# US 2014/0194094 A1 · Data loss prevention for mobile computing devices

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 2014/0194094 A1
- Document ID: US20140194094A1
- Status: Published application
- Kind: A1
- Application number: 14/126,714
- Filed: 2013-10-18
- Published: 2014-07-10
- Earliest claimed: 2012-10-19
- Assignees: McAfee, Inc.
- Inventors: Ratinder Paul Singh Ahuja; Balbir Singh; Rajbir Bhattacharjee; Dattatraya Kulkarni
- Web page: https://patentgrep.com/patent/US20140194094A1

## CPC

- H04L 63/107: {wherein the security policies are location-dependent, e.g. entities privileges depend on current location or allowing specific operations only from locally connected terminals}
- G06F 21/53: by executing in a restricted environment, e.g. sandbox or secure virtual machine
- H04W 4/021: Services related to particular areas, e.g. point of interest [POI] services, venue services or geofences
- H04W 4/029: Location-based management or tracking services
- G06F 2221/2111: Location-sensitive, e.g. geographical location, GPS
- H04W 12/033: of the user plane, e.g. user's traffic
- H04W 12/088: using filters or firewalls
- H04W 12/37: Managing security policies for mobile devices or for controlling mobile applications
- H04W 12/80: Arrangements enabling lawful interception [LI]
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)
- H04W: WIRELESS COMMUNICATION NETWORKS (broadcast communication H04H; communication systems using wireless links for non-selective communication, e.g. wireless extensions H04M1/72)

## Abstract

System calls to a kernel of a mobile computing device are monitored. A particular system call is intercepted relating to input/output (I/O) functionality of the mobile computing device. A data loss prevention (DLP) policy is identified that is applicable to the particular system call. An action is performed on the particular system call based at least in part on the DLP policy.

## Claims

### Claim at position 1

1-25. (canceled)

### Claim 26

At least one machine accessible storage medium having instructions stored thereon, the instructions when executed on a machine, cause the machine to:
intercept a system call involving photograph data to a kernel of a mobile computing device;
identify a location-based data loss prevention (DLP) policy applicable to use of the photograph data, based at least in part on a detected location of the mobile computing device; and
perform an action on the intercepted system call based at least in part on the location-based DLP policy and the location of the mobile computing device.

### Claim 27 (depends on 26)

The storage medium of claim 26, wherein attempts to output the photograph data while the mobile computing device is located outside of a particular geographic location are blocked based on the location-based DLP policy.

### Claim 28 (depends on 26)

The storage medium of claim 26, wherein the kernel is a Linux kernel and the particular system call is intercepted by a Linux Security Module (LSM).

### Claim 29 (depends on 26)

The storage medium of claim 26, wherein the agent is an application installed on the mobile computing device.

### Claim 30 (depends on 29)

The storage medium of claim 29, wherein the agent interfaces with a remote security server for policy information corresponding to the mobile computing device.

### Claim 31 (depends on 26)

The storage medium of claim 26, wherein the agent logic is included in a security module interfacing with the kernel.

### Claim 32 (depends on 26)

The storage medium of claim 26, wherein the particular system call includes at least one of an output of the photograph data utilizing SMS, email, near field communication (NFC), Bluetooth, and WiFi functionality of the mobile computing device.

### Claim 33 (depends on 26)

The storage medium of claim 26, wherein applications of the mobile computing device capable of utilizing the photograph data are run in a process virtual machine container.

### Claim 34 (depends on 33)

The storage medium of claim 33, wherein the process virtual machine container comprises a Dalvik process virtual machine.

### Claim 35 (depends on 26)

The storage medium of claim 26, wherein the photograph data includes video data.

### Claim 36

A method for providing computer security, the method comprising:
intercepting a system call involving photograph data to a kernel of a mobile computing device;
identifying a location-based data loss prevention (DLP) policy applicable to use of the photograph data, based at least in part on a detected location of the mobile computing device; and
performing an action on the intercepted system call based at least in part on the location-based DLP policy and the location of the mobile computing device.

### Claim 37 (depends on 36)

The method of claim 36, wherein identifying the location-based DLP policy includes:
querying an agent on the mobile computing device for DLP policies applicable to the photograph data; and
receiving a result from the agent identifying whether DLP policies apply to the photograph data, the result identifying the location-based DLP policy.

### Claim 38 (depends on 36)

The method of claim 36, wherein the location-based DLP policy restricts access to the photograph data outside of a particular geographic area.

### Claim 39 (depends on 38)

The method of claim 38, wherein the particular geographic area is defined using a geofence.

### Claim 40 (depends on 38)

The method of claim 38, wherein the particular geographic area corresponds to a location where the photograph data was created.

### Claim 41 (depends on 36)

The method of claim 36, wherein the system call involves an input of the photograph data and the photograph data originates from a camera on the mobile computing device.

### Claim 42 (depends on 41)

The method of claim 41, wherein the action includes tagging the photograph data with location information, wherein location-based DLP policies are enforced on the photograph data based on the tagged location information.

### Claim 43 (depends on 42)

The method of claim 42, wherein the location information corresponds to a location where the photograph data was captured.

### Claim 44 (depends on 43)

The method of claim 43, wherein the location information corresponds to geopositional data captured using the mobile computing device at the capturing of the photograph data.

### Claim 45 (depends on 42)

The method of claim 42, further comprising:
receiving a subsequent system call involving the photograph data;
identifying the location data;
communicating the location data in connection with a query of the agent for DLP policies applicable to the photograph data; and
performing an action on the subsequent system call based at least in part on the tagging.

### Claim 46

A system for providing computer security, the system comprising:
a processor device;
a memory element; and
a security manager interfacing with a kernel and adapted, when executed by the processor device to:
intercept a system call involving photograph data to a kernel of a mobile computing device;
identify a location-based data loss prevention (DLP) policy applicable to use of the photograph data, based at least in part on a detected location of the mobile computing device; and
perform an action on the intercepted system call based at least in part on the location-based DLP policy and the location of the mobile computing device.

### Claim 47 (depends on 46)

The system of claim 46, further comprising a digital camera to generate the photograph data.

### Claim 48 (depends on 46)

The system of claim 46, wherein identifying the location-based DLP policy includes:
querying a DLP agent on the mobile computing device for DLP policies applicable to the photograph data; and
receiving a result from the agent identifying whether DLP policies apply to the photograph data, the result identifying the location-based DLP policy.

### Claim 49 (depends on 48)

The system of claim 48, further comprising the DLP agent.

### Claim 50 (depends on 46)

The system of claim 46, wherein the system comprises the mobile computing device.