Systems and methods for regional data storage and data anonymization

Systems and methods for data localization and anonymization are provided herein. In some embodiments, systems and methods for data localization and anonymization may include receiving a communication request to send a message or establish a call between a first service provider and an end user device associated with an end user, determining that the communication request is associated with a requirement for securing personally identifiable information (PII) of the end user, and processing the communication request based on the requirement for securing the PII of the end user, wherein the requirement includes at least one of (A) localization of the communication request processing or (B) anonymization of any data records associated with the communication request that includes the PII of end user.

BACKGROUND OF THE INVENTION

Field of the Invention

Embodiments of the present invention relate generally to systems and methods for regional data storage and data anonymization. More specifically, the present invention relates to systems and methods for anonymizing stored end user data and ensuring end user data is transmitted and stored on systems pinned to a designated geo-location (i.e., geo-pinning).

Description of the Related Art

End users of mobile applications and online services have to rely on and trust service providers with respect to the end user data they provide. The service providers, in turn, require that the end users provide a lot of personally identifying information (PII) in order to be able to serve the end users properly, and possibly for other reasons. However, the personally identifying information of end users can easily be misused, consciously or unconsciously, but still very little is done to protect the privacy rights of the end users.

Privacy concerns exist wherever personally identifiable information or other sensitive information is collected, stored, used, and finally destroyed or deleted, in digital form or otherwise. Recently, end users, individual countries, and regions (e.g., the EU), have demanded more be done to protect end user data and to contain/store/transmit the data out of the reach of countries/regions whose governmental agencies may access it. In addition, there is a strong demand from service providers who have compliance regulations (e.g., the EU General Data Protection Regulation (GDPR), Health Insurance Portability and Accountability Act (HIPAA) regulations, and the like) that they have to meet with respect to privacy of end user data and storage, transmission, and access of end user data that needs to be geo-located/pinned within specific region/country.

Accordingly, there exists a need in the art for anonymizing stored end user data and ensuring end user data is transmitted and stored on systems pinned to a designated geo-location (i.e., geo-pinning).

SUMMARY OF THE INVENTION

Systems and methods for data localization and anonymization are provided herein. In some embodiments, systems and methods for data localization and anonymization may include receiving a communication request to send a message or establish a call between a first service provider and an end user device associated with an end user, determining that the communication request is associated with a requirement for securing personally identifiable information (PII) of the end user, and processing the communication request based on the requirement for securing the PII of the end user, wherein the requirement includes at least one of (A) localization of the communication request processing or (B) anonymization of any data records associated with the communication request that includes the PII of end user.

DETAILED DESCRIPTION

Embodiments consistent with the present invention are directed to methods and systems for anonymizing stored end user data and ensuring end user data is transmitted and stored on systems pinned to a designated geo-location (i.e., geo-pinning). In some embodiments, end user data may be scrubbed/anonymized by removing the personally identifiable information (PII) from any records either immediately or after a certain time after (e.g., hours, weeks, months, at the time of archival/data warehouse storage, etc.). For example, in some embodiments, there may be a setting or flag on the API call to specify if, when and how to anonymize/store the data. In addition, in some embodiments there may also be a setting or flag on the API call regarding localization of the data to specify if, when and how to transmit and store with specific geo-location/geo-pinning constraints. As used herein, data localization is used to refer to the geolocation of the data (i.e., geo-pinning or regional data storage) as opposed to changing the language of the data and the like. In other embodiments, the API end point (i.e., the URL or address associated with the API end point) could be used to localize/contain data within a given region (e.g., an API call to api-us.nexmo.com will cause data to be contained within the US region while traffic directed to/from api.nexmo.com would be spread across multiple regions.) Various techniques associated with anonymizing stored end user data and/or ensuring end user data is transmitted and stored on systems pinned to a designated geo-location are described below.

Some exemplary embodiments described below are with respect to a mobile Voice over Internet Protocol (VOIP) telecommunication app. However, one skilled in the art will readily recognize from the following description that any application that relies on or uses address books/contact directories may be used in embodiments consistent with the present invention without departing from the principles of the disclosure described herein. For example, access to the cloud address book may be provided via a browser of a user device. When a contact is modified in the cloud address book, the change is further reflected on the user device where the contact is a native contact, and further synchronized with the “owner” of the contact, such as GOOGLE, YAHOO!, or Exchange.

In the following description, the terms VOIP system, VOIP telephony system, IP system and IP telephony system are all intended to refer to a system that connects callers and that delivers data, text and video communications using Internet protocol data communications. Those of ordinary skill in the art will recognize that embodiments of the present invention are not limited to use with IP telephony systems and may also be used in other systems.

FIG. 1illustrates an example communications environment100for anonymizing stored end user data and ensuring end user data is transmitted and stored on systems pinned to a designated geo-location (i.e., geo-pinning). A global cloud communications platform service provider120implements functionality to facilitate communication with users using a variety of different types of communication channels, while anonymizing stored end user data and/or ensuring end user data is transmitted and stored on systems pinned to a designated geo-location. In particular, the global cloud communications platform service provider120manages communications between third parties such as a first service provider or business (e.g., customer140) and users (e.g., user149using end user device150) by means of telephony services and/or SMS services provided by a telephony service provider165(e.g., VOIP and/or PSTN telephony service providers), OTT161(Over the Top) messaging service provider, or other service provider, which are communicatively coupled via networks113. The networks113comprise one or more communication systems that connect computers by wire, cable, fiber optic and/or wireless link facilitated by various types of well-known network elements, such as hubs, switches, routers, and the like. The networks108may include an Internet Protocol (IP) network, a public switched telephone network (PSTN), or other mobile communication networks, and may employ various well-known protocols to communicate information amongst the network resources.

The server system122comprises hardware and software components and databases that can be deployed at one or more data centers (DC)121in one or more geographic locations. The software components can comprise subcomponents that can execute on the same or on different individual data processing apparatus. The primary server system122includes a number of hardware and software modules to facilitate anonymization and geo-pinning (also referred to a localization) of end user data. In some embodiments, the server system122may be disposed at a single data center121, or spread across multiple data centers121. In some embodiments, the primary server system122may include an anonymization manager112, a localization manager114, a communication system116, a rule-based system118, and a machine learning system120. The communication system116facilitates and manages the communications between customers140and end users devices150. In some embodiments, communication system116performs authentication services that authenticates customers140, users149or both with the server system122and, optionally, with a selected service providers161and165. The anonymization manager112manages the anonymization of end user data. In some embodiments described herein, anonymization may include complete removal of PII or the encryption/obfuscation of PII. The localization manager114is responsible for geo-pinning the communication between customers and users and associated storage of end user data associated with those communications. An application programming interface (API) that is part of primary server system122and described in greater detail below can be used by customers' computer systems (e.g., customer140) to communicate with the primary server system122, and more specifically, with the anonymization manager112and/or a localization manager114. The API can be provided to customers in a software library (e.g., in a software development kit or SDK). In some implementations, the API implements a communication protocol that supports message sending and authentication. In some embodiments, the API is provided as part of the communication system116on server system122. The rule-based system118and the machine learning system120, discussed further below, are systems that can be used by the anonymization manager112and/or a localization manager114to assist in determining whether and how to anonymize/localize end user data depending on a variety of factors. The server system122databases comprise, at least, a customer database130and an end user data database132. The databases can reside in one or more physical storage systems. In some embodiments, the customer database130and/or the end user data database132may include customer profiles/settings and end user profiles/settings that specify if and how information is to be localized and/or anonymized.

End user devices150execute one or more applications that allow users149to obtain and send messages, and establish other types of communications such as voice and video calls. The end user device150can be a data processing apparatus such as a mobile phone, a smart watch, a tablet computer, a personal computer, a game console, or an in-car media system. Other examples of client devices are possible.

The customer140computer system sends a request for transmitting a message to the server system122using a communication protocol implemented by the aforementioned API. In some implementations, API requests are submitted by the customer140to the server system122using Hypertext Transfer Protocol (HTTP) where the parameters of the requests are in Extensible Markup Language (XML) or JavaScript Object Notation (JSON) format or using the WebSocket protocol. By way of illustration, a request to send a message to a user can include the following parameters: message content, optional authentication information, identification of the sender and the recipient of the message, and a message content type. Other parameters are possible. The message content type can indicate that the message is text or rich media (e.g., an image, video, audio, executable code, or programming language statements). If the message content type is rich media, the message can in some implementations include an address (e.g., a uniform resource locator address) from which the message can be obtained by the message recipient. That is, the request does not need to include the message content itself. In some embodiments, the sender, the recipient, or both can be specified in a Uniform Resource Identifier (URI) format.

The request may include information that specifies a user identifier of the recipient for the particular service. The user identifier can be a phone number of a user, a user account name (e.g., a text string) for the particular channel, or an identifier that can be mapped to an identifier for the channel. In some implementations, the sender is specified using a key or a Uniform Resource Locator (URL) address of the sender, for example. The server system122receives the request to send the message from the customer140and optionally authenticates the request.

FIG. 2depicts a block diagram of a plurality of data centers121described above grouped by region based on their location. In some embodiments, the grouping of data centers may be by physical geo-location (i.e., all data centers are located within a specific country, group of countries (e.g., the EU), state, etc.) In other embodiments, the grouping of data centers may be a logical grouping based policies/standards implemented by the data centers. Customers within a specific region that requires localization will access data centers within that same region. For example, customers1401within region1would be able access the services of region1data centers (e.g., data centers121in group2021) that have been identified as being geo-located within region12021. Similarly, customers1402within region2would be able access the services of region2data centers (e.g., data centers121in group2022) that have been identified as being geo-located within region2. Requests and API calls to the various data centers may be routed via respective managed DNS systems204n. In some embodiments, the managed DNS system204may be any DNS system that is able to manage DNS traffic (e.g., DYNECT).

For example, Customer1operates in Region1and wishes to communicate with End User1. Customer1may make an API call to server system122to facilitate the communication. If regional data storage is required by any of Customer1, End User1and/or by governmental/regulatory entities within Region1, etc., then the systems associated with Customer1would make the API call to a server system122at a data center121that is geo-located within Region1(e.g., “DC2”). In that scenario, the message is initiated, transmitted and processed by servers within Region1. In some embodiments, the API call is to a specific address (e.g., api-REGION1.server.com) that is directed to a managed DNS system2041that then directs the API call to one of the multiple data centers121geo-located within Region1(e.g., within2021). In other embodiments, if Customer1makes an API call to a different end point that is not geo-located with Region1, they may receive an error message noting that the call could not be processed due to localization rules. The error message may further include information as to what address to use or may re-direct the API call to the appropriate managed DNS system204or data center121based on a determination of the geo-location of at least one of Customer1or End User1.

The above description pertains to the transmission of data within a specific region. When it comes to storage of data, some customers140, end users149, and/or by governmental/regulatory entities may also require that all data be stored within the same region, while other would only require data that includes PII be geo-pinned within a specific region. However, in some embodiments, anonymized data that removes the PII would meet the requirement for some customers and governmental/regulatory entities, which would allow anonymized data to be stored in a global data warehouse208. For example, Customer1from Region1may have regional data storage requirements with respect to data transmission and non-anonymized data. However, Customer1may not have any requirements on where the data is stored once it has been anonymized to remove the PII. Thus, anonymized data from Customer1may be stored in global data warehouse208geo-located in Region2. Region2, however, may require that all data generated by customers within Region2be stored locally, whether anonymized or not.

In some embodiments, the data may be anonymized immediately, or after a certain time period (e.g., after 1 month, 1 week, 1 day, etc.). The data would be stored locally until such time it is anonymized and can also be stored in the global data warehouse208. In some embodiments, anonymization of the data may be set as a preference on the customer's140account. In other embodiments, anonymization may be set as a flag on the initial API call.

Exemplary use cases for the anonymization and localization of data are provided below. In a first example, a national government health agency may have many IT providers who must comply with national or regional (e.g., EU) data protection laws. The agency and/or IT providers may be customers140of the global cloud communications platform service provider120, and use the services of the global cloud communications platform service provider120to send text messages or provide automated voice communications to patients or employees.

The national government health agency may impose various anonymization/regional data storage requirements on their IT providers and the global cloud communications platform service provider120. In this example, those requirements may include the following: (A) Any PII data which transits outside the EU, whether temporarily or for storage, triggers a review of all systems used; (B) if PII data is stored within the EU, no review is required; (C) any PII data should be encrypted; and (D) implementation of a data retention policy that removes non-anonymized data after one month.

In embodiments consistent with the present invention, the above requirements are met by the global cloud communications platform service provider120by performing the following:Set customer account preference to anonymize data after one monthSet customer account preference to only use EU datacentersOnly accept the customer's API requests at an EU API endpoint, and reject any customer API requests at other API endpoints that are not located in the EUStore customer non-anonymized data only in an EU datacenterAutomatically delete customer's non-anonymized data after one monthStore an anonymized version of the data in a global central data warehouse208for billing, reporting and analytics use

In a second example, a global bank customer140wishes to send messages to end user devices150of end users149located in different countries. To ensure compliance with regional data protection laws, the global bank customer140does not want any messages to be saved. Thus, the global bank customer140requires that end user data is deleted as soon as a message has been processed successfully.

In embodiments consistent with the present invention, the above requirements of the global bank customer140are met by the global cloud communications platform service provider120by (A) not storing any data records containing non-anonymized data, and (B) storing only an anonymized version of the data in a global central data warehouse208for reporting and analytics use.

In a third example, a U.S. based global social network customer140wishes to ensure their user data stays within the U.S., for privacy and/or security reasons. The global social network customer140requires that no end user PII data transits outside of the U.S. and the no end user PII data is stored outside of the U.S.

In embodiments consistent with the present invention, the above requirements of the global bank customer140are met by the global cloud communications platform service provider120by performing the following:Set customer account preference to only use US datacentersOnly accept the customer's API requests at an US API endpoint, and reject any customer API requests at other API endpoints that are not located in the USStore customer non-anonymized data only in an US datacenterAutomatically delete customer's non-anonymized data after one monthStore an anonymized version of the data in a global central data warehouse208for reporting and analytics use.

Exemplary methods that may be performed by one or more elements of the server system122of global cloud communications platform service provider120for anonymizing stored end user data and ensuring end user data is transmitted and stored on systems pinned to a designated geo-location are described below with respect to flowchart300ofFIG. 3.FIG. 3depicts further details with respect to a regional data center121and the systems/services provided by the regional data center121.

InFIG. 3, the method starts at302when the customer140receives the address of the appropriate regional data center121to use via the managed DNS service204. At304, the customer140sends a communication request to a system server122in the regional data center1211based on the address received from the managed DNS service204. More specifically, the request is sent to the appropriate application252on an application server250within data center121, which is part of system server122described with respect toFIG. 1, based on the identity of the customer140and their associated settings/rule, and the address specified in the request. The communication request may be a request to establish a call, or other form of communication, between the customer140and the end user149. In some embodiments, the communication request may be a request to establish a call, or other form of communication, between multiple end users149.

In some embodiments, the request may include PII data about the end user and flags that trigger performance of localization and anonymization methods and systems. The PII data may include some or all of the following information: the end user's name, phone number, OTT chat username, previous names used, physical or mailing addresses (residence or otherwise), date of birth, details of relatives, personal health details, personal employment details, personal relationship details, personal financial details, personal contact details such as email address, or anything else that could be transmitted in a message or call. In other embodiments, the call request may only include an account number and/or phone number which is then used to retrieve the PII of the end user required to process the request. In some embodiments, the PII may be provided in a separate chat session, text message, or call with the customer140or end user150. In some embodiments, if the PII is provided in a call, a recording of the call may be saved and the PII may be extracted from the recording. In some embodiments, the system server122may reject the request if localization rules are in effect for that customer140, and the request came from outside an approved region. The request may be a call request or a request to transmit a message between customer140and end-user device150. The request may be in the form of an API call transmitted using HTTP or WebSocket protocol.

In some embodiments, each application252may include a localization manager114described above with respect toFIG. 1. In other embodiments, each application server250may include a common localization manager114that may be used by all applications252. When the request is received, the application252and the associated API processes the API call and retrieves customer localization and anonymization rules from customer database130for customer140at306. In some embodiments, the API call may include a flag and/or additional information that specifies the following: whether at least some of the data in the request should be anonymized, the time period after which the data should be anonymized (e.g., immediately or after 30 days, etc.), localization rules with respect to transmission and/or storage of the data, and the like. The subsequent transmittal and storage of data will be based on the localization and anonymization rules retrieved from the customer database130and the localization and anonymization flags included in the request. In some embodiments, the a parameter in the API call may be one of a flag specifying the localization requirement or an explicit choice of a geographic region the communication request should be processed in. For example, the explicit choice of a geographic region may be “EU” or “APAC”. Similarly, in some embodiments, the a parameter in the API call may be one of a flag specifying the anonymization requirement or an explicit choice of governmental agency requirement that the end user data should be anonymized according to. For example, the explicit choice of a governmental agency requirement may be “HIPAA” or the like.

At308, the application252will generate call data records (CDRs)254nand/or other log files. In some embodiments, the CDRs will be in JSON format or XML format. At310, a logging service256may continuously scan for new content such as the generated CDRs or log files. Any detected content is then pushed to streaming data processing platform258at312. In some embodiments, the logging service256may be a FILEBEAT lightweight logging shipper or the like. In some embodiments, the streaming data processing platform258may an APACHE KAFKA cluster.

At314, the streaming data processing platform258will send the CDRs to be anonymized by the anonymization manager112. In some embodiments, the anonymization manager112may be implemented using a JAVA based processing engine or the APACHE SPARK data processing engine. In some embodiments, anonymization of the data may include removal of all PII data. In other embodiments, anonymization of the data may include encryption and/or obfuscation of all data. In some embodiments, all PII of the end user is encrypted prior to storage regardless of whether anonymization and/or localization is performed. In other embodiments, the data storage itself is encrypted.

At316, the anonymized data is sent back to the streaming data processing platform258. The anonymized data may then be sent at320to non-local storage such as a global central data warehouse208. In some embodiments, the either anonymized or non-anonymized data may be sent and stored locally at318in database260. In some embodiments, at322, the streaming data processing platform258may also send mirror data to another data center121xfor backup/mirroring while adhering to the anonymization and localization for customer140.

The embodiments of the present invention may be embodied as methods, apparatus, electronic devices, and/or computer program products. Accordingly, the embodiments of the present invention may be embodied in hardware and/or in software (including firmware, resident software, micro-code, and the like), which may be generally referred to herein as a “circuit” or “module”. Furthermore, the present invention may take the form of a computer program product on a computer-usable or computer-readable storage medium having computer-usable or computer-readable program code embodied in the medium for use by or in connection with an instruction execution system. In the context of this document, a computer-usable or computer-readable medium may be any medium that can contain, store, communicate, propagate, or transport the program for use by or in connection with the instruction execution system, apparatus, or device. These computer program instructions may also be stored in a computer-usable or computer-readable memory that may direct a computer or other programmable data processing apparatus to function in a particular manner, such that the instructions stored in the computer usable or computer-readable memory produce an article of manufacture including instructions that implement the function specified in the flowchart and/or block diagram block or blocks.

The computer-usable or computer-readable medium may be, for example but not limited to, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus or device. More specific examples (a non-exhaustive list) of the computer-readable medium include the following: hard disks, optical storage devices, magnetic storage devices, an electrical connection having one or more wires, a portable computer diskette, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or Flash memory), an optical fiber, and a compact disc read-only memory (CD-ROM).

Computer program code for carrying out operations of the present invention may be written in an object oriented programming language, such as JAVA, SMALLTALK or C++, and the like. However, the computer program code for carrying out operations of the present invention may also be written in conventional procedural programming languages, such as the “C” programming language and/or any other lower level assembler languages. It will be further appreciated that the functionality of any or all of the program modules may also be implemented using discrete hardware components, one or more Application Specific Integrated Circuits (ASICs), or programmed Digital Signal Processors or microcontrollers.

FIG. 4depicts a computer system400that can be utilized in various embodiments of the present invention to implement the computer and/or the display, according to one or more embodiments.

Various embodiments of method and apparatus for localizing and anonymizing data, as described herein, may be executed on one or more computer systems, which may interact with various other devices. One such computer system is computer system400illustrated byFIG. 4, which may in various embodiments implement any of the elements or functionality illustrated inFIGS. 1-3. In various embodiments, computer system400may be configured to implement methods described above. The computer system400may be used to implement any other system, device, element, functionality or method of the above-described embodiments. In the illustrated embodiments, computer system400may be configured to implement the flowchart300as processor-executable executable program instructions422(e.g., program instructions executable by processor(s)410) in various embodiments.

In the illustrated embodiment, computer system400includes one or more processors410a-410ncoupled to a system memory420via an input/output (I/O) interface430. Computer system400further includes a network interface440coupled to I/O interface430, and one or more input/output devices450, such as cursor control device460, keyboard470, and display(s)480. In various embodiments, any of the components may be utilized by the system to receive user input described above. In various embodiments, a user interface may be generated and displayed on display480. In some cases, it is contemplated that embodiments may be implemented using a single instance of computer system400, while in other embodiments multiple such systems, or multiple nodes making up computer system400, may be configured to host different portions or instances of various embodiments. For example, in one embodiment some elements may be implemented via one or more nodes of computer system400that are distinct from those nodes implementing other elements. In another example, multiple nodes may implement computer system400in a distributed manner.

In various embodiments, computer system400may be a uniprocessor system including one processor410, or a multiprocessor system including several processors410(e.g., two, four, eight, or another suitable number). Processors410may be any suitable processor capable of executing instructions. For example, in various embodiments processors410may be general-purpose or embedded processors implementing any of a variety of instruction set architectures (ISAs). In multiprocessor systems, each of processors410may commonly, but not necessarily, implement the same ISA.

System memory420may be configured to store program instructions422and/or data432accessible by processor410. In various embodiments, system memory420may be implemented using any suitable memory technology, such as static random access memory (SRAM), synchronous dynamic RAM (SDRAM), nonvolatile/Flash-type memory, or any other type of memory. In the illustrated embodiment, program instructions and data implementing any of the elements of the embodiments described above may be stored within system memory420. In other embodiments, program instructions and/or data may be received, sent or stored upon different types of computer-accessible media or on similar media separate from system memory420or computer system400.

In one embodiment, I/O interface430may be configured to coordinate I/O traffic between processor410, system memory420, and any peripheral devices in the device, including network interface440or other peripheral interfaces, such as input/output devices450. In some embodiments, I/O interface430may perform any necessary protocol, timing or other data transformations to convert data signals from one component (e.g., system memory420) into a format suitable for use by another component (e.g., processor410). In some embodiments, I/O interface430may include support for devices attached through various types of peripheral buses, such as a variant of the Peripheral Component Interconnect (PCI) bus standard or the Universal Serial Bus (USB) standard, for example. In some embodiments, the function of I/O interface430may be split into two or more separate components, such as a north bridge and a south bridge, for example. Also, in some embodiments some or all of the functionality of I/O interface430, such as an interface to system memory420, may be incorporated directly into processor410.

Input/output devices450may, in some embodiments, include one or more display terminals, keyboards, keypads, touchpads, scanning devices, voice or optical recognition devices, or any other devices suitable for entering or accessing data by one or more computer systems400. Multiple input/output devices450may be present in computer system400or may be distributed on various nodes of computer system400. In some embodiments, similar input/output devices may be separate from computer system400and may interact with one or more nodes of computer system400through a wired or wireless connection, such as over network interface440.

In some embodiments, the illustrated computer system may implement any of the operations and methods described above, such as the methods illustrated by the flowchart ofFIG. 3. In other embodiments, different elements and data may be included.