# US 2014/0155028 A1 · Method and aparatus for managing the transfer of sensitive information to mobile devices > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2014/0155028 A1 - Document ID: US20140155028A1 - Status: Published application - Kind: A1 - Application number: 13/691,544 - Filed: 2012-11-30 - Published: 2014-06-05 - Earliest claimed: 2012-11-30 - Assignees: Websense, Inc. - Applicants: Websense, Inc. - Inventors: Ramon Daniela; Mark Ostrer; Michael Stoler - Web page: https://patentgrep.com/patent/US20140155028A1 ## CPC - H04L 51/212: using filtering or selective blocking - H04L 51/234: for tracking messages - H04W 12/02: Protecting privacy or anonymity, e.g. protecting personally identifiable information [PII] - H04W 12/121: Wireless intrusion detection systems [WIDS]; Wireless intrusion prevention systems [WIPS] - H04L 51/58: Message adaptation for wireless communication - H04L 63/0227: {Filtering policies (mail message filtering H04L51/212)} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - H04W: WIRELESS COMMUNICATION NETWORKS (broadcast communication H04H; communication systems using wireless links for non-selective communication, e.g. wireless extensions H04M1/72) ## Abstract Methods and apparatus provide data loss protection for mobile devices. In one aspect, data is analyzed by a data loss protection server to determine if it is authorized by data loss protection policies to be transferred to a mobile device. The time necessary to analyze the data may exceed a mobile device timeout value. To prevent the mobile device from timing out, the DLP server may send one or more portions of a response to the mobile device at a time interval less than the mobile device timeout value. Some portions of the response may be sent before the analyzing of the data is completed. ## Claims ### Claim 1 A method of preventing the loss of sensitive data, comprising: receiving a request via a network from a mobile device for data; filtering a data set to produce a filtered data set, the filtering based, at least in part, on properties of the mobile device; and sending a response to the mobile device via the network, the response based, at least in part, on the filtered data set. ### Claim 2 (depends on 1) The method of claim 1, wherein the properties of the mobile device include at least one of the mobile device model number, mobile device EUN, mobile device operating system, or mobile device location. ### Claim 3 (depends on 1) The method of claim 1, wherein the properties of the mobile device include whether the mobile device is communicating over a secure channel. ### Claim 4 (depends on 1) The method of claim 1, wherein filtering the data set comprises: initiating filter processing of the data set to produce the filtered data; and sending a plurality of portions of the response to the network request to the mobile device in separate network messages, at an interval that is less than a mobile device timeout value and greater than a timer value, while the filter processing of the data set is in progress. ### Claim 5 (depends on 4) The method of claim 4, wherein the mobile device timeout value is based on the operating system of the mobile device. ### Claim 6 (depends on 4) The method of claim 4, wherein each of the plurality of portions include four or less bytes of data and does not include data derived from the data set. ### Claim 7 (depends on 4) The method of claim 4, wherein the timer value is greater than 500 milliseconds. ### Claim 8 (depends on 1) The method of claim 1, wherein filtering the data set comprises initiating filter processing of the data set to produce the filtered data set; and while the filter processing of the data set is incomplete: setting a timer with a duration less than a mobile device timeout value, receiving notification that the timer has expired, and sending a portion of the response to the mobile device in response to expiration of the timer, wherein sending the response comprises completing transmission of the response in response to the completion of filter processing of the data set. ### Claim 9 (depends on 8) The method of claim 8, wherein a portion of the response comprises at least a portion of a http header. ### Claim 10 (depends on 8) The method of claim 8, wherein a portion of the response comprises a portion of a WBXML file. ### Claim 11 (depends on 8) The method of claim 8, further comprising: sending a server request for the data set to a server in response to receiving the request from the mobile device; and receiving the data set from the server in response to the server request. ### Claim 12 (depends on 1) The method of claim 1, wherein filtering the data set comprises: determining that a received email message is not authorized to be transferred to the mobile device; and sending a block notification message in response to the determining. ### Claim 13 (depends on 12) The method of claim 12, further comprising indicating the received email message is quarantined when sending the response to the mobile device. ### Claim 14 (depends on 12) The method of claim 12, further comprising: receiving an indication that the received email message is authorized to be transferred to the mobile device after sending the response to the mobile device; in response to the indication, sending a first network message to the mobile device, indicating a property of the received email message has changed from a first value to a second value; receiving a second request from the mobile device for an email data set; and sending a response to the mobile device including the received email message. ### Claim 15 (depends on 8) The method of claim 8, wherein the receiving notification, sending of a portion, and setting of a timer are iteratively performed until filter processing of the data set is complete. ### Claim 16 (depends on 15) The method of claim 15, wherein the portions do not include email message data or attachments from the data set. ### Claim 17 (depends on 1) The method of claim 1, wherein the request is an http or https request and the response comprises an http or https response. ### Claim 18 (depends on 1) The method of claim 1, wherein the request for data requests one or more of email data, contact data, task data, calendar data, or notes data. ### Claim 19 An apparatus for preventing the loss of sensitive data on a mobile device, comprising: a processor; and a memory operatively coupled to the processor, the memory storing: a mobile device communication module, configured to receive a request for data from the mobile device, and a data processing module, configured to filter a data set to produce a filtered data set, the filtering based, at least in part, on properties of the mobile device, wherein the mobile device communication module is further configured to complete a response to the mobile device based, at least in part, on the filtered data set. ### Claim 20 (depends on 19) The apparatus of claim 19, wherein the data processing module is further configured to initiate filter processing of the data set to produce the filtered data set, and the apparatus further comprises: a connection management module configured to send one or more portions of the response to the mobile device at time intervals less than a mobile device timeout value while the filter processing of the data set is incomplete, wherein completing the response to the mobile device comprises sending a remaining portion of the response to the mobile device in response to the completion of filter processing of the data set. ### Claim 21 An apparatus for preventing the loss of sensitive data on a mobile device, comprising: means for receiving a request for data from the mobile device; means for filtering an data set to produce a filtered data set, the filtering based, at least in part, on properties of the mobile device; and means for sending a complete response to the mobile device based, at least in part, on the filtered data set. ### Claim 22 (depends on 21) The apparatus of claim 21, wherein the means for filtering of the data set comprises: means for initiating filter processing of the data set to produce the filtered data set; and means for sending a plurality of portions of the response to the network request to the mobile device in separate network messages, at an interval that is less than a mobile device timeout value while the filter processing of the data set is in progress. ### Claim 23 A non-transitory computer readable medium, storing instructions that when executed by a processor perform a method of preventing the loss of sensitive data on a mobile device, the method comprising: receiving a request for data from the mobile device; filtering an data set to produce a filtered data set, the filtering based, at least in part, on properties of the mobile device; and completing a response to the mobile device based, at least in part, on the filtered data set. ### Claim 24 (depends on 23) The computer readable medium of claim 23, wherein filtering of the data set comprises initiating filter processing of the data set to produce the filtered data set; sending a plurality of portions of the response to the network request to the mobile device in separate network messages, at an interval that is less than a mobile device timeout value while the filter processing of the data set is in progress, wherein completing the response comprises sending a remaining portion of the response to the mobile device in response to the completion of filter processing of the data set.