Client-Side Data Leakage Prevention via Local Monitoring
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current security systems are inadequate in protecting computer networks from internal data leakage, as they primarily focus on external threats and fail to prevent accidental or intentional exposure of sensitive data by users within the network, despite the complexity of communication protocols and frequent data transmissions.
Innovation Solution
A system comprising a central server and client computers that monitor data communications for sensitive data, restrict transmissions, and provide configuration data to detect trigger events, allowing for intelligent security measures to prevent data leakage by identifying and responding to potential risks through notification and action.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If comprehensive monitoring of all data communications is implemented to detect sensitive data, then data security is improved, but system complexity and processing overhead increase
Solution Approach 1:
The system segments the monitoring function by deploying lightweight client software on individual computers within the network. Each client independently monitors its own data communications and identifies sensitive information locally, rather than requiring a centralized system to analyze all network traffic. This segmentation reduces the complexity of the central monitoring system while maintaining comprehensive security coverage across the network.
2Reliability
If all data transmissions are scanned for sensitive information, then data leakage prevention is improved, but processing time and computational resources increase
Solution Approach 1:
The system performs preliminary classification of data communications at the client level before transmission. Clients pre-identify sensitive information in their local data and apply appropriate security controls in advance. This preliminary action allows the central server to receive already-classified data, reducing the need for time-consuming re-analysis and enabling faster processing of data transmissions while maintaining effective leakage prevention.
3Reliability
If strict security controls are applied to all users and applications, then data protection is improved, but ease of operation and user productivity deteriorate
Solution Approach 1:
The system implements local quality control by applying different security measures to different data communications based on their sensitivity classification. Rather than uniformly restricting all user actions, the system monitors and controls only those specific data transmissions that contain sensitive information. This targeted approach maintains data protection while minimizing interference with normal user operations and preserving productivity.
4Reliability
If multiple communication protocols are monitored for sensitive data, then comprehensive security coverage is improved, but detection complexity and false positive rates increase
Solution Approach 1:
The system introduces configuration data as an intermediary layer between the diverse communication protocols and the sensitive data detection logic. This configuration data contains protocol-specific patterns, keywords, and classification rules that guide the detection process. By using this intermediary, the system can efficiently monitor multiple protocols without requiring complex custom detection logic for each protocol, thereby reducing false positives and simplifying the overall detection architecture.
Data Source
AI summary
Systems, devices or methods provide for control of sensitive data in a computer system that includes at least one central server communicatively-coupled to a plurality of client computers. One particular example is directed to a method involving execution of software code on the at least one central server to monitor data communications of the plurality of client computers for sensitive data. A subset of the data communications is restricted when sensitive data is detected. Configuration data is provided to each of the plurality of client computers. Software code is executed on each of the plurality of client computers to detect accesses to sensitive data by one or more applications running on a client computer. Actions of the one or more applications running on a client computer are monitored to determine whether or not a trigger event has occurred. In response to determining that the trigger event has occurred, a notification is sent.