Code-Based Sensitive Data Protection via Flow Analysis
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current data leak prevention methods are limited in protecting sensitive data, as they rely on structured schema definitions and regular expressions, which can lead to false positives, performance bottlenecks, and inefficiencies in handling unstructured data, and do not effectively address the context of sensitive data within code bases.
Innovation Solution
A system and method that leverages natural language processing and code flow analysis to detect and protect sensitive data by analyzing contextual information in code, such as variable names, comments, and data structures, rather than just data values, using a multi-tenant cloud-hosted platform with a dashboard for management and customization for various industries.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If regular expressions and schema definitions are used to detect sensitive data, then detection capability is improved, but false positives increase and performance deteriorates
Solution Approach 1:
The patent segments the detection process into multiple stages: static code analysis to identify potential sensitive data locations, runtime monitoring to verify actual sensitive data flow, and contextual analysis to validate data sensitivity. This multi-stage segmentation reduces false positives by requiring multiple confirmation points rather than relying on a single regex pattern match.
Solution Approach 2:
The patent introduces code flow analysis as an intermediary mechanism between raw data detection and final sensitive data classification. By analyzing the context, transformations, and usage patterns of detected data through this intermediary layer, the system can distinguish true sensitive data from false positives without relying solely on rigid pattern matching.
2Measurement precision
If regular expressions are applied at every step to check data patterns, then detection thoroughness is improved, but processing cost increases
Solution Approach 1:
The patent performs preliminary static code analysis during the development phase to identify potential sensitive data locations and patterns before runtime. This preliminary action creates a whitelist of monitored variables and data flows, so that during runtime, the system only needs to monitor pre-identified locations rather than applying regex patterns to all data throughout the system, significantly reducing processing overhead.
Solution Approach 2:
The patent applies full regex-based pattern matching only to data at critical checkpoints identified through static analysis, rather than applying it universally to all data at all times. This partial application of the detection mechanism maintains thoroughness at key decision points while avoiding the performance penalty of continuous comprehensive scanning.
3Measurement precision
If schema-based structured data protection is used, then protection accuracy is improved, but adaptability to unstructured data decreases
Solution Approach 1:
The patent creates a universal detection framework that can handle both structured and unstructured data through a common code flow analysis mechanism. The system monitors data assignments, transformations, and usage patterns in the code itself rather than relying on data format schemas, making it equally effective for structured data in databases and unstructured data in strings or files.
Solution Approach 2:
The patent replaces the mechanical schema-based detection system with a context-based code analysis system. Instead of mechanically checking if data matches a predefined schema, the system analyzes the semantic context of code variables, data flow patterns, and usage scenarios to determine sensitivity, thereby adapting to any data structure without requiring schema definitions.
Data Source
AI summary
A system and method for monitoring and protecting sensitive data that includes identifying sensitive data and statically tracking sensitive data using data flow analysis across a code base, monitoring flow of the data during application runtime, and responding to vulnerabilities according to a sensitive data characterization of the data. Identifying sensitive data includes processing a semantic description of the data in the application code and characterizing the sensitive data. Monitoring flow of the data includes: identifying and characterizing sensitive data through data usage, updating the characterization for the sensitive data through data usage, and enforcing security measures on the data according to the sensitive data characterization of the data.