Abstract:
A method and system for data loss prevention controls and protects sensitive data from being printed in an unauthorized manner. A method for controlling printing activities implemented in a computer system comprises intercepting a print job comprising print data intended for a printer driver, delaying performance of the print job, analyzing content of the print data to determine whether to allow or cancel the print job based on a security policy, and resuming or canceling the print job based on the analysis of the content of the print data.

Description:
BACKGROUND OF THE INVENTION 
       [0001]    1. Field of the Invention 
         [0002]    The present invention relates to a method and system for data loss prevention, and more particularly to a method of protecting sensitive data from being printed in an unauthorized manner. 
         [0003]    2. Description of the Related Art 
         [0004]    Host based data loss prevention agents are used to prevent unauthorized user activities that result in data leaving the organization in a manner that compromises a set security policy. User activity is monitored within each host by an application software agent. The agent intercepts user activities via software probes that gather information about application requests and provide that information to the agent to determine if the user request should be allowed or blocked. Data loss incidents can be of many forms, such as file copy, email, web posting and printing of sensitive content. 
         [0005]    A need arises for a technique by which data loss incidents involving printing can be controlled and prevented. 
       SUMMARY OF THE INVENTION 
       [0006]    The present invention provides a method and system for data loss prevention, and more particularly to a method of protecting sensitive data from being printed in an unauthorized manner. The system includes software agents on host machines that enforce a security policy and determine whether a printing activity should be allowed to execute, monitored or even blocked. The agents examine various criteria to determine if the printing activity is allowed, such as the user identity, type of printer, location of printer, process initiating the printing activity, and the content being printed. The agent uses a dynamic proxy replacement printer driver, for each installed printer, to extract the content of the data being printed, and determine if the printing operation should be allowed. 
         [0007]    A method for controlling printing activities implemented in a computer system comprises intercepting a print job comprising print data intended for a printer driver, delaying performance of the print job, analyzing content of the print data to determine whether to allow or cancel the print job based on a security policy, and resuming or canceling the print job based on the analysis of the content of the print data. 
         [0008]    The print data comprises representation of characters to be printed and the content of the print data is analyzed by determining whether the representation of characters to be printed is text data or other data, when the representation of characters to be printed is other data, converting the other data to text data, organizing the text data into lines of text, and analyzing the organized text data using the security policy. The other data comprises glyphs and the glyphs are converted to text data by determining whether a mapping from glyph to text data is available, when a mapping from glyph to text data is not available, generating a mapping from glyph to text data using the font of the glyph, and converting the glyphs to text data using the mapping from glyph to text data. The print data further comprises information identifying a location of each character of the text data and the text data is organized into lines of text by extracting the information identifying the location of each character of the text data, and sorting the characters of the text data using the information identifying the location of each character of the text data. The process described is done in collaboration with the printer driver for which the print job was intended. 
     
    
     
       BRIEF DESCRIPTION OF THE DRAWINGS 
         [0009]    The details of the present invention, both as to its structure and operation, can best be understood by referring to the accompanying drawings, in which like reference numbers and designations refer to like elements. 
           [0010]      FIG. 1  is an exemplary block diagram of a software environment, such as in a host computer system, in which the present invention may be implemented. 
           [0011]      FIG. 2  is an exemplary flow diagram of a process of operation of a DLP agent and a DLP printer driver. 
           [0012]      FIG. 3  is an exemplary flow diagram of a process of converting glyphs to Unicode text. 
           [0013]      FIG. 4  is an exemplary flow diagram of spatial sorting of characters of a Unicode text stream. 
           [0014]      FIG. 5  is an exemplary flow diagram of a process of installing software that may implement the present invention. 
           [0015]      FIG. 6  is an exemplary block diagram of a computer system, in which the present invention may be implemented. 
       
    
    
     DETAILED DESCRIPTION OF THE INVENTION 
       [0016]    The present invention provides a method and system for data loss prevention, and more particularly to a method of protecting sensitive data from being printed in an unauthorized manner. The system includes software agents on host machines that enforce a security policy and determine whether a printing activity should be allowed to execute, monitored or even blocked. The agents examine various criteria to determine if the printing activity is allowed, such as the user identity, type of printer, location of printer, process initiating the printing activity, and the content being printed. The agent uses a dynamic proxy replacement printer driver, for each installed printer, to extract the content of the data being printed, and determine if the printing operation should be allowed. 
         [0017]      FIG. 1  illustrates a software environment  100 , such as in a host computer system, in which the present invention may be implemented. Software environment  100  includes one or more application programs, such as application  102 , print spooler  104 , Data Loss Prevention (DLP) agent  105 , DLP printer driver  106 , security policy  107 , original printer driver  108 , and Graphical Device Interface (GDI)  110 . Printer  111  is controlled by software environment  100 , typically via spooler  104 . Application  102  is a software program that a user controls or manipulates in order to perform tasks that the user wishes to perform. Print spooler  104  accepts print requests from application  102 , loads the print requests into a buffer (such as an area on a disk), and transmits the print requests from the buffer to the printer at the rate at which the printer requests them. 
         [0018]    DLP agent  105  is software that is installed on all computers in an organization. DLP agent  105 , in conjunction with DLP printer driver  106 , intercepts all printing requests and allows them to proceed only if they comply with security policy  107 . Security policy  107  is the definition of security for software environment  100 , may also define security for one or more systems, organizations or other entities associated with software environment  100 . For an organization, security policy  107  addresses the constraints on behavior of its members as well as constraints imposed on adversaries by mechanisms such as doors, locks, keys and walls. For systems, security policy  107  addresses constraints on functions and flow among them, constraints on access by external systems and adversaries including programs and access to data by people. 
         [0019]    DLP printer driver  106  and original printer driver  108  are software that converts the data to be printed to the form specific to a printer. The purpose of printer drivers is to allow applications, such as application  102  to do printing without being aware of the technical details of each printer model. Original printer driver  108  is the printer driver that was originally installed in the software environment and is typically specific to printer  111 . DLP printer driver  106  intercepts data and communication flow between spooler  104  and original printer driver  108  and implements the DLP functions described below. GDI  110  is an interface for representing graphical objects and transmitting them to output devices such as monitors and printers. GDI  110  is responsible for tasks such as drawing lines and curves, rendering fonts and handling palettes. GDI  110  outputs Enhanced MetaFile (EMF)  114 , which includes information that may be used by GDI  110  and/or printer  111  to generate images for display or printing. 
         [0020]    DLP agent  105  is software that is installed on all computers in an organization. DLP agent  105 , in conjunction with DLP printer driver  106 , intercepts all printing requests and allows them to proceed only if the comply with a security policy. Interception of printing activities will be performed by the agent whether the target printer is a local printer or a network printer. 
         [0021]    DLP agent  105 , once installed, installs DLP printer driver  106 , which is a dynamic proxy printer driver, to intercept communications and data directed to each original printer driver  108 , which is printer specific. Although for clarity, only one DLP printer driver  106 , original printer driver  108 , and printer  111  are shown in  FIG. 1 , the present invention contemplates application to any number of installed DLP printer drivers  106 , original printer drivers  108 , and printers  111 . 
         [0022]    DLP printer driver  106  processes the information being sent to the printer. It extracts, as described below, the contents of the printing activity as well as information about the application originating the printing activity. This information is passed to DLP agent  105  and based on security policy  107 , DLP agent  105  will signal DLP printer driver  106  whether to cancel or to continue the printing activity. If the printing is allowed to continue, DLP printer driver  106  will send the print data to original printer driver  108 , otherwise the data will not reach original printer driver  108  and the printing activity will be blocked. Each DLP printer driver  106  is specific to the underlying printer whose driver it replaces, as it needs to mimic the underlying printer&#39;s specifics. DLP printer driver  106  prevents data from reaching the original printer driver until DLP agent  105  confirms that the print job is allowed to go through. 
         [0023]    A flow diagram of a process  200  of operation of DLP agent  105  and DLP printer driver  106  is shown in  FIG. 2 . It is best viewed in conjunction with  FIG. 1 . Process  200  begins with step  202 , in which DLP printer driver  106  waits for print data to be transmitted to it. Once an application begins a print job, print data is sent to DLP printer driver  106 . The print data sent to DLP printer driver  106  in step  202 , shown in  FIG. 2 , includes the a text stream, in the form of Unicode text or glyphs, and information identifying the location of the text on the printed page. Typically, the location of each character on the printed page is included with the print data. The location of each character is identified using an X,Y coordinate system. 
         [0024]    Unicode is an industry standard allowing computers to consistently represent and manipulate text expressed in any of the world&#39;s writing systems. Unicode consists of a repertoire of about 100,000 characters, a set of code charts for visual reference, an encoding methodology and set of standard character encodings, an enumeration of character properties such as upper and lower case, a set of reference data computer files, and a number of related items, such as character properties, rules for text normalization, decomposition, collation, rendering and bidirectional display order (for the correct display of text containing both right-to-left scripts, such as Arabic or Hebrew, and left-to-right scripts). Unicode is used in this document as an example of a text representation system. However, the present invention is not limited to Unicode, but rather, contemplates application to any text representation system. 
         [0025]    In step  203 , DLP printer driver  106  intercepts the print data and delays the print job from printing on the target printer until process  200  has completed. In step  204 , DLP printer driver  106  sends the print request including the print data to DLP agent  105 . In step  205 , DLP agent  105  determines whether the print data should be canceled by examining non content criteria such as the application, user identity, etc. If the agent determines that the print job is to be canceled, there is no need to do the text extraction at all and the process continues with step  220 , in which the print job is canceled. The settings of the DLP printer driver will ensure that applications send data to printers using raw format  112  because the print data content will not be available if the operating system is responsible for rendering the printing job, such as using GDI  110  and EMF spool file  114 . Some operating systems convert all print jobs to raw format using the specific printer driver for the target printer, so in essence, the operating system is forced to access the printer driver with all the plain-text from the original document. 
         [0026]    If, in step  205 , it is determined that the print job is not to be canceled, then the process continues with step  206 , in which DLP agent  105  determines whether the print data includes text, such as Unicode text, or glyphs, which are representations of the actual shape of a character image. Application  102  can send textual information to the printer driver as Unicode stream or a glyph stream. If the application is printing text in fonts which are mapped to glyphs in the printer driver, the textual content may not be available to the printer driver. In this case, DLP printer driver  106  needs to translate the glyphs back to Unicode text. Therefore, the process will continue with step  208 , in which DLP printer driver  106  will extract a Unicode text stream by converting from the font and glyphs that are sent to the printer driver. The process maps the glyphs back to the textual characters they represent. This reverse mapping is created using the font mapping table and is used to map from glyph codes back to Unicode character code. This allows DLP agent  105  to monitor and block documents written in languages other than English or any other applications that use the Glyphs format. 
         [0027]    After the glyphs are converted to Unicode text in step  208 , or if, in step  206 , it is determined that the print data is already Unicode text, then the process continues with step  210 , in which the Unicode character stream is sorted. DLP printer driver  106  may receive the text as glyphs and the text can be received by the driver in a different order than that printed on the document. Thus, DLP printer driver  106  needs to remap the coordinates of the printed text in order to reconstruct the correct textual content being printed. Different printing engines in applications, can send data to the printer driver in different order from which it is seen in the application or on paper. Each string being sent to the printer driver is sent with information on the location of that string on the paper/screen. This information is in the form of bi-dimensional coordinates for each character/glyph. The printer driver sorts the characters by their coordinates and reconstructs the string stream being printed. 
         [0028]    In step  212 , as the Unicode text stream is sorted, the sorted result is stored in a temporary file for later use. In step  214 , it is determined whether the end of the document to be printed has been reached. If not, the process loops back to step  202 , in order to wait for more print data. If the end of the document has been reached, then the process continues with step  216 , in which the text content is sent to DLP agent  105  for analysis. In step  218 , DLP agent  105  performs the content analysis, and determines whether or not the text content is approved, based on security policy  107  and optionally on other parameters. If the content is not approved, then the process continues with step  220 , in which the print job is canceled on the target printer  111 . If the content is approved, then the process continues with step  222 , in which the print job is resumed on the target printer  111 . 
         [0029]    A process  300  of converting glyphs to Unicode text is shown in  FIG. 3 . It is best viewed in conjunction with  FIG. 1 . Process  300  begins with step  302 , in which a text stream in the form of glyphs is sent to DLP printer driver  106 . Each glyph is a representation of an image of a character. Such a representation may include raster (image) data, vector data, spline data, etc. In order to generate text in the form of glyphs, a mapping is performed in which the character ID and the font ID are mapped to the glyph. In order to extract Unicode text from the input glyph text stream, the inverse mapping is performed. 
         [0030]    Thus, in step  304 , it is determined whether a mapping table that may be used to perform the inverse mapping is available. If not, then the process continues with step  306 , in which a glyph to Unicode mapping table is created and stored for each specific font being used. Once the glyph to Unicode mapping table is created, or if, in step  304 , glyph to Unicode mapping table is available, the process continues with step  308 , in which the glyph text stream is converted to Unicode text using the glyph to Unicode mapping table. 
         [0031]    A process of spatial sorting of the characters of the Unicode text stream is shown in  FIG. 4 . It is best viewed in conjunction with  FIG. 1 . Process  400  begins with step  402 , in which the Unicode text stream is sent to DLP printer driver  106 . The print data sent to DLP printer driver  106  in step  202 , shown in  FIG. 2 , includes the a text stream, in the form of Unicode text or glyphs, and information identifying the location of the text on the printed page. Typically, the location of each character on the printed page is included with the print data. The location of each character is identified using an X,Y coordinate system. The X,Y coordinates for each character is also included with the Unicode text stream set to DLP printer driver  106 . 
         [0032]    In step  404 , the X,Y coordinates for each character in the Unicode text stream are extracted from the location information. In step  406 , it is determined whether the X,Y coordinates refer to a new line. If not, then the process continues with step  408 , in which the characters in the current line are sorted according to their coordinates within the line and stored. The process then continues with step  410 . If, in step  406 , it was determined that the X,Y coordinates refer to a new line, then the process continues with step  412 , in which the aggregated text, including the line just completed, is stored to a temporary file. 
         [0033]    From step  408  or step  412 , the process then continues with step  410 , in which it is determined whether the end of the document has been reached. If not, then the process loops back to step  402 , in which additional Unicode text data is received. If the end of the document has been reached, then the process continues with step  414 , in which the document text, now stored in the temporary file, is sent to DLP agent  105  for content analysis. 
         [0034]    A process  500  of installing the software to implement the above-described processes is shown in  FIG. 5 . It is best viewed in conjunction with  FIG. 1 . Process  500  is executed upon installation of the DLP Agent for all installed printers, or after the DLP agent is installed, is executed upon installation of a new printer. The DLP Agent is responsible for initiating this process by recognizing a new printer was installed. Process  500  begins with step  502 , in which a printer  111  and its corresponding original printer driver  108 , DLP agent  105 , and DLP printer driver  106  are installed. In step  504 , the system registry is modified to register DLP printer driver  106  as a dynamic replacement driver for original printer driver  108 . The proxy driver settings force the operating system to send print jobs intended for printer  111  in raw format  112 , rather than in EMF format  114 . In step  506 , all resources from original printer driver  108  are copied for use by DLP printer driver  106 . This is necessary because each printer may have different mappings and may have different required resources. Copying all resources from original printer driver  108  ensures that they are available for use by DLP printer driver  106 . In step  508 , DLP printer driver instances are created for each printer. 
         [0035]    An exemplary block diagram of a computer system  600 , in which the present invention may be implemented, is shown in  FIG. 6 . Computer system  600  is typically a programmed general-purpose computer system, such as a personal computer, workstation, server system, and minicomputer or mainframe computer. Computer system  600  includes one or more processors (CPUs)  602 A- 602 N, input/output circuitry  640 , network adapter  606 , and memory  608 . CPUs  602 A- 602 N execute program instructions in order to carry out the functions of the present invention. Typically, CPUs  602 A- 602 N are one or more microprocessors, such as an INTEL PENTIUM® processor.  FIG. 6  illustrates an embodiment in which computer system  600  is implemented as a single multi-processor computer system, in which multiple processors  602 A- 602 N share system resources, such as memory  608 , input/output circuitry  604 , and network adapter  606 . However, the present invention also contemplates embodiments in which computer system  600  is implemented as a plurality of networked computer systems, which may be single-processor computer systems, multi-processor computer systems, or a mix thereof. 
         [0036]    Input/output circuitry  604  provides the capability to input data to, or output data from, computer system  600 . For example, input/output circuitry may include input devices, such as keyboards, mice, touchpads, trackballs, scanners, etc., output devices, such as video adapters, monitors, printers, etc., and input/output devices, such as, modems, etc. Network adapter  606  interfaces computer system  600  with Internet/intranet  610 . Internet/intranet  610  may include one or more standard local area network (LAN) or wide area network (WAN), such as Ethernet, Token Ring, the Internet, or a private or proprietary LAN/WAN. 
         [0037]    Memory  608  stores program instructions that are executed by, and data that are used and processed by, CPUs  602 A-N to perform the functions of computer system  600 . Memory  604  may include electronic memory devices, such as random-access memory (RAM), read-only memory (ROM), programmable read-only memory (PROM), electrically erasable programmable read-only memory (EEPROM), flash memory, etc., and electro-mechanical memory, such as magnetic disk drives, tape drives, optical disk drives, etc., which may use an integrated drive electronics (IDE) interface, or a variation or enhancement thereof, such as enhanced IDE (EIDE) or ultra direct memory access (UDMA), or a small computer system interface (SCSI) based interface, or a variation or enhancement thereof, such as fast-SCSI, wide-SCSI, fast and wide-SCSI, etc, or a fiber channel-arbitrated loop (FC-AL) interface. 
         [0038]    The contents of memory  608  varies depending upon the function that computer system  600  is programmed to perform. In the example shown in  FIG. 6 , memory  608  includes application  102 , security policy  107 , DLP agent  105 , DLP printer driver  106 , original printer driver  108 , spooler  104 , and operating system  612 . Application  102  is a software program that a user controls or manipulates in order to perform tasks that the user wishes to perform. Print spooler  104  accepts print requests from application  102 , loads the print requests into a buffer (such as an area on a disk), and transmits the print requests from the buffer to the printer at the rate at which the printer requests them. DLP agent  105  is software that is installed on all computers in an organization. DLP agent  105 , in conjunction with DLP printer driver  106 , intercepts all printing requests and allows them to proceed only if they comply with security policy  107 . Security policy  107  is the definition of security for computer system  600 . DLP printer driver  106  and original printer driver  108  are software that converts the data to be printed to the form specific to a printer. Original printer driver  108  is the printer driver that was originally installed in the software environment and is typically specific to printer  111 . DLP printer driver  106  intercepts data and communication flow between spooler  104  and original printer driver  108  and implements the DLP functions described above. Operating system  612  provides overall system functionality. 
         [0039]    As shown in  FIG. 6 , the present invention contemplates implementation on a system or systems that provide multi-processor, multi-tasking, multi-process, and/or multi-thread computing, as well as implementation on systems that provide only single processor, single thread computing. Multi-processor computing involves performing computing using more than one processor. Multi-tasking computing involves performing computing using more than one operating system task. A task is an operating system concept that refers to the combination of a program being executed and bookkeeping information used by the operating system. Whenever a program is executed, the operating system creates a new task for it. The task is like an envelope for the program in that it identifies the program with a task number and attaches other bookkeeping information to it. Many operating systems, including UNIX®, OS/2®, and WINDOWS®, are capable of running many tasks at the same time and are called multitasking operating systems. Multi-tasking is the ability of an operating system to execute more than one executable at the same time. Each executable is running in its own address space, meaning that the executables have no way to share any of their memory. This has advantages, because it is impossible for any program to damage the execution of any of the other programs running on the system. However, the programs have no way to exchange any information except through the operating system (or by reading files stored on the file system). Multi-process computing is similar to multi-tasking computing, as the terms task and process are often used interchangeably, although some operating systems make a distinction between the two. 
         [0040]    It is important to note that while the present invention has been described in the context of a fully functioning data processing system, those of ordinary skill in the art will appreciate that the processes of the present invention are capable of being distributed in the form of a computer readable medium of instructions and a variety of forms and that the present invention applies equally regardless of the particular type of signal bearing media actually used to carry out the distribution. Examples of computer readable media include storage media, examples of which include, but are not limited to, floppy disks, hard disk drives, CD-ROMs, DVD-ROMs, RAM, and, flash memory, as well as transmission media, examples of which include, but are not limited to, digital and analog communications links. 
         [0041]    Although specific embodiments of the present invention have been described, it will be understood by those of skill in the art that there are other embodiments that are equivalent to the described embodiments. Accordingly, it is to be understood that the invention is not to be limited by the specific illustrated embodiments, but only by the scope of the appended claims.