# US 12,603,868 B2 · Endpoint data loss prevention

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 12,603,868 B2
- Document ID: US12603868B2
- Status: Granted
- Kind: B2
- Application number: 17/952,696
- Filed: 2022-09-26
- Published: 2023-09-21
- Granted: 2026-04-14
- Earliest claimed: 2020-04-21
- Assignees: Zscaler, Inc.
- Applicants: Zscaler, Inc.
- Inventors: Arun Bhallamudi; Narinder Paul
- Web page: https://patentgrep.com/patent/US12603868B2

## CPC

- G06F 21/554: {involving event detection and direct action}
- H04L 63/04: {for providing a confidential data exchange among entities communicating through data packet networks}
- G06F 21/6245: {Protecting personal data, e.g. for financial or medical purposes}
- H04L 63/0876: {based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint}
- H04L 63/10: {for controlling access to devices or network resources}
- H04L 63/1425: {Traffic logging, e.g. anomaly detection}
- H04L 63/20: {for managing network security; network security policies in general (filtering policies H04L63/0227)}
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)

## Abstract

Systems and methods include receiving Data Loss Prevention (DLP) configurations for one or more devices, wherein the DLP configurations define how exfiltration of sensitive data is protected for the one or more devices; monitoring traffic of the one or more devices; and scanning the traffic of the one or more devices using the DLP configurations assigned to the one or more devices.

## Claims

### Claim 1

A non-transitory computer-readable storage medium having computer-readable code stored thereon for programming one or more processors to perform steps of:
authenticating one or more devices with a cloud-based system using device Identification (ID) information;
establishing a Hypertext Transfer Protocol Secure (HTTPS) connection to an authenticated device and receiving, for an authenticated device via the HTTPS connection, device-specific Data Loss Prevention (DLP) configurations stored in bidirectional mapping structures associating engines with dictionaries and dictionaries with engines, wherein the DLP configurations define how preventing exfiltration via one or more channels configured as outlets of sensitive data is performed for the one or more devices, the channels comprising endpoint exfiltration outlets operable for exfiltration via data duplication and distribution;
monitoring traffic of the one or more devices; and
scanning the traffic of the one or more devices using the DLP configurations for the one or more devices, wherein the scanning includes performing text extraction, tokenizing the extracted text by segmenting the text into numeric, alphanumeric, and non-alphanumeric tokens based on delimiter characters, matching the tokens to predefined and custom dictionaries using hash-based lookups and pattern-matching, generating a dictionary score for each dictionary based on matched tokens and dictionary-specific weighting or confidence rules, and evaluating Boolean engine expressions comprising logical operators applied to the dictionary scores to determine whether any DLP engines are triggered, wherein each DLP engine correlates results from multiple dictionaries to identify whether the traffic contains content indicative of sensitive or policy-restricted information, and, responsive to identifying, causing performance of at least one DLP action including blocking the traffic or generating a notification associated with the traffic.

### Claim 2 (depends on 1)

The non-transitory computer-readable storage medium of claim 1, wherein the steps further include:
determining a DLP trigger for the one or more devices based on the DLP configurations for the one or more devices, the DLP configurations define any of dictionaries, engines, and rules, wherein the DLP configurations are one of custom or predefined, and wherein the engines include Boolean expressions with thresholds applied to the dictionaries.

### Claim 3 (depends on 2)

The non-transitory computer-readable storage medium of claim 2, wherein the steps further include:
responsive to the DLP trigger, performing an action specified in a triggered policy based thereon, the actions are any of allow, block, notify, justify, and audit.

### Claim 4 (depends on 1)

The non-transitory computer-readable storage medium of claim 1, wherein the DLP configurations include one or more DLP dictionaries, DLP engines, and rules.

### Claim 5 (depends on 4)

The non-transitory computer-readable storage medium of claim 4, wherein the one or more DLP dictionaries are any of a predefined dictionary and a custom dictionary.

### Claim 6 (depends on 1)

The non-transitory computer-readable storage medium of claim 1, wherein channels protected from exfiltration of sensitive data from the devices include endpoint channels comprising copying to peripheral devices via Universal Serial Bus (USB) or Bluetooth, printing, clipboarding, copying to local network shares, and Software-as-a-Service (SaaS) remote sync services.

### Claim 7 (depends on 1)

The non-transitory computer-readable storage medium of claim 1, wherein the DLP configurations are stored in bidirectional mapping structures including mappings from engines to dictionaries and from dictionaries to engines.

### Claim 8 (depends on 1)

The non-transitory computer-readable storage medium of claim 1, wherein safe listed file paths are excluded from scanning.

### Claim 9

A method comprising steps of:
authenticating one or more devices with a cloud-based system using device Identification (ID) information;
establishing a Hypertext Transfer Protocol Secure (HTTPS) connection to an authenticated device and receiving, for an authenticated device via the HTTPS connection, device-specific Data Loss Prevention (DLP) configurations for one or more devices, the DLP configurations stored in bidirectional mapping structures associating engines with dictionaries and dictionaries with engines, wherein the DLP configurations define how preventing exfiltration via one or more channels configured as outlets of sensitive data is performed for the one or more devices, the channels comprising endpoint exfiltration outlets operable for exfiltration via data duplication and distribution;
monitoring traffic of the one or more devices; and
scanning the traffic of the one or more devices using the DLP configurations for the one or more devices, wherein the scanning includes performing text extraction, tokenizing the extracted text by segmenting the text into numeric, alphanumeric, and non-alphanumeric tokens based on delimiter characters, matching the tokens to predefined and custom dictionaries using hash-based lookups and pattern-matching, generating a dictionary score for each dictionary based on matched tokens and dictionary-specific weighting or confidence rules, and evaluating Boolean engine expressions comprising logical operators applied to the dictionary scores to determine whether any DLP engines are triggered, wherein each DLP engine correlates results from multiple dictionaries to identify whether the traffic contains content indicative of sensitive or policy-restricted information, and, responsive to identifying, causing performance of at least one DLP action including blocking the traffic or generating a notification associated with the traffic.

### Claim 10 (depends on 9)

The method of claim 9, wherein the steps further comprise:
determining a DLP trigger for the one or more devices based on the DLP configurations for the one or more devices, and wherein the engines include Boolean expressions with thresholds applied to the dictionaries.

### Claim 11 (depends on 10)

The method of claim 10, wherein the steps further comprise:
responsive to the DLP trigger, performing an action based thereon.

### Claim 12 (depends on 9)

The method of claim 9, wherein the DLP configurations include one or more DLP dictionaries, DLP engines, and rules.

### Claim 13 (depends on 12)

The method of claim 12, wherein the one or more DLP dictionaries are any of a predefined dictionary and a custom dictionary.

### Claim 14 (depends on 9)

The method of claim 9, wherein channels protected from exfiltration of sensitive data from the devices include endpoint channels comprising copying to peripheral devices via Universal Serial Bus (USB) or Bluetooth, printing, clipboarding, copying to local network shares, and Software-as-a-Service (SaaS) remote sync services.

### Claim 15 (depends on 9)

The method of claim 9, wherein the DLP configurations are stored in bidirectional mapping structures, including mappings from engines to dictionaries and from dictionaries to engines.

### Claim 16 (depends on 9)

The method of claim 9, wherein safe listed file paths are excluded from scanning.