Metadata Tracking for Information Asset Leakage Prevention
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing Host-based Information Leakage Detection and Prevention Systems (HILDP) face challenges in comparing the content of transmitted files against a global database of sensitive documents, particularly when files are stored in encrypted formats or when information assets are not accessible, leading to scalability issues and false positives.
Innovation Solution
A method and system that attach content-meta-data to information assets, enabling real-time comparison and protection against leakage by tracking and preserving meta-data through transmissions and transformations, using a rule-based policy with agents installed on each computer to enforce security policies and log events.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If content comparison is performed against a global database of sensitive documents, then detection accuracy is improved, but system scalability deteriorates and false positives increase
Solution Approach 1:
The patent extracts the essential identifying characteristics of sensitive information into metadata tags attached to individual files. Instead of comparing entire file contents against a global database, the system extracts and preserves metadata (such as document properties, author information, classification tags) that uniquely identify sensitive documents. This extraction approach maintains detection accuracy while eliminating the need for resource-intensive full-content comparisons, thereby improving system scalability.
Solution Approach 2:
The system performs preliminary action by attaching metadata tags to information assets before they are transmitted or transformed. The metadata is preserved and carried through various operations (copying, moving, transforming) so that when a transmission event occurs, the system can immediately compare the metadata against the global database without needing to analyze the actual file content. This preliminary tagging enables fast, scalable detection while maintaining high accuracy.
2Measurement precision
If file content is accessed for comparison, then detection accuracy is improved, but system complexity increases due to encrypted file handling
Solution Approach 1:
The patent extracts metadata from files at the point of creation or last modification, storing this information separately from the actual file content. This extracted metadata includes identifying characteristics such as document type, author, creation date, and classification information. When detection is needed, the system compares only this extracted metadata against the global database, completely avoiding the need to access or decrypt file contents, thereby simplifying the system while maintaining detection accuracy.
Solution Approach 2:
The system introduces metadata as an intermediary layer between the file content and the detection process. Instead of directly accessing file content for comparison, the system uses the metadata tags as a mediator that carries the essential identifying information. This intermediary approach allows the system to detect sensitive information without needing to handle encrypted or complex file formats directly, reducing system complexity while preserving detection capabilities.
3Measurement precision
If metadata is preserved through transmissions and transformations, then information tracking accuracy is improved, but data processing overhead increases
Solution Approach 1:
The system creates and preserves a copy of the metadata information through transmissions and transformations rather than re-analyzing the original file content. When a file is copied, moved, or transformed, the system attaches or preserves the original metadata tags with the file, enabling continuous tracking without additional processing overhead. This copying approach maintains high tracking accuracy while minimizing energy consumption compared to repeated content analysis.
Data Source
AI summary
A system and method are provided for tracking an operation performed on an information asset. The information asset has metadata associated therewith. In use, the metadata is preserved during the at least one operation.