Security Rules Module for Data Leakage Prevention
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional systems fail to prevent data leakage between systems during runtime integration, often due to unawareness of confidential data being transmitted and lack of dynamic security rule enforcement, leading to accidental exposure of sensitive information.
Innovation Solution
A computer-implemented method that tags sensitive data fields, transforms them, and obscures values based on security rules, ensuring that only non-sensitive data is shared with external systems, utilizing a security rules management module to decouple security settings from core integration logic and reduce the number of rules executed.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If security rules are tightly controlled by a separate security team, then security control is improved, but integration complexity increases
Solution Approach 1:
The patent introduces a security rules management module as an intermediary component that sits between the integration runtime and the core integration logic. This module receives integration flows, applies security rules to tag and obscure data fields, and returns transformed flows to the integration runtime. By placing security control in a separate, dedicated module rather than embedding it throughout the integration system, the patent achieves improved security isolation while maintaining cleaner integration logic in other components.
2Reliability
If all data fields are transformed and secured, then data security is improved, but processing time increases
Solution Approach 1:
The patent applies local quality by selectively securing only the data fields that require protection. Through the security rules management module, the system identifies specific data fields marked with sensitive tags and applies obscuring transformations only to those fields, while leaving non-sensitive fields unchanged. This selective approach ensures data security for sensitive information while minimizing processing overhead on the entire data structure.
Solution Approach 2:
The patent implements preliminary action by tagging data fields as sensitive before the actual transformation occurs. The security rules management module receives the integration flow, identifies sensitive fields through pre-defined rules, and marks them with tags. This preliminary identification allows the subsequent obscuring operation to focus only on tagged fields, avoiding unnecessary processing of all fields and reducing overall processing time.
3Reliability
If security rules are enforced at every integration step, then data leakage prevention is improved, but system performance decreases
Solution Approach 1:
The patent extracts the security rule enforcement logic from the core integration runtime and places it in a separate security rules management module. This extracted module handles security operations independently, allowing the integration runtime to focus on core integration functionality. The security module receives integration flows, applies necessary security transformations, and returns them to the runtime, thereby preventing data leakage while minimizing performance impact on the main integration process.
4Measurement precision
If detailed security tagging is applied to all data, then data classification accuracy is improved, but device complexity increases
Solution Approach 1:
The patent implements universality through the security rules management module that handles multiple security-related functions within a single component. This module performs data field identification, sensitivity determination, tagging, and obscuring operations all in one place. By consolidating these functions into a universal module rather than implementing separate mechanisms for each function, the patent achieves detailed data classification accuracy while reducing overall system complexity.
Data Source
AI summary
A method, system, and computer program product that is configured to: receive inbound data; tag a plurality of data fields of the inbound data; execute at least one integration flow which transforms the inbound data with tagged data fields to transformed data with the tagged data fields; obscure values of the data fields in the transformed data based on the tagged data fields; and send outbound data which includes the transformed data with the obscured values of the data fields.