Sensitive Information Exposure Detection via Entitlement Vectors
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current systems for detecting sensitive information exposure to unauthorized users are inflexible and inefficient due to the inability to encode specific circumstances of leaks, making it difficult to determine if unauthorized access has occurred.
Innovation Solution
A method that encodes risks and circumstances of leaks using parallel processing to identify users with access to exposure vectors, estimates the probability and severity of leaks, and monitors user activity to confirm unauthorized access, employing machine learning models for analysis and lockdown protocols.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If existing systems use invariable protocols for managing sensitive information leaks, then the system structure is simple, but the system is inflexible and cannot be tailored to specific circumstances of leaks
Solution Approach 1:
The patent segments the leak detection and response system into multiple independent modules: exposure vector identification module, user subset determination module, probability estimation module, and lockdown protocol selection module. Each module handles a specific aspect of the leak response process, allowing the system to be adaptable to different leak circumstances while maintaining manageable complexity through modular architecture.
Solution Approach 2:
The system dynamically adjusts its response based on real-time analysis of exposure vectors and user access patterns. Rather than using fixed invariable protocols, the system adapts its lockdown measures, probability estimates, and response strategies based on the specific circumstances of each leak event, including the type of sensitive information exposed and the characteristics of users with access to exposure vectors.
2Measurement precision
If the system attempts to directly encode whether users accessed sensitive information, then detection accuracy would be high, but the difficulty of detecting and measuring is extremely high due to the impossibility of encoding actual access
Solution Approach 1:
The patent introduces exposure vectors as an intermediary construct that indirectly represents the circumstances of potential leaks. Instead of directly measuring whether users accessed sensitive information (which is difficult or impossible), the system measures exposure vectors - such as the type of information that could be exposed, the channels through which it could leak, and the user roles that have access rights. This intermediary measurement approach enables detection accuracy while avoiding the intractable problem of directly encoding actual user access.
Solution Approach 2:
The system creates a model or copy of the leak scenario through exposure vectors, which replicate the essential characteristics of potential leaks without requiring direct observation of actual user access. By working with these copied representations of leak circumstances, the system can accurately assess and respond to potential exposures while avoiding the difficulty of directly measuring actual information access by users.
3Reliability
If the system monitors all users for leak activity, then detection completeness is high, but the productivity is low due to the large volume of users to monitor
Solution Approach 1:
The patent applies local quality by focusing monitoring resources on specific user subsets rather than uniformly monitoring all users. The system identifies and monitors only those users who have access to exposure vectors related to the specific leak incident, allocating monitoring intensity according to each user's relevant exposure risk. This approach maintains detection completeness for at-risk users while significantly improving productivity by avoiding unnecessary monitoring of unrelated users.
Solution Approach 2:
The system performs partial monitoring by concentrating efforts on the critical subset of users most likely to be involved in the leak, rather than attempting to monitor all users equally. By applying monitoring resources excessively to the relevant user subset and minimally or not at all to irrelevant users, the system achieves high detection completeness for actual threats while maintaining high productivity through efficient resource allocation.
Data Source
AI summary
Methods and systems to detect and manage access to sensitive information. The system retrieves a dataset of entitlements for a plurality of users. The dataset of entitlements specifies one or more respective exposure vectors. The system detects a triggering event, including a release of sensitive information to a first subset of users of the plurality of users via a first exposure vector. The system then determines a second subset of users of the plurality of users that have access to the first exposure vector based on a comparison of the first exposure vector to the dataset of entitlements. The system monitors electronic communications of the second subset of users for activity related to the sensitive information to detect first activity of a first user of the second subset of users. The system generates for display a first notification to a second user based on detecting the first activity.