Proxy-Based Data Classification via Transaction Interception
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Managing and classifying large volumes of data stored across multiple platforms and locations is challenging due to its dispersed nature, size, and variability, making it difficult to track sensitive data without scanning the entire data store, which is inefficient and resource-intensive.
Innovation Solution
A data classification system that intercepts transactions between clients and a data store to construct a classification map, classifying data into predefined classes without direct access to the data store, indicating sensitive data locations and client identities, and enforcing policies based on this map.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If data scanning is performed to classify and track sensitive data, then data classification accuracy is improved, but system resource consumption increases and transaction disruption occurs
Solution Approach 1:
A proxy server is introduced as an intermediary component between clients and the data store. The proxy intercepts data transactions, extracts data access information from transaction requests and responses, and provides this information to the classification system. This approach enables accurate data classification without requiring direct scanning of the data store, thereby reducing system resource consumption and avoiding transaction disruption.
2Loss of information
If direct data store access is used for classification, then complete data visibility is achieved, but system complexity and operational disruption increase
Solution Approach 1:
The proxy server acts as a mediator that enables the classification system to obtain data visibility indirectly through transaction interception rather than direct data store access. This maintains operational simplicity and avoids disrupting existing data store operations while still achieving comprehensive data classification through transaction monitoring.
Solution Approach 2:
The patent replaces the mechanical approach of directly accessing and scanning the data store with an information-based approach using transaction interception. Instead of physically examining data in the data store, the system analyzes transaction requests and responses to infer data access patterns and classifications, reducing operational complexity and disruption.
3Loss of information
If comprehensive data transactions are intercepted and analyzed, then classification completeness is improved, but processing time and system overhead increase
Solution Approach 1:
The system extracts only the necessary classification-relevant information from intercepted data transactions, such as data access patterns, data types, and sensitivity indicators. By extracting only essential information rather than processing complete transaction data, the system achieves comprehensive classification coverage while minimizing processing time and system overhead.
Solution Approach 2:
The classification system processes transactions selectively, focusing on intercepting and analyzing transactions that are relevant to classification objectives. Rather than uniformly processing all transactions with equal depth, the system applies partial action by prioritizing analysis of transactions containing potentially sensitive data, thereby improving classification completeness for critical data while reducing overall processing time.
Data Source
AI summary
A data classification system includes a proxy and a processor. The proxy is configured to intercept transactions that are conducted over a network between clients and a data store. The processor is configured to construct, based on the intercepted transactions, a classification map including a classification of at least some of the data that is stored in the data store into predefined classes.