Runtime Instrumentation for Online Application Data Protection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Recent studies indicate that approximately 23% of data breaches are attributed to internal sources, and when including breaches by authorized third-parties, nearly half of all breaches are performed by authorized users, highlighting the complexity of mitigating information security breaches within organizations, where authorized users need access to perform daily tasks and distinguishing between legitimate and malicious access is difficult.
Innovation Solution
The system employs instrumentation to apply data protection policies within online applications, using client-side agents to dynamically enforce restrictions on functions like printing, saving, and screenshotting during transactions involving confidential information, leveraging a multi-tenant agent to gather runtime telemetry and enforce security policies.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Object-affected harmful factors
If traditional security measures (preventing external access via phishing and malware) are used, then external threats are blocked, but internal data breaches by authorized users remain unaddressed
Solution Approach 1:
The system segments security control into two layers: traditional external security measures and a new internal data protection layer. The data protection system operates independently within the application, using instrumentation and client-side agents to monitor and control data access, thereby addressing internal threats without compromising external security defenses
Solution Approach 2:
The patent introduces an intermediary data protection system between the application and the user. This intermediary layer includes instrumentation code inserted into the application and client-side agents that mediate data access requests, allowing the system to detect and prevent internal data exfiltration attempts while maintaining legitimate user access
2Reliability
If data protection policies restrict client-side functions (printing, saving, screenshotting), then data exfiltration is prevented, but legitimate user access and productivity are hindered
Solution Approach 1:
The system dynamically adjusts data protection restrictions based on real-time analysis of user behavior and transaction context. Client-side agents continuously monitor transactions and modify their security posture accordingly, allowing legitimate operations to proceed while blocking suspicious data exfiltration attempts, thus adapting protection levels to actual risk scenarios
Solution Approach 2:
The data protection system incorporates continuous feedback loops where client-side agents monitor user interactions and transaction outcomes. This feedback mechanism allows the system to learn from user behavior patterns, distinguish between legitimate access and malicious exfiltration, and adjust restrictions accordingly, maintaining productivity while enhancing security
3Reliability
If instrumentation code is inserted into the online application at runtime, then data protection capabilities are enhanced, but application complexity and performance impact increase
Solution Approach 1:
The system performs preliminary instrumentation of the application at runtime before data exfiltration attempts occur. Instrumentation code is injected into the application memory and executed in advance to establish monitoring and protection mechanisms, enabling the system to detect and prevent data breaches without requiring pre-modified application code
Solution Approach 2:
The data protection system is self-contained and self-managing, with instrumentation code that automatically monitors transactions and client-side agents that independently enforce policies. The system handles its own deployment, monitoring, and enforcement without requiring external intervention or complex integration with the application architecture
Data Source
AI summary
In one embodiment, a device obtains transaction data regarding a transaction attempted by a client of an online application to access confidential information within the online application. The transaction data is captured by instrumentation code inserted into the online application at runtime. The device permits, based on a policy, the transaction to complete within the online application. The device determines, based on the policy, a set of one or more client-side functions to disable during the transaction. The device instructs an agent executed by the client to disable the set of one or more client-side functions during the transaction.