Protecting sensitive data in documents

Abstract

In one approach, a request for a document is received by a processor. The processor identifies a set of datasets containing a sensitive dataset. The datasets in the set of datasets are related to each other according to a relational model. The processor extracts attribute values ​​from the document. The processor determines that a set of one or more attribute values ​​from the extracted attribute values ​​exists in the set of datasets. The attribute values ​​in the set are values ​​of attributes in an attribute set. The processor determines that one or more entities of the sensitive dataset can be identified based on the relational model relationships between the attributes in the set, where at least some of the attribute values ​​of the one or more entities contain sensitive information. In response to determining that one or more entities can be identified, the processor masks at least some of the set of one or more attribute values ​​in the document.

Description

[Technical Field]

[0001] The present invention relates generally to the field of computer system security, and more specifically to protecting sensitive data within documents. [Background technology]

[0002] Protecting data and keeping sensitive information private is crucial to companies and their customers. However, with the trend toward offloading services to third parties and the cloud, and with the increasing diversity of data, the technical challenges surrounding data privacy continue to grow.

[0003] Hickman et al. (Patent Document 1) (hereinafter Hickman) describe "a system, method, and computer-readable medium for applying policy enforcement rules to sensitive data. An unstructured data repository is maintained for storing unstructured data. A structured data repository is maintained for storing structured data. A request for information is received. The request is analyzed to determine its context. Based on the context, a policy enforcement action associated with generating a response to the request is identified. The policy enforcement action may be excluding sensitive data when generating a response to the request, or masking sensitive data when generating a response to the request, or both. An initial response to the request is generated by retrieving unstructured data from the unstructured data repository. Sensitive data contained in the initial response is identified using structured data maintained in the structured data repository. The policy enforcement action is applied to the sensitive data contained in the initial response to generate a response to the request" (Hickman, Abstract).

[0004] Current approaches parse documents to identify the various types of information contained in the documents and then mask the sensitive information while preserving as much non-sensitive information as possible. One drawback of such current processes is that they only consider the information contained in the documents being searched and ignore other sources of information that the documents may be able to use to reconstruct the masked sensitive information. [Prior art documents] [Patent documents]

[0005] [Patent Document 1] U.S. Patent Application Publication No. 2013 / 0167192 A1 Summary of the Invention

[0006] Aspects of an embodiment of the present invention disclose a computer-implemented method, a computer program product, and a computer system. A request for a document is received by a processor. The processor identifies a set of datasets including a sensitive dataset. The datasets in the set of datasets are interrelated by a relational model. The processor extracts attribute values ​​for the document. The processor determines that an attribute value set exists in the set of datasets, the attribute value set being one or more attribute values ​​from the extracted plurality of attribute values. The attribute value set is the value of each attribute in the attribute set. The processor determines that one or more entities of the sensitive dataset can be identified based on the relational model relationships between attributes in the attribute set. In this case, at least some of the attribute values ​​of the one or more entities contain sensitive information. In response to determining that one or more entities can be identified, the processor masks at least some of the attribute value set consisting of one or more attribute values ​​in the document. Masking one or more attribute values ​​in the document can be particularly advantageous for protecting sensitive data.

[0007] Embodiments of the present invention optionally include an approach for classifying the extracted attribute values ​​and masking each attribute value in the extracted attribute values ​​that is classified as a sensitive attribute value. This may enable embodiments of the present invention to apply a classification-based approach to the requested document. For example, an attribute value may be classified as sensitive based on data access rules. This may be particularly advantageous when the requested document contains both sensitive and non-sensitive information.

[0008] Embodiments of the present invention include approaches for creating an index of a dataset set, such that each attribute value in the dataset set can be associated with a table and a column in the table to which the attribute value belongs, and for querying the index to determine which attribute value sets of one or more extracted attribute values ​​are included in the dataset set. This can enable efficient and simple searches without having to query the entire dataset. This can be particularly advantageous by using a Solr index, a Lucene index, or an Elastic Search index.

[0009] In the following, several embodiments of the invention will be described in more detail, by way of example only, with reference to the drawings, in which: [Brief explanation of the drawings]

[0010] [Figure 1] 1 is a block diagram of a system according to one embodiment of the present invention. [Figure 2] 1 is a flowchart of an approach for protecting sensitive information in a document according to one embodiment of the present invention. [Figure 3A] 1 is a flowchart of an approach for protecting sensitive information according to one embodiment of the present invention. [Figure 3B] 1 illustrates a document according to one embodiment of the present invention. [Figure 3C] 1 illustrates a collection of data sets according to one embodiment of the present invention. [Figure 3D] FIG. 2 illustrates a method for extracting attribute values ​​from a document according to one embodiment of the present invention. [Figure 4] 1 is a flowchart of an approach for determining attribute values ​​to be masked according to one embodiment of the present invention. [Figure 5] 1 illustrates a computer system suitable for implementing one or more embodiments of the present invention. DETAILED DESCRIPTION OF THE INVENTION

[0011] The description of various embodiments of the present invention has been presented for purposes of illustration and is not intended to be exhaustive or limited to the disclosed embodiments. Many modifications and variations will be apparent to those skilled in the art that do not depart from the scope and spirit of the described embodiments. The terminology used herein has been selected to best explain the principles, practical applications, or technical improvements of the embodiments over existing technology, or to enable others skilled in the art to understand the embodiments disclosed herein.

[0012] A document can be structured or unstructured. Unlike structured documents, unstructured documents may contain unstructured information that does not have a predefined data model or is not organized in a predefined manner. This can make such documents more difficult to understand programmatically than data stored in a database in a fielded format or annotated data within a structured document. A document can be, for example, an electronic document. An electronic document can also be electronic media content intended for use in electronic form or as printed output. Electronic documents can include, for example, web pages, documents embedded in web pages, and documents that can be rendered into associated web pages, spreadsheets, emails, books, photos, and presentations by a user agent, such as a document reader, editor, or media player.

[0013] A typical application scenario for a document may involve loading the document and displaying it on an interface to multiple different users. However, this may result in data containing sensitive information being copied to less trusted environments. Sensitive information may include values ​​for attributes (referred to as sensitive attributes). Sensitive attributes may be privacy attributes. Privacy attributes may include social security numbers, passport data, credit card numbers, health record details, and so on, that should not be leaked to untrusted parties. Sensitive information according to the present subject matter may also include values ​​for attributes (referred to as non-sensitive attributes). However, these non-sensitive attribute values ​​may be used to obtain / reconstruct sensitive information. Therefore, by masking at least one sensitive attribute value and possible combinations of non-sensitive attribute values, the present subject matter may enable optimal data masking. The goal of data masking may be to declassify data by hiding or masking sensitive data items so that the entire data remains useful for its intended purpose. Data masking may be performed so that access to the document satisfies predefined data access rules. Data access rules can include governance policies, user access rights, or both. For example, governance rules can require protection of any type of sensitive information, such as personal information.

[0014] Masking of sensitive information can be performed by identifying attribute values ​​in a document that are classified as sensitive and masking those attribute values ​​in the document. This masking method can be referred to as classification-based masking. For example, a document can be parsed to identify multiple different types of information contained in the document. Sensitive information can be masked based on its type. This classification can be performed, for example, by comparing values ​​in the document to a predefined list of sensitive values, by finding values ​​in the document that match a regular expression, or by other classification techniques that indicate the identified values ​​are sensitive (e.g., by finding values ​​that match email addresses or credit card numbers). Masking can be performed while preserving as much non-sensitive information as possible so that the document can still be evaluated by a document requester. Additionally or alternatively, the subject matter can further mask non-sensitive attribute values, where a combination of the non-sensitive attribute values ​​in a document can be used to derive valid sensitive information. This derivation can be possible because other sources of information can be used to reconstruct sensitive information from non-sensitive attribute values. The derived sensitive information may, for example, be part of information already masked in the document, or may be new sensitive information.

[0015] Thus, the present subject matter may provide a computer system that can provide better data protection for unstructured documents by analyzing not only the information directly contained in the document but also indirect information that can be used to reconstruct sensitive information with the help of additional sources of information. To this end, embodiments of the present subject matter may utilize existing data. For example, a computer system may be configured to access and query several data storage systems, e.g., in a cloud environment. The existing data may enable a determination of whether a combination of attribute values ​​in a document may lead to sensitive information. This may be particularly advantageous when the existing data is stored according to a relational model. The relational model may define relationships between datasets within a dataset collection. A relationship between two datasets may be a link from one or more columns / attributes in one dataset to one or more columns in another dataset. In the case of a database, the relationship may be, for example, a first-order foreign key (PK-FK) relationship. In another example, a relationship may include a link from one document to another, such as a link from an XML document pointing to another document containing more information about the same entity, or a link from an unstructured document containing related information. An entity is a distinct and separate entity. An entity has specific attributes or characteristics to which values ​​can be assigned. For example, a student is an entity. Attributes for a student entity may be register number, name, date of birth, and class. An entity may be represented by a corresponding record in a dataset. If data is stored as triplets in a triplet storage system (e.g., RDF data) or if data is stored in a graph DB, a relationship may be a link from one entity to another.Relationships, for example, may enable the joining of datasets within a dataset collection, such that multiple records in the dataset collection representing the same entity may be merged into a new single record in the combined dataset representing the combined information contained in the dataset collection for the same entity. Thus, the combined information may reveal confidential data about the entity. For example, a relational model may define relationships between datasets within a dataset collection, e.g., DS1, DS2, and DS3, as follows: Attribute a1 of dataset DS1 also exists in dataset DS2, and attributes a2 and a3 of dataset DS2 also exist in DS3. That is, dataset DS1 has a relationship with dataset DS2, and dataset DS2 has a relationship with dataset DS3. For example, assume dataset DS3 is a confidential dataset. The relational model may indicate that there are two paths that relate DS1 to DS3 via DS2. The first path, a1 → a2, may be defined by attributes a1 and a2. The second path a1 → a3 may be defined by attributes a1 and a3. The relational model may be used to identify data within a sensitive dataset without having to read the contents of the dataset collection. That is, if the extracted attribute values ​​include values ​​for attributes a1 and a2, a user may use these two attribute values ​​to find one or more corresponding records in dataset DS3 via the relationship. However, if the extracted attribute values ​​include only the value of attribute a1, attribute value a1 may not be used to identify a record in dataset DS3.

[0016] At least a portion of the set of attribute values ​​to be masked may include, for example, all of the attribute values ​​in the set of attribute values. This may enable a reliable and secure approach to protecting confidential information. In another example, the present subject matter may enable the protection of confidential information while preserving as much non-confidential information as possible, so that the document can still be evaluated by a document requester. Therefore, according to one embodiment, masking at least a portion of the set of attribute values ​​includes repeatedly performing the second determining step. In this case, a reduced attribute set is used in each iteration. The reduced attribute set is obtained by removing one or more attributes from the set of attributes. This iteration results in one or more reduced attribute sets that do not enable the identification of one or more entities. In this case, at least a portion of the set of attribute values ​​is the value of the attribute set obtained by subtracting a selected set from the obtained multiple reduced sets. In other words, at least a portion of the set of attribute values ​​to be masked is the remaining value of the attribute set excluding the selected reduced set. For example, assume that the attribute set includes attributes b1, b2, b3, b4, and b5, and the selected reduced set includes attributes b1, b3, and b4. That is, the combination of b1, b3, and b4 does not allow the identification / reconstruction of one or more entities. In this case, at least a part of the set of attribute values ​​to be masked is the value of b2 and b5.

[0017] According to one embodiment, the selected set is the reduced set with the largest number of attributes.

[0018] According to one embodiment, this iteration is performed until the resulting reduced attribute set or sets exceed a predefined minimum number.

[0019] According to one embodiment, the approach further includes classifying the extracted attribute values ​​and masking each extracted attribute value classified as a sensitive attribute value. This may enable embodiments of the invention to apply a classification-based approach to the requested document. For example, attribute values ​​may be classified as sensitive based on data access rules. This is particularly advantageous when the requested document contains both sensitive and non-sensitive information.

[0020] According to one embodiment, the approach further includes creating an index for the dataset set such that each attribute value in the dataset set is associated with the table and column in the table to which the attribute value belongs, and querying the index to determine whether the dataset set contains an attribute value set consisting of one or more attribute values ​​from the extracted plurality of attribute values. This may enable efficient and simple searches without having to query the entire dataset. This may be particularly advantageous by using a Solr index, a Lucene index, or an ElasticSearch index.

[0021] According to one embodiment, the approach further comprises determining the domain that the content of the document represents, where the set of datasets represents the determined domain. This may enable an efficient method, as unnecessary processing of datasets that may belong to completely remote domains may be prevented, as such datasets are likely not to contain the attribute value in question.

[0022] According to one embodiment, the dataset collection is a number of tables in a relational database.

[0023] According to one embodiment, determining the one or more entities includes joining multiple tables of a dataset collection including the attribute value collection and determining whether the join results in one or more records of the sensitive dataset, where the one or more records each represent one or more entities. This may utilize an existing database system to quickly find the one or more entities.

[0024] According to one embodiment, the approach further includes determining whether unmasking one or more attribute values ​​of one or more entities, if one or more entities can be identified, violates data access rules. In this case, if a data access rule is violated, masking is performed. This may be particularly advantageous because classification of sensitive information may be location- and time-dependent. In another example, masking of a set of attribute values ​​may be performed unconditionally if one or more entities can be identified. This is because a sensitive data set is initially classified as sensitive. This is advantageous when the definition of sensitive data is uniform.

[0025] According to one embodiment, the data access rules indicate at least one of: which attribute values ​​may not be accessed from the requester's location in the document; which attribute values ​​may not be copied to the requester's location; and which attribute values ​​may not be accessed by the requester.

[0026] This approach may therefore enable a secure method of communication, for example, to prevent the sending of sensitive information to unauthorized users, which may require masking sensitive information each time a document is loaded and presented to a user who is not entitled to view the personal information.

[0027] 1 is a block diagram illustrating a document serving system 100 according to an example of the present subject matter. The document serving system 100 includes a document retrieval system 101 and a user computer system 102. The document retrieval system 101 and the user computer system 102 may be operable for communication over a network 103. The network 103 may be, for example, the Internet, a local area network, a wide area network, and / or a wireless network.

[0028] The document retrieval system 101 can access documents in a storage, represented by a database 105 operatively coupled to the document retrieval system 101. The database 105 contains a plurality of documents that are submitted to an operating user computer system 102. These documents may be any type of primarily unstructured text, such as newspaper articles, real estate records, or paragraphs in a manual. The document retrieval system 101 may enable document retrieval. Retrieval of a document may be defined as the matching of some user query submitted by the user computer system 102 to one or more documents in the database 105.

[0029] The document retrieval system 101 may be configured to protect sensitive information in accordance with the present subject matter. For example, the document retrieval system 101 may implement a dynamic data masking process, which may access documents, mask the documents, and transmit the masked documents to the user computer system 102 as needed. In particular, documents transmitted to the user computer system 102 may include specific attribute values ​​that may be masked before transmission. Such masked attribute values ​​may be predefined attribute values, dynamically determined attribute values ​​based on the document requester, or both. For example, the masked attribute values ​​may be dynamically determined based on the context in which the document is requested or transmitted to the user computer system 102. For example, data access rules may mask the same document differently depending on the location of the user computer system 102 and the location of the user submitting the query to access the document. For example, European (EU) or United States (US) data may be masked in accordance with the General Data Protection Regulation (GDPR) or Federal Law. Such masked attribute values ​​may further include attribute values ​​specified by the present subject matter.

[0030] The user computer system 102 may receive the masked document via the network 103. The user computer system 102 stores the masked document in storage, represented here by a database 106 operatively coupled to the user computer system 102.

[0031] The document retrieval system 101 may be configured to access one or more data storage systems 107.1-107.n. Each of the data storage systems 107.1-107.n may store a dataset 109.1-109.n, respectively. These datasets may be stored in the data storage systems according to a relational model. Examples of datasets include, but are not limited to, a single file, a collection of files, a portion of a file, a database, a portion of a database, a logical volume(s), a volume group(s), and so on. The data stored in the data storage systems 107.1-107.n may represent a domain set consisting of one or more domains. A domain represents concepts or categories belonging to a part of the world, such as biology or political science. Domains generally model domain-specific definitions of terms. For example, a domain may represent the specific fields of health, advertising, commerce, medicine, and / or biomedicine. The documents stored in database 105 may represent at least one domain of a set of domains. Data storage systems 107.1-107.n may include metadata 111.1-111.n that describe data sets stored in data storage systems 107.1-107.n, respectively.

[0032] Figure 2 is a flowchart of an approach for protecting sensitive information in a document. For purposes of illustration, the approach shown in Figure 2 may be embodied in the system shown in Figure 1, but is not limited to this implementation. The method of Figure 2 may be performed, for example, by document retrieval system 101.

[0033] In step 201, the document retrieval system 101 receives a request for a document. This request may be, for example, a user query, which may range from several sentences to a few words that fully describe an information need. The document retrieval system 101 may receive a request for a document from the user computer system 102. The user computer system 102 may receive, for example, a data analysis request from a user of the user computer system 102. The data analysis request may include natural language data. Natural language processing of the data analysis request may be performed by the user computer system. The request is submitted by the user computer system 102. In another example, a user may use a web search engine of the user computer system 102 to perform a web search. For example, the user may search the web for specific information specified in a textual web search query. The request includes the textual web search query. The term "user" refers to an entity, such as an individual, another computer, or an application running on the user computer system 101.

[0034] Upon receiving the request, the document retrieval system 101 may identify a set of datasets containing sensitive datasets in step 203. This set of datasets is related according to a relational model. Therefore, the document retrieval system 101 may process the request to, for example, determine the domain represented by the requested data. This may be performed, for example, by performing natural language processing of the received request. Based on the determined domain, the document retrieval system 101 may select this set of datasets as datasets for one or more of the data storage systems 107a-107n that have data representing the same determined domain. Furthermore, the document retrieval system 101 may use metadata 111.1-n of the selected database system to determine whether the datasets stored therein contain sensitive information. For example, if the selected data storage system is a database system, the document retrieval system 101 may use metadata 111.1-n to determine whether the datasets contain PII / sensitive fields. In another example, the set of data sets may be all data sets 109.1-n stored in the data storage systems 107.1-n.

[0035] The identified datasets may be further processed by the present approach to enable simple searches within the datasets. This processing may be performed based on the structure of the identified datasets. For example, if the identified datasets are multiple tables in a database, the document retrieval system 101 may catalog all available structured tables in the datasets, classify the data contained in these tables, and establish relationships between these tables (e.g., indicating how these tables can be joined to each other). Furthermore, the document retrieval system 101 may index all values ​​contained in these structured tables, resulting in an index. This indexing may be performed, for example, by loading the contents of the datasets into a Solr index, a Lucene index, or an ElasticSearch index using the Solr API. Thus, the index may be a Solr index.

[0036] In step 205, the document retrieval system 101 may extract attribute values ​​for the requested document from the database 105. In one example, a predefined attribute pool may be provided. The document may be searched to determine whether it contains values ​​for any of the predefined attributes. The found attribute values ​​may be extracted attribute values. In another example, the extraction of attribute values ​​may be performed by implementing rule-based methods, statistical methods, or both. Rule-based methods may include pattern matching. This method may focus on the fields of analysis and pattern matching. This approach may rely on specialized background knowledge. Statistical methods may be based, for example, on a manually labeled training corpus for model training. Examples of statistical methods may include conditional probability methods, hidden Markov models, etc.

[0037] In step 207, the document retrieval system 101 may determine whether a set (referred to as a SET) of one or more of the extracted attribute values ​​is included in the dataset. This may be done, for example, by searching within the identified dataset to determine whether the extracted attribute values ​​belong to the identified dataset. Following this database example, the created index may be queried to determine whether any of the extracted attribute values ​​are found in a dataset within the dataset. For example, if none of the extracted attribute values ​​are included in the dataset, the document retrieval system 101 may perform a classification-based masking method on the requested document, resulting in a masked document being provided.

[0038] The document retrieval system 101 may determine whether one or more entities in the sensitive dataset can be identified based on the relational model relationships between the attributes in the attribute set (step 209). In this case, at least some of the attribute values ​​of the one or more entities may contain sensitive information. Following this database example, the document retrieval system 101 may determine whether the identified rows containing the attribute value set SET can be directly or indirectly linked according to the relationships between the structured tables and associate them with PII / sensitive fields in the sensitive dataset. In one example, the one or more entities may be a single entity. In another example, the one or more entities may include several entities that can reveal sensitive information, for example, about a group of users. The minimum number of entities (N) that can be combined or reconstructed without accessing sensitive information may depend on the appropriate data protection policy. One policy may indicate that accessing information about one individual may violate the access rules, and thus the information may be sensitive information according to the policy. Another policy may consider a privacy violation if the number of resolvable individuals / entities is less than N, where N>2.

[0039] If one or more entities can be identified, the document retrieval system 101 may mask at least a portion of the attribute value set SET in step 211. Furthermore, a classification-based masking approach may be implemented to mask sensitive information based on classification. Implementing two masking methods may be advantageous for the following reasons. For example, if a document masked according to the classification-based method contains information such as "XXXXXXX called our call center on 05 / 01 / 2019 to order 31 shares of "Company A"...," masking the customer name may not be advantageous if another data source exists that may indicate that a single customer ordered 31 shares of "Company A" on 05 / 01 / 2019, and that data source contains the customer name. In other words, a non-sensitive attribute value, such as a date, may be used to reconstruct or find the customer name in another data source. Therefore, this approach may enable proper masking by masking more information (e.g., transaction date) to comply with data protection regulations. However, the type associated with the date may not be confidential.

[0040] In one example, the entire attribute value set SET can be masked. In another example, only one or more attribute values ​​in the attribute value set can be masked such that the remaining unmasked attribute values ​​in the attribute value set do not allow for the identification of one or more entities using inter-entity relationships. For example, masking can be performed by hashing, where one attribute value can be hashed with a long-term hash key. This attribute value can then be replaced with the resulting hash value in the masked document sent to the user. Other known methods based on substitution, shuffling, deletion ("nulling"), obfuscation, or perturbation techniques can be used to perform masking.

[0041] In step 213, the document retrieval system 101 may provide the masked document. For example, the document retrieval system 101 may send the masked document to the user computer system 102 in response to a request.

[0042] 3A is a flowchart of an approach for protecting sensitive information in a document. For illustrative purposes, the approach shown in FIG. 3A may be embodied in the system shown in FIG. 1, but is not limited to this implementation.

[0043] The approach of Figure 3A can be used to protect a document. Figure 3B shows an example of a document 300. The document 300 can be an unstructured document containing clauses, as shown in Figure 3B.

[0044] In step 302, the system identifies, catalogs, and classifies all available structured datasets and the relationships (PF-FK relationships) between them. For example, all available structured datasets may be datasets 109.1 through 109.n in data storage systems 107a through 107.n, respectively. Classifying the structured datasets and identifying all possible relationships within a dataset group may be performed using methods such as Holistic Primary Key and Foreign Key Detection (HoPF). Figure 3C shows an example of a table set 320 and the identified relationships between them. Table set 320 includes table 321, which includes an entity representing a company. For example, table 321 may include attributes such as a company name attribute and a company abbreviation attribute. Table set 320 further includes table 322, which includes multiple entities representing orders. For example, table 322 may include attributes such as an order ID attribute, an access ID attribute, a company abbreviation for the company corresponding to the order, and so on. As shown in FIG. 3C , two tables 321 and 322 are related to each other because they share the same column or attribute, i.e., the company name abbreviation attribute. This relationship may enable links from some entities in table 321 to entities in the other table 322. For example, an order with order ID 50113 is served by a company named "Company D," which can be derived from this relationship. Table collection 320 includes table 323, which contains entities that represent customer accounts. For example, table 323 may include attributes such as a customer ID attribute, an access ID attribute, an account opening date attribute, and so on. As shown in FIG. 3C , two tables 323 and 322 are related to each other because they share the same column or attribute, i.e., the access ID attribute. This relationship may enable links from some entities in table 322 to entities in the other table 323.For example, an order with order ID 50113 fulfilled by "Company D" can be linked to a customer ID of 10100, which can be derived from this relationship. Table collection 320 includes table 324, a sensitive table that contains entities representing customers. For example, table 324 can include attributes such as a customer ID attribute, a name attribute, a street address attribute, and so on. As shown in FIG. 3C , two tables 324 and 323 are related to each other because they share the same column or attribute, i.e., a customer ID attribute. This relationship can enable links from some entities in table 324 to entities in the other table 323. For example, an order with order ID 50113 fulfilled by "Company D" and placed by a customer with customer ID 10100 is an order placed by a customer named Lucy Adler, as can be derived from this relationship. The classification of table collection 320 can at least cover the identification of sensitive information that needs to be protected. For example, the classification process may identify that the information to be protected is a number of different columns in table 324 that represents customer entities.

[0045] In step 304, the system indexes the contents of table collection 320 (e.g., in an index such as a Solr or Elastic Search index). Each cell in each table in table collection 320 may be indexed in a separate document that contains the attribute value and a reference to the column and table where this attribute value can be found. For example, table 322 may be indexed by sending the following document to a Solr engine:

[0046] {“id”:”1”, “table”:”ORDERS”, “column”:”OrderId”, “stringValue”:“50110”} {“id”:”2”, “table”:”ORDERS”, “column”:”OrderId”, “stringValue”:“50111”} … {“id”:”150”, “table”:”ORDERS”, “column”:”Date”, “dateValue”:“2019-03-01”} … {“id”:”170”, “table”:”ORDERS”, “column”:”QTY”, “integerValue”:50} …

[0047] If a more detailed classification of these columns exists, information about this classification can be added to the index to improve the accuracy / performance of subsequent steps.

[0048] Once the structured information index is in place, analysis of the document 300 can be performed. This is done by first running a text analysis algorithm on the unstructured document 300 so that the system can extract attribute values ​​from the document 300 in step 306. As shown in Figure 3D, the contents of the document 300 are shown on the left, and the attribute values ​​330 extracted from the document 300 are shown on the right. The extracted attribute values ​​330 can be, for example, company names, dates, quantities, etc.

[0049] For each attribute value 330 extracted from document 300, the system may query the Solr index to obtain a list of tables and columns that contain the same attribute value, step 308. Once the list of tables that contain any attribute values ​​from document 300 has been identified, the system may calculate the feasibility of how these tables can be joined with each other and with any tables that contain sensitive information, step 310. Following the attribute value example in Figure 3D, the results of the index query show the following:

[0050] Quantity: 50 is found in ORDERS.QTY.

[0051] Company:Company D is found in COMPANIES.CompanyName.

[0052] Date:March is found in ORDERS.Date and ACCOUNTS.Date_open.

[0053] Thus, the identified tables in which attribute values ​​are stored are tables 121, 122, and 123 named ORDERS, COMANIES, and ACCOUNTS. However, previously identified relationships indicate that these tables can be joined to each other and to table CUSTOMERS 324, which contains sensitive information. If a path to sensitive information is identified from any of the tables containing attribute values ​​extracted from documents, a result set can be computed by joining the identified tables 321-323 to the table containing sensitive information using attribute values ​​330 extracted from documents 300 as filter predicates. This result set can be examined to determine whether a governance rule is violated (e.g., an individual can be uniquely identified) or not (the join result does not result in a unique individual).

[0054] In the example of Figure 3C, there is only one way to join the tables together. The result set to test is the result of the following query:

[0055] SELECT COUNT(*) FROM ORDERS INNER JOIN COMPANIES ON COMPANIES.SYMBOL=ORDERS.SYMBOL INNER JOIN ACCOUNTS ON ORDERS.ACCID=ACCOUNTS.ACCID INNER JOIN CUSTOMERS ON ACCOUNTS.CUSTID=CUSTOMERS.CUSTID WHERE ORDERS.QTY=50 AND COMPANIES.COMPANYNAME='COMPANY D' AND MONTH(ORDERS.DATE)=3

[0056] If this query results in only one row from the CUSTOMERS table 324 containing sensitive information, then governance rules would be violated.

[0057] Therefore, to protect the document 300, it may be necessary to mask the extracted attribute values ​​330. This approach may improve masking by determining the minimum number of extracted attribute values ​​that can be masked to prevent reconstruction of the row. To do so, the system may perform a simulation in step 312. This simulation may determine whether a virtual result set would appear such that any extracted attribute value (or combination of attribute values) is masked. Furthermore, it may verify whether the simulated result set violates a governance rule. That is, one of the extracted attribute values ​​may be masked. The remaining attribute values ​​may be used to join tables. The resulting result set may be a virtual result set. To mask the document, an optimal masking method (e.g., masking the minimum number of attribute values ​​possible that would result in a violation of a governance rule) may be selected (e.g., masking is minimized, or attributes relevant to the user's analytical purpose are not masked). The system may then send the resulting masked document to the user in step 314.

[0058] Figure 4 is a flowchart of an approach for determining attribute values ​​to be masked according to one example of the present subject matter. The approach of Figure 4 is a detailed implementation of step 211 of Figure 2. In particular, the approach of Figure 4 allows for the specification of at least a portion of the set of attribute values ​​to be masked in step 211.

[0059] In step 401, the process may select a subset of the attribute value set from the attribute value set. For example, one or more attribute values ​​may be removed from the attribute value set to obtain the subset.

[0060] The process may determine, in step 403, whether one or more entities of the sensitive data set can be identified based on the relational model relationships between the attributes of the subset, where at least some attribute values ​​of the one or more entities contain sensitive information. Step 403 may be performed as described with reference to step 209 of FIG. 2.

[0061] The process may determine whether a stopping criterion has been met in step 405. The stopping criterion may require, for example, that the number of iterations is higher than a threshold. In another example, the stopping criterion may require that the number of selected subsets that do not allow identification of one or more entities in the sensitive data set is greater than a predefined minimum number.

[0062] If the stopping criteria are not met, the process may repeat steps 401-405. If the stopping criteria are met, the process may select one of the selected subsets in step 407 that does not enable identification of one or more entities in the sensitive data set. The subset selected in step 407 may be the subset with the largest number of attribute values. This may enable protection of sensitive information while preserving as much non-sensitive information as possible so that the document can still be evaluated by a document requester. In another example, the subset selected in step 407 may be a randomly selected subset. At least a portion of the set of attribute values ​​masked in step 211 of FIG. 2 may be the set of attributes excluding the subset selected in step 407.

[0063] FIG. 5 depicts a general computerized system 600 suitable for implementing at least some of the method steps included in this disclosure.

[0064] It will be understood that the approaches described herein are at least partially non-interactive and automated by a computerized system, such as a server or embedded system. However, in exemplary embodiments, the methods described herein can be embodied in a (partially) interactive system. These approaches can also be embodied in software 612, 622 (including firmware 622), hardware (processor) 605, or a combination thereof. In exemplary embodiments, the methods described herein are embodied in software as executable programs executed by a special-purpose or general-purpose digital computer, such as a personal computer, workstation, minicomputer, or mainframe computer. Thus, the most general system 600 includes a general-purpose computer 601.

[0065] In exemplary embodiments, from a hardware architecture perspective, as shown in FIG. 5 , a computer 601 includes a processor 605, a memory (main memory) 610 coupled to a memory controller 615, and one or more input and / or output (I / O) devices (or peripherals) 10, 645 communicatively coupled via a local input / output controller 635. The input / output controller 635 may be, but is not limited to, one or more buses or other wired or wireless connections, as known in the art. The input / output controller 635 may include additional components, such as controllers, buffers (caches), drivers, repeaters, and receivers, to enable communication. These additional elements have been omitted for simplicity. Furthermore, a local interface may include address, control, and / or data connections to enable proper communication between the above components. As described herein, the I / O devices 10, 645 may generally include any generalized cryptographic card or smart card known in the art.

[0066] Processor 605 is a hardware device for executing software, particularly software stored in memory 610. Processor 605 can be any custom or commercially available processor, a central processing unit (CPU), a coprocessor among several processors associated with computer 601, a semiconductor-based microprocessor (in the form of a microchip or chip set), a microprocessor, or any general device for executing software instructions.

[0067] The memory 610 may include any one or combination of volatile memory elements (e.g., random access memory (RAM) such as DRAM, SRAM, SDRAM, etc.) and non-volatile memory elements (e.g., ROM, erasable programmable read-only memory (EPROM), electronically erasable programmable read-only memory (EEPROM), programmable read-only memory (PROM)). Additionally, the memory 610 may have a distributed architecture, in which various components are located remotely from each other but are accessible by the processor 605.

[0068] The software in memory 610 may include one or more individual programs, each of which includes an ordered list of executable instructions for implementing logical functions, particularly those included in embodiments of the present invention. In the example of Figure 5, the software in memory 610 includes software 612, e.g., instructions for managing a database, such as a database management system.

[0069] The software in memory 610 will generally further include a suitable operating system (OS) 411, which essentially controls the execution of other computer programs, possibly including software 612 for implementing the methods described herein.

[0070] The approaches described herein may be in the form of a source program, an executable program (object code), a script, or any other entity containing a set of instructions to be performed. In the case of a source program, the program must be translated via a compiler, assembler, interpreter, or the like to properly operate in conjunction with the OS 611. These may or may not be contained in memory 610. Furthermore, the approaches may be written as an object-oriented programming language with data classes and methods, or as a procedural programming language with routines, subroutines, and / or functions.

[0071] In some exemplary embodiments, a conventional keyboard 650 and mouse 655 can be coupled to the input / output controller 635. Other output devices, such as I / O device(s) 645, can include input devices, such as, but not limited to, printers, scanners, microphones, and the like. Finally, I / O device(s) 10, 645 can further include devices for communicating with both input and output, such as, but not limited to, network interface cards (NICs) or modulators / demodulators (for accessing other files, devices, systems, or networks), radio frequency (RF) or other transceivers, telephone interfaces, bridges, routers, and the like. I / O device(s) 10, 645 can be any generalized encryption card or smart card known in the art. System 600 can further include a display controller 625 coupled to a display 630. In some exemplary embodiments, system 600 can further include a network interface for coupling to a network 665. Network 665 may be an IP-based network for communication between computer 601 and any external servers, clients, and the like via a broadband connection. Network 665 transmits and receives data between computer 601 and external systems 30, which may be involved in performing all or some of the steps of the methods described herein. In some exemplary embodiments, network 665 may be a managed IP network managed by a service provider. Network 665 may be embodied wirelessly, for example, using wireless protocols and technologies such as Wi-Fi, WiMAX, etc. Network 665 may also be a packet-switched network such as a local area network, wide area network, metropolitan area network, Internet network, or other similar network environment.The network 665 may be a fixed wireless network, a wireless local area network (LAN), a wireless wide area network (WAN), a personal area network (PAN), a virtual private network (VPN), an intranet, or other suitable network system. The network 665 includes facilities for transmitting and receiving signals.

[0072] If computer 601 is a PC, workstation, intelligent device, or the like, the software in memory 610 may further include a basic input / output system (BIOS) contained in firmware 622. The BIOS is a set of basic software routines that initializes and tests hardware at start-up, starts OS 611, and supports data transfer between hardware devices. The BIOS is stored in ROM so that it can be executed when computer 601 starts up.

[0073] The processor 605 is configured, when the computer 601 is operating, to execute software 612 stored in the memory 610, to exchange data with the memory 610, and to generally control the operation of the computer 601 in accordance with the software. The methods and OS 611 described herein may be read, in whole or in part, but typically in part, by the processor 605, possibly buffered within the processor 605, and then executed.

[0074] 5, the systems and methods described herein may be embodied in software 612, such as in storage 620, for use by or in connection with any computer-related system or method. Storage 620 may include disk storage, such as HDD storage.

[0075] The present invention may be a system, method, and / or computer program product at any possible level of integration of technical details, which may include computer-readable storage medium(s) storing computer-readable program instructions for causing a processor to implement aspects of the present invention.

[0076] A computer-readable storage medium may be a tangible device capable of retaining and storing instructions for use by an instruction execution device. Computer-readable storage media may be, for example, but not limited to, electronic storage devices, magnetic storage devices, optical storage devices, electromagnetic storage devices, semiconductor storage devices, or any suitable combination thereof. A non-exhaustive list of more specific examples of computer-readable storage media includes portable computer diskettes, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), static random access memory (SRAM), portable compact disk read-only memory (CD-ROM), digital versatile disk (DVD), memory stick, floppy disk, mechanically encoded devices such as punch cards or ridge structures in grooves on which instructions are recorded, and any suitable combination thereof. Computer-readable storage media, as used herein, should not be interpreted as signals that are transitory in nature. A transient signal may be a radio wave or other freely propagating electromagnetic wave, an electromagnetic wave propagating through a waveguide or other transmission medium (e.g., a light pulse traveling through a fiber optic cable), or an electrical signal transmitted over an electrical wire.

[0077] The computer-readable program instructions described herein can be downloaded from a computer-readable storage medium into each computing / processing device or downloaded to an external computer or storage device over a network, such as the Internet, a local area network, a wide area network, and / or a wireless network. The network may include copper cables, optical fibers, wireless networks, routers, firewalls, switches, gateway computers, and / or edge servers. A network adapter card or network interface within each computing / processing device receives the computer-readable program instructions from the network and forwards the computer-readable program instructions to a computer-readable storage medium within the computing / processing device for storage.

[0078] Computer-readable program instructions for carrying out the operations of the present invention may be either source code or object code written in any combination of one or more programming languages, including assembler instructions, instruction set architecture (ISA) instructions, machine instructions, machine-dependent instructions, microcode, firmware instructions, state setting data, configuration data for integrated circuits, or object code, including object-oriented programming languages ​​such as Smalltalk, C++, or the like, and procedural programming languages ​​such as the "C" programming language or similar programming languages. The computer-readable program instructions may be executed entirely on the user's computer, partially on the user's computer, as a standalone software package, partially on the user's computer, partially on a remote computer, or entirely on a remote computer or server. In the latter scenario, the remote computer may be connected to the user's computer via any type of network, including a local area network (LAN) or a wide area network (WAN). Alternatively, the connection may be to an external computer (e.g., via the Internet using an Internet service provider). In some embodiments, electronic circuitry, including, for example, a programmable logic circuit, a field programmable gate array (FPGA), or a programmable logic array (PLA), may execute computer-readable program instructions using state information of the computer-readable program instructions to personalize the electronic circuitry to implement aspects of the present invention.

[0079] Aspects of the present invention are described herein with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems) and computer program products according to embodiments of the invention. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be embodied by computer-readable program instructions.

[0080] These computer-readable program instructions may be provided to a computer processor or other programmable data processing device. The computer-readable program instructions, when executed by the computer processor or other programmable data processing device, produce means for implementing the functions / acts specified in one or more blocks of the flowcharts and / or block diagrams. These computer-readable program instructions may also be stored on a computer-readable storage medium. The computer-readable program can cause a computer, programmable data processing device, and / or other device to function in a particular manner, such that the computer-readable storage medium on which the instructions are stored comprises an article of manufacture including a plurality of instructions that embody aspects of the functions / acts specified in one or more blocks of the flowcharts and / or block diagrams.

[0081] The computer-readable program instructions may be loaded into a computer, other programmable data processing apparatus, or other device to cause the computer, other programmable apparatus, or other device to perform a series of operational steps to produce a computer-implemented process, such that the functions / acts specified in one or more blocks of the flowcharts and / or block diagrams are implemented when the instructions are executed on the computer, other programmable apparatus, or other device.

[0082] The flowcharts and block diagrams in these figures illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments of the present invention. In this regard, each block in a flowchart or block diagram may represent a module, segment, or portion of instructions, including one or more executable instructions for implementing the specified logical function(s). In some alternative implementations, the functions shown in the blocks may occur out of the order shown in the figures. For example, two blocks shown in succession may actually be executed substantially concurrently, with partial or complete overlap in time. Or, the blocks may be executed in reverse order, depending on the functionality involved. It should also be noted that each block of the block diagrams and / or flowchart diagrams, and combinations of blocks in the block diagrams and / or flowchart diagrams, may be embodied by a dedicated hardware-based system that performs the specified functions or acts or executes a combination of dedicated hardware and computer instructions.

Claims

1. 1. A computer-implemented method comprising: receiving, by one or more processors, a request for a document; identifying, by one or more processors, a set of datasets including sensitive datasets, the set of datasets being interrelated according to a relational model; extracting attribute values ​​of the document by one or more processors; determining, by one or more processors, that an attribute value set of one or more of the extracted attribute values ​​is present in the data set, wherein each attribute value in the attribute value set is a value of an attribute in the attribute set; determining, by one or more processors, that one or more entities of the sensitive data set are identifiable based on the relational model relationships between attributes in the attribute set, wherein at least some attribute values ​​of the one or more entities contain sensitive information; masking, by one or more processors, at least a portion of a set of one or more attribute values ​​in the document in response to determining that the one or more entities are identifiable; Including, The step of masking the at least a portion of the set of one or more attribute values ​​comprises: a sub-step of iteratively determining that the one or more entities of the sensitive data set are identifiable, At each iteration, a reduced attribute set is used, The reduced attribute set is obtained by removing one or more attributes from the attribute set. the iteration results in one or more reduced attribute sets that hide the identity of one or more entities; selecting, by one or more processors, one reduced attribute set from the plurality of obtained reduced attribute sets, wherein at least some of the attribute value sets are values ​​of attributes in the attribute sets excluding the selected reduced attribute set; Including, method.

2. 2. The computer-implemented method of claim 1, wherein the selected reduced set is the reduced set with the largest number of attributes among the obtained plurality of reduced sets.

3. 3. The computer-implemented method of claim 1, wherein the iterations are performed until the number of reduced attribute sets obtained exceeds a predefined minimum number.

4. classifying the extracted plurality of attribute values ​​by one or more processors; masking, by one or more processors, each attribute value classified as a confidential attribute value among the extracted plurality of attribute values; The computer-implemented method of any one of claims 1 to 3, further comprising:

5. creating, by one or more processors, an index for the set of data sets such that each attribute value is associated with the table and column of the table to which it belongs; querying the index by one or more processors to determine whether the set of attribute values, consisting of one or more attribute values ​​of the extracted plurality of attribute values, is within the set of data; The computer-implemented method of any one of claims 1 to 4, further comprising:

6. 6. The computer-implemented method of claim 5, wherein the index is selected from the group consisting of a Solr index, a Lucene index, and an Elastic Search index.

7. 7. The computer-implemented method of claim 1, further comprising determining, by one or more processors, a domain represented by content of the document, the set of datasets representing the determined domain.

8. The computer-implemented method of any one of claims 1 to 7, wherein the collection of data sets is a table of a relational database.

9. Determining that the one or more entities of the sensitive data set are identifiable includes: a sub-step of combining, by one or more processors, tables of the set of data sets that include the set of attribute values ​​consisting of one or more attribute values; and determining, by one or more processors, whether the combination results in one or more records of the sensitive data set, the one or more records representing the one or more entities.

10. Determining that the one or more entities of the sensitive data set are identifiable includes: determining, by one or more processors, whether unmasking one or more attribute values ​​of said one or more entities violates data access rules; substep, wherein the attribute values ​​of at least some of the one or more entities are values ​​of attributes in the attribute set; 10. A computer-implemented method according to any one of claims 1 to 9, comprising:

11. 11. The computer-implemented method of claim 10, wherein the data access rules indicate a selection from the group consisting of: which attribute values ​​cannot be accessed from the requester's location in the document; which attribute values ​​cannot be copied to the requester's location; which attribute values ​​cannot be accessed by the requester; which attribute values ​​are sensitive but cannot be accessed; and the number of records that should at least be returned by any query filtering on attribute values ​​extracted to prevent identification of individuals.

12. A computer program comprising: On the computer, a plurality of program instructions for receiving a request for a document; a plurality of program instructions for identifying a set of datasets including a sensitive dataset, the set of datasets being related to one another according to a relational model; a plurality of program instructions for extracting attribute values ​​of the document; a plurality of program instructions for determining that an attribute value set of one or more of the extracted attribute values ​​is present in the data set, the attribute values ​​in the attribute value set being values ​​of each attribute in an attribute set; a plurality of program instructions for determining that one or more entities of the sensitive data set are identifiable based on the relational model relationships between attributes of the attribute set, wherein at least some attribute values ​​of the one or more entities include sensitive information; a plurality of program instructions for masking at least a portion of the set of one or more attribute values ​​in the document in response to determining that the one or more entities can be identified; Execute The plurality of program instructions for masking the at least a portion of the set of one or more attribute values ​​include: a plurality of program instructions for iteratively determining whether the one or more entities of the sensitive data set are identifiable, At each iteration, a reduced attribute set is used, the reduced attribute set is obtained by removing one or more attributes from the attribute set; the iteration results in one or more reduced attribute sets that hide the identity of one or more entities; a plurality of program instructions; a plurality of program instructions for selecting one of the obtained reduced sets, wherein the at least some of the attribute value sets are values ​​of attributes in the attribute sets excluding the selected reduced set; Including, Computer program.

13. 13. The computer program product of claim 12, wherein the selected reduced set is the reduced set with the largest number of attributes of the obtained reduced sets.

14. 14. The computer program product of claim 12 or 13, wherein the iterations are performed until the number of reduced attribute sets obtained exceeds a predefined minimum number.

15. classifying the extracted attribute values ​​by one or more processors; masking, by one or more processors, each of the extracted attribute values ​​classified as a sensitive attribute value; 15. The computer program of claim 12, further comprising:

16. a plurality of program instructions collectively stored on the one or more computer-readable storage media for indexing the set of data such that each attribute value is associated with the table to which it belongs and the column of the table; a plurality of program instructions collectively stored on the one or more computer-readable storage media for querying the index to determine if a set of one or more of the extracted attribute values ​​is within the dataset; and 16. The computer program of claim 12, further comprising:

17. 17. The computer program product of claim 16, wherein the index is selected from the group consisting of a Solr index, a Lucene index, and an Elastic Search index.

18. 1. A computer system comprising: one or more computer processors; one or more computer-readable storage media; and a plurality of program instructions collectively stored on the one or more computer-readable storage media for execution by at least one of the one or more computer processors, the plurality of program instructions comprising: a plurality of program instructions for receiving a request for a document; a plurality of program instructions for identifying a set of datasets including a sensitive dataset, the set of datasets being related to one another according to a relational model; a plurality of program instructions for extracting attribute values ​​of the document; a plurality of program instructions for determining that an attribute value set of one or more of the extracted attribute values ​​is present in the data set, wherein each attribute value in the attribute value set is a value of an attribute in the attribute set; a plurality of program instructions for determining that one or more entities of the sensitive data set can be identified based on the relational model relationships between attributes in the attribute set, wherein at least some attribute values ​​of the one or more entities contain sensitive information; a plurality of program instructions for masking at least a portion of the set of one or more attribute values ​​in the document in response to determining that the one or more entities can be identified; Including, The plurality of program instructions for masking the at least a portion of the set of one or more attribute values ​​include: a plurality of program instructions for iteratively determining whether the one or more entities of the sensitive data set are identifiable, At each iteration, a reduced attribute set is used, the reduced attribute set is obtained by removing one or more attributes from the attribute set; the iteration results in one or more reduced attribute sets that hide the identity of one or more entities; a plurality of program instructions; a plurality of program instructions for selecting one of the obtained reduced sets, wherein the at least some of the attribute value sets are values ​​of attributes in the attribute sets excluding the selected reduced set; Including, Computer systems.

Images