Threat Detection Network Sensitive Data Encryption
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing threat detection systems face challenges in protecting sensitive data from leaving the organization while still allowing for effective investigation during security incidents, as they either remove sensitive information, leading to incomplete data, or share it externally in readable format.
Innovation Solution
A method where endpoints generate and manage encryption keys to encrypt sensitive data, which are stored securely, allowing for decryption only when necessary, using a key server or distributed ledger, ensuring sensitive data is not shared externally in readable form.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Object-affected harmful factors
If sensitive data is removed from collected data before sending to external parties, then data protection is improved, but investigation capability deteriorates
Solution Approach 1:
The data is segmented into sensitive and non-sensitive parts. Sensitive data is encrypted separately using encryption keys that remain within the organization, while non-sensitive data can be shared externally. This segmentation allows selective protection of critical information while maintaining investigability of other data elements.
Solution Approach 2:
Encryption keys act as an intermediary mechanism between the organization and external parties. The keys enable controlled access to sensitive data - external parties cannot read the encrypted data without the keys, which remain within the organization. This intermediary layer protects sensitive information while allowing authorized investigation when keys are temporarily provided.
2Loss of information
If sensitive data is kept in readable format for investigation, then investigation capability is improved, but data security deteriorates
Solution Approach 1:
The sensitivity parameter of data is dynamically changed through encryption. Data can be in an encrypted state (protected) or decrypted state (investigable) depending on the operational context. The encryption/decryption process changes the data's readability parameter, allowing flexible control between security and investigability based on current needs.
3Productivity
If encryption keys are stored externally for easy access, then decryption efficiency is improved, but key security deteriorates
Solution Approach 1:
The key storage problem is solved by moving from a single-dimensional approach (either store locally or externally) to a multi-dimensional architecture. Encryption keys are generated and stored within the organization's infrastructure, while encrypted data can be shared externally. This dimensional separation allows keys to remain secure locally while enabling efficient decryption when needed, without requiring external key storage.
Data Source
AI summary
A threat detection network, an endpoint of a threat detection network, a server of a threat detection network and a method for protecting sensitive data in a threat detection network, which threat detection network includes at least one end point, at least one server and an encryption key storage, such as a key server. In the method the endpoint generates a data encryption key to be used for encrypting sensitive data and the endpoint sends the encryption key to the encryption key storage. When the endpoint records an event, it checks the event related information for identifying sensitive data. The endpoint uses the encryption key to encrypt the event related information identified as sensitive data. The endpoint sends at least part of the event related information with encrypted sensitive data to the at least one server.