Granted Patent B1

US 10,248,797 · App. 15/199,700 · Granted Apr 2, 2019

Inventors: Ameet Shinde (Mountain View, CA); Eftiquar Shaikh (Mountain View, CA); Rupesh Khetawat (Mountain View, CA); Jogesh Sharma (Mountain View, CA); Amit Dhotre (Mountain View, CA)

Assignee: SYMANTEC CORPORATION

G06F21/604G06F16/172H04L43/106H04L63/0428H04L67/02H04L67/06H04L67/2842

Abstract

Claims (102)

1. A method of Data Loss Prevention (DLP) Protection comprising:

capturing file upload context for a scheduled file or folder upload, wherein capturing the file upload context comprises:

detecting an associated operation for the scheduled file or folder upload, including whether the scheduled file or folder upload corresponds to a single file upload, multi-file upload, folder upload, or a drag-and-drop operation, and wherein detecting the associated operation comprises:

intercepting a shell dialogue Application Programming Interface (API) to detect the single file upload and multi-file upload;

intercepting a browse folder API to detect the folder upload;

intercepting a drop process interface exposed by browser during an instance creation to detect the drag-and-drop operation;

detecting a match between the scheduled file or folder upload and data associated with the shell dialogue API, the browse folder API, and the drop process interface;

extracting metadata, and active Uniform Resource Locator (URL) associated with the scheduled file or folder upload; and

caching folder name, metadata, and active URL to form the file upload context wherein the folder name is cached in a global structure;

sending the file upload context to a DLP filesystem driver;

generating a file upload cache including the file upload context, prior classification entries, and a timestamp indicating when the scheduled file or folder upload was last modified;

intercepting a file open call by the DLP filesystem driver; and

processing the file open call based upon the file upload cache.

2. The method of claim 1 , wherein the processing of the file open call comprises:

detecting a match between a file path of the scheduled file or folder upload and a current process, a parent process, or a process that initiates a current Mac Operating System (OS) X interProcess Communication (XPC) service;

detecting, in response to the detected file path match, whether the active URL is closed or browser process is terminated;

invalidating, in response to closed URL or terminated process, the file upload cache;

detecting, in response to open URL or active browser process, a match between the scheduled file or folder upload and a prior classification entry;

determining, in response to the detected prior classification entry, whether the last modified timestamp corresponds with the detected prior classification entry;

applying, in response to the corresponding timestamp, a processing associated with the prior classification entry; and

detecting, in response to no detected prior classification match, a file classification for the scheduled file or folder upload.

3. The method of claim 2 , wherein the applying of the processing comprises:

approving, when the prior classification entry is approved, the file open call and uploading the file; and

denying, when the prior classification entry is denied, the file open call and blocking file upload.

4. The method of claim 2 , wherein the detecting of the file classification comprises:

detecting a match between the scheduled file or folder upload and a file filter;

detecting a match between the active URL and a domain filter;

applying, in response to the detected file filter match or the detected domain filter match, a processing scheme based upon the file filter or domain filter;

determining, in response to no detected match, whether the scheduled file or folder upload violates a security policy, wherein the scheduled file or folder upload contains sensitive data according to one or more DLP policies;

applying, in response to the detected security policy violation, a policy violation processing scheme; and

approving, in response to no detected security policy violation, the file open call and uploading the file.

5. The method of claim 4 , wherein the applying of the processing scheme based upon the file filter or the domain filter comprises:

approving the file open call; and

uploading the file.

6. The method of claim 4 , wherein the applying of the processing scheme based upon the policy violation processing scheme comprises:

denying the file open call; and

blocking file upload.

7. The method of claim 1 , wherein the metadata includes a process identifier (PID) or active user information.

8. The method of claim 1 , wherein the intercepting of the shell dialogue API comprises:

executing a GetOpenFileName or NSOpenPanel command.

9. The method of claim 1 , wherein the intercepting of the browse folder API comprises:

executing a ShBrowseForFolder command.

10. The method of claim 1 , wherein the intercepting of the drop process comprises:

executing a IDropTargetHelper command.

11. A DLP system comprising:

a memory; and

a processor coupled to the memory to execute a DLP agent, the processor configured to:

capture file upload context for a scheduled file or folder upload, wherein the processor, for capturing the file upload context, is configured to:

detect an associated operation for the scheduled file or folder upload, including whether the scheduled file or folder upload corresponds to a single file upload, multi-file upload, folder upload, or a drag-and-drop operation, and wherein detecting the associated operation comprises:

intercept a shell dialogue Application Programming Interface (API) to detect the single file upload and multi-file upload;

intercept a browse folder API to detect the folder upload;

intercept a drop process interface exposed by browser during an instance creation to detect the drag-and-drop operation;

detect a match between the scheduled file or folder upload and data associated with the shell dialogue API, the browse folder API, and the drop process interface;

extract metadata, and active Uniform Resource Locator (URL) associated with the scheduled file or folder upload; and

cache folder name, metadata, and active URL to form the file upload context wherein the folder name is cached in a global structure;

send the file upload context to a DLP filesystem driver;

generate a file upload cache including the file upload context, prior classification entries, and a timestamp indicating when the scheduled file or folder upload was last modified;

intercept a file open call by the DLP filesystem driver; and

process the file open call based upon the file upload cache.

12. The DLP system of claim 11 , wherein the processor, for processing the file open call, is configured to:

detect a match between a file path of the scheduled file or folder upload and a current process, a parent process, or a process that initiates a current Mac Operating System (OS) X interProcess Communication (XPC) service;

detect, in response to the detected file path match, whether the active URL is closed or browser process is terminated;

invalidate, in response to closed URL or terminated process, the file upload cache;

detect, in response to open URL or active browser process, a match between the scheduled file or folder upload and a prior classification entry;

determine, in response to the detected prior classification entry, whether the last modified timestamp corresponds with the detected prior classification entry;

apply, in response to the corresponding timestamp, a processing associated with the prior classification entry; and

detect, in response to no detected prior classification match, a file classification for the scheduled file or folder upload.

13. The DLP system of claim 12 , wherein the processor, for detecting the file classification, is configured to:

detect a match between the scheduled file or folder upload and a file filter;

detect a match between the active URL and a domain filter;

apply, in response to the detected file filter match or the detected domain filter match, a processing scheme based upon the file filter or domain filter;

determine, in response to no detected match, whether the scheduled file or folder upload violates a security policy, wherein the scheduled file or folder upload contains sensitive data according to one or more DLP policies;

apply, in response to the detected security policy violation, a policy violation processing scheme; and

approve, in response to no detected security policy violation, the file open call and uploading the file.

14. A non-transitory computer-readable medium including code for performing a method, the method comprising:

capturing file upload context for a scheduled file or folder upload, wherein

capturing the file upload context comprises:

detecting an associated operation for the scheduled file or folder upload, including whether the scheduled file or folder upload corresponds to a single file upload, multi-file upload, folder upload, or a drag-and-drop operation, and wherein detecting the associated operation comprises:

intercepting a shell dialogue Application Programming Interface (API) to detect the single file upload and multi-file upload;

intercepting a browse folder API to detect the folder upload;

intercepting a drop process interface exposed by browser during an instance creation to detect the drag-and-drop operation;

detecting a match between the scheduled file or folder upload and data associated with the shell dialogue API, the browse folder API, and the drop process interface;

extracting metadata, and active Uniform Resource Locator (URL) associated with the scheduled file or folder upload; and

caching folder name, metadata, and active URL to form the file upload context wherein the folder name is cached in a global structure;

sending the file upload context to a DLP filesystem driver;

generating a file upload cache including the file upload context, prior classification entries, and a timestamp indicating when the scheduled file or folder upload was last modified;

intercepting a file open call by the DLP filesystem driver; and

processing the file open call based upon the file upload cache.

15. The computer-readable medium of claim 14 , wherein the processing of the file open call comprises:

detecting a match between a file path of the scheduled file or folder upload and a current process, a parent process, or a process that initiates a current XPC service;

detecting, in response to the detected file path match, whether the active URL is closed or browser process is terminated;

invalidating, in response to closed URL or terminated process, the file upload cache;

detecting, in response to open URL or active browser process, a match between the scheduled file or folder upload and a prior classification entry;

determining, in response to the detected prior classification entry, whether the last modified timestamp corresponds with the detected prior classification entry;

applying, in response to the corresponding timestamp, a processing associated with the prior classification entry; and

detecting, in response to no detected prior classification match, a file classification for the scheduled file or folder upload.

16. The computer-readable medium of claim 15 , wherein the detecting of the file classification comprises:

detecting a match between the scheduled file or folder upload and a file filter;

detecting a match between the active URL and a domain filter;

applying, in response to the detected file filter match or the detected domain filter match, a processing scheme based upon the file filter or domain filter;

determining, in response to no detected match, whether the scheduled file or folder upload violates a security policy, wherein the scheduled file or folder upload contains sensitive data according to one or more DLP policies; and

applying, in response to the detected security policy violation, a policy violation processing scheme.

Assignments (3)

Cited By (9)

US 12,225,089 US 12,231,464 US 12,267,355 US 12,284,206 US 12,299,117 US 12,355,817 US 12,561,430 US 12,598,216 US 12,684,018