DLP System Detecting Encrypted Data via Compression Ratios
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Data loss prevention systems face challenges in detecting and handling encrypted data, as existing methods struggle to identify encrypted sensitive information, which can be obscured and potentially leaked or transmitted unintentionally.
Innovation Solution
A Data Loss Prevention (DLP) system is configured to detect encrypted data by analyzing compressibility measures, such as compression ratios, and take preventive actions like blocking or sequestering the data, with customizable ranges for compression ratios to enhance detection accuracy.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If the DLP system scans all data transmissions to detect sensitive information, then data security is improved, but false positives increase when encrypted data is misidentified as sensitive plaintext
Solution Approach 1:
The patent applies parameter changes by analyzing the compression ratio of data transmissions. Encrypted data typically exhibits different compression characteristics compared to plaintext sensitive data. By measuring and comparing compression ratios against threshold values, the system can distinguish encrypted from unencrypted data, thereby reducing false positives while maintaining security monitoring.
Solution Approach 2:
The patent replaces traditional content-based detection mechanisms with a statistical approach using compression ratio analysis. Instead of attempting to decode or analyze the actual content of potentially encrypted data, the system substitutes a mechanical compression test that indirectly identifies encrypted data through its mathematical properties, avoiding the need to break encryption or make unreliable content assumptions.
2Object-affected harmful factors
If the DLP system blocks all encrypted data transmissions, then data leak risk is reduced, but legitimate encrypted communications are unnecessarily blocked
Solution Approach 1:
The system uses compression ratio as a discriminatory parameter to differentiate between malicious encrypted data and legitimate encrypted communications. By establishing threshold ranges for compression ratios, the system can selectively block only those transmissions exhibiting characteristics of encrypted sensitive data while allowing legitimate encrypted communications to pass through unaffected, thus maintaining productivity.
Solution Approach 2:
The patent implements partial action by applying blocking measures only to data transmissions that meet specific compression ratio criteria indicative of encrypted sensitive information. Rather than universally blocking all encrypted data, the system selectively applies prevention measures only where necessary, minimizing impact on legitimate communications while still addressing security concerns.
3Difficulty of detecting and measuring
If the DLP system uses compression ratio analysis to detect encrypted data, then detection capability is improved, but system complexity increases due to additional analysis requirements
Solution Approach 1:
The patent replaces complex decryption and content analysis systems with a simpler compression ratio measurement mechanism. This substitution reduces system complexity by using a straightforward statistical test that can be implemented with minimal computational resources, while still effectively identifying encrypted data through its characteristic compression behavior.
Solution Approach 2:
The system leverages the inherent properties of encrypted data itself to enable detection. Encrypted data naturally exhibits specific compression characteristics that can be measured and identified without requiring external decryption keys or complex analysis tools. The data's own mathematical properties serve the detection function, reducing the need for additional system complexity.
Data Source
AI summary
A system and method is disclosed for implementing a data loss prevention (DLP) system capable of detecting transmission attempts involving encrypted data. In response to detecting that the data is encrypted, such a DLP system may perform any number of configurable DLP actions, such as blocking the data transmission attempt and/or sequestering the data. The DLP system may determine that the data is encrypted, based at least in part, on a value of a compressibility measure of the data, such as a compression ratio. The DLP system may leverage other operating system and/or file system capabilities, such as file extensions, magic numbers, or other utilities. The DLP system may determine if the data is compressed rather than encrypted by attempting to decompress the file.