Mask sensitive information in documents

Abstract

The present disclosure relates to masking sensitive information in documents. Exemplary embodiments disclose a method, computer program product, and computer system for protecting sensitive information. Exemplary embodiments may include: evaluating one or more statistical measures of index tokens of an inverted text index using an inverted text index, selecting a candidate token set using the one or more statistical measures, extracting metadata from the inverted text index, associating the candidate token set with corresponding token metadata, tokenizing at least one document to produce one or more document tokens, comparing the one or more document tokens to the candidate token set, selecting a document token set to mask, selecting at least a portion of the document token set that includes sensitive information based on the associated token metadata, masking at least a portion of the document token set, and providing one or more masked documents.

Description

Technical Field

[0001] The present invention relates to the field of digital computer systems, and more particularly, to a method for masking sensitive information in a document. Background Art

[0002] Data protection and keeping sensitive information private is extremely important for companies and their customers. However, the technical challenges of data privacy protection are increasing with the trend of moving services to third parties and into the cloud as the diversity of data increases. Summary of the invention

[0003] Exemplary embodiments disclose a method, computer program product, and computer system for protecting sensitive information. Exemplary embodiments may include: evaluating one or more statistical metrics of index tokens of an inverted text index using an inverted text index, selecting a candidate token set using the one or more statistical metrics, extracting metadata from the inverted text index, associating the candidate token set with corresponding token metadata, tokenizing at least one document to produce one or more document tokens, comparing the one or more document tokens with the candidate token set, selecting a document token set to be masked, selecting at least a portion of the document token set that includes sensitive information based on the associated token metadata, masking the at least a portion of the document token set, and providing one or more masked documents. BRIEF DESCRIPTION OF THE DRAWINGS

[0004] The following detailed description, which is given by way of example and is not intended to limit only the exemplary embodiments thereto, will be best understood in conjunction with the accompanying drawings, in which:

[0005] Figure 1 An exemplary block diagram of a system according to an exemplary embodiment is shown.

[0006] Figure 2 An exemplary flow chart illustrating a method for protecting sensitive information in a document in accordance with an exemplary embodiment is depicted.

[0007] Figure 3 An exemplary flow chart illustrating a method for providing a set of candidate tokens that may include sensitive information is depicted in accordance with an exemplary embodiment.

[0008] Figure 4 An exemplary flow chart illustrating a method for protecting sensitive information in a document according to an exemplary embodiment.

[0009] Figure 5 An exemplary flow chart illustrating a method for protecting sensitive information in a document in accordance with an exemplary embodiment is depicted.

[0010] Figure 6 Depicted is an exemplary block diagram depicting hardware components of a system according to an exemplary embodiment.

[0011] Figure 7 A cloud computing environment is depicted according to an exemplary embodiment.

[0012] Figure 8 Abstract model layers are depicted according to an exemplary embodiment.

[0013] The drawings are not necessarily to scale. The drawings are only schematic representations and are not intended to depict specific parameters of the exemplary embodiments. The drawings are intended to depict only typical exemplary embodiments. In the drawings, the same reference numerals represent the same elements. DETAILED DESCRIPTION

[0014] Detailed embodiments of the claimed structures and methods are disclosed herein; however, it is understood that the disclosed embodiments are merely illustrative of the claimed structures and methods that may be embodied in different forms. The exemplary embodiments are merely illustrative, however, may be embodied in many different forms, and should not be construed as limited to the exemplary embodiments set forth herein. Rather, these exemplary embodiments are provided so that this disclosure will be thorough and complete, and will fully convey the scope covered by the exemplary embodiments to those skilled in the art. In the description, details of well-known features and techniques may be omitted to avoid unnecessarily obscuring the given embodiments.

[0015] References in the specification to "one embodiment," "an embodiment," "an exemplary embodiment," etc. indicate that the described embodiment may include a particular feature, structure, or characteristic, but every embodiment may not necessarily include the particular feature, structure, or characteristic. Moreover, such phrases do not necessarily refer to the same embodiment. Further, when a particular feature, structure, or characteristic is described in conjunction with an embodiment, it is considered to be within the knowledge of those skilled in the art to implement such feature, structure, or characteristic in conjunction with other embodiments, whether or not explicitly described.

[0016] In order not to obscure the presentation of exemplary embodiments, in the following detailed description, some processing steps or operations known in the art may have been grouped together for presentation and illustration purposes, and in some cases may not be described in detail. In other instances, some processing steps or operations known in the art may not be described at all. It should be understood that the following description focuses on the distinguishing features or elements according to various exemplary embodiments.

[0017] The description of different embodiments of the present invention will be presented for the purpose of illustration, but is not intended to be exhaustive or limited to the disclosed embodiments. Many modifications and variations will be apparent to those of ordinary skill in the art without departing from the scope and spirit of the described embodiments. The terminology used herein is selected to best explain the principles of the embodiments, practical applications or technical improvements over technologies found in the marketplace, or to enable those of ordinary skill in the art to understand the embodiments disclosed herein.

[0018] The requested document may be a structured or unstructured document. Compared to structured documents, unstructured documents may include unstructured information that does not have a predefined data model or is not organized in a predefined manner. Compared to data stored in a database in a fielded form or annotated in a document of a structured document, this may make it difficult to understand such a document using a program. The document may be, for example, an electronic document. An electronic document may be an electronic media content intended to be used in electronic form or as a printout. An electronic document may include, for example, a web page, a document embedded in a web page and that can be presented in a web page, a spreadsheet, an email, a book, a picture, and a presentation with an associated user agent such as a document reader, an editor, or a media player.

[0019] A typical application scenario for a document may include loading a document and displaying it on an interface for different users. However, this may result in data including sensitive information being copied to a less trusted environment. Sensitive information may include private data, such as social security numbers, passport data, credit card numbers, health record details, etc., which should not be disclosed to untrusted parties. The present subject matter can address this issue by using data masking. The purpose of data masking may be to desensitize the data so as to hide or mask sensitive data items so that the data as a whole remains useful for its intended purpose. Data masking may be performed so that access to the document satisfies predefined data access rules. Data access rules may include management policies and / or user access rights. For example, management rules may require protection of any type of sensitive information, such as personal information.

[0020] However, conventional data masking can be very resource intensive because it can require large infrastructure processing, setup, and configuration to work. The present subject matter can solve this problem by providing efficient and optimized data masking of documents. The present subject matter can be effective because it can use the same set of candidate tokens that potentially contain sensitive information to identify content to be masked in multiple requested documents. This can save processing resources that would otherwise be required to process each document separately. The present subject matter can be optimal because an inverted text index (also referred to as an inverted index) can be provided in different formats, for example, a compressed format, which enables resource-saving processing. An inverted text index can be an index data structure that stores mappings from tokens such as words or numbers to their locations in one or more documents in the set of documents. For example, an inverted text index can be a hashmap data structure. The tokens of an inverted text index can be referred to as index tokens.

[0021] According to one embodiment, the method further comprises: determining subject metadata of the candidate token set. The subject metadata of each token in the candidate token set indicates the subject of the token or the subject of the document containing the token, wherein the token metadata of the token also comprises subject metadata.

[0022] The subject metadata of a token may include an attribute value representing the subject of the token and one or more values ​​describing the attributes of the subject of the token. For example, if the token is Morbus-Addison as an orphan disease, the subject of the token may be a disease and some subject metadata may be an indicator like an orphan disease. It is also possible for a token to be associated with multiple subjects. According to the above example, the subject of the token Morbus-Addison may be a disease subject and an orphan disease subject. The subject metadata of the token may additionally or alternatively include management rules indicating the value of the token of this subject that needs to be confidential. For example, the subject of a given token may involve a healthcare system, and the management rules may indicate that information about patients should be handled confidentially. Therefore, the content of the token metadata of each candidate token may be processed to determine whether it contains sensitive information, for example, using a data sensitive-non-sensitive classifier. The classifier may, for example, use the domain of the token to associate it with a management directory, and the rules defined for the domain may be used to classify the token. The processing may, for example, also include data mining to interpret the attribute values ​​present in the token metadata and apply rules to them. Data mining may enable the metadata to be re-examined using the business vocabulary to see what is "known" about the metadata and whether any kind of sensitivity classification is associated with it.

[0023] This embodiment may enable accurate selection of at least a portion of the set of candidate tokens, as the selection may be based on rich content of the metadata.

[0024] According to one embodiment, the method further comprises inputting the token subject into an information governance tool and receiving the subject metadata as output.The information governance tool may be, for example, a corporate governance directory solution.

[0025] According to one embodiment, the statistical measure of the index token includes one or a combination of the following items: the number of documents in the document set containing the index token, the frequency of occurrence of the index token in the document set, the frequency of occurrence of the token type of the index token in the document set, wherein selecting the candidate token set includes comparing the statistical measure with a predefined threshold. The token type can be a text type, a numeric type, or a combination thereof. For example, a configurable threshold can be provided for each token type, which indicates the frequency at which the token is allowed to appear in the document set (the posting list of the token). For example, in the case where the frequency of occurrence of the index token is less than the configurable threshold, it can be selected as a candidate token that may potentially contain sensitive information. That is, the lower the frequency of the index token, the more likely it is that this is suspicious and potentially individual information that must be masked. In another example, more than one statistical measure can be used to decide whether the index token is a candidate token that potentially contains sensitive information. According to the above example, if the frequency of occurrence of the index token is less than the configurable threshold, it can be further determined whether the number of documents in the document set containing the index token is less than another configurable threshold, and if so, the index token can be selected as a candidate token.

[0026] According to one embodiment, in case the document set changes, the inverted text index is updated. The method further comprises: storing the candidate token set in association with the token metadata in a storage system or a data storage, and repeatedly: performing the selection of the candidate token set and the extraction of the metadata, and updating the storage system accordingly, wherein the updated storage system is used to select the masked document token.

[0027] The method may include a first method for providing a set of candidate tokens, followed by a second method for masking the requested document. The first method includes the steps of the method performed before receiving a document request. The second method includes the steps of receiving a document request and the following steps of the method. The second method may be performed independently of the first method. For example, upon receiving a document request, a storage system may be read to retrieve a set of candidate tokens. The storage system may be updated with a new set of candidate tokens independent of the second method using the first method. Thus, this embodiment may further improve the accuracy of data masking because it may be based on the latest data.

[0028] According to one embodiment, selecting at least a portion of a document token set including sensitive information based on associated token metadata includes running a classifier on the token metadata, and classifying the document token set as sensitive or non-sensitive tokens, wherein the selection is performed based on the classification. For example, if the token metadata includes a token type, it can be used to decide whether to mask the document token. If the document token is a combination of a number and a string, this can indicate that it represents sensitive information. That is, only candidate tokens of a specific category or type can be masked. The frequency of occurrence of a token can be defined (first definition) as the number of occurrences of the token divided by the number of documents in the document collection. In another example, the frequency of occurrence can be defined (second definition) as the number of documents containing the token divided by the number of documents in the set of documents. For example, if the token metadata also includes the document ID of the document in which the index token exists, the document ID can be advantageously used to mask the document token or not mask the document token if the frequency of occurrence of the document token according to the first definition is low, i.e., less than a threshold. For example, since the frequency is defined relative to all documents, even if the same token only exists in one document, the frequency can still be smaller because the frequency is calculated using all documents. That is, if the same document token is present in only one document, then 10 times it may indicate that it is non-sensitive, although the frequency may be small. Thus, using an additional document ID may enable detection of such cases, for example, as non-sensitive. For example, if the token metadata also includes a management rule indicating that users located in a certain area are not allowed to access information such as a person's address, the classifier may determine the location of the user requesting the document and may decide whether to mask the address information (which is part of the document token set) based on that location and according to the rule.

[0029] According to one embodiment, the method further comprises: determining a domain represented by the content of the requested document, wherein the set of documents represents the determined domain and excludes the requested document. In other words, the requested document may not have been used to generate an inverted index; however, an inverted index may be advantageously used according to this embodiment because it requires that the requested document and the set of documents of the inverted index have the same domain. This may, for example, enable the separation of test data used to provide candidate tokens from data used to classify tokens to be masked.

[0030] According to one embodiment, the set of documents includes the requested document.This may be advantageous because it may provide accurate selection of a set of document tokens and thus accurate data masking because document tokens may be part of index tokens.

[0031] Figure 11 is a block diagram illustrating a document provider system 100 according to an example of the present subject matter. The document provider system 100 includes a document retrieval system 101 and a user computer system 102. The document retrieval system 101 and the user computer system 102 may be operable to communicate via a network 103. The network 103 may be, for example, the Internet, a local area network, a wide area network, and / or a wireless network.

[0032] The document retrieval system 101 is capable of accessing documents in a memory, which is represented here by a database 105, which is operatively coupled to the document retrieval system 101. The database 105 contains documents to be sent to the user computer system 102 in operation. These documents can be any type of primarily unstructured text, such as a paragraph in a newspaper article, a property record, or a manual. The document retrieval system 101 can implement document retrieval. Document retrieval can be defined as the matching of some purported user query of the user computer system 102 with one or more documents in the database 105. The documents 108 stored in the database 105 can represent a collection of one or more domains. For example, the document 108 may include multiple groups of documents representing different domains, respectively. A domain represents a concept or category belonging to a part of the world, such as biology or politics. The domain generally simulates a domain-specific definition of a term. For example, a domain can refer to a specific domain of health care, advertising, business, medical and / or biomedical. The database 105 may also include an inverted text index 109. An inverted text index may be an index data structure that stores mappings from index tokens (such as words or numbers) to their locations in one or more documents in the documents 108. To simplify the description, only one inverted text index is shown, but is not limited to, for example. The database 105 may store one inverted index for each of multiple groups of documents.

[0033] The document retrieval system 101 can be configured to protect sensitive information in accordance with the present subject matter. For example, the document retrieval system 101 can implement a dynamic data masking process whereby documents can be accessed, masked, and sent to the user computer system 102 as needed. In particular, the document to be sent to the user computer system 102 can contain certain tokens that can be masked before the document is sent out. For example, the token to be masked can be dynamically determined based on the context in which the document is requested or will be sent to the user computer system 102. For example, depending on the data access rules, the same document can be masked differently depending on the location of the user computer system 102 and the user who submitted the query to access the document. For example, European (EU) or United States (US) data can be masked according to the General Data Protection Regulation (GDPR) or federal regulations.

[0034] The user computer system 102 may receive the masked document via the network 103 and store the masked document in a storage device operatively coupled to the user computer system 102 , represented herein by the database 106 .

[0035] Figure 2 is a flow chart of a method for protecting sensitive information in a document according to an example of the present subject matter. For purposes of explanation, Figure 2 The method described in Figure 1 The method is implemented in the system shown in , but is not limited to this implementation method. Figure 2 The method may be executed, for example, by the document retrieval system 101 .

[0036] The inverted text index 109 may be used in step 201 to evaluate one or more statistical measures of index tokens of the inverted text index 109. The statistical measures of the index tokens may include one or a combination of the following: the number of documents in the document set 108 that contain the index token, the frequency of occurrence of the index token in the document set, and the frequency of occurrence of the token type of the index token in the document set. The statistical measures may be evaluated using the information contained in the inverted text index 109. The combination of the number and frequency of documents may be, for example, an array or a vector or a list having two elements including the number and frequency of documents, etc.

[0037] In step 203, the evaluated statistical measure can be used to select a set of candidate tokens that can contain sensitive information from the index tokens of the inverted text index 109. To this end, the statistical measure of each index token of the inverted text index 109 can be compared with a threshold. The threshold can be a configurable threshold. Based on the comparison result, each index token can be selected as a candidate token. For example, if the index token does not appear frequently in the document collection 108, the index token can be selected as a candidate token. To this end, the frequency of occurrence of the index token in the document collection 108 can be compared with a maximum frequency value. If the frequency of co-occurrence is less than the maximum frequency value, the index token can be selected as a candidate token. This can result in N candidate tokens T cand1 ,T cand2 …T candN A collection of .

[0038] In step 205, metadata describing the set of candidate tokens may be extracted from the inverted text index 109. The extracted metadata of the index tokens may include at least the token type of the index token and the document identifier of the document containing the index token.

[0039] The set of candidate tokens may be associated with corresponding token metadata in step 207, wherein the token metadata of the tokens includes the extracted metadata of the tokens. The set of candidate tokens may be stored, for example, in a data store in association with the token metadata. For example, the candidate tokens may be stored together with some metadata about the token type, document frequency, and potential other information such as document metadata (e.g., type) present in the inverted text index, including the document ID of the document in which the token is located.

[0040] In step 209, a request for at least one of the documents 108 may be received. The request may be, for example, a user query that may range from a multi-sentence complete description of an information need to a few words. The request for the document may be received from a user computer system 102. The user computer system 102 may receive a data analysis request, for example, from a user of the user computer system 102. The data analysis request may include natural language data. Natural language processing of the data analysis request may be performed by the user computer system 102, resulting in a request sent by the user computer system 102. The term "user" refers to an entity, such as an individual, another computer, or an application executing on the user computer system 102.

[0041] When the request is received, the requested document may be tokenized to obtain a document token in step 211. This may produce a tokenized document, which may be a document represented as a collection of words (document tokens). This step 211 may be optional if, for example, an inverted text index includes index tokens for the requested document. In this case, these index tokens may be provided as document tokens for the requested document, e.g., without having to re-tokenize the requested document.

[0042] In step 213, the document token of the requested document may be compared with the candidate token set. To this end, the candidate token set may be read from a data storage. This may be advantageous because the data storage may include the latest version of the candidate token set.

[0043] Based on the comparison result, in step 215, a set of document tokens to be masked can be selected from all document tokens of the requested document. The comparison result can, for example, indicate which document tokens are part of the candidate token set. Thus, the selected document token set can include document tokens belonging to the candidate token set. In addition, the comparison result can, for example, indicate document tokens that are semantically related to the candidate token set. These semantically related document tokens can be part of the document token set. For example, if a candidate token indicates the age of a patient (which should be confidential in certain contexts), a document token including a date of birth can be semantically related to the candidate token. For example, information about the semantic relationship of tokens can be part of the token metadata. This step 215 can produce M document tokens T doc1 ,T doc2 …T docM A collection of M document tokens T doc1 ,T doc2 …T docM Each of these can be associated with one or more candidate tokens T cand1 ,T cand2 …T candN For example, two or more document tokens may be associated with different candidate tokens or with the same candidate token. Each document token in the set of M document tokens may be associated with token metadata of the corresponding candidate token.

[0044] At step 217, at least a portion of the document token set including sensitive information may be selected based on the associated token metadata. The at least a portion of the document token set may include L document tokens T doc1 ,T doc2 …T docL , where L≤M. The selection may be performed by processing token metadata associated with the document token set. For example, step 217 may be performed automatically. For example, if a token is associated with a subject / term that may also be found within a management catalog or associated with a business term, then rules defined for the business term may be applied. For example, if a business term is defined as sensitive, then the candidate token may be masked.

[0045] At least a portion of the set of document tokens may be masked in the document in step 219, resulting in a masked document. For example, masking may be performed via hashing. Here, the document tokens may be hashed along with a long-term hash key. The document tokens may then be replaced with the resulting hash values ​​in a masked document sent to the user. Other known methods based on substitution, shuffling, deletion ("nulling"), obfuscation, or perturbation techniques may be used to perform masking.

[0046] The masked document may be provided in step 221. For example, the document retrieval system 101 may send the masked document to the user computer system 102 in response to the request.

[0047] At step 209, steps 211 to 221 may be repeated for each requested document. For example, the requested documents may be processed by steps 211 to 221 simultaneously or in parallel.

[0048] Figure 3 is a flow chart of a method for providing a set of candidate tokens that may include sensitive information according to an example of the present subject matter. For purposes of explanation, Figure 3 The method described in Figure 1 The method is implemented in the system shown in , but is not limited to this implementation method. Figure 3 The method may be executed, for example, by the document retrieval system 101 .

[0049] In step 300, an inverted text index 109 may be provided. The inverted text index 109 is obtained from a document collection, for example, index tokens and related information of the inverted text index are obtained from the document collection.

[0050] The inverted text index 109 may be used in step 301 to evaluate one or more statistical metrics of index tokens of the inverted text index 109. The statistical metrics of the index tokens may include one or a combination of the following: the number of documents in the document collection 108 that contain the index token, the frequency of occurrence of the index token in the document collection, and the frequency of occurrence of the token type of the index token in the document collection. The statistical metrics may be evaluated using information contained in the inverted text index 109.

[0051] The evaluated statistical measure can be used to select a set of candidate tokens that can contain sensitive information from the index tokens of the inverted text index 109 in step 303. To this end, the statistical measure of each index token of the inverted text index 109 can be compared with a threshold. The threshold can be a configurable threshold. Based on the comparison result, each index token can be selected as a candidate token. For example, if the index token does not appear frequently in the document collection 108, the index token can be selected as a candidate token. To this end, the frequency of occurrence of the index token in the document collection 108 can be compared with the maximum frequency value. If the frequency of co-occurrence is less than the maximum frequency value, the index token can be selected as a candidate token.

[0052] Metadata describing the set of candidate tokens may be extracted from the inverted text index 109 in step 305. The extracted metadata of the index tokens may include at least a token type of the index token and a document identifier of a document containing the index token.

[0053] In step 307, the candidate token set may be associated with corresponding token metadata, wherein the token metadata of the token includes the extracted token metadata. The candidate token set may be stored in a data storage.

[0054] It may be determined (query step 308) whether the document set represented by the inverted index has changed. The change may, for example, include adding one or more documents to the document set, removing one or more documents in the document set, and / or changing the content of one or more documents in the document set. If the document set has changed, steps 300 to 308 may be repeated to generate a new inverted index and update the data store with the new determined set of candidate tokens. If the document set has not changed, the last provided or generated set of candidate tokens may be retained.

[0055] Figure 4 is a flow chart of a method for protecting sensitive information in a document according to an example of the present subject matter. For purposes of explanation, Figure 4 The method described in Figure 1 The method is implemented in the system shown in, but is not limited to this implementation method. Figure 4 The method may be executed, for example, by the document retrieval system 101 .

[0056] In step 400, a candidate token set may be provided. The candidate token set is a token that can potentially represent sensitive information. In one example, a candidate token set may be provided using, for example, Figure 3The actual content of the data storage may include the candidate token set provided in step 400. In another example, the candidate token set may be defined by one or more users. The one or more users may be prompted with the document set 108 and asked to provide candidate tokens that may potentially include sensitive information, and the candidate token set may be received from the one or more users at the document retrieval system. Steps 409 to 421 are respectively Figure 2 Steps 209 to 221 of the embodiment of the present invention can be performed. Steps 409 to 421 can be performed by reading the contents of the data memory. Since the contents of the data memory are determined by, for example, Figure 3 As provided in the independent method, the set of candidate tokens provided in step 400 may change over time.

[0057] Figure 5 is a flow chart of a method for protecting sensitive information in a document according to an example of the present subject matter. For purposes of explanation, Figure 5 The method described in Figure 1 The method is implemented in the system shown in, but is not limited to this implementation method. Figure 5 The method may be executed, for example, by the document retrieval system 101 .

[0058] Figure 5 The method is similar to Figure 4 A method, wherein steps 409 to 421 are repeated for each further received request using the candidate token set provided in step 400. For example, as provided by Figure 3 The actual data contents of the data memory populated by the method are available in each iteration.

[0059] Figure 6 Depicted is a block diagram of devices within a system according to an exemplary embodiment. It should be understood that Figure 6 This merely provides an illustration of one embodiment and does not imply any limitations with regard to the environments in which different embodiments may be implemented.Many modifications to the depicted environments may be made.

[0060] As used herein, a device may include one or more processors 102, one or more computer-readable RAMs 04, one or more computer-readable ROMs 06, one or more computer-readable storage media 08, a device driver 12, a read / write driver or interface 14, a network adapter or interface 16, all interconnected by a communication fabric 18. The communication fabric 18 may be implemented with any architecture designed to pass data and / or control information between processors (such as microprocessors, communications and network processors, etc.), system memory, peripheral devices, and any other hardware components within the system.

[0061] One or more operating systems 10 and one or more application programs 11 are stored on one or more computer-readable storage media 08 for execution by one or more processors 02 via one or more corresponding RAMs 04 (which typically include cache memory). In the illustrated embodiment, each of the computer-readable storage media 08 may be a disk storage device of an internal hard drive, a CD-ROM, a DVD, a memory stick, a tape, a disk, an optical disk, a semiconductor storage device such as a RAM, a ROM, an EPROM, a flash memory, or any other computer-readable tangible storage device that can store computer programs and digital information.

[0062] The device as used herein may also include a R / W drive or interface 14 for reading from and writing to one or more portable computer readable storage media 26. The application 11 on the device may be stored on one or more of the portable computer readable storage media 26, read via the corresponding R / W drive or interface 14 and loaded into the corresponding computer readable storage medium 08.

[0063] The apparatus used herein may also include a network adapter or interface 16, such as a TCP / IP adapter card or a wireless communication adapter (such as a 4G wireless communication adapter using OFDMA technology). The application 11 on the computing device can be downloaded to the computing device from an external computer or an external storage device via a network (e.g., the Internet, a local area network or other wide area network or wireless network) and a network adapter or interface 16. The program can be loaded from the network adapter or interface 16 onto a computer-readable storage medium 08. The network may include copper wires, optical fibers, wireless transmissions, routers, firewalls, switches, gateway computers, and / or edge servers.

[0064] As used herein, a device may also include a display screen 20, a keyboard or keypad 22, and a computer mouse or touchpad 24. The device driver 12 interfaces to the display screen 20 for imaging, interfaces to the keyboard or keypad 22, interfaces to the computer mouse or touchpad 24, and / or interfaces to the display screen 20 for alphanumeric character input and pressure sensing for user selection. The device driver 12, R / W driver or interface 14, and network adapter or interface 16 may include hardware and software (stored on computer readable storage medium 08 and / or ROM 06).

[0065] The programs described herein are identified based on the application for which the programs are implemented in a particular exemplary embodiment of the exemplary embodiments. However, it should be understood that any specific program nomenclature herein is used only for convenience, and thus the exemplary embodiments should not be limited to use only in any specific application identified and / or implied by such nomenclature.

[0066] Based on the above, a computer system, method and computer program product have been disclosed. However, many modifications and substitutions may be made without departing from the scope of the exemplary embodiments. Therefore, the exemplary embodiments are disclosed by way of example and not limitation.

[0067] It should be understood that although the present disclosure includes detailed descriptions about cloud computing, the implementation of the teachings cited herein is not limited to cloud computing environments. Instead, exemplary embodiments can be implemented in conjunction with any other type of computing environment now known or later developed.

[0068] Cloud computing is a service delivery model for enabling convenient, on-demand network access to a shared pool of configurable computing resources (e.g., networks, network bandwidth, servers, processing, memory, storage, applications, virtual machines, and services) that can be quickly provisioned and released with minimal management effort or interaction with a service provider. The cloud model can include at least five characteristics, at least three service models, and at least four deployment models.

[0069] Features are as follows:

[0070] On-demand self-service: Cloud consumers can unilaterally provision computing capabilities, such as server time and network storage, automatically on demand without requiring human interaction with the provider of the service.

[0071] Broad Network Access: Capabilities are available over the network and accessed through standard mechanisms that facilitate use by heterogeneous thin or thick client platforms (e.g., mobile phones, laptops, and PDAs).

[0072] Resource pooling: A provider's computing resources are pooled to serve multiple consumers using a multi-tenant model, where different physical and virtual resources are dynamically assigned and reassigned as needed. There is a sense of location independence, as consumers typically have no control or knowledge of the exact location of the provided resources, but may be able to specify the location at a higher level of abstraction (e.g., country, state, or data center).

[0073] Rapid elasticity: Capacity can be quickly and elastically provided (in some cases, automatically) to quickly scale down and quickly released to quickly scale up. To the consumer, the capacity available for provisioning generally appears unlimited and can be purchased in any quantity at any time.

[0074] Measured services: Cloud systems automatically control and optimize resource usage by leveraging metering capabilities at some level of abstraction appropriate to the type of service (e.g., storage, processing, bandwidth, and active user accounts). Resource usage can be monitored, controlled, and reported, providing transparency to both providers and consumers of the utilized services.

[0075] The business model is as follows:

[0076] Software as a Service (SaaS): The capability provided to the consumer is to use the provider's applications running on a cloud infrastructure. The applications are accessible from different client devices through a thin client interface such as a web browser (e.g., web-based email). The consumer does not manage or control the underlying cloud infrastructure including the network, servers, operating systems, storage, or even individual application capabilities, with the possible exception of limited user-specific application configuration settings.

[0077] Platform as a Service (PaaS): The capability provided to consumers is to deploy consumer-created or acquired applications on the cloud infrastructure, which are created using programming languages ​​and tools supported by the provider. Consumers do not manage or control the underlying cloud infrastructure including networks, servers, operating systems, or storage, but have control over the deployed applications and possibly the configuration of the application hosting environment.

[0078] Infrastructure as a Service (IaaS): The capabilities provided to consumers are processing, storage, networking, and other basic computing resources on which consumers can deploy and run arbitrary software, including operating systems and applications. Consumers do not manage or control the underlying cloud infrastructure, but have control over the operating system, storage, deployed applications, and possibly limited control over selected networking components (e.g., host firewalls).

[0079] The deployment model is as follows:

[0080] Private Cloud: Cloud infrastructure is operated solely for an organization. It can be managed by the organization or a third party and can exist on-premises or off-premises.

[0081] Community Cloud: Cloud infrastructure is shared by several organizations and supports a specific community with shared concerns (e.g., mission, security requirements, policies, and compliance considerations). It can be managed by the organization or a third party and can exist on-premises or off-premises.

[0082] Public cloud: Cloud infrastructure is made available to the public or large industry groups and is owned by an organization that sells cloud services.

[0083] Hybrid cloud: A cloud infrastructure consisting of two or more clouds (private, community, or public) that remain unique entities but are bound together by standardized or proprietary technologies that enable data and application portability (e.g., cloud bursting for load balancing between clouds).

[0084] The cloud computing environment is service-oriented, focusing on statelessness, low coupling, modularity, and semantic interoperability. The core of cloud computing is the infrastructure consisting of a network of interconnected nodes.

[0085] See now Figure 7 , depicts an illustrative cloud computing environment 50. As shown, the cloud computing environment 50 includes one or more cloud computing nodes 40, and local computing devices used by cloud consumers (such as, for example, personal digital assistants (PDAs) or cellular phones 54A, desktop computers 54B, laptop computers 54C, and / or automotive computer systems 54N) can communicate with the cloud computing nodes 40. The nodes 40 can communicate with each other. They can be physically or virtually grouped (not shown) in one or more networks, such as the private clouds, community clouds, public clouds, or hybrid clouds described above, or a combination thereof. This allows the cloud computing environment 50 to provide infrastructure, platforms, and / or software as services for which cloud consumers do not need to maintain resources on local computing devices. It should be understood that Figure 7 The types of computing devices 54A-N shown in are intended to be illustrative only, and computing nodes 40 and cloud computing environment 50 may communicate with any type of computerized device over any type of network and / or network-addressable connection (eg, using a web browser).

[0086] See now Figure 8 , showing the cloud computing environment 50 ( Figure 7 ) provides a set of functional abstraction layers. It should be understood in advance that Figure 8 The components, layers, and functions shown in are intended to be illustrative only, and the exemplary embodiments are not limited thereto. As depicted, the following layers and corresponding functions are provided:

[0087] The hardware and software layer 60 includes hardware and software components. Examples of hardware components include: host 61; server 62 based on RISC (Reduced Instruction Set Computer) architecture; server 63; blade server 64; storage device 65; and network and networking components 66. In some embodiments, software components include network application server software 67 and database software 68.

[0088] Virtualization layer 70 provides an abstraction layer from which the following examples of virtual entities can be provided: virtual servers 71 ; virtual storage 72 ; virtual networks 73 , including virtual private networks; virtual applications and operating systems 74 ; and virtual clients 75 .

[0089] In one instance, the management layer 80 may provide the functionality described below. Resource provisioning 81 provides dynamic acquisition of computing resources and other resources for performing tasks within a cloud computing environment. Metering and pricing 82 provides cost tracking when resources are utilized within a cloud computing environment, and bills or invoices for the consumption of these resources. In one example, these resources may include application software licenses. Security provides authentication for cloud consumers and tasks, as well as protection of data and other resources. User portal 83 provides access to the cloud computing environment for consumers and system administrators. Service level management 84 provides cloud computing resource allocation and management so that the required service levels are met. Service level agreement (SLA) planning and fulfillment 85 provides pre-scheduling and procurement of cloud computing resources in anticipation of future requirements for the cloud computing resources based on the SLA.

[0090] The workload layer 90 provides examples of functions that can take advantage of the cloud computing environment. Examples of workloads and functions that can be provided from this layer include: mapping and navigation 91; software development and lifecycle management 92; virtual classroom education delivery 93; data analysis processing 94; transaction processing 95; and sensitive information masking 96.

[0091] The exemplary embodiments may be systems, methods and / or computer program products of any possible level of integrated technical detail. The computer program product may include a computer-readable storage medium (one or more) having computer-readable program instructions thereon, the computer-readable program instructions being used to cause a processor to perform various aspects of the exemplary embodiments.

[0092] Computer readable storage medium can be a tangible device that can retain and store instructions for use by instruction execution devices. Computer readable storage medium can be, for example, but not limited to, electronic storage devices, magnetic storage devices, optical storage devices, electromagnetic storage devices, semiconductor storage devices, or any suitable combination of the foregoing. A non-exhaustive list of more specific examples of computer readable storage medium includes the following: portable computer disk, hard disk, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), static random access memory (SRAM), portable compact disk read-only memory (CD-ROM), digital versatile disk (DVD), memory stick, floppy disk, mechanical encoding device (such as punch card) or a convex structure in a groove with instructions recorded thereon), and any suitable combination of the above. Computer readable storage medium as used herein should not be interpreted as a transient signal itself, such as a radio wave or other freely propagating electromagnetic wave, an electromagnetic wave propagated by a waveguide or other transmission medium (for example, a light pulse by a fiber optic cable), or an electrical signal transmitted by a wire.

[0093] The computer-readable program instructions described herein may be downloaded from a computer-readable storage medium to a corresponding computing / processing device, or downloaded to an external computer or external storage device via a network (e.g., the Internet, a local area network, a wide area network, and / or a wireless network). The network may include copper transmission cables, optical transmission fibers, wireless transmissions, routers, firewalls, switches, gateway computers, and / or edge servers. The network adapter card or network interface in each computing / processing device receives the computer-readable program instructions from the network and forwards the computer-readable program instructions to be stored in a computer-readable storage medium within the corresponding computing / processing device.

[0094] The computer-readable program instructions for performing the operation of the exemplary embodiment may be assembly instructions, instruction set architecture (ISA) instructions, machine instructions, machine-related instructions, microcode, firmware instructions, state setting data, configuration data of an integrated circuit, or source code or object code written in any combination of one or more programming languages, including object-oriented programming languages, such as Smalltalk, C++, etc., and procedural programming languages, such as "C" programming languages ​​or similar programming languages. The computer-readable program instructions may be executed entirely on the user's computer, partially on the user's computer, executed as an independent software package, partially on the user's computer, partially on a remote computer, or completely on a remote computer or server. In the latter case, the remote computer may be connected to the user's computer via any type of network (including a local area network (LAN) or a wide area network (WAN)), or may be connected to an external computer (e.g., via the Internet using an Internet service provider). In some embodiments, an electronic circuit (including, for example, a programmable logic circuit, a field programmable gate array (FPGA), or a programmable logic array (PLA)) may execute computer-readable program instructions to personalize the electronic circuit by utilizing the state information of the computer-readable program instructions, so as to perform various aspects of the exemplary embodiments.

[0095] Various aspects of the exemplary embodiments are described herein with reference to flowchart illustrations and / or block diagrams of methods, devices (systems) and computer program products according to the exemplary embodiments. It should be understood that each block of the flowchart illustration and / or block diagram and the combination of each block in the flowchart illustration and / or block diagram can be implemented by computer-readable program instructions.

[0096] These computer-readable program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing device to produce a machine, so that the instructions are executed by the processor of the computer or other programmable data processing device to create a device for implementing the functions / actions specified in one or more boxes of the flowchart and / or block diagram. These computer-readable program instructions can also be stored in a computer-readable storage medium, which can direct the computer, programmable data processing device, and / or other equipment to function in a specific manner, so that the computer-readable storage medium having the instructions stored therein includes an article of manufacture, which includes instructions for implementing various aspects of the functions / actions specified in one or more boxes in the flowchart and / or block diagram.

[0097] Computer-readable program instructions may also be loaded onto a computer, other programmable data processing apparatus, or other apparatus, so that a series of operational steps are performed on the computer, other programmable apparatus, or other device to produce a computer-implemented process, so that the instructions executed on the computer, other programmable apparatus, or other device implement the functions / actions specified in one or more boxes in the flowchart and / or block diagram.

[0098] The flow charts and block diagrams in the accompanying drawings show the architecture, function and operation of the possible implementation of the system, method and computer program product according to various exemplary embodiments. To this end, each box in the flow chart or block diagram can represent a part of a module, a fragment or an instruction, which includes one or more executable instructions for realizing the logical function of the specification. In some alternative implementations, the function marked in the box may not occur in the order marked in the figure. For example, depending on the function involved, the two boxes shown in succession can actually be performed substantially at the same time, or these boxes can sometimes be performed in the opposite order. It will also be noted that each box in the block diagram and / or flow chart, and the combination of the boxes in the block diagram and / or flow chart can be implemented by a system based on special-purpose hardware, and the system based on special-purpose hardware performs a specified function or action or performs a combination of special-purpose hardware and computer instructions.

Claims

1. A computer-implemented method for protecting sensitive information in a document, the method comprising: Providing an inverted text index for a collection of documents in a computer database; evaluating, via a processor, one or more statistical metrics of index tokens of the inverted text index, the one or more statistical metrics of the corresponding index tokens comprising at least one item selected from the group consisting of: the number of documents in the document collection that contain the index token, the frequency of occurrence of the index token in the document collection, and the frequency of occurrence of a token type of the index token in the document collection; selecting, based on the evaluation of the one or more statistical metrics and via a processor, a set of candidate tokens that may contain sensitive information, the selecting comprising comparing the one or more statistical metrics to corresponding predefined thresholds; extracting, via a processor, metadata describing the candidate token from the inverted text index, wherein the extracted metadata includes at least a token type of the index token and a document identifier of a corresponding document containing the corresponding index token; receiving, via a processor, a request for at least one document; tokenizing, via a processor, the requested at least one document, thereby generating a document token; comparing, via a processor, the document token with the set of candidate tokens; selecting, via a processor, a set of document tokens to mask based on the comparing; selecting, via the processor, at least a portion of the set of document tokens that include sensitive information based on the extracted metadata; masking, via a processor, at least a portion of the set of document tokens in the at least one document, thereby generating one or more masked documents; as well as The one or more masking documents are provided via a processor.

2. The method of claim 1, wherein the extracted metadata further comprises topic metadata, the topic metadata comprising at least one of a topic of the candidate token set and a topic of a document containing the candidate token set.

3. The method of claim 2, further comprising: determining a token class for each token in the set of candidate tokens; inputting the token category into an information management tool; as well as The subject metadata is received as output.

4. The method of claim 1, wherein: The token type includes one or more of a text type and a number type.

5. The method of claim 1, further comprising: storing the set of candidate tokens in association with the extracted metadata in a storage system; evaluating one or more statistical metrics of updated index tokens of the updated inverted text index; selecting an updated set of candidate tokens that may contain sensitive information based on the one or more statistical metrics; extracting updated metadata describing the updated candidate token from the updated inverted text index, wherein the extracted updated metadata includes at least a token type of the updated index token and a document identifier of a corresponding document containing the updated index token; storing the updated set of candidate tokens in association with the extracted updated metadata in the storage system to form an updated storage system; as well as An updated document token is selected for masking from the updated storage system for new document retrieval requests.

6. The method of claim 1, wherein: Selecting at least a portion of the set of document tokens that include sensitive information based on the extracted metadata includes: running a classifier on the extracted metadata to classify the set of document tokens as sensitive tokens or non-sensitive tokens; and The selecting is performed based on the classification.

7. The method of claim 1, further comprising: A corresponding domain represented by the content of the requested at least one document is determined, wherein the document collection represents the determined domain and excludes the requested at least one document.

8. The method of claim 1, wherein the document collection includes the requested at least one document.

9. The method of claim 1, wherein at least one of the requested documents is an unstructured document.

10. The method of claim 1, wherein evaluating one or more statistical metrics of index tokens of the inverted text index and selecting a set of candidate tokens that may contain sensitive information comprises: evaluating, via a processor, a frequency of occurrence of an index token; as well as In response to the occurrence frequency being less than a frequency threshold, evaluating, via a processor, a number of documents containing the index token.

11. The method of claim 1 , wherein the one or more statistical measures of a corresponding index token include a frequency of occurrence of the index token in the document collection, wherein the frequency of occurrence includes: the number of occurrences of the index token divided by the total number of documents in the document collection, or The number of documents containing the index token divided by the total number of documents in the document collection.

12. A computer program product for protecting sensitive information in a document, the computer program product comprising: One or more non-transitory computer-readable storage media and program instructions stored on the one or more non-transitory computer-readable storage media, the program instructions being capable of executing the method of any one of claims 1 to 11.

13. A computer system for protecting sensitive information in a document, the computer system comprising: One or more computer processors, one or more computer-readable storage media, and program instructions stored on one or more of the computer-readable storage media, the program instructions being executed by at least one of the one or more processors capable of performing the method of any one of claims 1 to 11.

Images