Document Sensitivity Classification via API Handle Analysis
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Cloud-based services pose challenges in protecting sensitive corporate data due to limited control over access and sharing, leading to potential data exfiltration as users can easily download and share documents across multiple devices and networks without fine-grained security controls.
Innovation Solution
A network security system that monitors transaction data between cloud providers and enterprise users, uses deep API inspection to extract critical metadata, and assigns sensitivity classifications to documents based on their handles, embedding these classifications in document headers to enable efficient data exfiltration prevention without requiring content inspection.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If cloud-based services are used for corporate data management, then accessibility and collaboration are improved, but control over sensitive data and prevention of data exfiltration deteriorate
Solution Approach 1:
The system performs preliminary classification of documents as sensitive or non-sensitive based on metadata (such as document handles, names, or types) before the documents are downloaded or shared. Sensitivity markers are embedded in the document metadata during this preliminary stage, enabling downstream systems to enforce policies without needing to analyze document contents later. This preliminary action prevents data exfiltration by establishing control measures before the document leaves the secure environment.
2Measurement precision
If document sensitivity is determined by inspecting document contents, then accuracy of sensitivity classification is improved, but processing time and computational resources increase
Solution Approach 1:
The system extracts and utilizes specific metadata fields from documents (such as document handles, names, types, or other identifying information) to determine sensitivity classification. By taking out and analyzing only these specific metadata elements rather than the entire document content, the system achieves accurate sensitivity determination while significantly reducing processing time and computational resource requirements compared to full content inspection.
3Reliability
If fine-grained security controls are implemented in cloud services, then data protection is improved, but system complexity and implementation difficulty increase
Solution Approach 1:
The system implements self-service security by embedding sensitivity markers in document metadata that automatically enable policy enforcement without requiring complex centralized control mechanisms. Documents carry their own sensitivity information (such as markers indicating whether a document is sensitive), allowing endpoints and cloud services to autonomously enforce appropriate policies based on the embedded markers. This self-service approach simplifies the overall system architecture while maintaining fine-grained security controls.
Data Source
AI summary
The technology disclosed includes a system to efficiently classify sensitivity of document generated by and downloaded from cloud-based provider services. The system monitors network traffic at a document-generation initiating endpoint and receives a web page identifying the document generated. The system parses the network traffic that selects the document for download, based on the user selecting a link, and intercepts a document handle in an API parameter string used to download the document. The system interprets the document handle to analyze sensitivity of the document to assign a sensitive classification to the document. The sensitivity classification is encoded into the document header metadata. The encoded sensitivity classification can be used to enhance security, for example, preventing data exfiltration.