Cloud Schema DLP for Sensitive Data Removal During Offboarding
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional Data Loss Prevention (DLP) systems struggle to effectively remove sensitive data from cloud-based systems, particularly during offboarding, due to lack of visibility and control, increasing the risk of data loss from unintentional or malicious persistence.
Innovation Solution
A method and system utilizing dictionaries to identify sensitive data fields within cloud storage schemas, allowing for actions such as obfuscation or removal, with customizable dictionaries and machine learning models to enhance detection, particularly in Apache Kafka environments.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If conventional DLP approaches are used, then data protection can be provided, but visibility and control over sensitive data in cloud services is insufficient
Solution Approach 1:
The patent introduces a cloud-based DLP system as an intermediary layer between cloud services and data storage. This system receives data from cloud services, analyzes it against dictionaries of sensitive information, and performs actions such as blocking, deleting, or alerting. The intermediary enables visibility and control over sensitive data that would otherwise remain opaque in cloud storage systems.
Solution Approach 2:
The patent replaces traditional mechanical DLP approaches (software agents at endpoints, physical appliances) with a cloud-based system that operates on data in motion and at rest within cloud services. This substitution enables comprehensive visibility into cloud storage schemas and facilitates automated removal of sensitive data through schema analysis and dictionary matching.
2Stability of the object's composition
If sensitive data is persisted in cloud services, then data availability is maintained, but data loss risk increases during offboarding
Solution Approach 1:
The patent implements preliminary action by analyzing data storage schemas before data is persisted in cloud services. The system compares schema variables against dictionaries of sensitive information fields and performs removal or blocking actions in advance. This prevents sensitive data from being stored while maintaining the ability to access non-sensitive data, thereby reducing data loss risk during offboarding.
Solution Approach 2:
The patent extracts sensitive data from the data storage schema by identifying matching variables against sensitive field name dictionaries. The system then removes or blocks only the sensitive portions of data while preserving non-sensitive data, enabling selective data removal that maintains data availability for legitimate purposes while eliminating data loss risks.
3Reliability
If data is monitored in real-time, then data loss can be prevented, but system complexity increases
Solution Approach 1:
The patent implements a universal cloud-based DLP system that performs multiple functions: monitoring data in motion, analyzing data at rest in cloud storage, comparing against dictionaries of sensitive information, and executing various actions (blocking, deleting, alerting). This multi-functional approach consolidates what would otherwise require multiple separate systems into a single platform, reducing overall system complexity while maintaining real-time data loss prevention capabilities.
Data Source
AI summary
Systems and methods for removing sensitive information from a cloud-based system include receiving one or more dictionaries, the one or more dictionaries including a plurality of field names identified as corresponding to sensitive information; analyzing one or more data storage schemas, the one or more data storage schemas defining how data is stored in a cloud-based system; comparing a plurality of variables within the one or more data storage schemas to the field names in the one or more dictionaries for identifying matches therein; and responsive to identifying a match between a variable of the plurality of variables and one or more of the field names, performing an action based thereon.