Hashed EDM Indexing for Data Owner Control in DLP
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing Data Loss Prevention (DLP) systems generate false positives when detecting exact matches of sensitive data, preventing legitimate data owners from using their own personal information, leading to loss of control and unnecessary flagging.
Innovation Solution
Implementing Exact Data Matching (EDM) systems that allow data owners to configure policies at the individual field level, enabling them to share their own Personally Identifiable Information (PII) data without blocking, using structured signature data and hash values to identify and correlate tokens within a byte stream.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If Exact Data Matching (EDM) is used to detect sensitive data, then detection precision is improved, but false positive rate increases causing data owners to lose control over their own PII
Solution Approach 1:
The patent segments the detection process into two distinct phases: (1) Exact Data Matching for high-precision detection of sensitive data patterns, and (2) Data Owner Control verification to confirm whether the detected data actually belongs to the user. This segmentation allows the system to maintain high detection precision while adding a separate validation layer that eliminates false positives by verifying data ownership before triggering blocking actions.
Solution Approach 2:
The patent introduces Data Owner Control as an intermediary verification mechanism between EDM detection and the final blocking decision. This intermediary layer acts as a mediator that receives detected sensitive data, verifies whether it belongs to the current user through policy checks, and only then determines whether to block or allow the action. This resolves the contradiction by preventing EDM from directly causing false positive blocks.
2Reliability
If EDM blocks all exact matches of sensitive data, then data security is improved, but data owner flexibility deteriorates
Solution Approach 1:
The patent implements dynamic policy evaluation where Data Owner Control policies are applied conditionally based on user authentication and data ownership verification. The system dynamically adjusts its behavior: for authenticated data owners, the policy allows flexible use of their own PII; for unauthenticated or non-owner cases, strict blocking is applied. This dynamic approach maintains data security while adapting to legitimate use cases.
Solution Approach 2:
The patent changes the control parameter from a static binary block/allow decision to a multi-state system that includes: (1) Block for unauthorized sensitive data, (2) Allow for authenticated data owner's own PII, and (3) Report for monitoring. By changing the parameter states based on verification results, the system maintains security reliability while providing flexibility for legitimate data owner activities.
3Reliability
If DLP monitoring is applied to all traffic, then data loss prevention is improved, but user convenience deteriorates due to unnecessary flagging
Solution Approach 1:
The patent applies Data Owner Control verification as a preliminary action before finalizing the block decision. Instead of immediately blocking detected sensitive data, the system first performs preliminary verification to check if the data belongs to the user and if the action is authorized. This preliminary action prevents unnecessary flagging and maintains user convenience while preserving data loss prevention capabilities.
Solution Approach 2:
The patent implements a feedback mechanism where the system continuously learns from verification outcomes. When Data Owner Control confirms that a user is accessing their own authorized data, this feedback is used to refine future detection and verification processes. The feedback loop helps distinguish between legitimate user activities and actual data loss risks, improving both prevention reliability and user convenience over time.
Data Source
AI summary
Systems and methods are disclosed for data owner control in Data Loss/Leakage Prevention (DLP). A data owner system processes sensitive data from a structured data source, normalizes fields, and generates an index comprising one-way hash representations of tokens. The index, including schema and primary key information, is uploaded via a secure channel to a cloud-based monitoring system. The cloud system distributes the index to enforcement nodes and performs inline monitoring of network traffic. Content is tokenized and normalized, and tokens are compared against the hashed index using index lookup tables and token windows to detect violations. Policies specify actions such as reporting, blocking, quarantining, or allowing authenticated personally identifiable information (PII) of a data owner. Incremental updates are supported through row hash-based deltas without regenerating the entire index. This approach provides efficient, precise, and privacy-preserving DLP while reducing false positives and granting data owners control over use of their own data.