# US 12,182,297 B2 · Data protection for computing device > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 12,182,297 B2 - Document ID: US12182297B2 - Status: Granted - Kind: B2 - Application number: 17/448,776 - Filed: 2021-09-24 - Published: 2023-03-30 - Granted: 2024-12-31 - Earliest claimed: 2021-09-24 - Assignees: Google Inc. - Applicants: Google LLC - Inventors: Tony Ureche; Sergey Poromov; Alex Huie; Nikita Podguzov; Aya Mahmoud Ebrahim Elsayed - Web page: https://patentgrep.com/patent/US12182297B2 ## CPC - G06F 21/6236: {between heterogeneous systems} - G06F 21/10: Protecting distributed programs or content, e.g. vending or licensing of copyrighted material (protection in video systems or pay television H04N7/16) {; Digital rights management [DRM]} - G06F 21/6245: {Protecting personal data, e.g. for financial or medical purposes} - G06F 21/78: to assure secure storage of data (address-based protection against unauthorised use of memory G06F12/14; record carriers for use with machines and with at least a part designed to carry digital markings G06K19/00) - G06F 21/84: output devices, e.g. displays or monitors - H04L 63/10: {for controlling access to devices or network resources} - H04W 12/08: Access security - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - H04W: WIRELESS COMMUNICATION NETWORKS (broadcast communication H04H; communication systems using wireless links for non-selective communication, e.g. wireless extensions H04M1/72) ## Abstract According to an aspect, a method includes receiving data loss prevention (DLP) restriction data, where the DLP restriction data defines a first DLP control. The first DLP control identifies at least one content attribute of restricted content. The first DLP control identifies a restriction to a computer function when the restricted content is rendered on a display of a computing device. The method includes storing the DLP restriction data in a memory device associated with an operating system of the computing device, detecting, by the operating system, that content rendered on the display of the computing device includes at least a portion of the restricted content as identified by the at least one content attribute, and restricting the computer function during a period of time in which the portion of the restricted content is rendered on the display. ## Claims ### Claim 1 A method comprising: receiving data loss prevention (DLP) restriction data, the DLP restriction data including a DLP control identifying at least one content attribute of restricted content and a restriction to a computer function when the restricted content is rendered on a display of a computing device; storing the DLP restriction data in a memory device associated with an operating system of the computing device, the operating system including a first software container executing a native application and a second software container executing a virtual application; detecting, by a window manager of the operating system, a first display event generated by the first software container, the first display event including a content attribute of content to be rendered on the display; detecting, by the window manager, a second display event generated by the second software container, the second display event including a content attribute of content to be rendered on the display; detecting, by the window manager, that the content attribute from the first display event or the content attribute from the second display event corresponds to the at least one content attribute of the DLP control; and restricting the computer function during a period of time in which the restricted content is rendered on the display. ### Claim 2 (depends on 1) The method of claim 1, further comprising: disabling the restriction to the computer function in response to the restricted content not being detected as rendered on the display. ### Claim 3 (depends on 1) The method of claim 1, wherein the computer function includes at least one of a screenshot function, a screencast function, or a printing function. ### Claim 4 (depends on 1) The method of claim 1, wherein the computer function includes a display screen function in which the restriction to the display screen function reduces a viewing angle of the content rendered on the display. ### Claim 5 (depends on 1) The method of claim 1, wherein the at least one content attribute includes a web location of a computer resource. ### Claim 6 (depends on 1) The method of claim 1, wherein the DLP control is a first DLP control, the DLP restriction data including a second DLP control identifying a restriction to a file transfer function to transfer a computer file. ### Claim 7 (depends on 6) The method of claim 6, further comprising: intercepting a file system event; extracting content metadata from the file system event, the content metadata identifying a content attribute of the computer file; detecting that the content attribute from the content metadata corresponds to a content attribute identified in the second DLP control; and restricting transfer of the computer file. ### Claim 8 (depends on 1) The method of claim 1, wherein the DLP control is a first DLP control, the DLP restriction data including a second DLP control identifying a restriction to a clipboard function. ### Claim 9 (depends on 8) The method of claim 8, further comprising: detecting a clipboard request; extracting content metadata from the clipboard request, the content metadata identifying a content attribute of content subject to the clipboard function; detecting that the content attribute from the content metadata corresponds to a content attribute identified in the second DLP control; and disabling the clipboard function. ### Claim 10 An apparatus comprising: at least one processor; and a non-transitory computer readable medium storing executable instructions that when executed by the at least one processor cause the at least one processor to: store data loss prevention (DLP) restriction data in a memory device associated with an operating system of a computing device, the DLP restriction data including a DLP control identifying at least one content attribute of restricted content and a restriction to a computer function when the restricted content is rendered on a display of the computing device, the operating system including a first software container executing a native application and a second software container executing a virtual application; detect, by a window manager of the operating system, a first display event generated by the first software container, the first display event including a content attribute of content to be rendered on the display; detect, by the window manager, a second display event generated by the second software container, the second display event including a content attribute of content to be rendered on the display; detect, by the window manager, that the content attribute from the first display event or the content attribute from the second display event corresponds to the at least one content attribute in the DLP control; and restrict the computer function during a period of time in which the restricted content is rendered on the display. ### Claim 11 (depends on 10) The apparatus of claim 10, wherein the restriction to the computer function includes enablement of an electronic privacy screen on the display. ### Claim 12 (depends on 10) The apparatus of claim 10, wherein the DLP control is a first DLP control, the DLP restriction data including a second DLP control identifying a restriction to a file transfer function to transfer a computer file, wherein the executable instructions include instructions that when executed by the at least one processor cause the at least one processor to: intercept, by an application programming interface, a file system event; extract content metadata from the file system event, the content metadata identifying a content attribute of the computer file; detect that the content attribute from the content metadata corresponds to a content attribute in the second DLP control; and restrict transfer of the computer file. ### Claim 13 (depends on 12) The apparatus of claim 12, wherein the DLP restriction data includes a third DLP control identifying a restriction to a clipboard function, wherein the executable instructions include instructions that, when executed by the at least one processor, cause the at least one processor to: detect a clipboard request; extract content metadata from the clipboard request, the content metadata identifying at least one of a source or destination of content subject to the clipboard function; detect that at least one of the source or the destination from the content metadata corresponds to at least one of a source or destination identified in the second DLP control; and disable the clipboard function. ### Claim 14 (depends on 10) The apparatus of claim 10, wherein the second display event is detected via an inter-process communication (IPC) link between the second software container and the window manager. ### Claim 15 A non-transitory computer-readable medium storing executable instructions that, when executed by at least one processor, cause the at least one processor to execute operations, the operations comprising: receiving data loss prevention (DLP) restriction data, the DLP restriction data including a DLP control identifying at least one content attribute of restricted content and a restriction to a computer function when the restricted content is rendered on a display of a computing device; storing the DLP restriction data in a memory device associated with an operating system of the computing device, the operating system including a first software container executing a native application and a second software container executing a virtual application; detecting, by a window manager of the operating system, a first display event generated by the first software container, the first display event including a content attribute of content to be rendered on the display; detecting, by the window manager, a second display event generated by the second software container, the second display event including a content attribute of content to be rendered on the display; detecting, by the window manager, that the content attribute from the first display event or the content attribute from the second display event corresponds to at least one content attribute of the DLP control; and restricting the computer function during a period of time in which the restricted content is rendered on the display. ### Claim 16 (depends on 15) The non-transitory computer-readable medium of claim 15, wherein the DLP control is a first DLP control, the DLP restriction data including a second DLP control identifying a restriction to a file transfer function when a computer file includes the restricted content, the operations further comprising: receiving, by a content analyzer, contents of the computer file; and detecting, by the content analyzer, that the contents of the computer file include at least a portion of the restricted content. ### Claim 17 (depends on 16) The non-transitory computer-readable medium of claim 16, wherein the content analyzer includes a machine-learning model.