System and method for producing secure data management software

A system for producing secure data management software, comprising at least one hardware processor adapted to: receive a plurality of data patterns, each comprising at least one data field identifier selected from a set of protected data field identifiers of at least one data repository, at least one output target, and an access instruction; identify in a plurality of computer instructions of the data management software one or more forbidden output instructions by matching one or more reaching definitions of some of the plurality of computer instructions with one or more of the plurality of data patterns; and remove the one or more forbidden output instructions from the plurality of computer instructions.

BACKGROUND

The present invention, in some embodiments thereof, relates to a data management system and, more specifically, but not exclusively, to a system for managing health information.

There exist reasons to limit access to sensitive electronic information. Some examples of sensitive electronic information are a person's name, a person's address, an identification number such as a passport number, a Social Security number or a national identification number, a bank account identifier, and a health record. Some reasons to limit access to the sensitive electronic information are business related, for example to protect business interests of a business entity. Some other reasons are regulatory, for example regulations governing distribution of and access to health information. An example of a regulation regarding health information is United States Health Insurance Portability and Accountability Act of 1996 (HIPAA).

Some existing data management systems control access to sensitive electronic information by isolating the data management system from other systems. In such systems the sensitive electronic information is stored in dedicated storage devices, and processed by dedicated hardware processors. Some such systems comprise a central database, implementing access control lists to restrict access to data stored in the database. In some such systems only explicitly authorized computers, identified by a network address or a network device port, may retrieve the sensitive electronic information.

The term “cloud computing” refers to delivering one or more hosted services, often over the Internet. Examples of a hosted service delivered over the Internet are a compute resource such as a virtual machine (VM), storage and access to an application. Cloud computing enables an entity such as a company to consume the one or more hosted services as a utility, rather than having to build and maintain computing infrastructures in house. There is an increase in the amount of data management systems implemented using cloud computing for data storage and data management applications. Possible advantages of a cloud implementation of a data management system compared to a system comprising dedicated storage devices and dedicated hardware processing resources include reduced cost of storage and computing resources, simpler storage management, easier expansion, better backup and recovery, and decreased Information Technology (IT) maintenance costs. Cloud computing is characterized by sharing one or more pools of configurable system resources between one or more software applications. A data management system using cloud computing may be susceptible to unintentional or malicious data leaks.

SUMMARY

It is an object of the present invention to provide a system and a method for producing secure data management software.

According to a first aspect of the invention, a system for producing secure data management software comprises at least one hardware processor adapted to: receive a plurality of data patterns, each comprising at least one data field identifier selected from a set of protected data field identifiers of at least one data repository, at least one output target, and an access instruction; identify in a plurality of computer instructions of the data management software one or more forbidden output instructions by matching one or more reaching definitions of some of the plurality of computer instructions with one or more of the plurality of data patterns; and remove the one or more forbidden output instructions from the plurality of computer instructions. Removing from the data management software forbidden output instructions exposing identified data from a data repository to unauthorized targets, may help prevent installation of potentially problematic software on a data management system. Using a reaching definition of an output instruction may preserve an association between the output instruction and the source of a value in the output instruction.

According to a second aspect of the invention, a computer implemented method producing secure data management software comprises: receiving a plurality of data patterns, each comprising at least one data field identifier selected from a set of protected data field identifiers of at least one data repository, at least one output target, and an access instruction; identifying in a plurality of computer instructions of the data management software one or more forbidden output instructions by matching one or more reaching definitions of some of the plurality of computer instructions with one or more of the plurality of data patterns; and removing the one or more forbidden output instructions from the plurality of computer instructions.

According to a third aspect of the invention, a software program product for producing secure data management software comprises: a non-transitory computer readable storage medium; first program instructions for receiving a plurality of data patterns, each comprising at least one data field identifier selected from a set of protected data field identifiers of at least one data repository, at least one output target, and an access instruction; second program instructions for identifying in a plurality of computer instructions of the data management software one or more forbidden output instructions by matching one or more reaching definitions of some of the plurality of computer instructions with one or more of the plurality of data patterns; and third program instructions for removing the one or more forbidden output instructions from the plurality of computer instructions; wherein the first, second, and third program instructions are executed by at least one computerized processor from the non-transitory computer readable storage medium.

With reference to the first, second, and third aspects, in a first possible implementation of the first, second, and third aspects of the present invention, identifying the one or more forbidden output instructions comprises: identifying in the plurality of computer instructions one or more output instructions each having an instruction output target; identifying in the plurality of computer instructions one or more protected variables having a value assigned by reading a protected data field from the at least one data repository; applying data-flow analysis to the plurality of computer instructions to identify at least one reaching definition of at least one of the one or more output instructions, each identified reaching definition comprising at least one of the one or more protected variables; identifying at least one suspect output instruction in the at least one of the one or more output instructions having at least one reaching definition comprising at least one of the one or more protected variables, wherein the at least one suspect output instruction has a first instruction output target and the at least one suspect output instruction's at least one reaching definition has a first protected variable; identifying a first protected data field read to assign a value to the first protected variable; and identifying in the plurality of data patterns at least one data pattern having an output target matching the first instruction output target according to a target matching test and a data field identifier matching the first protected data field according to a variable matching test. The at least one data pattern's access instruction forbids access from the first output target to the first protected data field. Identifying a reaching definition of an output instruction and identifying a source of a value of a variable in a reaching definition may preserve an association between the output instruction and the source of a value in the output instruction. Matching a target of an output instruction and an associated data value with a data pattern may facilitate applying an access policy for the target to the data value.

With reference to the first, second, and third aspects, in a second possible implementation of the first, second, and third aspects of the present invention, the at least one hardware processor is further adapted to write the plurality of computer instructions remaining after removing the one or more forbidden output instructions to a digital storage connected to the at least one hardware processor. Storing the plurality of computer instructions may facilitate using the plurality of computer instructions at a future time, and/or more than once.

With reference to the first, second, and third aspects, in a third possible implementation of the first, second, and third aspects of the present invention, the plurality of computer instructions are in a human readable programming language. Optionally, the at least one hardware processor is further adapted to compile the plurality of computer instructions remaining after removing the one or more forbidden output instructions to produce compiled code comprising a plurality of machine language computer instructions or a plurality of intermediate language computer instructions. Compiled code produced by compiling a plurality of computer instructions remaining after removing one or more forbidden output instructions may be less of a threat of exposing sensitive information than other compiled code. Optionally, the at least one hardware processor is further adapted to install the compiled code on at least one other hardware processor of a data management system. Such an implementation facilitates automatic installation, without requiring a human administrator to take action.

With reference to the first, second, and third aspects, or the third possible implementation of the first, second, and third aspects, in a fourth possible implementation of the first, second, and third aspects of the present invention the at least one other hardware processor executes at least one virtual machine. Some cloud implementations of data management systems use virtual machines.

With reference to the first, second, and third aspects, or the third possible implementation of the first, second, and third aspects, in a fifth possible implementation of the first, second, and third aspects of the present invention the at least one other hardware processor is connected to the at least one data repository via at least one other data communication network. Connecting the at least one data repository to the at least one other hardware processor via at least one other data communication network may facilitate a distributed implementation of a data management system.

With reference to the first, second, and third aspects, in a sixth possible implementation of the first, second, and third aspects of the present invention the at least one hardware processor is further adapted to install the plurality of computer instructions remaining after removing the one or more forbidden output instructions on at least one other hardware processor of a data management system. The plurality of computer instructions remaining after removing the one or more forbidden output may be less of a threat of exposing sensitive information than other computer instructions. Such an implementation facilitates automatic installation, without requiring a human administrator to take action.

With reference to the first, second, and third aspects, or the sixth possible implementation of the first, second, and third aspects, in a seventh possible implementation of the first, second, and third aspects of the present invention the at least one other hardware processor executes at least one virtual machine.

With reference to the first, second, and third aspects, or the sixth possible implementation of the first, second, and third aspects, in an eighth possible implementation of the first, second, and third aspects of the present invention the at least one other hardware processor is connected to the at least one data repository via at least one other data communication network.

With reference to the first, second, and third aspects, in a ninth possible implementation of the first, second, and third aspects of the present invention, the at least one output target is a member of a group consisting of: a file name value, a file name template value comprising at least one variable file name element, a network address value, a network address template value comprising at least one variable network address element, and a display device identifier. Any of these targets may expose data to an unauthorized user.

With reference to the first, second, and third aspects, in a tenth possible implementation of the first, second, and third aspects of the present invention, the at least one data field identifier is a member of a group consisting of: an attribute identifier in a relational database table, a key identifier, a column identifier, a document name value, and a document name template value comprising at least one variable document name element. Optionally, the set of protected data field identifiers comprises at least one data field identifier identifying at least one type of protected health information according to Health Insurance Portability and Accountability Act of 1996 (HIPAA) security regulations. Optionally, the set of protected data field identifiers comprises at least one identifier identifying at least one of a group consisting of: a patient name, an address, a Social Security number, a passport number, a national identification number, an electronic mail address, a telephone number, a fingerprint, a photographic image, a medical record, a bank account identifier, and an amount of money.

With reference to the first, second, and third aspects, in an eleventh possible implementation of the first, second, and third aspects of the present invention, the at least one data repository comprises a database.

With reference to the first, second, and third aspects, in a twelfth possible implementation of the first, second, and third aspects of the present invention, the at least one hardware processor receives the plurality of data patterns via a data communication network interface connected to the at least one hardware processor or by reading the plurality of data patterns from a digital storage connected to the at least one hardware processor. Receiving the plurality of data patterns via a data communication network allows modifying an access policy without modifying the system.

DETAILED DESCRIPTION

The present invention, in some embodiments thereof, relates to a data management system and, more specifically, but not exclusively, to a system for managing health information.

When sensitive electronic information, for example electronically protected health information (ePHI), is stored and processed by a cloud data management system, retrieval of sensitive electronic information from the cloud data management system discloses the sensitive electronic information outside the boundaries of the cloud. This may be undesirable, for example for business considerations or regulatory and legal considerations. There exist solutions that monitor data at the data storage level, and allow a cloud implemented data management system to retrieve sensitive electronic information from storage only according to user authentication and predefined privileges. However, such systems cannot prevent the cloud implemented data management system from exposing the retrieved sensitive electronic information outside the cloud.

In some systems sensitive electronic information retrieved from the storage is encrypted, however some operations performed on the sensitive electronic information by the data management system require decrypting the sensitive electronic information, enabling the data management system to expose unencrypted sensitive electronic information. Systems that operate only on encrypted data are limited in functionality.

In addition, a data management system may expose sensitive electronic information by writing the sensitive electronic information to a log file or a console. In some cases, such an operation is not part of the data management system's normal functionality but was inserted by a programmer for analyzing or debugging the system and may have been left unintentionally. In some cases, such an operation may be inserted maliciously into a data management system, to bypass network access limitations. As software developed by 3rdparties increasingly used by data management systems, there is an increased need to identify such risks of exposing sensitive electronic information.

In some data management systems, sensitive electronic information stored in a data repository is stored in a database. The database is optionally a relational database. In a relational database sensitive electronic information may be stored in one or more identified attributes (also known as fields) of one or more identified tables. The database is optionally a Not Only Structured Query Language (NoSQL) database. In a NoSQL database sensitive electronic information may be stored in one or more identified key identifiers, column identifiers and/or document names.

The present invention, in some embodiments thereof, proposes identifying in the data management software, prior to installing the data management software on the data management system, one or more violations of flow permissions defined using a set of data patterns, and installing on the data management system only data management software that does not violate the flow permissions. In such embodiments the present invention proposes identifying the one or more violations by matching one or more reaching definitions of a plurality of computer instructions of the data management software with the set of data patterns. In some embodiments the present invention is implemented within a software development environment, for example as a compiler plugin or a processing component in an automated software build environment. Optionally, the present invention is implemented within a software configuration management environment, for deploying software.

Optionally, each data pattern of the set of data patterns comprises at least one data field identifier identifying some sensitive electronic information stored in at least one data repository, at least one output target and an access instruction defining allowance or forbiddance of the at least one output target accessing the sensitive electronic information identified by the at least one data field identifier. The present invention proposes, in such embodiments, to identify one or more protected variables having a value assigned by reading sensitive electronic information from the at least one data repository, and to identify for each output instruction of the data management software its reaching definition. A reaching definition for a given instruction is an earlier instruction whose target variable can reach (be assigned to) the given instruction without an intervening assignment. Optionally, one or more data-flow analyses are applied to the data management software to identify the one or more reaching definitions.

An output instruction has an output instruction target. When an output instruction has a reaching definition comprising a protected variable having a value assigned by reading sensitive electronic information from the at least one data repository, there is a risk of the data management system outputting the sensitive electronic information to a target of the output instruction. The sensitive electronic information read from the at least one data repository to assign a value to the protected variable has a data field identifier. However, during runtime, when executing the output instruction, association between output data of the output instruction and a data field identifier of a source of the output data is lost. Optionally, according to the present invention, when a data pattern of the set of data patterns matches a target of the output instruction and the protected variable's data field identifier, the instruction may be forbidden when the data pattern's access instruction forbids the target of the output instruction from receiving data retrieved using the protected variable's data field identifier. Optionally the present invention enables installation of only secure data management software having no forbidden output instructions, and upon identifying one or more forbidden output instructions in data management software the one or more forbidden output instructions are removed from the plurality of instructions prior to installing the data management software. When the present invention is implemented within a software development environment, the present invention facilitates identifying the one or more forbidden output instructions while building the data management software. For example, when the present invention is implemented as a compiler plugin, the compiler plugin may remove the one or more forbidden output instructions from the data management software's source code before compiling the source code into executable machine code. Thus, executable machine code of the secure data management software produced using a compiler with a compiler plugin implemented according to the present invention is more likely to comply with the flow permissions than data management software produced using a compiler without the compiler plugin. In another example, where the present invention is implemented as a processing component in an automated build environment, the processing component may be used to process data management software that is distributed as source files written in a human-readable interpreted language such as JavaScript or Python. In such embodiments the processing component implemented according to the present invention may remove the one or more forbidden output instructions from the source code of the data management before packaging the source code for distribution. Secure data management software produced by an automated build environment executing the processing component is more likely to comply with the flow permissions than data management software produced by an automated build environment without the processing component.

Using data-flow analysis to verify data management software prior to installing the data management software on the data management system allows detection of potential data leaks not identifiable during run time due to loss of runtime association between output data and the data's source. In addition, a system executing data management software verified using the present invention may not have to check for real time access permissions, and thus may respond faster than other systems that do check access permissions in real time during execution.

The present invention may be used for any electronic information requiring access limitations. Some of the following description relates to ePHI but is not limited to health information.

The computer readable storage medium can be a tangible device that can retain and store instructions for use by an instruction execution device. The computer readable storage medium may be, for example, but is not limited to, an electronic storage device, a magnetic storage device, an optical storage device, an electromagnetic storage device, a semiconductor storage device, or any suitable combination of the foregoing.

Computer readable program instructions described herein can be downloaded to respective computing/processing devices from a computer readable storage medium or to an external computer or external storage device via a network, for example, the Internet, a local area network, a wide area network and/or a wireless network.

Reference is now made toFIG. 1, showing a schematic block diagram of an exemplary data management system100, according to some embodiments of the present invention. Optionally, cloud computing environment110comprises at least one data management system hardware processor101executing data management software of data management system100. The data management software comprises a plurality of computer instructions.

For brevity, henceforth the term “data manager” is used to mean at least one data manager system hardware processor. Optionally, data manager101executes at least one virtual machine. Optionally, entity102, authorized to interact with the data management software, sends data manager101a request121for first information. Entity102may be a second hardware processor executing a client software application of data management system100. Optionally, entity102is a second hardware processor executing Hyper Text Transfer Protocol (HTTP) client software and request121is a HTTP request message. Optionally, the data management software executed by data manager101implements a representational state transfer (REST) interface, optionally using HTTP.

Optionally, data manager101is connected to at least one data repository103, optionally via a data communication network, for example a LAN such as an Ethernet LAN, or a WAN such as the Internet. Upon receiving request121, data manager101optionally sends at least one data repository103a request122for second information, and optionally at least one data repository103sends at least one data management system hardware processor101return information123, according to an optional access policy governing access of software executed by data manager101to at least one data repository103. Returned information123from at least one data repository103to data manager101is still within cloud boundaries and so long as the optional access policy conforms to system100's security policy regarding external entities, returning information123to data manager101does not violate system100's security policy regarding external entities.

Optionally, data manager101processes return information123and generates a response to entity102comprising second return information124. It may be the case that system100's security policy regarding external entities prohibits sending some of return information123to data manager101. For example, when entity102is an insurance company and return information is ePHI, data manager101may be allowed to read from at least one data repository103data of a plurality of medical procedures of a certain patient, but may be allowed to send entity102only data of one identified medical procedure.

To define system100's security policy regarding external entities, some embodiments of the present invention use a plurality of data patterns describing data-flow permissions of data from at least one data repository103to external entities such as entity102.

Reference is now made also toFIG. 2, showing a schematic illustration of an exemplary data pattern300and its relation to exemplary data management system100, according to some embodiments of the present invention. In such embodiments, each data pattern of the plurality of data patterns comprises at least one data field identifier311, at least one output target312and an access instruction313. Optionally, at least one data field identifier311is selected from a set of protected data field identifiers of data repository103. Optionally, data repository103comprises a database. Optionally, the database is a relational database. An example of a data field identifier when the database is a relational database is an attribute identifier in a database table of the relational database. Optionally, the database is a NoSQL database. Examples of a data field identifier when the database is a NoSQL database are a key identifier of the NoSQL database, a column identifier of the NoSQL database, a document name value and a document name template. A document name template may comprise at least one variable document name element, for example a character representing a wildcard in a document name string value.

When data manager101requests information in122, comprising at least one data field identifier311, from at least one data repository103, at least one hardware processor optionally stores a value of at least one data field identifier311returned in123in at least one variable of the data management software executed by at least one hardware processor101. When data manager101sends second return information124to entity102, at least one hardware processor101executes at least one output instruction of the data management software. The at least one output instruction has an instruction output target identifying entity102.

Optionally, data pattern300comprises at least one output target312. Examples of an output target are a value of a file name, a template value of a filename comprising at least one variable file name element, a value of a network address, a template value of a network address comprising at least one variable network address element, and a display device identifier. A variable file name element may be a character representing a wildcard in a file name string value. A variable network address element may be a character representing a wildcard in a network address string value. Optionally, a file name value identifies a log file. Optionally, a file name template value identifies all files. Optionally, a display device identifier identifies a console display device, connected to data manager101. Optionally, a network address template identifies a range of network addresses.

Optionally, data pattern300comprises an access instruction313. Optionally, access instruction313either allows flow of data retrieved using at least one data field identifier311to at least one output target312or forbids flow of data retrieved using at least one data field identifier311to at least one output target312. The present invention, in some embodiments thereof, proposes a system and method for identifying an association between return information123and second return information124and denying installation of data management software where an association between return information123and second return information124violates a security policy defined by a plurality of data patterns comprising data pattern300.

An association between return information123and second return information124is optionally determined by identifying the at least one variable of the data management software, assigned a value from return information123, in at least one reaching definition of the at least one output instruction executed by at least one hardware processor101to send second return information124to entity102. When at least one data field identifier311is selected from a set of protected data field identifiers of at least one data repository103, at least one output target312is entity102and access instruction313forbids flow of data retrieved using at least one data field identifier311to at least one output target312, and in addition the at least one variable of the data management software, assigned a value from return information123, is identified in at least one reaching definition of the at least one output instruction executed by data manager101to send second return information124to entity102, the at least one output instruction is a forbidden output instruction. An example of a protected data field identifier is a data field identifier identifying one of: a patient name, an address, a Social Security number, a passport number, a national identification number, an electronic mail address, a telephone number, a fingerprint, a photographic image, a medical record, a bank account identifier, and an amount of money. Optionally, the set of protected data field identifiers comprises at least one data field identifier identifying at least one type of protected health information according to HIPAA security regulations.

The following description discloses a system and method for producing secure data management software verified to comprise no forbidden output instructions, according to some embodiments of the present invention.

Reference is now made also toFIG. 3, showing a schematic block diagram of an exemplary system200for producing secure data management software, according to some embodiments of the present invention. In such embodiments, at least one other hardware processor201executes a computer implemented method for producing secure data management software, and optionally installing the secure data management software on data manager101.

For clarity, henceforth the term “installer” is used to mean at least one other hardware processor.

Optionally, installer201is connected to a digital storage202, for example a hard disk. Optionally, digital storage202is another non-transitory computer readable storage medium, for example non-volatile random-access memory. Optionally, the plurality of data patterns is stored on digital storage202. Optionally, installer201executes a plurality of program instructions stored in digital storage202. Optionally, installer201executes a software development environment, for example a software development environment comprising a compiler or an environment for automatically building and packaging software for distribution. Optionally, installer201executes a software configuration management environment. Optionally, installer201is connected to at least one data communication network interface204for communicating with one or more users of system200. For example, installer201may receive the plurality of data patterns via at least one data communication network interface204. Optionally, installer201sends at least one user of system200one or more messages via at least one data communication network interface204.

Optionally, installer201is connected to at least one display device203, for displaying one or more messages to at least one user of system200.

Optionally, installer201is connected to data manger101. Optionally, installer201is connected to data manager101via at least one data communication network interface204. Optionally, installer201is data manager101.

At least one data communication network interface204is optionally a Local Area Network interface such as an Ethernet network interface or a wireless network interface. Optionally at least one other hardware processor201is connected to a wide area network, for example the Internet, via at least one data communication network interface204.

To produce secure data management software system200, in some embodiments of the present invention, implements the following optional method.

Reference is now made also toFIG. 4, showing a flow chart schematically representing an optional flow of operations400, according to some embodiments of the present invention. In such embodiments, installer201is adapted receive in401a plurality of data patterns, each comprising at least one data field identifier selected from a set of protected data field identifiers of at least one data repository103, at least one output target, and an access instruction. Optionally, each of the plurality of data patterns is a JavaScript Object Notation (JSON) object. An example of a protected data field identifier is a data field identifier identifying one of: a patient name, an address, a Social Security number, a passport number, a national identification number, an electronic mail address, a telephone number, a fingerprint, a photographic image, a medical record, a bank account identifier, and an amount of money. Optionally, the set of protected data field identifiers comprises at least one data field identifier identifying at least one type of protected health information according to HIPAA security regulations. Examples of an output target are a value of a file name, a template value of a filename comprising at least one variable file name element, a value of a network address, a template value of a network address comprising at least one variable network address element, and a display device identifier.

In415, installer201optionally identifies in the plurality of output instructions one or more forbidden output instructions by matching one or more reaching definitions of some of the plurality of computer instructions with one or more of the plurality of data patterns.

Reference is now made also toFIG. 5, showing a flow chart schematically representing an optional flow of operations500for identifying one or more forbidden output instructions, according to some embodiments of the present invention. In such embodiments, in404installer201optionally identifies in a plurality of computer instructions of the data management software one or more output instructions each having an instruction output target, and in409installer201optionally identifies in the plurality of computer instructions one or more protected variables having a value assigned by reading a protected data field from at least one data repository103.

Optionally, installer201applies in412data-flow analysis to the plurality of computer instructions to identify for at least one of the one or more output instructions one or more reaching definitions comprising at least one of the one or more protected variables, and in501installer201optionally identifies at least one suspect output instruction in the at least one of the one or more output instructions having one or more reaching definitions comprising at least one of the one or more protected variables, wherein the at least one suspect output instruction has a first instruction output target, for example entity102, and the at least one suspect output instruction's one or more reaching definitions has a first protected variable, for example a variable assigned a value by reading at least one data identifier311from data repository103. Optionally, in504installer201identifies a first protected data field read to assign a value to the first protected variable, for example at least one data identifier311, and in505installer201optionally identifies in the plurality of data patterns at least one data pattern, for example data pattern300, having an output target, for example at least one output target312, matching the first instruction output target according to a target matching test and a data field identifier, for example data field identifier311, matching the first protected data field according to a variable matching test. An example of a target matching test is a comparison between a string value of the first instruction output target and a string value of the output target of the at least one data pattern. An example of a variable matching test is a comparison between a string value of the first protected data field's data field identifier and a string value of the at least one data pattern's at least one data field identifier.

When the at least one data pattern's access instruction, for example access instruction313, forbids access from the first output target to the first protected data field, installer201optionally identifies a forbidden output instruction in505.

Optionally, each data pattern of the plurality of data patterns has a priority. Optionally, installer201applies the target matching test and the variable matching test to some of the plurality of data patterns, in ascending or descending order of data pattern priority. Optionally, installer201implements a policy resolution method as known in the industry to identify whether the at least one suspect output instruction is a forbidden output instruction according to the plurality of data patterns.

Reference is now made again toFIG. 4. When one or more forbidden output instructions are identified, installer201optionally removes the one or more forbidden output instructions from the plurality of computer instructions. Optionally, installer201writes in431the plurality of computer instructions remaining after removing the one or more forbidden output instructions to storage202.

Optionally, the plurality of computer instructions are in a human readable programming language. Examples of a human readable programming language are Java, JavaScript, C, C++, C#, Perl, Tcl, and Python. In some embodiments, in437installer201installs the plurality of computer instructions remaining after removing the one or more forbidden output instructions on data manager101, for example when the plurality of computer instructions are in an interpreted programming language such as JavaScript or Python. Optionally, for example when installer201executes an automated build environment, installer201implements steps401,415, and417as a processing component of the automated build environment. Optionally, step437is implemented as another processing component of the automated build environment. Optionally, step437is implemented as a processing component of a software deployment tool executed by installer201.

Optionally, in432installer201compiles the plurality of computer instructions remaining after removing the one or more forbidden output instructions to produce compiled code, for example when the plurality of computer instructions are in a compiled programming language such as C or C#. Optionally, the compiled code comprises a plurality of machine language computer instructions, optionally in binary format. Optionally, the compiled code comprises a plurality of intermediate language computer instructions, for example Java bytecode or register transfer language. Optionally, for example when installer201executes a software development environment, installer201implements steps401,415, and417as a compiler plugin of a compiler of the software build environment. Optionally, step432is executed by a compiler of the software development environment. Optionally, in433installer201installs the compiled code on data manager101. Optionally, step433is implemented as a processing component of a software deployment tool executed by installer201.

Optionally, installer201outputs a message instructing a user of system200to install secure data management software comprising the plurality of computer instructions remaining after removing the one or more forbidden instructions on data manager101. The secure data management software may be the plurality of computer instructions remaining after removing the one or more forbidden instructions. The secure data management software may be the compiled code. Optionally, installer201outputs the message to display device203. Optionally, installer201outputs the message to a data communication network via at least one data communication interface204, for example by sending an electronic mail message to an electronic mail address of the user. In some embodiments of the present invention, installer201sends the secure data management software to another hardware processor via at least one data communication interface204, for example for the purpose of storing the secure data management software in a remote location such as a remote software repository.

It is expected that during the life of a patent maturing from this application many relevant protected data identifiers will be developed and the scope of the term protected data identifier is intended to include all such new technologies a priori.

As used herein the term “about” refers to ±10%.