Technique for data loss prevention for a cloud sync application

Techniques describe preventing sensitive data from being misappropriated during an operation performed by a cloud synchronization application. A request from a cloud sync application to upload a file to a cloud storage service is intercepted. The file is currently stored on a client computer of an enterprise network. An account associated with the request is identified. The file is evaluated based on a data loss prevention policy and the account associated with the request. The request is blocked based on the evaluation.

CROSS-REFERENCE TO RELATED APPLICATION

This application claims benefit of Indian Provisional Patent Application Serial No. 1710/CHE/2015 filed Mar. 31, 2015, which is incorporated herein by reference in its entirety.

BACKGROUND

Field

Embodiments presented herein generally relate to data loss prevention (DLP) in a computer system, and more specifically, to techniques for providing DLP in cloud synchronization applications.

Description of the Related Art

Data loss prevention (DLP) refers to a variety of techniques for protecting sensitive data. In endpoint DLP, a DLP agent can monitor and control activity occurring within a client computing system according to a policy, usually specified by an administrator (e.g., of an enterprise network). The DLP agent can block attempted transmissions of sensitive data and generate incident reports describing such attempts.

One issue that DLP addresses is preventing sensitive data from being leaked by a client computing system to a cloud storage service. Many enterprise networks rely on a cloud storage services (e.g., Box, Dropbox, Google Drive, etc.) to store data. Cloud storage services also facilitate online collaboration on documents. For example, an enterprise network may maintain a list of customer information on a cloud storage service. Users may collaborate to edit the list in real-time. Each user may download the list on a client computer, e.g., through a storage interface on the web, a cloud synchronization (“sync”) application, or a cloud storage-integrated productivity application. When a given user modifies the listing, the modifications can be saved to cloud storage via an enterprise account associated with the user on the service, e.g., through a cloud sync application on the client computer, a web interface on a browser, or a productivity application that is integrated with the cloud storage service.

However, using cloud services also risks leaking sensitive data to a user's personal account. Continuing the previous example, it is undesirable if a user saves the listing of customer information to a personal account (instead of the enterprise account) on the cloud storage service.

SUMMARY

Embodiments presented herein describe a method. The method generally includes intercepting a request, from a cloud sync application, to upload a file to a cloud storage service. The file is currently stored on a client computer of an enterprise network. An account associated with the request is identified. The method also includes evaluating the file based on a data loss prevention (DLP) policy and the account associated with the request. The request is blocked based on the evaluation.

Other embodiments include, without limitation, a computer-readable medium that includes instructions that enable a processing unit to implement one or more aspects of the disclosed methods as well as a system having a processor, memory, and application programs configured to implement one or more aspects of the disclosed methods.

DETAILED DESCRIPTION

A cloud synchronization (“sync”) application synchronizes data hosted by a cloud storage service (e.g., Dropbox, Google Drive, Microsoft OneDrive, etc.) with a copy of the data stored locally on a client computer. One concern with cloud sync applications is the potential for leakage of sensitive data in an enterprise setting. Files stored on a cloud storage service and downloaded to a client computer for legitimate purposes, such as for editing often contain sensitive data. However, one concern is allowing a user to upload such files to an unauthorized account on the cloud storage service, using the cloud sync application.

Embodiments presented herein describe techniques for preventing sensitive data from being misappropriated during sync operations performed by a cloud sync application. In one embodiment, a file system filter driver intercepts a request from the cloud sync application to upload a file to a cloud storage service. The filter driver may evaluate file attributes (e.g., file path, file type, and the like). The filter driver determines, based on the evaluation, whether the file is a specified type to be monitored based on a DLP policy. If so, a DLP agent determines whether the cloud sync application is currently signed into an enterprise account. If not (e.g., the application is currently signed into a non-enterprise or personal account), the filter driver analyzes the content of the file against the DLP policy, e.g., to determine whether the file contains sensitive data. The filter driver may quarantine files that contain sensitive data (or are otherwise subject to quarantine under the policy). If an enterprise account is signed into the cloud storage service, the filter driver may analyze the data under a policy. In such a case, if the filter driver determines that the data is sensitive, then the filter driver may encrypt the file prior to allowing the file to be stored on the cloud storage service.

Further, to prevent repeated analysis of unmodified files (e.g., evaluated files that are downloaded to systems of other users), the filter driver may generate a cryptographic hash of attributes associated with the file. One example of an applicable cryptographic hash is a hash-based message authentication code (HMAC). A generated HMAC can be a hash of file attributes such as file path, file size, date modified, and the like. The filter driver determines, on subsequent access to the file, whether the file has changed. That is, on subsequent accesses, the filter driver generates another HMAC for the file and compares that HMAC and the previously generated HMAC. If the HMAC values match, then the filter driver determines that the file does not need to be analyzed against the DLP policy. However, if the HMAC values differ, then the filter driver determines that the file should be analyzed due to changes made to the file.

Advantageously, the techniques described herein provide a file system-based approach to prevent sensitive data from being leaked from a cloud sync application. The filter driver intercepts file system calls made by the cloud sync application, e.g., to open or read a file. Further, by identifying an user associated with an account signed-in to the cloud sync application, the DLP agent can determine whether the cloud sync application is attempting to upload a given file to storage associated with an enterprise or a personal cloud service account. In addition, by generating a HMAC of attributes for each DLP-analyzed file, the DLP agent analyzes that file again only if the file has been modified (i.e., if the HMAC changes). Doing so prevents large amounts of I/O operations related to DLP analysis from occurring.

FIG. 1illustrates an example computing environment100, according to one embodiment. As shown, computing environment includes a client computing system105, a DLP system110, a cloud service provider115, and a network125. In one embodiment, the client computing system105is a physical computing system, e.g., a desktop computer, a laptop computer, etc. Further, the client computing system105may be one of many client computers residing within an enterprise network.

In one embodiment, the client computing system105includes a data loss prevention (DLP) agent106, a cloud sync application107, and a file system filter driver108. The DLP agent106monitors and controls activity occurring within the client computer105. The DLP agent106blocks attempted transmissions of sensitive data (e.g., personal information, confidential information, and the like) to locations unauthorized by specified policies111(e.g., maintained on the DLP system110).

The cloud service provider115includes a storage server120and a data store122. The storage server120provides a service121that allows the clients to maintain data in the data store122. For example, the cloud sync application107allows the client computing system105to upload and continuously sync data to the data store122. Further, the cloud service provider115may segment user accounts based on a configuration. The configuration may describe an identity associated with a particular account, e.g., whether the account is associated with a given enterprise network, or whether the account is a personal account and not associated with any particular enterprise or organization.

The cloud sync application107syncs data between the client computer107and the service122. Typically, the cloud sync application107monitors activity on a specified sync directory on a file system of the client computer107. For example, if a user adds a file to the sync directory, the cloud sync application107detects the addition and uploads the file to the service122. As another example, if a user modifies the file, the cloud sync application107may detect the modification and upload a delta indicating changes to the file. As yet another example, assume multiple users collaborate on that file. If another user modifies that file, the file is updated on the service122. In addition, the file is also updated locally in the file system of the client computer105.

The cloud sync application107may potentially leak sensitive data. For example, a user that is connected to the cloud sync application107through an enterprise account may have access to files containing confidential information, such as customer data, credit card numbers, and the like. The user can log out from and log in back into the service122using a personal account. The user may then designate the sync directory for the personal account as the directory that contains those files. As a result, the cloud sync application107would sync those files to the personal account.

Typically, the cloud sync application107performs a series of file system operations when syncing a file between the client computer105and the service121. For example, when a user updates a file in the sync directory, the cloud sync application may prepare to upload the update to the server122. In such a case, the cloud sync application107performs a variety of file system operations to upload the file.

In one embodiment, the file system filter driver108monitors file system calls made by the cloud sync application107. Doing so allows the filter driver108to detect attempts by the cloud sync application107to sync a file with the service121. As further described below, when detected, the file system filter driver108intercepts file system calls and determines whether to the DLP agent106should perform DLP analysis on the file to be synced. The DLP agent106may analyze the file relative to the policy111to determine whether the file contains sensitive data. If so, the DLP agent106may prevent the file from being synced with the service121. The DLP agent106may also generate an incident report112describing the attempt and send the report112to the DLP system110.

FIG. 2illustrates a diagram describing preventing loss of sensitive data in a sync operation, according to one embodiment. Illustratively,FIG. 2depicts a user space205and a kernel space210of an operating system executing in the client computer105. The user space205includes the cloud sync application107and the DLP agent106. The kernel space210includes the file system filter driver108.

In one embodiment, the DLP agent106identifies a user identity220, which is maintained in a cloud sync application configuration store222. The user identity220allows the DLP agent106to identify information about an account that is currently logged into the service121via the cloud sync application107, i.e., whether the account is associated with the enterprise network. If the account is not associated with the enterprise network, then the DLP agent106enables the file system filter driver108. In one embodiment, the DLP agent106may enable the file system filter driver108for an enterprise account. In such a case, the file system filter driver108may apply a different set of policies to the account, e.g., the file system filter driver108may encrypt a given file prior to allowing the cloud sync application107to upload the file to the service121.

In one embodiment, the cloud sync application107performs an open operation for a given file215stored in the file system when syncing the file215with the service121. The operation result includes a file handle207, which the application107uses to access the file. Illustratively, the file system filter driver108intercepts the open operation. The file system filter driver108retrieves a file object211associated with the file215. The file system filter driver108determines, based on the file object211, attributes of the file215, such as file type, file path, file size, and last modified date/time of the file. The file system filter driver108may then determine, based on the attributes, whether the file should be monitored based on the DLP policy112. For example, the DLP policy112may specify that PDF files, spreadsheets, and documents should be monitored for potential DLP analysis. As another example, the DLP policy112may specify that image files that are modified after a given year should be monitored.

If the file system filter driver108determines to monitor the file215, the file system filter driver108allows the cloud sync application107to open the file215. In addition, the file system filter driver108generates a stream handle context212to associate with the file object211. The stream handle context212is a data structure that includes process and user information for the file (e.g., user ID, process ID, and the like).

In one embodiment, the file system filter driver108generates a cryptographic hash, such as a hash-based message authentication code (HMAC), for the file215. The file system filter driver108uses the HMAC to determine whether the file215has already been analyzed under the DLP policy112. That is, prior to analyzing the content of the file215, the file system filter driver108generates an updated HMAC for the file215. The file system filter driver108then compares the updated HMAC with the previous HMAC (if available). Matching HMACs indicate that the file215is unchanged since the last DLP analysis. Therefore, if the HMACs match, the file system filter driver108determines that further DLP analysis is unnecessary. Non-matching HMACs indicate that the file215was modified since the last DLP analysis. In this case, the file system filter driver108determines that DLP analysis should be performed on the file215. In such a case, the DLP agent106evaluates the file215based on the DLP policy. If the DLP agent106determines that the file215contains sensitive data and the sync should be blocked, the DLP agent106may relocate the file215to a quarantine location and prevent further access to the file215by the cloud sync application. Further, the DLP agent106may generate an incident report describing the attempted sync operation.

FIG. 3illustrates a diagram describing preventing loss of sensitive data in a sync operation, according to one embodiment. In some cases, a user may collaborate on editing a file215maintained by the service121with other users of the enterprise network. In such a case, another user may edit the file215. In turn, the cloud sync application107updates the file locally. Once updated, the file system filter driver on the other user's system may perform an unwanted DLP analysis on the file215.

The cloud sync application107updates the file locally on the client computer105of the user. Typically, to do so, the cloud sync application107saves the updated file to a temporary download location305on disk (as temporary file310). The cloud sync application107subsequently performs a rename operation on the file and saves the file to the sync location218.

To prevent a repeated DLP analysis on the local file, the file system filter driver108intercepts rename operations performed by the cloud sync operation. When intercepted, the file system filter driver108generates an HMAC for the updated file and updates the HMAC currently associated with the file. Thus, when the file system filter driver108subsequently detects an open operation by the cloud sync application107to the file215, the file system filter driver108can bypass the DLP analysis because the updated HMAC will match with a subsequently generated HMAC.

FIG. 4illustrates a method for managing a request to access a file by the cloud sync application107, according to one embodiment. As stated, the file system filter driver108monitors activity of the cloud sync application107and intercepts file system calls performed by the application107. For example, assume that a client associated with an enterprise network adds a file to a sync directory. The cloud sync application107may begin syncing the file with the service121by performing an open operation of the file.

At step405, the file system filter driver108intercepts the file system open operation of the file. The file system filter driver108obtains a handle and file object associated with the file. The file object describes various file attributes, such as file path, file size, file type, and the like. At step410, the file system filter driver108determines, based on the file attributes, whether to monitor the file based on a DLP policy. For example, the policy may specify that files of a given type (e.g., PDF, spreadsheet, binary image) or having a given last modified date (e.g., modified after a given date) should be monitored. If not, the driver108allows the sync to proceed normally.

Otherwise, at step415, the file system filter driver108allows the open operation to proceed. Further, the file system filter driver108generates a stream handle context for the file. As stated, the stream handle context provides process and user information associated with the file. At step420, the DLP agent106determines a user identity associated with the account signed into the service121via the client sync application. The user identity indicates whether the account that is currently signed into the service121through the application107is associated with the enterprise. The DLP agent106sends the determination to the filter driver108. Then at step425, the filter driver108performs DLP analysis on the file based on the identity. That is, in some cases, the driver108may apply a different set of policies to the file. For example, the driver108may encrypt the file prior to allowing the sync operation to proceed. Otherwise, if the account is not associated with the enterprise, the driver108determines that DLP analysis should be performed on the file.

FIG. 5illustrates a method for evaluating a file to be uploaded to a cloud storage service, according to one embodiment. Assume that the file system filter driver108determined that DLP analysis should be performed on the file. At step505, the file system filter driver108determines whether a cryptographic hash, e.g., a HMAC, associated with the file has been generated. As stated, the file system filter driver108uses the HMAC to determine whether a given file was previously analyzed based on the DLP policy.

At step510, if an HMAC for the file exists, then the file system filter driver108generates a new HMAC of the current file attributes (e.g., file type, file size, file path, etc.). The file system filter driver108then compares the existing HMAC with the newly generated HMAC to determine whether the HMACs match (at step515). Non-matching HMACs suggests that the file was recently updated, and thus should be evaluated based on the DLP policy. However, if the HMACs match, then the file system filter driver108does not analyze the file because the file was previously analyzed and remains unchanged.

If no HMAC exists for the file (or if the newly-generated HMAC does not match with the existing HMAC), then at step520, the DLP agent106evaluates the content of the file based on the DLP policy. The DLP agent106determines whether to allow or block the file from being uploaded (at step525). For example, the DLP agent106may determine that the file should be blocked from being uploaded to the service121if the file contains sensitive data. In such a case, at step530, the file system filter driver108relocates the file to a quarantined location in storage. Doing so prevents the cloud sync application107from repeatedly attempting to access the file. Further, at step535, the DLP agent106may generate an incident report describing an unauthorized attempt to upload sensitive data to the service121.

If the DLP agent106determines that the file should be allowed to be uploaded to the service121, then the DLP agent106notifies the file system filter driver108. At step540, the file system filter driver108allows the sync operation to proceed normally. Further, the file system filter driver108generates a HMAC for the current attributes of the file and stores the HMAC. As a result, if the file remains unchanged and the cloud sync application107subsequently tries to access the file, the file system filter driver108does not perform any additional DLP analysis.

FIG. 6illustrates a client computing system600configured to prevent loss of sensitive data during a sync operation, according to one embodiment. As shown, computing system600includes, without limitation, a central processing unit (CPU)605, a network interface615, a memory620, and storage630, each connected to a bus617. The client computing system600may also include an I/O device interface610connecting I/O devices612(e.g., keyboard, display, mouse devices, etc.) to the client computing system600. Further, in context of the present disclosure, the computing elements shown in the computing system600may correspond to a physical computing system (e.g., a system in an enterprise network).

CPU605retrieves and executes programming instructions stored in memory620as well as stores and retrieves application data residing in the storage630. The bus617is used to transmit programming instructions and application data between CPU605, I/O devices interface610, storage630, network interface615, and memory620. Note, CPU605is included to be representative of a single CPU, multiple CPUs, a single CPU having multiple processing cores, and the like. Memory620is generally included to be representative of a random access memory. Storage630may be a disk drive storage device. Although shown as a single unit, storage630may be a combination of fixed and/or removable storage devices, such as fixed disc drives, removable memory cards, or optical storage, network attached storage (NAS), or a storage area-network (SAN).

Illustratively, memory620includes a DLP agent622, a cloud sync application623, and a file system filter driver624. And storage630includes a cloud sync application configuration632, files633, and HMACs634associated with each the files632. The cloud sync application107syncs data between the client computing system600and a cloud storage service. The file system filter driver624monitors file system calls made by the cloud sync application623. When the cloud sync application623attempts to sync a given file633with the cloud service, the file system filter driver624intercepts the call and determines, based on a DLP policy whether to prevent the sync from occurring. The file system filter driver624may generate an HMAC634of attributes associated with each file. The file system filter driver624uses the HMAC634to determine whether a given file633has changed since last evaluated under a DLP policy. If not, then the filter system filter driver624allows a sync operation to occur without any further DLP analysis. The DLP agent622may generate incident reports based on attempted sync operations where a user tries to upload sensitive data to the cloud storage service. Further, the DLP agent622may determine, based on the cloud sync application configuration632, whether an account that is currently signed into the cloud service via the cloud sync application configuration632is associated with an enterprise network.

The preceding discussion presents a variety of embodiments. However, the present disclosure is not limited to the specifically described embodiments. Instead, any combination of the following features and elements, whether related to different embodiments or not, is contemplated to implement and practice the techniques described herein. Furthermore, although embodiments of the present disclosure may achieve advantages over other possible solutions and/or over the prior art, whether or not a particular advantage is achieved by a given embodiment is not limiting of the present disclosure. Thus, the following aspects, features, embodiments and advantages are merely illustrative and are not considered elements or limitations of the appended claims except where explicitly recited in a claim(s).

The following discussion presents a variety of embodiments. However, the present disclosure is not limited to the specifically described embodiments. Instead, any combination of the following features and elements, whether related to different embodiments or not, is contemplated to implement and practice the techniques described herein. Furthermore, although embodiments of the present disclosure may achieve advantages over other possible solutions and/or over the prior art, whether or not a particular advantage is achieved by a given embodiment is not limiting of the present disclosure. Thus, the following aspects, features, embodiments and advantages are merely illustrative and are not considered elements or limitations of the appended claims except where explicitly recited in a claim(s).