Exact Data Matching for Sensitive Data Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing Data Loss Prevention (DLP) solutions struggle to detect exact matches of sensitive data, such as social security numbers and credit card numbers, within a stream of bytes, often resulting in false positives or inefficiencies due to their reliance on imprecise methods like keywords and regular expressions.
Innovation Solution
The implementation of Exact Data Matching (EDM) using structured signature data in a cloud-based system, which receives and processes customer-specific sensitive data, represented by hash values, to identify related tokens through a tokenizer configured to recognize various token types and perform optimizations, allowing for precise detection and policy-based actions.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If imprecise methods like keywords and regular expressions are used for data detection, then the system complexity is reduced and ease of operation is improved, but measurement precision and reliability deteriorate due to false positives
Solution Approach 1:
The patent segments the data detection process into multiple stages: initial filtering using imprecise methods (keywords, regular expressions), followed by precise matching using structured signature data and hash values. This segmentation allows the system to benefit from both approaches - the ease of operation of imprecise methods and the precision of exact matching techniques.
Solution Approach 2:
The patent introduces structured signature data and hash values as intermediary elements between the imprecise detection methods and the final detection result. These intermediaries serve as a bridge that transforms unstructured data into a format suitable for precise comparison, thereby improving measurement precision without completely abandoning the simplicity of keyword-based approaches.
2Measurement precision
If exact data matching using structured signature data is implemented, then measurement precision and reliability are improved, but device complexity and loss of information increase due to hash value processing
Solution Approach 1:
The patent performs preliminary actions by pre-processing structured data into signature formats and generating hash values before the actual detection process. This preliminary structuring of data simplifies the subsequent matching operations, as the system only needs to compare pre-computed signatures and hashes rather than processing raw unstructured data during detection.
Solution Approach 2:
The patent creates copies of data in transformed formats (hash values, structured signatures) that preserve the essential identifying characteristics while reducing complexity. Instead of storing and comparing entire records, the system works with compact hash representations that are computationally efficient to process and compare.
3Productivity
If customer-specific sensitive data is processed in a cloud-based system, then productivity and data protection are improved, but loss of information and security risks increase due to data distribution across nodes
Solution Approach 1:
The patent extracts only the essential identifying features from customer-specific sensitive data and stores them as structured signature data and hash values in the cloud. The actual sensitive data remains with the customer, while the cloud system holds only the minimal necessary information for detection purposes, thereby improving productivity through cloud distribution while minimizing information loss and security risks.
Data Source
AI summary
Systems and methods of Exact Data Matching (EDM) include receiving customer specific sensitive data for a customer, wherein the customer specific sensitive data are converted into a plurality of tokens; receiving a configuration for exact data matching of the plurality of tokens; performing inline monitoring of a user associated with the customer; detecting a presence of one or more tokens of the plurality of tokens based on the inline monitoring; and, responsive to the detecting, performing an action based on the configuration.