HTTP Traffic Interception for Source-Code-Free IRM Protection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing Information Rights Management (IRM) integration with enterprise applications is challenging due to the need for source code modifications, which are time-consuming, costly, and often not feasible, especially for legacy or third-party applications, leading to potential information leakage when documents are downloaded.
Innovation Solution
A method that intercepts HTTP requests and responses using traffic interceptors and protectors to apply IRM without modifying the application's source code, utilizing ICAP-aware network equipment, reverse proxy servers, and web application firewalls to identify and encrypt sensitive information.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If IRM is integrated with enterprise applications to protect downloaded information, then information security is improved, but implementation complexity and cost increase due to source code modification requirements
Solution Approach 1:
The patent introduces a mediator component that sits between the enterprise application and the client, intercepting HTTP requests and responses. This intermediary captures downloaded information, applies IRM protection, and returns the protected content without requiring any modification to the application's source code, thus resolving the contradiction between security and implementation complexity
Solution Approach 2:
The solution segments the IRM protection function into a separate, independent module that operates outside the application's codebase. By dividing the protection mechanism into distinct components (interceptor, protector, encryption module), the system achieves security enhancement without entangling the protection logic with the application's existing code structure
2Reliability
If source code modification is performed to integrate IRM protection, then information protection capability is improved, but time consumption and cost increase
Solution Approach 1:
The intermediary component provides drop-in protection by monitoring HTTP traffic at the network layer. This approach eliminates the need for time-consuming source code modification, as the intermediary can be deployed independently and begins protecting information downloads immediately upon activation
Solution Approach 2:
The system performs preliminary interception of HTTP requests before they reach the application and processes responses after they are generated but before they reach the client. This preliminary action allows IRM protection to be applied automatically without waiting for application code changes, significantly reducing implementation time
3Reliability
If source code modification is required for IRM integration, then IRM protection can be applied, but feasibility decreases for legacy or third-party applications
Solution Approach 1:
The intermediary acts as a universal gateway that can protect any application providing information downloads, regardless of whether the application is legacy, third-party, or open-source. By operating at the HTTP protocol level rather than the application code level, the solution achieves broad adaptability across different application types without requiring source code access
Solution Approach 2:
The intermediary component is designed with universal functionality to work with multiple types of applications (enterprise applications, legacy systems, third-party services) through a common HTTP interception mechanism. This universal approach eliminates the need for application-specific integration methods, thereby enhancing versatility
4Ease of operation
If access rights logic is used within the application, then internal information access is controlled, but information leakage occurs once data is extracted outside the application
Solution Approach 1:
The intermediary extends the application's access control capabilities beyond the application boundaries by monitoring and protecting HTTP responses. It captures the access rights logic decisions made within the application and enforces them continuously on the downloaded information, preventing leakage even after extraction
Solution Approach 2:
The system implements a feedback loop where the intermediary monitors downloaded information, verifies it against access rights policies, and applies appropriate protection measures. This continuous feedback mechanism ensures that access control decisions made within the application are maintained and enforced throughout the information's lifecycle outside the application
Data Source
AI summary
System and method for automatically protecting sensitive information downloaded as documents from enterprise web applications using Information Rights Management. The system includes technologies capable of intercepting and modifying HTTP traffic, software/program to detect and extract the sensitive information out of the HTTP traffic, and an IRM Server. The HTTP request and response are inspected and any sensitive information found is extracted and protected using the IRM Server. The IRM protected version of the sensitive information is then sent to an HTTP client.