Exact Data Matching Policies for PII False Positive Control
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing Data Loss Prevention (DLP) systems generate false positives when detecting sensitive data, preventing legitimate use of personal information by employees, leading to loss of data owner control.
Innovation Solution
Implementing Exact Data Matching (EDM) systems that allow data owners to configure policies at the individual field level, enabling them to share their own PII data without triggering false positives, using structured signature data and hash values to identify and correlate tokens within a byte stream.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If Exact Data Matching (EDM) is used to detect sensitive data, then data loss prevention capability is improved, but false positive incidents increase
Solution Approach 1:
The patent segments the data matching process into multiple components: hash value generation from structured signature data, token extraction from byte streams, and correlation matching. By dividing the EDM process into these discrete steps with specific data structures (hash tables, token buffers), the system achieves more precise control over matching accuracy, reducing false positives while maintaining detection capability.
Solution Approach 2:
The patent introduces hash values as an intermediary between the original sensitive data and the matching process. Instead of directly comparing raw PII data, the system generates hash values from structured signature data and correlates these with hash values extracted from byte streams. This intermediary layer enables precise matching while providing a mechanism to distinguish legitimate from illegitimate data usage, thereby reducing false positives.
2Reliability
If EDM blocks all detected sensitive data, then data security is improved, but data owner control is lost
Solution Approach 1:
The patent implements local quality by allowing different matching behaviors for different data contexts. The system correlates tokens with structured signature data to identify specific data records, then applies policies based on the data owner's intent. This enables the system to block sensitive data in inappropriate contexts while allowing data owners to share their own PII when legitimate, maintaining both security and owner control.
Solution Approach 2:
The patent employs preliminary action by requiring data owners to pre-configure policies and provide structured signature data before the matching process begins. Data owners can pre-specify which PII they wish to share and under what conditions. This preliminary configuration enables the system to automatically distinguish between legitimate data sharing and potential data loss, maintaining security while preserving owner control without requiring real-time intervention.
3Ease of manufacture
If traditional DLP methods are used, then ease of implementation is maintained, but detection precision deteriorates
Solution Approach 1:
The patent replaces traditional mechanical DLP methods (keyword matching, regex patterns) with a hash-based correlation system. Instead of using complex pattern matching algorithms, the system generates hash values from structured signature data and correlates these with extracted tokens through hash table lookups. This substitution maintains implementation simplicity by using efficient hash-based operations while dramatically improving detection precision through exact matching capability.
Data Source
AI summary
Systems and methods include receiving an index of data for exact data matching, wherein the index includes Personally Identifiable Information (PII); receiving policy related to actions to perform for any violations associated with the exact data matching; loading the index and the policy into memory; monitoring traffic for violations, wherein the violations include detection of any values in the index in the traffic; and performing an action responsive to any violations and associated policy. The action can be one of reporting the violation, blocking the traffic associated with the violation, reporting the violation and allowing the traffic associated with the violation when the violation is based on authenticated PII, allowing the traffic associated with the violation when the violation is based on authenticated PII, and a combination thereof.