An Active Data Leakage Prevention Model for Insider Threat

Abstract

Insider threat has become the main vector of data leakage. Existing research on it mainly focuses on sensing and detection without defense capabilities. Meanwhile, traditional technologies for data leakage prevention rely on the terminal or boundary control which is difficult for data leakage in distributed environment. This paper presents an active data leakage prevention model for insider threat that combines trusted storage with virtual isolation technologies and expresses the protection requirements from the aspect of data object. We also show an implementation framework and give formal description as well as security properties proof. Finally, we give implementation strategies of dynamic isolation mechanisms.