 63/12: {Applying verification of the received information (cryptographic mechanisms or cryptographic arrangements for data integrity or data verification H04L9/32)} - H04L 63/1408: {by monitoring network traffic (monitoring network traffic per se H04L43/00)} - G06F 16/1734: {Details of monitoring file system events, e.g. by the use of hooks, filter drivers, logs} - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract The technology disclosed presents an improved endpoint data loss prevention (DLP) solution, referred to herein as “small-footprint endpoint DLP (sf-EDLP),” which enforces security policies at endpoints by relying on previously generated sensitivity metadata, rather than by performing content sensitivity scans at the endpoints. Since content sensitivity scans are computationally intensive and time consuming, sf-EDLP leads to a significantly simpler implementation, reduced runtime computation, and a smaller memory footprint; making it suitable for computationally constrained environments such as modern mobile devices. ## Claims ### Claim 1 A system including one or more processors coupled to memory, the memory loaded with computer instructions to enforce data loss prevention (DLP) policies at an endpoint without needing to perform content sensitivity scan at the endpoint or on server-side, the instructions, when executed on the processors, implement actions comprising: an endpoint traffic monitor that performs network traffic monitoring by parsing requests directed toward cloud-based services to determine that the requested cloud-based services are those that are previously identified as sensitive cloud-based services; a file system monitor that performs file system monitoring by detecting write system calls issued by a file system driver of the endpoint to determine download of one or more documents to the endpoint from the sensitive cloud-based services; a document classifier that labels the documents as sensitive based on a combination of the inference from the network traffic monitoring that the documents originated from the sensitive cloud-based services, and the inference from the file system monitoring that the documents were downloaded to the endpoint; a local metadata store at the endpoint that stores the sensitivity labels for the documents as sensitivity metadata; and an endpoint policy enforcer which, in response to detecting data egress events at the endpoint that would push data in a document from the endpoint to uncontrolled locations, determines that the document is sensitive based on looking up the sensitivity metadata for the document in the local metadata store and without scanning the document at the endpoint for sensitivity, and enforces a DLP policy at the endpoint based on the determination. ### Claim 2 A system including one or more processors coupled to memory, the memory loaded with computer instructions to enforce data loss prevention (DLP) policies at an endpoint without needing to perform content sensitivity scan at the endpoint or on server-side, the instructions, when executed on the processors, implement actions comprising: an endpoint traffic monitor that performs network traffic monitoring by parsing requests directed toward cloud-based services to determine that the requested cloud-based services are those that are previously identified as sensitive cloud-based services; a file system monitor that performs file system monitoring by detecting write system calls issued by a file system driver of the endpoint to determine download of one or more documents to the endpoint from the sensitive cloud-based services; a document classifier that labels the documents as sensitive based on a combination of the inference from the network traffic monitoring that the documents originated from the sensitive cloud-based services, and the inference from the file system monitoring that the documents were downloaded to the endpoint; and wherein the sensitivity labels for the documents are stored as sensitivity metadata and used by an endpoint policy enforcer for responding to data egress requests and endpoint DLP policy enforcement in future without scanning the documents at the endpoint for sensitivity. ### Claim 3 (depends on 2) The system of claim 2, wherein the sensitivity metadata is stored in a local metadata store at the endpoint. ### Claim 4 (depends on 3) The system of claim 3, wherein the sensitivity metadata further labels the sensitive cloud-based services as a source of the documents downloaded at the endpoint; and implementing actions further comprising, in response to detecting a revision or copying of a downloaded document after the download, attaching the sensitivity metadata label from the downloaded document to the revised or copied document, including attaching the sensitivity metadata label identifying the sensitive cloud-based services as the source and updating the local metadata store with the attachment. ### Claim 5 (depends on 4) The system of claim 4, implementing actions further comprising, in response to detecting a revision or copying of a downloaded document after the download, reevaluating sensitivity of the revised or copied document, generating sensitivity metadata that labels the revised or copied document as sensitive, and updating the local metadata store with the sensitivity metadata generated for the revised or copied document. ### Claim 6 (depends on 5) The system of claim 5, implementing actions further comprising embedding the sensitivity metadata in the downloaded documents. ### Claim 7 (depends on 1) The system of claim 1, wherein the sensitive cloud-based services are previously identified based on their functionality and sensitive nature of data they store. ### Claim 8 (depends on 7) The system of claim 7, wherein the sensitive cloud-based services are identified in at least one sensitivity list stored at the endpoint. ### Claim 9 (depends on 8) The system of claim 8, wherein the sensitive cloud-based services are identified based on their respective unified resource locators (URLs). ### Claim 10 A computer-implemented method of enforcing data loss prevention policies at an endpoint without needing to perform content sensitivity scan at the endpoint or on server-side, the method including: combining network traffic monitoring of user interaction with cloud-based services identified as sensitive with file system monitoring of document download to the endpoint from the sensitive cloud-based services; the combination of the network traffic monitoring and the file system monitoring generating sensitivity metadata that labels documents downloaded to the endpoint from the sensitive cloud-based services as sensitive and persisting the sensitivity metadata in a local metadata store at the endpoint; and in response to detecting data egress events at the endpoint that would push data in a document from the endpoint to uncontrolled locations, determining that the document is sensitive based on looking up the sensitivity metadata for the document in the local metadata store and without scanning the document at the endpoint for sensitivity; and enforcing a data loss prevention policy at the endpoint based on the determination. ### Claim 11 (depends on 10) The computer-implemented method of claim 10, wherein the sensitivity metadata further labels the sensitive cloud-based services as a source of the documents downloaded at the endpoint; and further including, in response to detecting a revision or copying of a downloaded document after the download, attaching the sensitivity metadata label from the downloaded document to the revised or copied document, including attaching the sensitivity metadata label identifying the sensitive cloud-based services as the source and updating the local metadata store with the attachment. ### Claim 12 (depends on 11) The computer-implemented method of claim 11, further including, in response to detecting a revision or copying of a downloaded document after the download, reevaluating sensitivity of the revised or copied document, generating sensitivity metadata that labels the revised or copied document as sensitive, and updating the local metadata store with the sensitivity metadata generated for the revised or copied document. ### Claim 13 (depends on 10) The computer-implemented method of claim 10, further including embedding the sensitivity metadata in the downloaded documents. ### Claim 14 (depends on 10) The computer-implemented method of claim 10, wherein the sensitive cloud-based services are identified based on their functionality and sensitive nature of data they store. ### Claim 15 (depends on 14) The computer-implemented method of claim 14, wherein the sensitive cloud-based services are identified in at least one sensitivity list stored at the endpoint. ### Claim 16 (depends on 15) The computer-implemented method of claim 15, wherein the sensitive cloud-based services are identified based on their respective unified resource locators (URLs). ### Claim 17 A non-transitory computer readable storage medium impressed with computer program instructions to enforce data loss prevention policies at an endpoint without needing to perform content sensitivity scan at the endpoint or on server-side, the instructions, when executed on a processor, implement a method comprising: combining network traffic monitoring of user interaction with cloud-based services identified as sensitive with file system monitoring of document download to the endpoint from the sensitive cloud-based services; the combination of the network traffic monitoring and the file system monitoring generating sensitivity metadata that labels documents downloaded to the endpoint from the sensitive cloud-based services as sensitive and persisting the sensitivity metadata in a local metadata store at the endpoint; and in response to detecting data egress events at the endpoint that would push data in a document from the endpoint to uncontrolled locations, determining that the document is sensitive based on looking up the sensitivity metadata for the document in the local metadata store and without scanning the document at the endpoint for sensitivity; and enforcing a data loss prevention policy at the endpoint based on the determination. ### Claim 18 (depends on 17) The non-transitory computer readable storage medium of claim 17, wherein the sensitivity metadata further labels the sensitive cloud-based services as a source of the documents downloaded at the endpoint; and implementing the method further comprising, in response to detecting a revision or copying of a downloaded document after the download, attaching the sensitivity metadata label from the downloaded document to the revised or copied document, including attaching the sensitivity metadata label identifying the sensitive cloud-based services as the source and updating the local metadata store with the attachment. ### Claim 19 (depends on 18) The non-transitory computer readable storage medium of claim 18, implementing the method further comprising, in response to detecting a revision or copying of a downloaded document after the download, reevaluating sensitivity of the revised or copied document, generating sensitivity metadata that labels the revised or copied document as sensitive, and updating the local metadata store with the sensitivity metadata generated for the revised or copied document. ### Claim 20 (depends on 19) The non-transitory computer readable storage medium of claim 19, implementing the method further comprising embedding the sensitivity metadata in the downloaded documents.