Cloud DLP Inspection for Unstructured and Encrypted Data
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional DLP systems struggle with unstructured documents and lack flexibility in combining predefined and custom dictionaries, leading to blind spots in data loss prevention, especially with encrypted traffic, increasing the risk of unintentional or malicious data exfiltration.
Innovation Solution
A cloud-based DLP system that utilizes DLP dictionaries and engines, enabling flexible expression building and Indexed Document Matching (IDM) to identify and protect unstructured documents, with real-time visibility and scalable security across all user devices, including encrypted traffic.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If conventional DLP approaches use software agents at endpoints and physical appliances, then data protection is provided within the network, but blind spots are created when users access applications directly from the cloud and bypass security controls
Solution Approach 1:
The patent introduces a cloud-based DLP service as an intermediary that sits between users and cloud applications. This service provides data protection by monitoring and controlling data exfiltration to cloud services without requiring users to be on the corporate network or use specific endpoint agents. The cloud DLP service acts as a mediator that enforces security policies regardless of user location or access method.
Solution Approach 2:
The cloud-based DLP service provides universal protection across multiple access scenarios - whether users are on-network or off-network, using corporate devices or personal devices, accessing through VPN or directly. This multi-functional approach eliminates blind spots by providing consistent data protection regardless of the access path or user location.
2Measurement precision
If DLP dictionaries are used to detect sensitive data, then structured documents can be scanned and analyzed effectively, but unstructured documents present difficulty for true DLP
Solution Approach 1:
The patent applies parameter changes by transforming unstructured documents into structured formats suitable for dictionary-based detection. The system extracts relevant parameters and features from unstructured documents (such as text content, metadata, and contextual information) and restructures them into formats that can be effectively scanned by DLP dictionaries, thereby maintaining detection accuracy across different document types.
Solution Approach 2:
The system segments unstructured documents into smaller, analyzable components that can be processed by DLP dictionaries. By dividing complex unstructured documents into discrete elements (such as text blocks, metadata fields, and contextual segments), the system enables precise detection while maintaining the ability to handle diverse document formats.
3Measurement precision
If each DLP dictionary contains its own violation threshold and confidence threshold, then specific detection criteria can be defined, but it becomes difficult for multiple dictionaries to work together flexibly
Solution Approach 1:
The patent merges multiple DLP dictionaries and their associated thresholds into a unified evaluation framework. Instead of requiring separate configurations for each dictionary, the system combines them into a single configurable structure where violation and confidence thresholds can be applied across multiple dictionaries simultaneously. This reduces complexity while maintaining the ability to define specific detection criteria for each dictionary type.
4Reliability
If encryption is used to protect sensitive data in SSL/TLS traffic, then data confidentiality is maintained, but inspection becomes difficult and expensive with increased processing capability requirements
Solution Approach 1:
The system extracts only the necessary information for DLP analysis from encrypted SSL/TLS traffic without requiring full decryption. By taking out specific metadata, headers, and observable patterns from the encrypted traffic, the system can perform effective DLP inspection while maintaining encryption benefits and minimizing processing overhead.
Solution Approach 2:
Instead of performing complete decryption of all encrypted traffic (excessive action), the system applies partial inspection by analyzing only the portions of encrypted traffic that contain detectable DLP-relevant information. This partial action approach maintains data confidentiality while providing effective security monitoring with reduced processing requirements.
Data Source
AI summary
Systems and methods include receiving Data Loss Prevention (DLP) configurations for one or more devices, wherein the DLP configurations define how exfiltration of sensitive data is protected for the one or more devices; monitoring traffic of the one or more devices; and scanning the traffic of the one or more devices using the DLP configurations assigned to the one or more devices.