Sectional fingerprinting for partial document content matching
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current technologies face challenges in efficiently monitoring and preventing the transmission of sensitive information across corporate networks, as existing access control systems fail to track and control the content of sensitive data, leading to potential misuse and exposure, with limitations in keyword matching and visibility into data transmission.
Innovation Solution
A content appliance system that monitors network traffic for compliance with private content transmission policies, using linguistic analysis to classify documents as private or public, and tracks private content transmission, even in partial forms, without storing the original content, allowing for real-time detection and prevention of unauthorized data exposure.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If keyword or key-phrase matching is used to identify sensitive material, then the system can detect potential sensitive content, but false positives occur frequently and the system becomes overly restrictive
Solution Approach 1:
The system changes the detection parameters from simple keyword matching to a more sophisticated approach that considers document properties, access control information, and contextual factors. This allows the system to distinguish between truly sensitive content and false positives, reducing overly restrictive blocking while maintaining detection accuracy.
Solution Approach 2:
The system dynamically adjusts detection and blocking behavior based on multiple factors including document classification, user privileges, and access control lists. Rather than applying static keyword-based rules, the system adapts its response to each specific document and transmission context, allowing legitimate transmissions while blocking actual sensitive content.
2Ease of operation
If Access Control Lists are used to control document access, then user access can be managed, but the system cannot control where information goes once access is granted
Solution Approach 1:
The system introduces an intermediary monitoring layer that sits between the Access Control List mechanism and actual document transmission. This intermediary captures documents at the point of creation or modification, classifies them according to sensitivity criteria, and then intercepts transmission attempts to enforce blocking rules based on document classification rather than just user privileges.
Solution Approach 2:
The system performs preliminary classification and marking of documents as they are created or modified, before transmission occurs. Documents are tagged with sensitivity information and access control metadata in advance, enabling the transmission monitoring system to automatically identify and block sensitive content without needing to analyze the full document content at transmission time.
3Device complexity
If tracking is done by filename or URL, then specific files can be monitored, but users can easily bypass this by copying sensitive information to locations with different identifiers
Solution Approach 1:
The system extracts the essential identifying characteristics and sensitivity metadata from the original document at the time of creation or classification. Rather than tracking the document by its location or filename, the system extracts a unique identifier or fingerprint that travels with the document content itself, allowing tracking regardless of where the document is copied or stored.
Solution Approach 2:
The system creates and propagates metadata copies that contain sensitivity classification information alongside the document content. When a document is copied or moved, these metadata copies ensure the sensitivity information travels with the content, allowing the monitoring system to identify sensitive material regardless of its new location or filename.
4Reliability
If blanket solutions are used to block external transmission of sensitive material, then all sensitive content can be prevented from leaving, but legitimate transmissions to remote locations are unnecessarily restricted
Solution Approach 1:
The system applies different transmission control rules to different documents based on their specific sensitivity classification and access control properties. Rather than applying a uniform blanket block to all external transmissions, the system evaluates each document individually and applies blocking only where actually required, allowing legitimate business communications to proceed while protecting sensitive information.
Data Source
AI summary
Monitored content is classified to determine partial matches with fragments of documents. A set of redundant keys, or sliding sectional fingerprints, are computed for every possible alignment of the documents with respect to the monitored content. The keys are stored in repositories according to the classification of the corresponding documents. Sectional fingerprints are computed for the monitored content, and the repositories are searched. If a match is found in a repository corresponding to public content, then the monitored data section is classified as public. If a match is found only in a repository corresponding to private content, then the data section is classified as private. Otherwise, the data section is classified as unknown. In a related aspect, a set of policies are searched for a first match in part according to the classifications of the monitored data sections, and a designated action taken if the first match is found.