Cloud Data Loss Prevention Integration via Event-Driven Notifications
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Enterprises face challenges in enforcing data loss prevention policies across cloud storage systems, particularly when data is stored outside their infrastructure, as existing solutions lack real-time monitoring and remediation capabilities for sensitive information.
Innovation Solution
An event-driven system is implemented, where cloud services notify enterprise computer systems of file activities, triggering on-demand scans and remedial actions based on predefined data loss prevention rules, utilizing a job scheduler, DLP backend server, and DLP engine to analyze files and enforce policies securely.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If cloud storage systems are used to store enterprise data externally, then storage accessibility and reliability are improved, but real-time monitoring and enforcement of data loss prevention policies become difficult
Solution Approach 1:
The patent introduces an intermediary component that acts as a bridge between the cloud storage system and the enterprise's DLP infrastructure. This intermediary receives notifications from cloud services about file activities, retrieves files for scanning, and enforces DLP policies without requiring direct integration between the cloud provider and enterprise security systems. This resolves the contradiction by enabling DLP enforcement in external cloud storage while maintaining system simplicity.
2Object-affected harmful factors
If traditional DLP solutions are used with cloud storage, then data security is improved, but real-time detection and remediation capabilities are lost
Solution Approach 1:
The system performs preliminary actions by establishing notification subscriptions with cloud services before any data loss incidents occur. When file activities happen in the cloud, the system is already positioned to immediately retrieve and scan the files. This preliminary setup enables real-time detection and remediation capabilities that traditional post-hoc DLP solutions cannot achieve.
Solution Approach 2:
The patent implements a feedback mechanism where the DLP system continuously monitors cloud file activities through notifications, scans files for sensitive information, and automatically remediates violations. This closed-loop feedback system ensures real-time detection and response to data security threats, maintaining both security protection and speed.
3Ease of operation
If cloud services manage computational resources independently, then storage accessibility is improved, but integration with enterprise DLP systems becomes complex
Solution Approach 1:
The patent creates a universal integration layer that can work with multiple cloud service providers through standardized notification mechanisms. The intermediary component is designed to be cloud-provider-agnostic, receiving notifications and executing DLP policies across different cloud platforms. This multi-functionality enables easy cloud storage accessibility while maintaining flexible integration with enterprise DLP systems.
Data Source
Figure 1
Figure 2
Figure 3A
AI summary
A system, method, and computer readable medium is provided to provide an integrated storage system. For example, an embodiment may detect, by an enterprise computer system, an activity notification from a cloud service that stores data on behalf of an enterprise. The activity notification may specify a file name involved in an activity performed by the cloud service (e.g., creating or modifying a file). The enterprise computer system may then download a file (or contents thereof) from the cloud service using the file name specified by the activity notification. After downloading the file, the enterprise computer system may analyze the file against a data loss prevention rule. Based on an outcome from the data loss prevention rule, the enterprise computer system may communicate an action response to the cloud service. The action response may direct the cloud service to perform an action on the file stored by the cloud service.