Dynamic Document Masking for Sensitive Data Sharing
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing systems fail to effectively share documents containing sensitive information among users with varying permissions without compromising readability or exposing sensitive data, often resulting in multiple alternate versions that are difficult to manage and secure.
Innovation Solution
A system that scans documents for sensitive information, generates masked values based on user permissions, and presents a masked version to secondary users while indexing the document, allowing for secure sharing and preserving readability.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If multiple alternate versions of documents are created for different users, then user-specific permission requirements are met, but device complexity and difficulty of management increase
Solution Approach 1:
The patent segments sensitive information within documents by identifying specific data elements (PII, SPI, etc.) and creating masked versions selectively. Instead of creating entirely different documents for each user, the system segments the content and applies different masking levels to specific segments, reducing the number of complete document versions needed while still meeting individual user permission requirements.
Solution Approach 2:
The patent implements dynamic document masking where the same base document can be adapted to different user permissions through programmable masking rules. The system dynamically generates masked versions based on user identity and permission settings, allowing a single document source to serve multiple user requirements without manual creation of each variant.
2Reliability
If sensitive information is masked in documents, then data security is improved, but readability and usability of the document deteriorate
Solution Approach 1:
The patent applies local quality masking by differentiating between sensitive and non-sensitive portions of the document. Instead of masking the entire document, the system identifies specific local elements (such as PII or SPI fields) and applies masking only to those segments, leaving the rest of the document readable and usable for its intended purpose.
Solution Approach 2:
The patent changes parameters of the masking technique based on user permission levels. Different users receive different masking parameters (e.g., complete masking, partial masking, or no masking) applied to the same sensitive information, allowing the system to balance security and readability according to individual user roles and needs.
3Reliability
If documents are shared with users having different permissions, then access control is improved, but the number of alternate versions increases
Solution Approach 1:
The patent creates a universal base document that can serve multiple user permission requirements through dynamic masking. Instead of creating separate documents for each user group, the system uses a single universal document source that can be adapted to different access control requirements through programmable masking, reducing the total quantity of document versions needed.
Solution Approach 2:
The patent uses selective copying where the base document is copied and masked only for distribution to users requiring restricted access. The masking process creates a derivative version only when needed, rather than maintaining multiple separate copies, thereby reducing the overall number of document versions while still providing user-specific access control.
Data Source
AI summary
An embodiment for recursively adapting a sensitive content masking technique is provided. The embodiment may include receiving a request from a primary user to share an original document. The embodiment may also include receiving an identity of a secondary user who needs access to a masked version of the original document. The embodiment may further include scanning the original document for sensitive information and identifying sensitive information in the original document. The identified sensitive information may be displayed to the primary user. The embodiment may also include generating a masked value for each piece of identified sensitive information. The embodiment may further include suggesting one or more groups of secondary users if there are additional secondary users. The embodiment may also include presenting the masked version of the original document to the secondary user. The embodiment may further include indexing the masked version of the original document.