On-the-fly Data Masking Proxy for Privacy Compliance
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing data protection methods, such as classical cryptography, are inadequate for ensuring privacy and security of data after decryption and are costly and complex to manage, particularly when handling sensitive information that must comply with varying international privacy laws.
Innovation Solution
A data masking system comprising a web data masking proxy, policy configuration engine, policy store, masking algorithm engine, and report server that de-personalizes data on-the-fly by applying policies based on user authentication and business rules, ensuring compliance with regulations like Gramm-Leach-Bliley and HIPAA, and masking data before it reaches the user.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If classical cryptographic techniques are used to protect data in transit, then data privacy is improved, but data security after decryption deteriorates and key management becomes tedious
Solution Approach 1:
The patent extracts the sensitive personal data elements from the original dataset and replaces them with masked identifiers. This separation allows the data to be used for analytical purposes while the sensitive information is removed, eliminating the need for complex key management while maintaining privacy protection.
Solution Approach 2:
The patent introduces a masking layer as an intermediary between the original data and the user/application. This masking layer acts as a mediator that protects sensitive information while allowing controlled access to non-sensitive data, replacing the need for cryptographic key management.
2Adaptability or versatility
If data is de-personalized to comply with privacy laws, then adaptability to different jurisdictions is improved, but data utility deteriorates
Solution Approach 1:
The patent applies different masking strategies to different data elements based on their sensitivity and the specific compliance requirements of different jurisdictions. Not all data is masked uniformly - only the specific personal identifiers required to be protected are masked, while other data retains its full utility.
Solution Approach 2:
The patent changes the parameters of data representation by replacing personal identifiers with masked versions that retain statistical properties and patterns needed for analysis, while removing the ability to identify individuals. This allows data to maintain its analytical utility while complying with privacy laws.
3Reliability
If data masking is applied to protect sensitive information, then security is improved, but access control complexity increases
Solution Approach 1:
The patent applies data masking in advance, before data access or transmission. By pre-masking the sensitive information, the system eliminates the need for complex runtime access control decisions. The masking is performed once, and the protected data can then be freely accessed within the system without additional security checks.
Data Source
AI summary
An approach is provided for de-personalizing data. Content from a data source is retrieved in response to a request by a user. A rule for masking data (e.g., web data) is determined, wherein the rule is specified in a policy associated with the user. A search, within the content, for data that satisfy the rule is performed. The data that satisfy the rule is masked. The content is then modified with the masked data for delivery to the user.