Indexed Document Matching for Unstructured Data DLP
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional Data Loss Prevention (DLP) systems face challenges in monitoring and protecting sensitive data, especially when users access applications directly from anywhere, leading to blind spots and increased risk of data loss due to unintentional or malicious reasons. They struggle with unstructured documents and non-searchable files like images, which can bypass security controls and conceal sensitive information.
Innovation Solution
The implementation of Indexed Document Matching (IDM) technology, which allows for the identification and protection of content that matches whole or partial documents by using cryptographic hashes and Context Triggered Piecewise Hashes, enabling similarity detection and fragment identification across multiple user-defined profiles, and supporting DLP on images through Optical Character Recognition (OCR) to extract and match text.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If conventional DLP approaches use software agents and physical appliances, then data can be monitored at endpoints and data at rest, but blind spots occur when users access applications directly from anywhere, especially off-network
Solution Approach 1:
The patent implements a cloud-based DLP service that provides universal data loss prevention capabilities across multiple locations and devices. The service monitors data at endpoints, data at rest, and data in motion through a centralized cloud platform that can access and analyze data regardless of user location, eliminating blind spots while maintaining comprehensive monitoring functionality.
2Reliability
If encryption is used to protect sensitive data, then data security is improved, but inspection of encrypted traffic becomes difficult and expensive
Solution Approach 1:
The patent introduces a cloud-based intermediary service that acts as a mediator between encrypted traffic and DLP inspection. The service receives encrypted data, performs decryption in a secure cloud environment, inspects the decrypted content for sensitive information, and then re-encrypts or forwards the data. This intermediary approach enables inspection without requiring complex local decryption capabilities at each endpoint.
3Measurement precision
If DLP dictionaries use exact data matching for structured documents, then specific data formats like social security numbers and credit card numbers can be detected, but unstructured documents and non-searchable files like images cannot be effectively scanned
Solution Approach 1:
The patent changes the detection parameters and methods based on file type. For structured documents, it uses traditional DLP dictionary matching with exact data patterns. For unstructured documents and images, it employs Optical Character Recognition (OCR) technology to extract text, then applies DLP detection. This parameter adaptation enables the system to effectively scan and detect sensitive information across diverse file formats while maintaining high detection accuracy for each type.
Applied Scientific Principles
This section explains which scientific principles are used to turn an abstract innovation direction into a practical engineering solution.
Function Achieved in This Case
IDM provides robust data leak protection for unstructured documents and images, ensuring sensitive information is detected and blocked, even when exact matches are not found, thereby enhancing the overall effectiveness of DLP systems in preventing data loss across various file types and platforms.
Implementation Method 1
supporting DLP on images through Optical Character Recognition (OCR) to extract and match text
Implementation Method 2
using cryptographic hashes and Context Triggered Piecewise Hashes, enabling similarity detection
Data Source
Figure 1
Figure 2
Figure 3~4
AI summary
Systems and methods include obtaining (851) a file to be checked for Data Loss Prevention (DLP); determining (852) a cryptographic hash of the file and comparing the cryptographic hash to corresponding cryptographic hashes of indexed files; responsive to a match (853) between the cryptographic hash and one of the corresponding cryptographic hashes, determining (854) a DLP match and performing an action based thereon; responsive to no match (853), extracting (855) text from the file and creating an ordered sequence of hashes of variable length chunks of the extracted text; and determining (857) the DLP match with one of the indexed files based on comparing (856) the ordered sequence of hashes with corresponding ordered sequence of hashes of the indexed files.