Image Data Loss Prevention via OCR and Dynamic Matching

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Conventional Data Loss Prevention (DLP) systems struggle to monitor and protect sensitive data in unstructured documents and images, particularly due to the difficulty in inspecting encrypted SSL/TLS traffic and the inability to scan non-searchable files like images, leading to increased risks of data loss.

Innovation Solution

A DLP system that utilizes Optical Character Recognition (OCR) to extract text from images and applies Exact Data Matching (EDM) and Indexed Data Matching (IDM) techniques to detect and protect sensitive content, enabling the use of expressions to combine dictionaries for enhanced detection and blocking of sensitive or embarrassing material.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If conventional DLP approaches are used to monitor sensitive data, then data protection is achieved for structured documents, but unstructured documents and images cannot be scanned leading to data loss risks

Engineering Contradiction:

Improvedata protection coverageVSAvoidability to scan unstructured documents and images

Core Design Contradiction:

ReliabilityVSAdaptability or versatility

Solution Approach 1:

The DLP system is extended to handle multiple file types including structured documents, unstructured documents, and images through a unified architecture. The system uses file type detection to route files to appropriate processing pipelines, enabling universal DLP coverage across diverse document formats and structures

Inventive Principle:

Principle #6Universality (Multi-functionality)

Solution Approach 2:

Optical Character Recognition (OCR) technology is introduced as an intermediary component to bridge the gap between image files and text analysis capabilities. The OCR engine converts images into machine-readable text, allowing the DLP system to apply text-based detection algorithms to previously unscannable image formats

Inventive Principle:

Principle #24Intermediary (Mediator)

2Measurement precision

If DLP dictionaries are used to detect sensitive data, then Exact Data Matching is achieved for known patterns, but flexibility to handle custom expressions and combinations is limited

Engineering Contradiction:

Improvedetection accuracy for known data patternsVSAvoidflexibility to handle custom expressions and combinations

Core Design Contradiction:

Measurement precisionVSAdaptability or versatility

Solution Approach 1:

The DLP system transitions from static dictionary-based detection to dynamic expression-based detection. Users can create custom expressions that combine multiple dictionaries using logical operators (AND, OR, NOT), allowing the detection rules to adapt to complex scenarios such as detecting credit card numbers only when accompanied by expiration dates, or identifying sensitive data across multiple formats with varying patterns

Inventive Principle:

Principle #15Dynamics

3Loss of information

If SSL/TLS traffic inspection is performed to monitor encrypted data, then data visibility is improved, but processing cost and latency increase significantly

Engineering Contradiction:

Improvevisibility of encrypted trafficVSAvoidprocessing capability and latency

Core Design Contradiction:

Loss of informationVSLoss of energy

Solution Approach 1:

The system applies partial inspection to SSL/TLS traffic by focusing on specific high-risk scenarios and file types rather than inspecting all encrypted traffic uniformly. The DLP engine selectively processes files based on file type, size, and detected sensitivity indicators, reducing the overall processing burden while maintaining protection for critical data

Inventive Principle:

Principle #16Partial or excessive action

Applied Scientific Principles

This section explains which scientific principles are used to turn an abstract innovation direction into a practical engineering solution.

Function Achieved in This Case

The system effectively identifies and protects sensitive information in images and unstructured documents, ensuring data leak protection and blocking of embarrassing content across various platforms, while providing flexible and configurable DLP policies.

Implementation Method 1

When an image is detected, it is scanned to identify text therein, such as via Optical Character Recognition (OCR)

Methodology Applied

Scientific EffectOptical Character Recognition:

Data Source

PatentUS11805138B2Data loss prevention on images

Publication Date: 2023.10.31 ZSCALER INC

AI summary

Systems and methods for Data Loss Prevention (DLP) on images include detecting an image in monitored user traffic; scanning the image to identify any text and extracting any identified text therein; responsive to the extracting, scanning the extracted text with a plurality of DLP techniques including one or more DLP engines where the extracted text is checked to trigger the one or more DLP engines, Exact Data Matching (EDM) where the extracted text is matched to see if it matches specific content, and Indexed Data Matching (IDM) where the extracted text is matched to some part of a document from a repository of documents; and performing one or more actions based on results of the plurality of DLP techniques.