PII Data Path Monitoring for Policy-Compliant Traffic Flows
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
There is a lack of visibility and enforcement in the movement and storage of personally identifiable information (PII) data across network environments, leading to potential breaches and non-compliance with data protection regulations due to the borderless nature of cloud-native SaaS applications.
Innovation Solution
Implementing a lightweight endpoint agent that identifies PII data and sends a probe to determine the intended data path, validating it against security policies to ensure compliance, and taking appropriate actions such as dropping the data or rerouting it to comply with policies.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If cloud-native SaaS applications are used to enable borderless data access and service delivery, then service availability and accessibility are improved, but visibility and control over PII data movement are lost
Solution Approach 1:
The system performs preliminary actions by sending probes to detect the intended data path before actual PII data transmission occurs. This allows the system to validate the path against security policies in advance, ensuring visibility and control are maintained even in borderless cloud environments.
Solution Approach 2:
The system implements feedback mechanisms by continuously monitoring and detecting actual data paths, then using this information to validate against security policies. This closed-loop approach ensures that the system maintains visibility over PII data movement dynamically, adapting to changing network conditions while preserving control.
2Productivity
If data traffic is allowed to flow freely across borders for cloud services, then service performance and user experience are improved, but compliance with data protection regulations deteriorates
Solution Approach 1:
The system validates intended data paths against security policies before PII data transmission begins. This preliminary validation ensures that compliance requirements are checked in advance, allowing free data flow only when compliance is confirmed, thus maintaining both performance and regulatory adherence.
Solution Approach 2:
The system introduces an intermediary validation layer that acts as a mediator between free data flow and compliance requirements. This intermediary component (the path detection and validation system) ensures that compliance checks are performed without blocking legitimate data traffic, maintaining service performance while ensuring regulatory compliance.
3Reliability
If path detection probes are sent to validate data routes, then data security and policy compliance are improved, but network overhead and latency increase
Solution Approach 1:
Path detection and validation are performed as preliminary actions before actual PII data transmission. By detecting the intended path in advance and validating it against security policies beforehand, the system ensures data security is maintained while the time penalty is paid only once during path validation, not during every data transmission.
Solution Approach 2:
The system maintains continuous path validation capability, so once a path is validated, it can be reused for subsequent data transmissions. This continuous validation approach ensures security is maintained while reducing repeated validation overhead, as the useful action of path validation continues to protect data flow without redundant checks.
Data Source
AI summary
This disclosure describes techniques for data path monitoring and visibility in communications among network devices. The techniques include determining that personally identifiable information (PII) is included in a data traffic flow intended for delivery to a destination endpoint. A probe may be sent from a source endpoint to identify an intended data path of the data traffic flow to the destination endpoint. The techniques include validating the intended data path of the data traffic flow against a policy related to data routing. Based at least in part on a result of the validation, the techniques may include allowing or dropping the data traffic flow, or various other actions.