Data loss prevention

Inventors

Monaco, Matthew K. • NEGRON, Daniel • SATIRA, Brian

Abstract

Techniques for providing data loss prevention, including data exfiltration prevention and crypto-ransomware prevention, are provided. In some embodiments, a slack-space file system is created by using a modified packing algorithm to increase and/or optimize an amount of slack space created by files stored in a standard file system. A program for accessing and indexing the slack-space file system may be stored, and requests by a user to store data on a storage medium of a computer system may cause the information to be stored in the slack-space file system, where it may be protected from destructive malware that operates solely on the standard file system. In some embodiments, sensitive information may be hidden by storing the information in an alternate data stream of a file and by replacing the information in the unnamed data stream of the file with non-sensitive information that may appear to be sensitive.

Core Innovation

The invention provides data loss prevention by receiving an instruction to store data in a first file system on a storage medium, where the first file system comprises a plurality of files and slack space. In response to the instruction, the system stores the data instead in a second file system configured to store a second set of files in the slack space of the first file system.

To manage and locate data stored in slack space, the invention uses a slack-space file-system program with an index for the second set of files stored in the slack space. The index and access are controlled so that the index for a plurality of files stored in the slack space cannot be accessed by the first file system, and the slack-space file-system program is described as encrypted and compressed.

The document also describes automatic redirection of store requests to the slack-space file system based on criteria including file size, file type, whether the data contains secure information, and a security level. In addition to slack-space file-system redirection, it describes storing sensitive data in Windows NTFS alternate data streams by replacing the unnamed or primary data stream with imitation or faux data so that exfiltration tools copy only the decoy.

Claims Coverage

The independent claim coverage includes three independent claims, centered on receiving a store instruction to a first file system with slack space and instead storing data in a second file system configured to store a second set of files in that slack space.

Across the independent claims, the core inventive coverage is storing data in slack space by redirecting store instructions from a first file system to a second file system that places a second set of files within that slack space, with an index-based slack-space file-system mechanism, controlled access to the index, and encrypted and compressed slack-space file-system program behavior. Additional claim scope includes routing or determination criteria for selecting the second file system based on file and security attributes.

Stated Advantages

Documented Applications

No documented applications found