Methods, computer programs, and computer systems for governing a collection of information assets (determining and communicating high-level classifications)

Abstract

To provide a method for governing a set of information assets by using an information governance system, a computer program product and a system.SOLUTION: A method includes applying one or more high level classification allocation rules to one or more information assets by one or more processors. Further, the method includes applying the one or more high level classification transfer rules to one or more information assets with the high level classification allocation provided by one or more processors so as to transfer respective high level classification allocations to one or more upper information assets of the set of information assets with the inside of a containment hierarchy formed by the set of information assets in an upper direction.SELECTED DRAWING: Figure 7

Description

[Technical Field]

[0001] The present invention relates generally to the field of electronic data governance, and more particularly to governing collections of information assets. [Background technology]

[0002] Information governance provides solutions for managing information, especially large amounts of data, so that the risks posed by information are balanced with the value it provides. A consistent and logical framework for handling electronically stored information is required, for example, through information governance policies and procedures. Policies guide appropriate behavior for organizations and employees regarding how to handle electronically stored information. Managed information may include several different information assets. Such information assets may contain each other, resulting in different and potentially interdependent requirements for their handling. Summary of the Invention [Problem to be solved by the invention]

[0003] To enable proper governance, information assets may have to be properly classified, which can be difficult. [Means for solving the problem]

[0004] Various embodiments provide a method for governing a collection of information assets using an information governance system, as well as a computer program product and a computer system for performing such a method, as set forth by the subject matter of the independent claims. Advantageous embodiments are set forth in the dependent claims. The embodiments of the invention, if not mutually exclusive, can be freely combined with one another.

[0005] Aspects of the present invention disclose methods, computer program products, and systems for governing a collection of information assets. The method includes one or more processors identifying a collection of information assets, the collection being at least a partially ordered set, forming a first containment hierarchy. The information assets are provided with information asset type identifiers, and at least some of the information assets are provided with low-level classification assignments to lower-level classes. The method further includes one or more processors determining a set of higher-level classes. The method further includes one or more processors determining a set of high-level classification assignment rules for assigning information assets in the collection of information assets to high-level classes in the set of high-level classes using the information asset type identifiers and low-level classification assignments of each information asset. The method further includes one or more processors determining a set of high-level classification propagation rules for propagating the high-level classification assignments of one or more information assets in the collection of information assets to one or more superior information assets that are subordinate to the one or more superior information assets in the collection of information assets. The method further includes one or more processors applying one or more high-level classification assignment rules in the set of high-level classification assignment rules to one or more information assets in the set of information assets using as input an information asset type identifier and a low-level classification assignment of each of the one or more information assets to provide as output one or more high-level classification assignments of each of the one or more information assets to one or more of the high-level classes in the set of high-level classes.

[0006] In another embodiment, the method further includes one or more processors applying one or more high-level classification propagation rules in the set of high-level classification assignment rules to one or more information assets in the collection of information assets to which a high-level classification assignment has been provided, to propagate each high-level classification assignment upward within the first containment hierarchy to one or more superior information assets in the collection of information assets.

[0007] In an exemplary embodiment, the set of high-level classes is at least a partially ordered set of high-level classes, at least some of which include hierarchical relationships to one another. In another exemplary embodiment, the partially ordered set of high-level classes forms a complete lattice, where each subset of the set has an upper bound. In another exemplary embodiment, providing the set of high-level classification propagation rules includes using the ordering of the high-level classes within the complete lattice to determine one or more high-level classification propagation rules in the set of high-level classification propagation rules.

[0008] In the following, embodiments of the invention will be explained in more detail, by way of example only, with reference to the drawings in which: [Brief explanation of the drawings]

[0009] [Figure 1] FIG. 1 is a schematic diagram illustrating an exemplary computer system according to an embodiment of the present invention. [Figure 2] FIG. 1 is a schematic diagram illustrating an exemplary collection of information assets according to an embodiment of the present invention. [Figure 3] FIG. 1 is a schematic diagram illustrating an exemplary collection of information assets according to an embodiment of the present invention. [Figure 4] FIG. 1 is a schematic diagram illustrating an exemplary collection of high-level classes according to an embodiment of the present invention. [Figure 5] FIG. 1 is a schematic diagram illustrating an exemplary collection of high-level classes according to an embodiment of the present invention. [Figure 6]1 is a schematic diagram illustrating an exemplary information governance system according to an embodiment of the present invention. [Figure 7] 1 is a schematic flow diagram of an exemplary method for governing a collection of information assets according to an embodiment of the present invention. DETAILED DESCRIPTION OF THE INVENTION

[0010] The description of various embodiments of the present invention has been presented for illustrative purposes, but is not intended to be exhaustive or limited to the disclosed embodiments. Many modifications and variations will be apparent to those skilled in the art without departing from the scope and spirit of the disclosed embodiments. The terms used herein have been selected to best explain the principles, practical applications, or technical improvements of the embodiments compared to techniques found in the market, or to enable others skilled in the art to understand the embodiments disclosed herein.

[0011] Embodiments may have the beneficial effect of providing an efficient method for assigning and communicating high-level classification (HLC) assignments in a collection of information assets. This may implement an efficient and effective approach for assigning information assets to high-level classes. Based on high-level classification assignments provided by applying high-level classification assignment rules, embodiments of the present invention may provide high-level classification assignments to superior information assets. To this end, embodiments of the present invention may communicate high-level classification assignments provided using high-level classification assignment rules upward within a first containment hierarchy to superior information assets using high-level classification communication rules. For example, a collection of information assets may be provided in the form of a governed data lake. The assignment and communication of HLC assignments may be implemented using an automated approach.

[0012] The term information asset refers to a collection of data (i.e., a dataset) that contains information. Datasets may be organized according to a hierarchical structure (e.g., a containment hierarchy). Datasets may be used to organize data (e.g., data in a data lake). Datasets at higher hierarchical levels in the hierarchy may contain datasets at lower hierarchical levels. Thus, information assets at higher hierarchical levels (i.e., higher-level information assets) may contain information assets at lower hierarchical levels (i.e., lower-level information assets).

[0013] A low-level class may be defined to classify information assets at a lower hierarchical level in the containment hierarchy of a collection of information assets (e.g., information assets at the lowest hierarchical level). A high-level class may be used to classify information assets at all hierarchical levels in the containment hierarchy of a collection of information assets. In particular, a high-level class may also be used to classify information assets at higher hierarchical levels in the containment hierarchy of a collection of information assets.

[0014] For example, a low-level class may define a specific characteristic of the information contained in an information asset. In a further example, a high-level class may define an abstract characteristic of the information contained in an information asset. At least some of the information assets in a collection of information assets may be provided with a low-level classification assignment. For example, information assets at the lowest hierarchical level of a containment hierarchy for a collection of information assets may be provided with a low-level classification assignment. In various examples, low-level classification assignments to low-level classes may be assigned manually, semi-automatically, or fully automatically.

[0015] A low-level class may be described by a low-level concept. For example, the low-level concept may include concepts such as "customer data" or "reference data." In a further example, the low-level concept describing a low-level class may include so-called business terms. A glossary may be provided to manage the low-level concepts of a collection of low-level classes.

[0016] In an exemplary embodiment, the HLC may use classes defined by regulations and laws (e.g., the Foreign Account Tax Compliance Act (FATCA), the Payment Card Industry Data Security Standard (PCI Compliance), the Health Insurance Portability and Accountability Act (HIPAA), the Financial Services Modernization Act of 1999 (GLBA), the Sarbanes-Oxley Act of 2002 (SOX), the Federal Rules of Civil Procedure, the General Data Protection Regulation (GDPR), or the California Consumer Privacy Act (CCPA)), or classes based on definitions provided by those regulations and laws. Thus, using the HLC, an information governance system may be configured to govern information assets in compliance with those regulations and laws.

[0017] For example, regulations such as the GDPR may require that an HLC consider classes such as "personally identifiable information" (PII) or "sensitive information" (SI). Because of such distinctions, embodiments of the present invention recognize that low-level classifications may not be appropriate, particularly because the conditions for low-level classes may often be subject to change. Even if low-level classes are organized into some kind of hierarchy or category, such a hierarchy often does not have a single point that indicates or can relate to a higher-level class of the HLC. For example, low-level classes may instead be orthogonal to one another (i.e., two different low-level classes may each relate to a different high-level class, but the two different high-level classes are not subclasses of a common high-level class).

[0018] Additionally, HLC assignments may be required to propagate from fine-grained information assets (i.e., lower-level information assets such as data fields or columns) to coarse-grained information assets (i.e., higher-level information assets such as tables, schemas, or databases). For example, in the case of PII, if a lower-level information asset (e.g., a column) contains personally identifiable information and is assigned to a higher-level class PII, then the higher-level information asset (e.g., the table containing the respective column) may also contain personally identifiable information and must likewise be assigned to a higher-level class PII. This type of information may be important for compliance with regulations such as the GDPR or similar rules and laws.

[0019] Embodiments of this approach may enable communication even in non-trivial cases where the HLC assignment of a higher-level information asset (e.g., a table) is not automatically a combination of all the HLC assignments of the lower-level information assets contained in each higher-level information asset (e.g., columns of each table).

[0020] For example, high-level classes may include the class "Personally Identifiable Information" (PII) described above, as well as classes such as "Personally Identifiable Information in the Public Domain" (PIIPD) (i.e., personally identifiable information that can be inferred from publicly available sources), "Sensitive Personally Identifiable Information" (SPII), and "Highly Sensitive Personally Identifiable Information" (HSPII). For example, a first column of a table may contain public domain personally identifiable information and be assigned an HLC PIIDP. A second column of a table may contain highly sensitive personally identifiable information and be assigned an HLC HSPII. A table containing two of the above-described columns may need to be assigned an HLC HSPII rather than a PIIPD.

[0021] Propagating HLCs upward can be a customized (e.g., user-defined) function that maps one or more HLC assignments of one or more information assets at a lower hierarchical level (e.g., column) to one or more HLC assignments of information assets at a higher hierarchical level (e.g., table).

[0022] For example, an HLC assignment of a subordinate information asset may result in an HLC assignment of the superior information asset that differs from the HLC assignment of the subordinate information asset. For example, a first column A may be assigned the HLC assignment PIIPD, while a second column B may be assigned the HLC assignment SPII. A table that includes two columns A and B may be assigned the HLC assignment HSPII because it may only be possible to uniquely identify an individual using the combination of information in columns A and B.

[0023] The methods for governing a collection of information assets described herein may introduce new concepts into information governance systems. The concept of high-level classes, such as PII, PIIPD, SPII, and HSPII, may be introduced to enable HLCs. Furthermore, an extensible rules (e.g., extensible automated rules) mechanism operates at classification time to generate HLCs from low-level class assignments (e.g., from business term assignments and other information). The extensible rules mechanism may also be configured to propagate HLC assignments from fine-grained information assets (e.g., columns) to the coarse-grained information assets (e.g., tables or databases containing the respective columns) that contain the respective fine-grained information assets. Thus, in some examples, HLC assignments may be automatically adapted to remove information assets. In other words, HLC assignments can be automatically adapted to modify low-level class assignments. For example, data included in information assets may be modified, replaced, or additional data may be added, resulting in modified low-level class assignments for the respective information assets. For example, an information asset (e.g., a column) may be populated with data of different syntactic or semantic types, so the low-level class assignment of each information asset, and consequently the HLC assignment of each information asset, may have to be modified as well.

[0024] In various exemplary embodiments, a collection of information assets may be used to govern a data lake. For example, an information governance system for governing a collection of information assets may be configured to provide the following features and functionality:

[0025] A meta data store may be provided that contains all information assets in a collection of information assets (e.g., identifiers for all information assets). For example, a collection of information assets may include all information assets for an enterprise. Each information asset is assigned an information asset type identifier that identifies the information asset type of the respective information asset (e.g., column, table, column, file, etc.). The information assets are organized into a containment hierarchy (i.e., the collection of information assets is at least a partially ordered set that forms a containment hierarchy). For example, a relational database may include a schema that includes tables that include columns.

[0026] In an exemplary embodiment, the information governance system may further include a glossary, such as a hierarchical glossary of low-level classes, that manages the low-level classes and assigns information assets with low-level classifications to the low-level classes. The glossary may define a collection of low-level classes. The low-level classes may describe syntactic properties of the information contained in the information assets (e.g., name, address, postal code, email address, telephone number, credit card number, airport code, etc.). The low-level classes may describe semantic properties of the information contained in the information assets (e.g., business terms that define the business-related properties of each information asset). For example, the glossary may be a business glossary.

[0027] An information governance system can be configured to perform data analysis on data contained in information assets in a collection of information assets. For example, the data can be analyzed through a pipeline of algorithms that perform a low-level classification of the information assets. The low-level classification can include retrieving and classifying the data and / or metadata of each information asset. Information assets can be assigned low-level assignments to low-level classes that are defined by syntactic and / or semantic definitions, or by terms provided by a glossary.

[0028] An information governance system may include automated rules. The automated rules may define the conditions under which they are executed and the actions that result from the execution of each rule. For example, the information governance system may note that the actions defined by an automated rule are executed whenever the conditions defined by each automated rule are met. For example, an automated rule may be defined as follows: if an information asset in the information type column is assigned to class X, then additionally assign the information asset to class Y. For example, class X may be defined by a syntactic definition, while class Y may be defined by a semantic definition provided by a glossary.

[0029] The concept of HLC may be introduced as the first class concept in an information governance system. For example, default HLC concepts (e.g., PII and SPII, as described above) may be provided. Additionally or alternatively, customized (e.g., user-defined) additional high-level classes may be provided for HLC. For example, HLCs may be hierarchical. For example, PII may have children PIIPD, SPII, or HSPII, or a combination thereof, which may be more restrictive than PII.

[0030] An HLC assignment rule may define how HLCs are created from lower-level classifications and assigned based on the lower-level classifications (e.g., base data classifications, term assignments, or both). For example, an HLC assignment rule may use an information asset type along with one or more of the lower-level classifications as input and produce as output a list of one or more HLC assignments to one or more higher-level classes. For example, an HLC assignment rule may be applied after the lower-level classifications have been performed either manually or using an automated process. An HLC assignment rule may be in any format. For example, the rule may be implemented using a simple JAVA script-like programming language. For example, an HLC assignment rule may have the following format: "If a column is assigned to the low-level classes 'PersonName' and 'Customer,' then the column is assigned to the high-level class 'PII.'"

[0031] An HLC propagation rule may define how an information asset's existing HLC assignments are propagated upward (i.e., toward one or more parent information assets that contain the information asset in question). For example, a column may be contained in a table, which in turn is contained in a schema, which in turn is contained in a database, etc. An HLC propagation rule may take an information asset type and one or more HLC assignments of a child information asset as input and provide one or more HLC assignments of one or more parent information assets as output.

[0032] HLC assignments made by HLC propagation rules may be applied to information assets of higher-level information asset types, including the lower-level information asset types of the information asset provided as input to the respective HLC propagation rules. In other words, propagation rules may define how HLC assignments are propagated to the next higher level in the containment hierarchy of information assets. For example, HLC propagation rules may be applied after HLC assignment rules are applied or after a user manually assigns or modifies an HLC assignment to an information asset. As described above, HLC propagation rules may be implemented using a simple JavaScript-like programming language. For example, an HLC propagation rule may have the following format: "If there are one or more information assets of information asset type 'column' assigned to high-level classes 'PII' and 'SPII', then a higher-level information asset of information asset type 'table' containing one or more information assets of each information asset type 'column' must be assigned to high-level class 'HSPII'."

[0033] For example, the HLC assignment rules and HLC propagation rules may be applied whenever an information asset is classified into a lower-level class, either through automated analysis or manually by a user. For example, the HLC assignment rules and HLC propagation rules may be applied whenever a lower-level class is deleted or modified.

[0034] For example, application of one or more high-level classification propagation rules may be performed recursively, hierarchical level by hierarchical level, upward through a first containment hierarchy. This application process may have the beneficial effect of successively assigning each information asset in a collection of information assets to a higher-level class. The HLC assignment of a higher-level information asset may depend on the HLC assignments of the subordinate information assets contained within the higher-level information asset according to the containment hierarchy. Thus, the HLC assignment of a higher-level information asset may be equally restrictive or more restrictive than the HLC assignments of each subordinate information asset.

[0035] For example, the HLC assignment rules and HLC propagation rules may be applied recursively, from the bottom to the top of the containment hierarchy of a collection of information assets: for example, when a lower-level class is removed, all information assets assigned to each lower-level class are determined, the HLC assignment rules are applied (again), and the HLC propagation rules are applied to each information asset and to all siblings (i.e., to all information assets at the same hierarchical level).

[0036] For example, application of one or more high-level classification propagation rules may begin with one or more information assets in a collection of information assets for which a high-level classification assignment is being provided and may end with a top-most information asset at the top of a first containment hierarchy. This process may have the beneficial effect that HLC assignment rules may be applied at information assets throughout the containment hierarchy.

[0037] For example, each information asset may be provided with an HLC assignment. For example, a low-level classification assignment may be applied only to information assets assigned to a particular hierarchical level in the containment hierarchy (i.e., assigned an information asset type identifier for each hierarchical level in the containment hierarchy). For example, a low-level classification assignment may be applied only to information assets at the bottom of the containment hierarchy (e.g., at the lowest level or levels in the containment hierarchy). HLC assignment rules may be applied only to information assets that have been assigned a low-level classification assignment to assign an HLC assignment to each information asset. Thus, HLC propagation rules may be used to assign HLC assignments to all remaining information assets assigned to higher hierarchical levels in the containment hierarchy (i.e., assigned an information asset type identifier for each higher hierarchical level in the containment hierarchy).

[0038] For example, applying the one or more high-level propagation rules may include applying the one or more high-level propagation rules to all information assets in the collection of information assets that are at the same hierarchical level within the first containment hierarchy and share a common ancestor information asset in the collection of information assets. This process may have the beneficial effect of taking into account the HLC assignments of all subordinate information assets contained in the ancestor information asset when propagating the HLC assignments upward to each ancestor information asset.

[0039] For example, a set of high-level classes may include one or more default high-level classes, which may have the beneficial effect of providing standardized high-level classes defined to meet particular requirements (e.g., defined by common rules or needs). For example, providing a set of high-level classes may include receiving one or more customized high-level classes, which may have the beneficial effect of providing individual high-level classes defined for particular individual purposes.

[0040] For example, a set of high-level classification assignment rules may include one or more default high-level classification assignment rules, which may have the beneficial effect of providing standardized high-level classification assignment rules defined to meet specific requirements (e.g., defined by common conventions or needs).

[0041] For example, providing a set of high-level classification assignment rules may include receiving one or more customized high-level classification assignment rules, which may have the beneficial effect of providing individual high-level classification assignment rules defined for specific individual purposes.

[0042] For example, a set of high-level classes may be at least a partially ordered set of high-level classes, at least some of which may have hierarchical relationships with one another, which may have the beneficial effect of allowing the hierarchical relationships to be used to determine (e.g., automatically) HLC propagation rules. For example, a high-level class that is hierarchically superior to one or more lower high-level classes may be more restrictive than the lower high-level classes. Thus, the combination of two or more lower high-level classes may result in a higher high-level class at the next higher level in the hierarchical relationship. If different lower information assets included in a higher-level information asset are assigned to two or more high-level classes at the same hierarchical level within the set of high-level classes, the higher information asset may be assigned to a higher high-level class at the next higher level in the hierarchical relationship that is above the two or more higher-level classes at the same hierarchical level.

[0043] For example, at least a partially ordered set of high-level classes may form a second containment hierarchy, which may have the beneficial effect that all high-level classes may be part of the containment hierarchy and that HLC propagation rules may be determined using the second containment hierarchy. For example, if different subordinate information assets contained in a superior information asset are assigned to two or more high-level classes at the same hierarchical level in the second containment hierarchy, the superior information asset may be assigned to a superior high-level class at the next higher level in the second containment hierarchy above the two or more high-level classes at the same hierarchical level. If all high-level classes in the set of high-level classes are included in the second containment hierarchy, the assignment propagation rules may be determined using the hierarchical structure of the second containment hierarchy, taking into account all high-level classes in the second containment hierarchy.

[0044] For example, providing a set of high-level classification propagation rules may include determining one or more high-level classification assignment rules using an analysis of the second containment hierarchy. This process may have the beneficial effect that the high-level classification propagation rules may be automatically determined using the second containment hierarchy.

[0045] For example, a partially ordered set of high-level classes may form a lattice. For example, a partially ordered set of high-level classes may form a complete lattice, with each subset of the set having an upper bound. Consider a higher-level information asset that includes a set of lower-level information assets assigned to a subset of high-level classes within the set of high-level classes included in the lattice structure. An HLC propagation rule can be determined that defines that the higher-level information asset is assigned to a high-level class within the set of high-level classes that is an upper bound for the subset of the high-level classes. Thus, by identifying the upper bounds for different subsets of high-level classes, an HLC propagation rule can be identified for propagating the HLC assignments.

[0046] A lattice is a partially ordered set, each of whose subsets has a least upper bound, also called an upper bound. In the context of this specification, for example, if there is a subset S of a lattice with high-level classes, there is always one high-level class (not necessarily an element of S) that is the most restrictive high-level class. For example, the upper bound of high-level classes PII and HSPII can be HSPII. For example, the upper bound of high-level classes PII and SPII can be HSPII. In the latter case, the upper bound of the two high-level classes is a different high-level class from the original two high-level classes. Given such a structure, HLC propagation rules can be automatically inferred in that the high-level class of a table is, so to speak, the upper bound of the high-level classes of the columns contained in each table. Furthermore, the high-level class of a higher-level information asset can be the upper bound of all high-level classes of all lower-level information assets contained in each higher-level information asset. Thus, HLC propagation rules do not need to be invoked recursively; rather, a single upper bound identification operation may be sufficient. Thus, it may be much more efficient to provide and / or apply HLC propagation rules that are determined based on the lattice structure of the high-level classes. For example, embodiments of the present invention may use customized (e.g., user-defined) HLC propagation rules and / or HLC propagation rules that are determined (e.g., automatically) using the lattice structure of the high-level classification.

[0047] For example, providing a set of high-level classification propagation rules may include using the ordering of high-level classes within a lattice (e.g., a complete lattice) to determine one or more high-level classification propagation rules in the set of high-level classification propagation rules. This process may have the beneficial effect of using an upper bound to determine the high-level propagation rules. A high-level propagation rule may define that a superior information asset is provided with a high-level classification assignment to a high-level class within a set of high-level classes that is the upper bound of a subset of high-level classes to which information assets included in the superior information asset are assigned. For example, automated determination of HLC propagation rules may be possible. For example, an upper bound may be determined for each combination of high-level classes to which subordinate information assets included in a common superior information asset are assigned. An HLC propagation rule may define that each common superior information asset is assigned to a high-level class that is the upper bound of the combination of high-level classes to which the subordinate information assets are assigned.

[0048] For example, a high-level classification propagation rule may be applied to multiple information assets at different hierarchical levels using a single ceiling-based operation. This process may have the beneficial effect that the ceiling determination may be used to directly determine the propagation of HLC assignments within a first containment hierarchy of a set of information assets to any hierarchical level of the containment hierarchy.

[0049] For example, the set of high-level classification propagation rules may include receiving one or more user-defined high-level classification assignment rules. Thus, embodiments of the present invention may provide customized high-level classification assignment rules that are optimized for the needs of a particular use.

[0050] For example, embodiments of the present invention may apply one or more high-level classification assignment rules and one or more high-level classification propagation rules upon detecting a trigger event, for example, the trigger event may be one of adding an information asset to a collection of information assets, modifying an information asset in the collection of information assets, and removing an information asset from the collection of information assets.

[0051] For example, modifying an information asset may include modifying the content of the information asset and modifying the low-level classification assignments of the information asset.

[0052] For example, modifying a low-level classification assignment may include adding additional low-level classification assignments, deleting low-level classification assignments, and modifying the low-level classes of a low-level classification assignment.

[0053] For example, amending the definitions of low-level classes and / or high-level classes may require immediate action to reclassify all affected information assets to ensure that the classification, particularly the HLC, is always up-to-date.

[0054] For example, processing of information assets may be restricted based on each information asset's high-level classification assignment. This processing may include one or more of storing, archiving, deleting, and accessing. This processing may have the beneficial effect that processing of information assets may depend on the high-level class to which each information asset is assigned. For example, two information assets may each contain information based on which no individual individual can be identified or associated with an individual. However, the combination of information provided by these two information assets may allow an individual individual to be identified or associated with an individual. For example, these two information assets may be stored in different (e.g., independent) storage locations to reduce the risk that an individual individual could be identified if the storage locations were compromised.

[0055] For example, the access rights may define one or more of the following permissions: read permission, modify permission, write permission, and delete permission. Defining access rights may have the beneficial effect of enabling embodiments of the present invention to grant access rights to information assets based on the high-level class to which each information asset is assigned.

[0056] For example, the type of information asset identified by an information asset type identifier may include one or more of a data field, a column, a table, a schema, a database, a machine, and a cluster. For example, the type of information asset identified by an information asset type identifier may include a file or a folder, or both. A folder, also referred to as a directory, may contain a collection of subfolders or a collection of files, or both. Folders allow files to be grouped into separate collections. Directories may be organized in the form of a directory structure, such as a hierarchical tree structure of directories and files in a file system.

[0057] For example, the high level classes may include one or more of the following classes: personally identifiable information, personally identifiable information in the public domain, sensitive personally identifiable information, and highly sensitive personally identifiable information.

[0058] In an exemplary embodiment, implementations of the methods described herein may provide a concept of information assets ordered by a containment hierarchy. Lower-level classes (e.g., business term and / or data-specific classes) may be provided for categorizing information assets. For example, lower-level classes may be used to categorize at least information assets at lower hierarchical levels of the containment hierarchy (e.g., information assets that contain no or few other types of information assets). In a further exemplary embodiment, implementations of the methods described herein may provide a concept of HLCs that are used to categorize information assets such as PII and SPII (e.g., as suggested by rules).

[0059] In additional exemplary embodiments, implementations of the methods described herein may provide a mechanism for extensible automated rules that can assign information assets to HLCs based on low-level classes and other information associated with each information asset, which can propagate HLC assignments from lower-level information assets to higher-level information assets in a containment hierarchy, and can automatically adapt HLC assignments to changes in low-level assignments and other information.

[0060] For example, the computer program product may further include machine-executable program instructions configured to implement any of the embodiments of the method for governing a collection of information assets using the information governance system described herein. For example, the computer system may further be configured to execute any of the embodiments of the method for governing a collection of information assets using the information governance system described herein.

[0061] 1 illustrates an exemplary computer system 100 configured to govern a collection of information assets using an information governance system in accordance with an embodiment of the present invention. The computer system 100 described herein may be any type of computerized system having multiple processor chips, multiple memory buffer chips, and memory. The computer system 100 may be implemented in the form of a general-purpose digital computer, such as, for example, a personal computer, a workstation, or a minicomputer.

[0062] In an exemplary embodiment, from a hardware architecture perspective, as shown in FIG. 1, computer system 100 includes processor 105, memory (main memory) 110 coupled to memory controller 115, and one or more input / output (I / O) devices 10 (or peripherals 145) communicatively coupled via a local I / O controller 135. I / O controller 135 may be, but is not limited to, one or more buses or other wired or wireless connections, as known in the art. I / O controller 135 may have additional elements, such as controllers, buffers (caches), drivers, repeaters, and receivers, to enable communication, but are omitted for simplicity. Additionally, the local interface may include address, control, and / or data connections to enable appropriate communication between the aforementioned components.

[0063] Processor 105 is a hardware device for executing software, particularly software stored in memory 110. Processor 105 may be any custom-made or commercially available processor, a central processing unit (CPU), a coprocessor among several processors associated with computer system 100, a semiconductor-based microprocessor (in the form of a microchip or chipset), a microprocessor, or generally any device for executing software instructions.

[0064] The memory 110 may include any one or combination of volatile memory modules (e.g., random access memory (RAM, such as DRAM, SRAM, SDRAM, etc.)) and non-volatile memory modules (e.g., ROM, erasable programmable read-only memory (EPROM), electronically erasable programmable read-only memory (EEPROM), programmable read-only memory (PROM)). Note that the memory 110 may have a distributed architecture, where additional modules are located remotely from each other but are accessible by the processor 105.

[0065] The software in memory 110 may include one or more separate programs, each of which includes an ordered list of executable instructions for implementing logical functions, particularly functions included in embodiments of the present invention. The executable instructions may be further configured to govern a collection of information assets using an information governance system. For example, the executable instructions may be configured to generate and / or apply HLC assignment rules and HLC propagation rules. The software in memory 110 may further include a suitable operating system (OS) 111. OS 111 essentially controls the execution of other computer programs, possibly including software 112.

[0066] If computer system 100 is a PC, workstation, intelligent device, or the like, the software in memory 110 may further include a basic input / output system (BIOS) 122. The BIOS is a set of essential software routines that initialize and test hardware at startup, start the OS 111, and support the transfer of data between hardware devices. The BIOS is stored in ROM so that it can be executed when computer system 100 is booted.

[0067] When computer system 100 is operating, processor 105 is configured to execute software 112 stored in memory 110, to communicate data to and from memory 110, and to generally control the operation of computer system 100 in accordance with the software. The methods and OS 111 described herein are loaded by processor 105, in whole or in part, but typically the latter, and possibly buffered internally within processor 105, and then executed.

[0068] Software 112 may also be provided for use by or in connection with any computer-related system or method, and stored on any computer-readable medium, such as storage 120. Storage 120 may include disk storage, such as HDD storage. Information assets governed using the information governance system may be stored on computer system 100 using internal storage, such as storage 120, or peripheral storage, such as storage medium 145. Alternatively, or additionally, information assets may be stored on another computer system (e.g., server 200) accessible to computer system 100 via a network (e.g., network 210). Alternatively, or additionally, definitions of information assets and their identifiers and their assignments may be stored on or accessible to computer system 100.

[0069] For example, a conventional keyboard 150 and mouse 155 may be coupled to the input / output controller 135. Other output devices, such as the I / O device 10, may include input devices, such as, but not limited to, a printer, scanner, microphone, etc. Finally, the I / O device 10, 145 may further include devices that communicate both input and output, such as, but not limited to, a network interface card (NIC) or modulator / demodulator (for accessing other files, devices, systems, or networks), a radio frequency (RF) or other transceiver, a telephone interface, a bridge, a router, etc. The I / O device 10, 145 may be any common cryptographic card or smart card known in the art. The computer system 100 may further include a display controller 125 coupled to the display 130. For example, the computer system 100 may further include a network interface for coupling to a network 210, such as an intranet or the Internet. The network 210 may be an IP-based network for communication between the computer system 100 and any external servers, such as the server 200 or other clients, via a broadband connection. The network 210 transmits and receives data between the computer system 100 and the server 200. For example, the network 210 may be a managed IP network operated by a service provider. The network 210 may be implemented wirelessly using wireless protocols and technologies, such as Wi-Fi®, WiMax®, etc. The network 210 may also be a packet-switched network, such as a local area network, a wide area network, a metropolitan area network, the Internet network, or other similar types of network environments.The network may be a fixed wireless network, a wireless local area network (LAN), a wireless wide area network (WAN), a personal area network (PAN), a virtual private network (VPN), an intranet, or other suitable network system, and includes equipment for transmitting and receiving signals.

[0070] 2 illustrates an exemplary collection of information assets 221 according to an embodiment of the present invention. The information assets may be organized to form a containment hierarchy. For example, column 220 may be contained in table 222. Table 222 may be contained in schema 224. Schema 224 may be contained in database 226. Database 226 may be contained in machine 228. Machine 228 may be contained in cluster 229. For example, all information assets at all hierarchical levels may be provided with an information asset type identifier that identifies the information asset type of the respective information asset. For example, information assets at the lowest hierarchical level (e.g., column) may be assigned a low-level classification assignment.

[0071] 3 illustrates an exemplary collection of information assets 221 according to an embodiment of the present invention. Multiple columns 220 may be provided. The columns 220 may be grouped to form tables 222. The tables 222 may be grouped to form schemas 224. The schemas 224 may be grouped to form databases 226. In an exemplary embodiment, multiple databases 226 may be hosted on machines 228. In a further example, the machines 228 may be grouped to form clusters 229.

[0072] 4 illustrates an exemplary collection of high-level classes 230 according to an embodiment of the present invention. In an exemplary embodiment, high-level classes in the collection of high-level classes 230 may include a class 232 having public domain personally identifiable information "PIIPD," a class 234 having personally identifiable information "PII," a class 236 having sensitive personally identifiable information "SPII," and a class 238 having highly sensitive personally identifiable information "HSPII." In an exemplary embodiment, the collection of high-level classes 230 is organized hierarchically. The arrows illustrate the order of the high-level classes.

[0073] In the case of the exemplary type of classes illustrated in FIG. 4, the arrow may indicate "requiring more attention" (i.e., PII data requires more attention than PIIPD). For example, HLC assignments may be propagated recursively, level by level, through the hierarchy of information assets (e.g., from the column level to the table level, then to schema, database, host machine, and beyond). For each information asset, a higher-level class may be determined based on the high-level class to which the subordinate information assets contained within each information asset are assigned using the hierarchical structure of the set of high-level classes 230. For example, the final high-level class in the direction of the arrow and to which one of the subordinate information assets is assigned may be selected. However, more complex relationships between high-level classes may also be considered (e.g., organizing the high-level classes as a complete lattice).

[0074] FIG. 5 illustrates an exemplary set of high-level classes 231 organized as a lattice in accordance with an embodiment of the present invention. In an exemplary embodiment, the high-level classes in the set of high-level classes 231 may include a class 232 with public domain personally identifiable information "PIIPD," a class 234 with personally identifiable information "PII," a class 236 with sensitive personally identifiable information "SPII," and a class 238 with highly sensitive personally identifiable information "HSPII." The high-level classes in the set of high-level classes 231 form a lattice. A lattice is a mathematical structure that is a set of elements such that any two elements always have a unique least upper bound, also called an upper bound, and a unique greatest lower bound, also called a lower bound. A special case of a lattice is a complete lattice, in which every subset of elements has a unique upper bound and a lower bound.

[0075] Using the lattice structure of the set of high-level classes 231 may enable straightforward determination of HLC assignments. Using the lattice, HLC assignments of information assets (e.g., columns, tables, etc.) may be made, and the most applicable HLC assignment may be determined in one step. If the HLC assignments are structured as a complete lattice, the HLC assignment of an information asset (e.g., a database) may be the upper bound of all HLC assignments of all corresponding children (i.e., all information assets, such as schemas, tables, columns, etc.) contained in each information asset for which an HLC assignment is provided.

[0076] Considering the lattice structure of the set of high-level classes 231 illustrated in Figure 5, the arrows illustrate the ordering of the high-level classes. For the example type of class illustrated in Figure 5, the arrows may suggest "requiring more attention" (i.e., PII data requires more attention than PIIPD). To find an upper bound for a subset of N elements, a unique element is determined that is reachable from all N elements (i.e., an upper bound) and not reachable from any other upper bound (i.e., a least upper bound).

[0077] For example, the upper bound of "PIIPD" and "PII" according to the lattice structure shown in Figure 5 is "PII", the upper bound of "PIIPD" and "SPII" is "SPII", the upper bound of "PII" and "SPII" is "HSPII", and the upper bound of "PII", "SPII", "HSPII", and "PIIPD" is "HSPII". "HSPII" is an upper bound of "PII" and "PIIPD", but is not the smallest, since "PII" is at a lower level in the ordering.

[0078] FIG. 6 illustrates an exemplary information governance system 300 according to an embodiment of the present invention. The information governance system 300 may include a set of high-level classes 306, a set of HLC assignment rules 302, and a set of HLC propagation rules. The set of high-level classes 306 may include multiple high-level classes. For example, the set of high-level classes 306 may be at least a partially ordered set of high-level classes. For example, the high-level classes in the set of high-level classes 306 may be hierarchically ordered. For example, the high-level classes in the set of high-level classes 306 may form a containment hierarchy. For example, the high-level classes in the set of high-level classes 306 may form a lattice (e.g., a complete lattice). An HLC assignment rule in the set of HLC assignment rules 302 may be configured to assign information assets to high-level classes in the set of high-level classes 306. The HLC assignment rules 302 may assign information assets to a high-level class within a set of high-level classes based on an information asset type identifier that identifies the information asset type (eg, column) of each information asset.

[0079] Additionally, the HLC assignment rule 302 may use the lower-level classification assignment of each information asset to provide an HLC assignment. An HLC assignment rule in the set of HLC assignment rules 304 may be configured to communicate the HLC assignment of an information asset in the higher-level information asset to which the HLC assignment is provided to one or more higher-level information assets, including the respective higher-level information asset. An information asset type identifier may be used to identify the hierarchical level to which each lower-level and higher-level information asset is assigned. For example, an HLC assignment rule may be used to provide an HLC assignment to an information asset at the lowest hierarchical level of a hierarchical collection of information assets. An HLC assignment rule may be used to provide an HLC assignment to an information asset at a higher level of a hierarchical collection of information assets (i.e., to communicate a lower-level HLC assignment, such as an HLC assignment provided using the HLC assignment rule, to a higher level of a hierarchical collection of information assets).

[0080] 7 illustrates a schematic flow diagram of an exemplary method 700 for governing a collection of information assets in accordance with embodiments of the present invention. In various embodiments, an information governance system (e.g., information governance system 300 operating on or in conjunction with a computing system such as computer system 100) may perform the processing steps of method 700 in accordance with embodiments of the present invention.

[0081] In an exemplary embodiment, the collection of information assets is at least a partially ordered set that forms a containment hierarchy. The information assets are provided with information asset type identifiers. Furthermore, at least some of the information assets are provided with a low-level classification assignment to a low-level class. For example, at least the information assets at the lowest hierarchical level of the containment hierarchy may be assigned the low-level classification assignment. For example, only the information assets at the lowest hierarchical level of the containment hierarchy may be assigned the low-level classification assignment.

[0082] At block 400 of method 700, the information governance system may provide a set of high-level classes. At block 402 of method 700, the information governance system may provide a set of HLC assignment rules. The HLC assignment rules may be configured to assign information assets in the set of information assets to high-level classes in the set of high-level classes using the information asset type identifier and low-level classification assignment of each information asset. At block 404 of method 700, the information governance system may provide a set of one or more HLC propagation rules. The HLC rules may be configured to propagate the HLC assignments of subordinate information assets to the superior information assets that contain each subordinate information asset.

[0083] In block 406 of method 700, the information governance system may apply the HLC assignment rules to information assets. For example, the information governance system may apply the HLC assignment rules to information assets at the lowest hierarchical level of the information asset's containment hierarchy. The information asset type identifier and low-level classification assignment of each information asset may be used as input to provide as output an HLC assignment for each information asset to a high-level class in the set of high-level classes.

[0084] At block 408 of method 700, the information governance system may apply the HLC propagation rules to the information assets. In an example embodiment, the information governance system applies the HLC propagation rules to information assets that have been provided with high-level classification assignments to propagate each information asset's HLC assignment upward within the information asset's containment hierarchy. For example, the information governance system may propagate each information asset's HLC assignment to one or more superior information assets.

[0085] Aspects of the present invention are described herein with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems) and computer program products according to embodiments of the invention. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer-readable program instructions.

[0086] The programs described herein are identified based on the application in which they are implemented in a particular embodiment of the invention. However, it should be understood that any terminology used herein for any particular program is used merely for convenience, and thus the invention should not be limited to use solely in any particular application identified and / or implied by such terminology.

[0087] The present invention may be a system, method, or computer program product, or any combination thereof, at any possible level of technical detail of integration. The computer program product may include one or more computer-readable storage media having computer-readable program instructions for causing a processor to perform aspects of the present invention.

[0088] A computer-readable storage medium may be a tangible device capable of retaining and storing instructions for use by an instruction execution device. A computer-readable storage medium may be, for example, but not limited to, an electronic storage device, a magnetic storage device, an optical storage device, an electromagnetic storage device, a semiconductor storage device, or any suitable combination thereof. A non-exhaustive list of more specific examples of computer-readable storage media includes the following: portable computer diskettes, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), static random access memory (SRAM), portable compact disk read-only memory (CD-ROM), digital versatile disk (DVD), memory sticks, floppy disks, mechanically encoded devices such as punch cards or ridge structures in grooves in which instructions are recorded, and any suitable combination thereof. As used herein, computer-readable storage media should not be construed as ephemeral signals per se, such as radio waves or other freely propagating electromagnetic waves, electromagnetic waves propagating through a waveguide or other transmission medium (e.g., light pulses passing through fiber optic cable), or electrical signals transmitted over wires.

[0089] The computer-readable program instructions described herein may be downloaded from a computer-readable storage medium into each computing / processing device, or may be downloaded to an external computer or storage device over a network, such as the Internet, a local area network, a wide area network, or a wireless network, or a combination thereof. The network may include copper cables, optical fibers, wireless networks, routers, firewalls, switches, gateway computers, or edge servers, or a combination thereof. A network adapter card or network interface in each computing / processing device receives the computer-readable program instructions from the network and transfers the computer-readable program instructions to a computer-readable storage medium within the respective computing / processing device for storage.

[0090] Computer-readable program instructions for carrying out the operations of the present invention may be either source code or object code written in any combination of one or more programming languages, including assembler instructions, instruction set architecture (ISA) instructions, machine instructions, machine-dependent instructions, microcode, firmware instructions, state setting data, configuration data for integrated circuits, or object code written in any combination of one or more programming languages, including object-oriented programming languages ​​such as Smalltalk®, C++, or the like, and procedural programming languages ​​such as the "C" programming language or similar. The computer-readable program instructions may be executed entirely on the user's computer, partially on the user's computer, as a standalone software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or remote server. In the latter case, the remote computer may be connected to the user's computer through any type of network, including a local area network (LAN) or a wide area network (WAN), or the connection may be made to an external computer (e.g., through the Internet using an Internet Service Provider). In some embodiments, electronic circuitry including, for example, a programmable logic circuit, a field programmable gate array (FPGA), or a programmable logic array (PLA) may execute computer readable program instructions by using state information of the computer readable program instructions to individually configure the electronic circuitry to perform aspects of the present invention.

[0091] These computer-readable program instructions may be provided to a processor of a computer or other programmable data processing apparatus to produce a machine, such that the instructions, when executed by the processor of the computer or other programmable data processing apparatus, create means for implementing the functions / acts identified in one or more blocks of the flowcharts and / or block diagrams. These computer-readable program instructions may also be stored on a computer-readable storage medium, capable of directing a computer, programmable data processing apparatus, or other device, or combination thereof, to function in a particular manner, such that the computer-readable storage medium on which the instructions are stored constitutes an article of manufacture containing instructions that implement aspects of the functions / acts identified in one or more blocks of the flowcharts and / or block diagrams.

[0092] The computer-readable program instructions may also be loaded into a computer, other programmable processing device, or other device to cause a computer-implemented process to perform a series of operational steps on the computer, other programmable data processing device, or other device, such that the instructions, which execute on the computer, other programmable processing device, or other device, implement the functions / operations identified in one or more blocks of the flowcharts and / or block diagrams.

[0093] The flowcharts and block diagrams in the figures illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments of the present invention. In this regard, each block in a flowchart or block diagram may represent a module, segment, or portion of instructions comprising one or more executable instructions for implementing a specified logical function. In some alternative implementations, the functions noted in the blocks may occur out of the order noted in the figures. For example, two blocks shown in succession may actually be accomplished as a single step, may be executed simultaneously, substantially simultaneously, partially, or fully in a time-overlapping manner, or the blocks may sometimes be executed in the reverse order, depending on the functionality involved. It should also be noted that each block in the block diagrams and / or flowchart diagrams, and combinations of blocks in the block diagrams and / or flowchart diagrams, may be implemented by a dedicated hardware-based system that performs the specified function or operation or executes a combination of dedicated hardware instructions and computer instructions.

[0094] The description of various embodiments of the present invention has been presented for illustrative purposes, but is not intended to be exhaustive or limited to the disclosed embodiments. Many modifications and variations will be apparent to those skilled in the art without departing from the scope and spirit of the present invention. The terms used herein have been selected to best explain the principles of the embodiments, practical applications, or technical improvements compared to techniques found in the market, or to enable others skilled in the art to understand the embodiments disclosed herein.

[0095] Possible combinations of the above mentioned features may be: 1. A method for governing a collection of information assets using an information governance system, the collection of information assets being at least a partially ordered set forming a first containment hierarchy, the information assets being provided with information asset type identifiers and at least some of the information assets being provided with low-level classification assignments to lower-level classes, the method comprising: Providing a set of high-level classes, providing a set of high-level classification assignment rules for assigning information assets in the set of information assets to high-level classes in the set of high-level classes using the information asset type identifier and low-level classification assignment of each information asset; providing a set of one or more high-level classification propagation rules for propagating high-level classification assignments of one or more information assets in the collection of information assets subordinate to one or more superior information assets in the collection of information assets to the one or more superior information assets; applying one or more high-level classification assignment rules in the set of high-level classification assignment rules to one or more information assets in the set of information assets using as input an information asset type identifier and a low-level classification assignment of each of the one or more information assets to one or more high-level classes in the set of high-level classes as output; applying one or more high-level classification propagation rules in the set of high-level classification assignment rules to one or more information assets in the collection of information assets provided with a high-level classification assignment to propagate each high-level classification assignment upward within the first containment hierarchy to one or more superior information assets in the collection of information assets; 2. A method for managing information governance, including using an information governance system for: 2. The method of item 1, wherein applying one or more high-level classification propagation rules is performed recursively, hierarchical level by hierarchical level, upward through the first containment hierarchy. 3. The method of item 1 or 2, wherein applying one or more high-level classification propagation rules includes applying one or more high-level classification propagation rules to all information assets in the collection of information assets that are at the same hierarchical level within the first containment hierarchy and share a common superior information asset in the collection of information assets. 4. The method of any of items 1 to 3, wherein the set of high-level classes includes one or more default high-level classes. 5. The method of any of items 1 to 4, wherein providing the set of high-level classes includes receiving one or more customized high-level classes. 6. The method of any of items 1 to 5, wherein the set of high-level classification assignment rules includes one or more default high-level classification assignment rules. 7. The method of any of items 1 to 6, wherein providing a set of high-level classification assignment rules includes receiving one or more customized high-level classification assignment rules. 8. The method of any of items 1 to 7, wherein the set of higher-level classes is at least a partially ordered set of higher-level classes, at least some of which include hierarchical relationships to one another. 9. The method of item 8, wherein at least a partially ordered set of higher-level classes forms a second containment hierarchy. 10. The method of items 8 or 9, in which the partially ordered sets of higher-level classes form a complete lattice, each subset of the set having an upper bound. 11. The method of item 10, wherein providing a set of high-level classification propagation rules includes using an order of high-level classes within the complete lattice to determine one or more high-level classification propagation rules in the set of high-level classification propagation rules. 12. The method of any of items 8 to 11, wherein a high-level classification propagation rule is applied to multiple information assets at different hierarchical levels using a single upper-bound based behavior. 13. The method of any of items 1 to 12, wherein the set of high-level classification propagation rules includes receiving one or more user-defined high-level classification assignment rules. 14. A method according to any one of items 1 to 13, wherein applying one or more high-level classification assignment rules and applying one or more high-level classification propagation rules are performed upon detecting a trigger event. 15. The method of item 14, wherein the trigger event is one of adding an information asset to the collection of information assets, modifying an information asset in the collection of information assets, and removing an information asset from the collection of information assets. 16. The method of any of items 1 to 15, wherein processing of information assets is restricted based on each information asset's high-level classification assignment, and processing includes one or more of storing, archiving, deleting, and accessing. 17. The method of any of items 1 to 16, wherein the type of information asset identified by the information asset type identifier comprises one or more of a data field, a column, a table, a schema, a database, a machine, and a cluster. 18. The method of any one of items 1 to 17, wherein the high-level classes include one or more of the following classes: personally identifiable information, personally identifiable information in the public domain, sensitive personally identifiable information, and highly sensitive personally identifiable information. 19. A computer program product including a non-volatile computer-readable storage medium having machine-executable program instructions embodied thereon for governing a collection of information assets using an information governance system, the collection of information assets being at least a partially ordered set forming a containment hierarchy, the information assets being provided with information asset type identifiers, and at least some of the information assets being provided with low-level classification assignments to lower-level classes; When program instructions are executed by a processor in a computer system, the information governance system is used to: provides a set of high-level classes, providing a set of high-level classification assignment rules for assigning information assets in the set of information assets to high-level classes in the set of high-level classes using the information asset type identifier and low-level classification assignment of each information asset; providing a set of one or more high-level classification propagation rules for propagating high-level classification assignments of one or more information assets in the collection of information assets subordinate to one or more superior information assets in the collection of information assets; applying one or more high-level classification assignment rules in the set of high-level classification assignment rules to one or more information assets in the set of information assets using as input the information asset type identifier and the low-level classification assignment of each of the one or more information assets to provide as output one or more high-level classification assignments of each of the one or more information assets to one or more of the high-level classes in the set of high-level classes; applying one or more high-level classification propagation rules in the set of high-level classification assignment rules to one or more information assets in the set of information assets for which a high-level classification assignment is provided, to propagate each high-level classification assignment up within the containment hierarchy to one or more superior information assets in the set of information assets. A computer program product that causes a processor to control a computer system. 20. A computer system for governing a collection of information assets using an information governance system, the collection of information assets being at least a partially ordered set forming a containment hierarchy, the information assets being provided with information asset type identifiers and at least some of the information assets being provided with low-level classification assignments to low-level classes, the computer system comprising a processor and a memory storing machine-executable program instructions; When the program instructions are executed by the processor, the information governance system: provides a set of high-level classes, providing a set of high-level classification assignment rules for assigning information assets in the set of information assets to high-level classes in the set of high-level classes using the information asset type identifier and low-level classification assignment of each information asset; providing a set of one or more high-level classification propagation rules for propagating high-level classification assignments of one or more information assets in the collection of information assets subordinate to one or more superior information assets in the collection of information assets; applying one or more high-level classification assignment rules in the set of high-level classification assignment rules to one or more information assets in the set of information assets using as input the information asset type identifier and the low-level classification assignment of each of the one or more information assets to provide as output one or more high-level classification assignments of each of the one or more information assets to one or more of the high-level classes in the set of high-level classes; applying one or more high-level classification propagation rules in the set of high-level classification assignment rules to one or more information assets in the set of information assets for which a high-level classification assignment is provided, to propagate each high-level classification assignment up within the containment hierarchy to one or more superior information assets in the set of information assets. A computer system that allows a processor to control the computer system in this way. [Explanation of symbols]

[0096] 10 Input / Output (I / O) Devices 100 Computer Systems 105 processors 110 Memory (Main Memory) 111 Operating System (OS) 112 Software 115 Memory Controller 120 storage 122 Basic Input / Output System (BIOS) 125 Display Controller 130 Display 135 Input / Output Controller 145 Peripheral devices and storage media 150 keyboards 155 Mouse 200 servers 210 Network 220 Column 222 Table 224 Schema 226 databases 228 Machine 229 clusters 230 High Level Classes 231 High Level Classes 232 Classes with personally identifiable information "PIIPD" 234 Classes with Personally Identifiable Information (PII) 236 Classes with Confidential Personally Identifiable Information "SPII" 238 Classes with Highly Confidential Personally Identifiable Information (HSPII) 300 Information Governance System 302 HCL Allocation Rules 304 HCL Transmission Rules 306 High Level Classes

Claims

1. 1. A method for governing a collection of information assets, comprising: identifying, by one or more processors, a set of information assets that are at least a partially ordered set forming a first containment hierarchy, the information assets being provided with information asset type identifiers and at least some of the information assets being provided with low-level classification assignments to lower-level classes; determining, by one or more processors, a set of high-level classes; determining, by one or more processors, a set of high-level classification assignment rules for assigning the high-level classes of the set of high-level classes to the information assets of the set of information assets using the information asset type identifier and the low-level classification assignment of each of the information assets; determining, by one or more processors, a set of one or more high-level classification propagation rules for propagating high-level classification assignments of one or more information assets of the set of information assets subordinate to one or more superior information assets of the set of information assets to the one or more superior information assets; applying, by one or more processors, one or more high-level classification assignment rules of the set of high-level classification assignment rules to one or more information assets of the set of information assets using the information asset type identifier and the low-level classification assignment of each of the one or more information assets as inputs to provide as output one or more high-level classification assignments of each of the one or more information assets to one or more of the high-level classes of the set of high-level classes; applying, by one or more processors, one or more high-level classification propagation rules of the set of high-level classification propagation rules to the one or more information assets of the set of information assets for which the high-level classification assignments have been provided. A method comprising:

2. The method described in claim 1, wherein applying the one or more high-level classification propagation rules includes propagating each of the high-level classification assignments upward within the first containment hierarchy to one or more higher-level information assets of the set of information assets.

3. The method of claim 2 , wherein applying the one or more high-level classification propagation rules is performed recursively, hierarchical level by hierarchical level, upward through the first containment hierarchy.

4. 4. The method of claim 2 or 3, wherein applying the one or more high-level classification propagation rules further comprises applying, by one or more processors, the one or more high-level classification propagation rules to all information assets of the set of information assets that are at the same hierarchical level within the first containment hierarchy and that share a common superior information asset of the set of information assets.

5. The method of claim 1 , wherein the set of high-level classes includes one or more default high-level classes.

6. 6. The method of claim 1, wherein determining the set of high-level classes further comprises receiving, by one or more processors, one or more customized high-level classes.

7. The method of claim 1 , wherein the set of high-level classification assignment rules includes one or more default high-level classification assignment rules.

8. determining said set of high-level classification assignment rules; The method of claim 1 , further comprising receiving, by one or more processors, one or more customized high-level classification assignment rules.

9. 9. The method of claim 1, wherein the set of high-level classes is at least a partially ordered set of high-level classes, at least some of the high-level classes including hierarchical relationships to one another.

10. 10. The method of claim 9, wherein the at least partially ordered set of higher-level classes forms a second containment hierarchy.

11. 11. The method of claim 9 or 10, wherein the at least partially ordered sets of higher-level classes form a complete lattice in which each subset of the sets has an upper bound.

12. 12. The method of claim 11, wherein determining the set of high-level classification propagation rules uses an order of the high-level classes in the complete lattice to determine one or more high-level classification propagation rules of the set of high-level classification propagation rules.

13. 13. The method of claim 11 or 12, further comprising applying, by one or more processors, the high-level classification propagation rules to multiple information assets at different hierarchical levels using a single upper-bound based operation.

14. 14. The method of claim 1, wherein applying the one or more high-level classification assignment rules and applying the one or more high-level classification propagation rules is performed in response to detecting a trigger event.

15. 15. The method of claim 14, wherein the trigger event is an event selected from the group consisting of adding an information asset to the collection of information assets, modifying an information asset in the collection of information assets, and removing an information asset from the collection of information assets.

16. 16. The method of claim 1, wherein processing of the information assets is restricted based on a high-level classification assignment of each of the information assets, and the processing includes actions selected from the group consisting of storing, archiving, deleting, and accessing.

17. 17. The method of claim 1, wherein the type of information asset identified by the information asset type identifier is selected from the group consisting of: a data field, a column, a table, a schema, a database, a machine, and a cluster.

18. 18. The method of claim 1, wherein the high-level classes include one or more classes selected from the group consisting of personally identifiable information, personally identifiable information in the public domain, sensitive personally identifiable information, and highly sensitive personally identifiable information.

19. 1. A computer program for governing a collection of information assets, the computer program comprising: identifying a set of information assets, at least a partially ordered set, that form a first containment hierarchy, the information assets being provided with information asset type identifiers and at least some of the information assets being provided with low-level classification assignments to lower-level classes; a procedure for determining a set of high-level classes; determining a set of high-level classification assignment rules for assigning the high-level classes of the set of high-level classes to the information assets of the set of information assets using the information asset type identifier and the low-level classification assignment of each of the information assets; determining a set of one or more high-level classification propagation rules for propagating high-level classification assignments of one or more information assets of the set of information assets subordinate to one or more superior information assets of the set of information assets to the one or more superior information assets; applying one or more high-level classification assignment rules of the set of high-level classification assignment rules to one or more information assets of the set of information assets using the information asset type identifier and the low-level classification assignment of each of the one or more information assets as input to provide one or more high-level classification assignments of each of the one or more information assets to one or more of the high-level classes of the set of high-level classes as output; applying one or more high-level classification propagation rules of the set of high-level classification propagation rules to one or more information assets of the set of information assets for which the high-level classification assignments have been provided; A computer program for executing the above.

20. 1. A computer system for governing a collection of information assets, the computer system comprising: one or more computer processors; one or more computer-readable storage media; program instructions stored on the one or more computer-readable storage media and executed by at least one of the one or more processors; wherein the program instructions include: program instructions for identifying a set of information assets, the set being at least a partially ordered set, forming a first containment hierarchy, the information assets being provided with information asset type identifiers and at least some of the information assets being provided with low-level classification assignments to low-level classes; program instructions for determining a set of high-level classes; program instructions that use the information asset type identifier and the low-level classification assignment of each information asset to determine a set of high-level classification assignment rules for assigning the high-level classes of the set of high-level classes to the information assets of the set of information assets; program instructions for determining a set of one or more high-level classification propagation rules for propagating high-level classification assignments of one or more information assets of the set of information assets subordinate to one or more superior information assets of the set of information assets; program instructions for applying one or more high-level classification assignment rules of the set of high-level classification assignment rules to one or more information assets of the set of information assets using as input the information asset type identifier and the low-level classification assignment of each of the one or more information assets to one or more of the high-level classes of the set of high-level classes; program instructions for applying one or more high-level classification propagation rules of the set of high-level classification propagation rules to one or more information assets of the set of information assets provided with the high-level classification assignments; 1. A computer system comprising:

Images