System and method for creating a policy for managing personal data on a mobile communications device
A system and method to create a policy for managing personal data on a mobile communications device are disclosed. Personal data stored at one or more locations on the mobile communications device is identified by a policy management module on the mobile communications device. A policy is then created based on the personal data stored at the one or more locations. The policy management module on the mobile communications device monitors at least the personal data stored in the one or more locations on the mobile communications device.
1. A method comprising:
identifying, by a policy management module on a mobile communications device, data stored at one or more locations on the mobile communications device, the data sharing a common pattern;
determining, by the policy management module, that a subset of the identified data is personal data representing data relating to an identifiable individual;
creating, by the policy management module on the mobile communications device, a policy based on the determined subset of the identified data stored at the one or more locations;
applying the created policy, by the policy management module on the mobile communications device, to monitor only the subset of the identified data at the one or more locations on the mobile communications device where the subset is stored;
determining that the personal data was accessed in violation of the created policy; and
generating an alert indicating that the personal data was accessed in violation of the created policy.
2. The method of claim 1 , wherein the applying the created policy to monitor only the subset of the identified data includes:
detecting a request for access to the subset of the identified data by an application executing on the mobile communications device.
3. The method of claim 1 , wherein the alert notification is sent to a user of the mobile communications device.
4. The method of claim 1 , wherein the alert notification is sent to an administrator, the alert notification including a prompt for a response from the administrator to allow the request for access to the subset of the identified data.
5. The method of claim 4 , further comprising:
receiving, by the policy management module on the mobile communications device, a response from the administrator; and
granting, by the policy management module on the mobile communications device, the request for access to the subset of the identified data when the response from the administrator is to allow the request.
6. The method of claim 2 , wherein detecting the request for access to the subset of the identified data includes determining that the application executing on the mobile communications device is requesting access to the subset of the identified data.
7. The method of claim 1 , further comprising storing, by the policy management module on the mobile communications device, the policy in a policies storage of the policy management module.
8. The method of claim 1 , further comprising identifying, by the policy management module on the mobile communications device using the created policy, additional personal data stored in the one or more locations for storing data on the mobile communications device, and applying the created policy to monitor the additional identified personal data.
9. The method of claim 1 , wherein the personal data is determined from the identified data based on at least one of databases of user information, email databases associated with the mobile communications device, contact information, and short messaging system (SMS) information.
10. The method of claim 1 , wherein the policy is created further based on at least one of indexed document matching, data identifiers, and a classifier.
11. The method of claim 10 , wherein creating the policy based on the indexed document matching includes creating the policy based on text identified from the determined subset of the identified data.
12. The method of claim 10 , wherein creating the policy based on the data identifiers includes creating the policy by identifying known formats associated with the determined subset of the identified data.
13. The method of claim 10 , wherein creating the policy based on the classifier includes creating the policy by analyzing the determined subset of the identified data, sorting the determined subset of the identified data by classification, and creating a model to be used to identify additional personal data that match classifications of the model.
14. A method comprising:
identifying, by a policy management module on a mobile communications device, one or more locations for storing data on the mobile communications device;
identifying, by the policy management module on the mobile communications device, data stored at the one or more locations for storing data on the mobile communications device, the data sharing a common pattern;
determining, by the policy management module, that a subset of the identified data contains personal data relating to an identifiable individual;
creating, by the policy management module on the mobile communications device, a policy based on the determined subset of the identified data stored at the one or more locations;
applying, by the policy management module on the mobile communications device, the created personal data policy to the mobile communications device;
monitoring, by the policy management module on the mobile communications device, only the determined subset of the identified data at the one or more locations on the mobile communications device where the subset is stored based on the personal data policy applied to the mobile communications device;
determining, by the policy management module, that the personal data was accessed in violation of the created policy; and
generating, by the policy management module, an alert indicating that the personal data was accessed in violation of the created policy.
15. The method of claim 14 , wherein the identified data includes at least one of a contacts database, email database, a database containing communications received or transmitted by the mobile communications device, location information of the mobile communications device, or recently used network names.
16. The method of claim 14 , wherein monitoring at least the determined subset of the identified data stored in the one or more locations on the mobile communications device comprises:
detecting a request for access to the subset of the identified data by an application executed on the mobile communications device.
17. The method of claim 16 , wherein detecting the request for access includes determining if the requested access results in a transmission of at least part of the monitored data from the mobile communications device.
18. The method of claim 16 , wherein, the application is associated with a container wrapper, and wherein detecting the request for access of the subset of identified data is based on the application interacting with an interface of the container wrapper.
19. The method of claim 15 , wherein the alert notification is sent to an administrator, the alert notification including a prompt for a response from the administrator to allow the request for access to the subset of the identified data.
20. The method of claim 19 , further comprising:
receiving, by the policy management module on the mobile communications device, a response from the administrator; and
granting, by the policy management module on the mobile communications device, the request for access to the subset of the identified data when the response from the administrator is to allow the request.
21. A non-transitory, computer-readable storage medium having stored thereon a plurality of instructions, which, when executed by a processor of a computing device, cause the processor to:
identify data stored at one or more locations on the computing device, the data sharing a common pattern;
determine that a subset of the identified data is personal data representing data relating to an identifiable individual;
create a policy based on the determined subset of the identified data stored at the one or more locations;
apply the created policy to monitor only the subset of the identified data at the one or more locations on the mobile communications device where the subset is stored
determine that the personal data was accessed in violation of the created policy; and
generate an alert indicating that the personal data was accessed in violation of the created policy.
22. A system, comprising at least one processor and memory and instructions that when executed cause the at least one processor to:
identify data stored at one or more locations on the computing device, the data sharing a common pattern;
determine that a subset of the identified data is personal data representing data relating to an identifiable individual;
create a policy based on the determined subset of the identified data stored at the one or more locations;
apply the created policy to monitor only the subset of the identified data at the one or more locations on the mobile communications device where the subset is stored
determine that the personal data was accessed in violation of the created policy; and
generate an alert indicating that the personal data was accessed in violation of the created policy.