Tri-module Data Protection System for Insider Threat Mitigation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current data protection methods are inadequate in preventing theft, especially from insiders and during data transit, as they often rely on encryption which can be compromised by insiders with access to encryption keys, and do not effectively prevent man-in-the-middle attacks, as identifying information is typically included with the data.
Innovation Solution
A system that separates data into two portions, with one host retaining the data header and another the core data, both without identifying information, requiring all three hosts to reassemble the data, and logs operations to detect and alert on any theft attempts, ensuring that no single host can access the complete data.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If encryption is used to protect data, then data security against outsiders is improved, but insiders with access to encryption keys can still compromise the data
Solution Approach 1:
The data is divided into multiple segments and distributed across different hosts. Each host stores only a portion of the data, making it impossible for any single host (including insiders) to access the complete data. The patent implements this by splitting data into fragments and storing them on separate servers, so that even if one host is compromised, the complete data remains secure.
2Reliability
If data is separated into portions and stored on multiple hosts, then security against insiders is improved, but the complexity of the system increases
Solution Approach 1:
While data is segmented for security, the system merges the functionality of multiple hosts into a unified data protection architecture. The patent combines the strengths of different hosts (some with stronger security, others with better performance) into a cohesive system where each host contributes to the overall security and functionality, managing complexity through structured integration.
Solution Approach 2:
The patent introduces intermediary components such as data brokers and coordination mechanisms that manage the complexity of multi-host data segmentation. These intermediaries handle the routing, reconstruction, and coordination between segmented data portions, shielding users from the underlying complexity while maintaining security benefits.
3Ease of operation
If identifying information is included with data in transit, then data usability is improved, but vulnerability to man-in-the-middle attacks increases
Solution Approach 1:
The patent extracts identifying information from the data stream during transmission. By removing headers, metadata, and identification fields from data packets in transit, the system prevents man-in-the-middle attackers from recognizing or targeting specific data. The identifying information is either stored separately or reconstructed only at the destination, ensuring that transmitted data lacks usable identifiers.
4Speed
If all data is stored on a single host for easy access, then data retrieval speed is improved, but the risk of data theft from that host increases
Solution Approach 1:
The patent segments data across multiple hosts to eliminate the single point of failure and theft risk. By distributing data portions across several locations, the system maintains security even as retrieval speed is optimized through intelligent caching and prioritization of critical data segments on accessible hosts.
Solution Approach 2:
The system performs preliminary actions by pre-positioning data segments on multiple hosts based on anticipated retrieval needs. This allows fast retrieval when data is needed while maintaining security through distribution, as the preliminary placement strategy optimizes access patterns without concentrating all data on one host.
Data Source
AI summary
The present invention provides a system, method and apparatus for protecting data:by separating limited data from the data storage on a primary host,and retaining only header information and the header information key at the primary host,and without the inclusion of any header information or identification of data,sending and storing the limited data at a secondary host,wherein retaining that limited portion of the data,and generating a limited data key to identify the limited portion of the data,and storing and connecting the generated key with the limited data,and sending and storing the limited data key to a tertiary host,wherein the limited data key being stored and connected with the header information key.Furthermore, to provide means for strong validation as well as header information key synchronization, a plurality of predetermined code set values being contained in data tables at each host, from which a different code value being used for each transmission of data sent and received. Upon receiving each code, the code set validation process executes by means of matching the received code, followed by sending the next code within the code set, for every transmission leg, by consecutively pointing to the correct code value in the code set subsequently required of the data operation. The code set furthermore providing the key synchronization of the data header key, that value also being referenced in like manner for the exclusive use of linking data at the primary and tertiary hosts.