Sensitive Data Element Tracking via Segmented Hashing
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing data security tools are unable to track the propagation of individual pieces of sensitive data within files and lack user-friendly interfaces for understanding data propagation within organizations, limiting visibility and control over sensitive data.
Innovation Solution
A method and system that deploy sensors to detect and extract sensitive data, hash it using a customer-specific salt, and transmit event information to a backend server for re-hashing and storage, enabling tracking and visualization of sensitive data propagation across devices and users, while maintaining data privacy through encryption and secure storage.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Loss of information
If existing tools track entire files shared within an organization, then visibility over data sharing is improved, but ability to track individual pieces of sensitive data is lost
Solution Approach 1:
The patent segments files into individual sensitive data elements (SDEs) by scanning files with regular expressions to identify specific sensitive data patterns. Each SDE is then tracked separately with its own metadata, allowing granular visibility into individual pieces of sensitive data while maintaining context about the files they reside in.
Solution Approach 2:
The patent introduces an intermediary layer of SDE metadata that bridges between file-level tracking and individual data element tracking. This metadata includes hashes, identifiers, and contextual information about each sensitive data element, enabling precise tracking without requiring direct monitoring of every file access event.
2Measurement precision
If sensitive data is extracted and stored for tracking, then propagation tracking capability is improved, but data privacy and security are compromised
Solution Approach 1:
The patent creates cryptographic hashes (copies) of sensitive data elements instead of storing the actual data. These hashes serve as unique identifiers for tracking purposes while containing no sensitive information themselves. The original sensitive data remains only in its source location, eliminating privacy risks associated with centralized storage.
Solution Approach 2:
The patent transforms sensitive data into a different parameter form (cryptographic hash) that preserves the ability to identify and track the original data while completely removing the sensitive information content. This parameter transformation enables tracking functionality without exposing private data.
3Measurement precision
If detailed metadata is collected for each detection event, then tracking accuracy is improved, but system complexity increases
Solution Approach 1:
The patent segments metadata collection into discrete, standardized fields (hash, identifier, file path, timestamp, user ID, etc.) that can be independently processed and stored. This modular metadata structure simplifies system architecture by breaking down complex tracking requirements into manageable, standardized data elements.
Data Source
AI summary
A system and associated method for tracking the propagation of sensitive data in computing devices. Each device is equipped with a sensor that detects and extracts sensitive data from data assets accessible via the device, hashes the data and associated metadata a first time, and transmits them to a backend server that hashes them a second time and stores them. The system can include a consulting device capable of searching information stored in the backend server and displaying it through an interface that allows the analysis of the propagation of sensitive data within the computing devices of a customer.