The Need

Data breaches are a looming risk for organizations that maintain significant repositories of sensitive data. The fundamental reason behind their inability to prevent them is the philosophy behind the current paradigm in data security: prevent all breaches at all times. Towards that end, existing approaches are geared towards building the strongest possible wall around their data. As the wall becomes stronger, the usability suffers substantially as there is typically a tradeoff between usability/performance and security. Another issue is that, once the legitimate users are authenticated, they are granted the right to not only the consumption but also the ownership of data. Thus, these organizations rely on their users to keep the data safe. However, human trust is a flawed foundation for security as it has been seen that many large data breaches have been caused by user mistake or intent.

The Technology

DAtAnchor is a data protection system that conducts the interaction between data and its consumers and works in tandem with other security measures to mitigate data loss. It has two major components: the anchor service and the heartbeat service. The anchor service is a hardened security module within the network. It unlocks the keys to encrypt/decrypt data in a way that does not degrade the experience of legitimate users. On the other hand, if the request for data is deemed unreasonable, then the anchor service throttles the access in such a way that the request will be served over an extended period of time. If the attacker waits for the whole period, he needs to be "anchored" within the network rendering him vulnerable for detection. Operating concurrently is the heartbeat service that gives location context to data access. Here, location refers to wherever the heartbeat signal is detected. DAtAnchor achieves multiresolution for the location context, varying from a single office to across a VPN. If the heartbeat service is not detected for a period of time, then the access to data is revoked, even after the fact. This means, even if the access credentials are compromised, this does not equate data loss outside of a context.

Commercial Applications

• Information security
• Network infrastructure

Benefits/Advantages

• Secures all forms of data
• Provides granular network monitoring with extensive logs of data access
• Allows customers to limit the consumption of data within specified location contexts
• Increases the likelihood of detecting an attacker