Sensitive Data Detection in Encrypted Backups
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional security software is unable to detect sensitive data in encrypted and compressed backups, allowing users to potentially circumvent security policies by placing sensitive files in backups.
Innovation Solution
A method that identifies sensitive data in backups by scanning their contents before encryption or compression, creating metadata to indicate the presence of sensitive data, and associating this metadata with the backup, which can be stored separately or within the backup, allowing detection even if the backup is encrypted and compressed.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If conventional backup software encrypts and compresses data using proprietary algorithms, then data security and storage efficiency are improved, but security software's ability to detect sensitive data is lost
Solution Approach 1:
The system performs sensitivity analysis on files before they are added to the backup. The sensitivity analyzer scans files for sensitive data patterns and creates sensitivity information that is stored alongside the backup data. This preliminary detection occurs before encryption and compression, allowing security policies to be enforced on the original sensitive data while the backup remains encrypted and compressed.
Solution Approach 2:
The patent introduces sensitivity information as an intermediary layer between the encrypted backup data and security software. This metadata contains sensitivity indicators that allow security software to detect sensitive data without needing to decrypt or decompress the backup. The sensitivity information acts as a mediator that bridges the gap between encrypted storage and security detection requirements.
2Reliability
If files containing sensitive data are placed in encrypted backups, then data protection is improved, but security policy compliance is violated
Solution Approach 1:
The system performs sensitivity analysis before files are added to the backup, creating sensitivity information that preserves knowledge about sensitive data content. This preliminary action ensures that sensitivity information is captured before encryption obfuscates the data, allowing security policies to be enforced while maintaining data protection.
Solution Approach 2:
The system creates sensitivity information that is a copy or representation of the sensitivity characteristics of the original data. This sensitivity metadata contains copies of sensitive data patterns or indicators that allow security software to detect sensitive information without accessing the actual encrypted backup content, thus preserving sensitivity information separately from the protected data.
3Reliability
If security software scans files for sensitive data, then security policy compliance is improved, but backup creation time is increased
Solution Approach 1:
The sensitivity analysis is performed as a preliminary step during the backup creation process, before encryption and compression. By integrating sensitivity detection into the backup workflow upfront, the system ensures security policy compliance is established early, and the sensitivity information is reused for security checks without requiring repeated scanning of the entire backup content.
Solution Approach 2:
The system creates sensitivity information as a separate metadata layer that contains copied sensitivity indicators from the original files. This copying approach allows security software to quickly check the sensitivity metadata rather than scanning through all backup data, significantly reducing the time required for security compliance verification while maintaining thorough detection capabilities.
Data Source
AI summary
A computer-implemented method for identifying the presence of sensitive data in a backup may comprise identifying a backup, identifying sensitive data in the backup, creating metadata that identifies the presence of the sensitive data in the backup, and associating the metadata with the backup. In addition, a method for preventing sensitive data from being placed in a backup may comprise identifying a file, identifying sensitive data in the file, and preventing the file from being placed in a backup. Corresponding systems and computer-readable media are also disclosed.