# US 12,225,089 B2 · Network-aware endpoint data loss prevention for web transactions

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 12,225,089 B2
- Document ID: US12225089B2
- Status: Granted
- Kind: B2
- Application number: 17/840,726
- Filed: 2022-06-15
- Published: 2023-12-21
- Granted: 2025-02-11
- Earliest claimed: 2022-06-15
- Assignees: Microsoft Technology Licensing, LLC
- Applicants: Microsoft Technology Licensing, LLC
- Inventors: Guy Lewin; Yossi Haber; Meital Ben David
- Web page: https://patentgrep.com/patent/US12225089B2

## CPC

- H04L 63/1408: {by monitoring network traffic (monitoring network traffic per se H04L43/00)}
- H04L 67/147: Signalling methods or messages providing extensions to protocols defined by standardisation
- G06F 21/554: {involving event detection and direct action}
- G06F 21/6281: {at program execution time, where the protection is within the operating system}
- H04L 9/0643: {Hash functions, e.g. MD5, SHA, HMAC or f9 MAC}
- H04L 9/3263: {involving certificates, e.g. public key certificate [PKC] or attribute certificate [AC]; Public key infrastructure [PKI] arrangements (network architectures or network communication protocols for supporting authentication of entities using certificates in a packet data network H04L63/0823)}
- H04L 63/0227: {Filtering policies (mail message filtering H04L51/212)}
- H04L 63/20: {for managing network security; network security policies in general (filtering policies H04L63/0227)}
- H04L 67/146: Markers for unambiguous identification of a particular session, e.g. session cookie or URL-encoding
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)

## Abstract

Methods for network aware endpoint data loss prevention (DLP) in web transactions are performed by systems and devices, which includes implementing DLP on endpoint devices and focuses on web traffic events from web browsers, while also associating the events to the network source entity. File download and upload events are intercepted from the operating system by a file system filter that determines the process creating events is a web browser based on process identifiers and comparing process names and process executable signatures. A uniform resource locator (URL) from a current tab or session is retrieved for the web browser. Policies for events are evaluated via a policy server or via cache, and additional data from the file is provided for policy decisions when necessary. DLP actions taken via the file system filter to block or allow events, including encrypting file data, are based on the policy decisions.

## Claims

### Claim 1

A method performed by a file system filter of a computing device, the method comprising:
intercepting, by the file system filter, a request to read from or write to a file, the request comprising a process identifier identifying a process executing on the computing device;
determining, based on the process identifier, that the process is an instance of a web browser application;
retrieving a uniform resource locator (URL) corresponding to the request; and
performing a data loss prevention (DLP) action against the request based at least on the URL and an identifier of the file.

### Claim 2 (depends on 1)

The method of claim 1, wherein said determining, based on the process identifier, that the process is an instance of a web browser application comprises:
determining, based on the process identifier, an executable path for the process;
identifying, based at least on the executable path, a hash value and a certificate associated with the process; and
comparing the hash value and the certificate associated with the process to a browser certificate and hash value associated with the web browser application.

### Claim 3 (depends on 1)

The method of claim 1, wherein said retrieving the URL comprises at least one of:
reading a current session file of the web browser application and retrieving the URL therefrom;
querying the web browser application for one or more open instances thereof via an application programming interface; or
reading the URL from an operating system-level metadata file that comprises origin information of download files.

### Claim 4 (depends on 1)

The method of claim 1, further comprising:
providing the URL and the file identifier to a policy server configured to evaluate DLP policies; and
receiving, from the policy server, an indication of the DLP action to be performed.

### Claim 5 (depends on 4)

The method of claim 4, further comprising:
receiving, from the policy server, a request for additional information; and
providing at least a portion of the file associated with the request to the policy server.

### Claim 6 (depends on 5)

The method of claim 5, wherein the request is a request to write to the file; and
wherein said providing the at least a portion of the file comprises:
enabling the instance of the web browser application to initiate a download of the file; and
buffering the at least a portion of the file during the download for providing to the policy server, while preventing the at least a portion of the file from being saved to a persistent storage at the computing device.

### Claim 7 (depends on 1)

The method of claim 1, wherein the DLP action comprises at least one of:
allowing the request to complete;
blocking the request from completion;
encrypting data of the file associated with the request; or
releasing a buffer that stores at least a portion of the file associated with the request.

### Claim 8 (depends on 2)

The method of claim 2, wherein said determining, based on the process identifier, an executable path for the process comprises:
querying, based on the process identifier, a process list for the execution path.

### Claim 9

A computing system, comprising:
a processor; and
a memory that stores program code structured to cause the processor to:
intercept a request to read from or write to a file, the request comprising a process identifier identifying a process executing on the computing device;
determine, based on the process identifier, that the process is an instance of a web browser application;
retrieve a uniform resource locator (URL) corresponding to the request; and
perform a data loss prevention (DLP) action against the request based at least on the URL and an identifier of the file.

### Claim 10 (depends on 9)

The computing system of claim 9, wherein, to determine, based on the process identifier, that the process is an instance of a web browser application, the program code causes the processor to:
determine, based on the process identifier, an executable path for the process;
identify, based at least on the executable path, a hash value and a certificate associated with the process; and
compare the hash value and the certificate associated with the process to a browser certificate and a hash value associated with the web browser application.

### Claim 11 (depends on 9)

The computing system of claim 9, wherein, to retrieve the URL corresponding to the request, the program code is structured to cause the processor to perform at least one of:
read a current session file of the web browser application and retrieving the URL therefrom;
query the web browser application for one or more open instances thereof via an application programming interface; or
read the URL from an operating system-level metadata file that comprises origin information of download files.

### Claim 12 (depends on 9)

The computing system of claim 9, wherein the program code is structured to further cause the processor to:
provide the URL and the file identifier to a policy server that is configured to evaluate DLP policies; and
receive, from the policy server, an indication of the DLP action to be performed.

### Claim 13 (depends on 12)

The computing system of claim 12, wherein the program code is structured to further cause the processor to:
receive, from the policy server, a request for additional information; and
provide at least a portion of the file associated with the request to the policy server.

### Claim 14 (depends on 13)

The computing system of claim 13, wherein the request is a request to write to the file; and
wherein, to provide the at least a portion of the file, the program code is structured to cause the processor to:
enable the instance of the web browser application to initiate a download of the file; and
buffer the at least a portion of the file during the download for providing to the policy server, while preventing the at least a portion of the file from being saved to a persistent storage at the computing device.

### Claim 15 (depends on 9)

The computing system of claim 9, wherein, to perform the DLP action, the program code is structured to cause the processor to perform at least one of to:
allow the request to complete;
block the request from completion;
encrypt data of the file associated with the request; or
release a buffer that stores at least a portion of the file associated with the request.

### Claim 16

A computer-readable storage medium comprising program instructions recorded thereon that, when executed by a processor, cause the processor to:
intercept a request to read from or write to a file, the request comprising a process identifier identifying a process executing on the computing device;
determine a process, based on the process identifier, that the process is an instance of a web browser application;
retrieve a uniform resource locator (URL) corresponding to the request; and
perform a data loss prevention (DLP) action against the request based at least on the URL and an identifier of the file.

### Claim 17 (depends on 16)

The computer-readable storage medium of claim 16, wherein, to determine, based on the process identifier, that the process is an instance of a web browser application, the program instructions, when executed by the processor, cause the processor to:
determine, based on the process identifier, an executable path for the process;
identify, based at least on the executable path, a hash value and a certificate associated with the process; and
compare the hash value and the certificate associated with the process to a browser certificate and a hash value associated with the web browser application.

### Claim 18 (depends on 16)

The computer-readable storage medium of claim 16, wherein, to perform the DLP action, the program instructions, when executed by the processor, cause the processor to perform at least one of:
allow the request to complete;
block the request from completion;
encrypt data of the file associated with the request; or
release a buffer that stores at least a portion of the file associated with the request.

### Claim 19 (depends on 16)

The computer-readable storage medium of claim 16, wherein, to retrieve the URL, the program instructions, when executed by the processor, cause the processor to perform at least one of:
read a current session file of the web browser application and retrieving the URL therefrom;
query the web browser application for one or more open instances thereof via an application programming interface; or
read the URL from an operating system-level metadata file that comprises origin information of download files.

### Claim 20 (depends on 16)

The computer-readable storage medium of claim 16, wherein the request is a request to write to the file; and
wherein, to perform the DLP action, the program instructions, when executed by the processor, cause the processor to:
provide the URL and the file identifier to a policy server configured to evaluate DLP policies;
receive, from the policy server, a request for additional information;
provide at least a portion of the file associated with the event to the policy server by:
enabling the instance of the web browser application to initiate a download of the file, and
buffering the at least a portion of the file during the download for providing to the policy server, while preventing the at least a portion of the file from being saved to a persistent storage at the computing device; and
receive, from the policy server, an indication of the DLP action to be performed.