Cloud Resource DLP via Metadata-Based Transaction Blocking
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing data loss prevention (DLP) systems fail to detect and prevent data egress in cloud storage transactions at the resource level due to the absence of content analysis, allowing sensitive data to be inadvertently transferred outside organizational accounts.
Innovation Solution
A metadata-based solution that generates a resource list of cloud-based resources configured under an organization's accounts, which is stored in a metadata store, and uses inline proxies to block resource-level transactions attempting to manipulate these resources, thereby enforcing DLP policies without identifying the resource data.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If content analysis is performed on cloud storage transactions to detect sensitive data, then data loss prevention capability is improved, but computational intensity and processing time increase significantly
Solution Approach 1:
The patent extracts and analyzes only the metadata portion of cloud storage transactions rather than performing content analysis on the entire data payload. The system identifies and examines specific metadata fields (such as transaction type, source/destination identifiers, and data classification tags) to detect potential data loss events, thereby reducing computational intensity while maintaining prevention capability
Solution Approach 2:
The system performs preliminary classification and tagging of data at the time of upload to cloud storage. This pre-processing action assigns metadata labels to data sets, enabling subsequent DLP operations to rely on pre-established metadata rather than performing intensive content analysis during transaction monitoring, thus reducing real-time computational requirements
2Productivity
If metadata-based monitoring is implemented on resource-level transactions, then user experience is improved through faster processing, but detection precision may be reduced compared to content analysis
Solution Approach 1:
The patent implements a multi-functional metadata framework that serves both performance optimization and detection accuracy requirements. The metadata system simultaneously enables fast transaction processing through efficient filtering while incorporating multiple detection dimensions (transaction patterns, data classification, user behavior analysis) to maintain high detection precision without requiring full content analysis
Solution Approach 2:
The system introduces metadata as an intermediary layer between the transaction system and the DLP analysis engine. This intermediary contains pre-extracted key characteristics and classification information that bridge the gap between fast metadata processing and accurate sensitive data detection, allowing the system to achieve both speed and precision without direct content analysis
3Reliability
If resource-level transaction monitoring is enforced, then data security is improved, but system complexity and implementation difficulty increase
Solution Approach 1:
The patent implements self-service mechanisms where the cloud storage service itself generates and maintains the metadata required for DLP monitoring. The system automatically extracts transaction information, classifies data, and populates metadata fields without requiring external monitoring infrastructure, thereby reducing implementation complexity while maintaining security
Solution Approach 2:
The system merges the DLP monitoring functionality with the existing cloud storage transaction processing infrastructure. By integrating metadata generation and analysis into the native transaction flow rather than implementing separate monitoring systems, the patent reduces overall system complexity while achieving comprehensive resource-level security
Data Source
AI summary
The technology disclosed relates to an introspector that scans an organization's accounts on cloud storage services and detects resources on the cloud storage services configured to store the organization's data, and identifies the detected resources in a resource list. The technology disclosed further includes an inline proxy that controls manipulation of the detected resources based on the resource list.