Partial Encryption for Data Loss Prevention
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing data loss prevention methods rely on human compliance and full encryption, which is time-consuming and inefficient, especially for large files, leading to reduced throughput and increased computational resources.
Innovation Solution
A computer-implemented method using partial encryption, where a random subset of bytes in a file is replaced with random data, generating a randomly modified file, along with a legend data object containing the original byte values and encryption keys, to enhance security and traceability while maintaining computational efficiency.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If full encryption is used to prevent data loss, then security is improved, but computational time and resource expenditure increase significantly
Solution Approach 1:
The patent applies partial encryption by encrypting only a random subset of bytes (e.g., 10-50% of the file) rather than the entire file. This partial action maintains adequate security for data loss prevention while dramatically reducing the time and computational resources required compared to full encryption of the complete file.
Solution Approach 2:
The encryption process is segmented into discrete byte-level operations where individual bytes or byte-ranges are encrypted independently. This segmentation allows the system to process only portions of the file rather than treating the entire file as a monolithic encryption target, thereby reducing overall computational burden while maintaining security integrity.
2Reliability
If full encryption is applied to all files, then data protection is improved, but throughput and productivity deteriorate
Solution Approach 1:
By applying encryption only to a partial subset of bytes rather than the entire file, the system maintains sufficient data protection to prevent unauthorized access or data loss, while simultaneously enabling faster data transfer speeds and higher throughput because the majority of the file can be transferred without encryption overhead.
Solution Approach 2:
The system changes the encryption parameter from 'entire file' to 'random subset of bytes', transforming the encryption scope from maximum protection to optimized protection. This parameter modification allows the system to achieve adequate data protection with significantly improved productivity and throughput characteristics.
3Reliability
If random bytes are replaced with random data, then security and traceability are improved, but file size and data volume increase
Solution Approach 1:
The system replaces only a random subset of bytes with random data rather than the entire file content. This partial replacement provides sufficient security and traceability capabilities while minimizing the increase in data volume, as only a portion of the file undergoes transformation rather than the complete file.
Solution Approach 2:
The patent extracts only the necessary portion of the file (random subset of bytes) for encryption and randomization, leaving the rest of the file unchanged. This extraction approach maintains security and traceability for the encrypted portion while avoiding the unnecessary expansion of the entire file, thereby controlling overall data volume increase.
Data Source
AI summary
Embodiments of the disclosure provide for partial encryption of data to improve data loss prevention. Some embodiments receive a request to transfer a file from a computing device to a file storage device, identify a random subset of bytes in the file, and replace the random subset of bytes with random data to generate a randomly modified file. Some embodiments generate a data object indicative of an original value of each byte of the random subset of bytes, encrypt the data object with a first key, and generate a legend data object comprising a location array defining a location of each original value. Some embodiments, encrypt the first key with a second key to generate an encrypted first key, store the encrypted first key and the encrypted data object in the legend data object, and provide the randomly modified file and the legend data object to the file storage device.