US 12,355,817 B2
Data loss prevention (DLP) for cloud resources via metadata analysis
Sudha Iyer, Sunnyvale, CA (US); VenkataSwamy Pathapati, Koduru Mandal (IN); Kenil Patel, Surat (IN); and Krishna Narayanaswamy, Saratoga, CA (US)
Assigned to Netskope, Inc., Santa Clara, CA (US)
Filed by Netskope, Inc., Santa Clara, CA (US)
Filed on Aug. 1, 2022, as Appl. No. 17/878,875.
Application 17/878,875 is a continuation of application No. 16/411,039, filed on May 13, 2019, granted, now 11,405,423.
Application 16/411,039 is a continuation in part of application No. 16/118,278, filed on Aug. 30, 2018, granted, now 11,403,418, issued on Aug. 2, 2022.
Application 16/411,039 is a continuation in part of application No. 16/000,132, filed on Jun. 5, 2018, granted, now 10,291,657, issued on May 14, 2019.
Application 16/118,278 is a continuation of application No. 15/368,246, filed on Dec. 2, 2016, granted, now 11,019,101, issued on May 25, 2021.
Application 16/118,278 is a continuation of application No. 15/368,240, filed on Dec. 2, 2016, granted, now 10,826,940, issued on Nov. 3, 2020.
Claims priority of provisional application 62/307,305, filed on Mar. 11, 2016.
Prior Publication US 2022/0377112 A1, Nov. 24, 2022
This patent is subject to a terminal disclaimer.
Int. Cl. H04L 29/06 (2006.01); G06F 16/28 (2019.01); G06F 16/951 (2019.01); G06F 21/62 (2013.01); H04L 9/40 (2022.01)
CPC H04L 63/20 (2013.01) [G06F 16/285 (2019.01); G06F 16/951 (2019.01); G06F 21/6209 (2013.01); H04L 63/0281 (2013.01); H04L 63/10 (2013.01); H04L 63/104 (2013.01); H04L 63/105 (2013.01); H04L 63/12 (2013.01)] 20 Claims
OG exemplary drawing
 
1. A computer-implemented method of enforcing data loss prevention policies on resource-level transactions that do not identify resource data, the method including:
intercepting resource-level transactions from client endpoints, wherein:
the resource-level transactions request copying of an organization's resources on cloud storage services from controlled locations to uncontrolled locations,
the resource-level transactions do not identify data stored in the resources, and the controlled locations are subject to inspection for data loss prevention by a network security system while the uncontrolled locations are not subject to inspection for data loss prevention by the network security system;
extracting identifiers that identify the resources in the resource-level transaction;
generating substrings of the resource-level transactions by preprocessing the identifiers that identify the resources, wherein the preprocessing comprises lexically tokenizing the identifiers by demarcating the identifier using character-based delimiters;
comparing the substrings to entries in a resource list that identifies the organization's resources on the cloud storage services;
finding matches in a subset of the resource-level transactions based on the comparison and classifying the subset of the resource-level transactions as malicious data egress attempts; and
blocking the malicious data egress attempts by preventing the copying, thereby enforcing the data loss prevention policies.