Utilizing smart data tags to track and control secure enterprise data

Aspects of the disclosure relate to utilizing smart data tags to track and control secure enterprise data. A computing platform may receive, from an enterprise user computing device, enterprise data. Subsequently, the computing platform may determine one or more tags to be applied to the enterprise data. Then, the computing platform may generate a smart data object based on the enterprise data received from the enterprise user computing device and the one or more tags determined to be applied to the enterprise data received from the enterprise user computing device. Next, the computing platform may send, to an enterprise data storage platform, the smart data object, and sending the smart data object to the enterprise data storage platform may cause the enterprise data storage platform to store the smart data object in a repository comprising a plurality of smart data objects maintained by the enterprise data storage platform.

BACKGROUND

Aspects of the disclosure relate to deploying digital data processing systems, providing information security, and preventing unauthorized access to resources of an information system. In particular, one or more aspects of the disclosure relate to preventing unauthorized access to information resources by utilizing smart data tags to track and control secure enterprise data.

Enterprise organizations may utilize various computing infrastructure to maintain large data sets, which may include confidential information and/or other sensitive data that is created and/or used for various purposes. In some instances, these large data sets may need to be accessed by and/or transferred across various networks and/or between various computer systems. Ensuring security when accessing and/or transferring such data may be critically important to protect the integrity and confidentiality of the underlying information. In many instances, however, it may be difficult to ensure the integrity and confidentiality of the information associated with the data sets while also attempting to optimize the resource utilization, bandwidth utilization, and efficient operations of the computing infrastructure involved in maintaining, accessing, and transferring the data.

SUMMARY

Aspects of the disclosure provide effective, efficient, scalable, and convenient technical solutions that address and overcome the technical problems associated with ensuring information security and preventing unauthorized access to resources of enterprise computer systems by utilizing smart data tags to track and control secure enterprise data.

In accordance with one or more embodiments, a computing platform having at least one processor, a communication interface, and memory may receive, via the communication interface, from an enterprise user computing device, first enterprise data. Subsequently, the computing platform may determine one or more tags to be applied to the first enterprise data received from the enterprise user computing device. Then, the computing platform may generate a first smart data object based on the first enterprise data received from the enterprise user computing device and the one or more tags determined to be applied to the first enterprise data received from the enterprise user computing device. Then, the computing platform may send, via the communication interface, to an enterprise data storage platform, the first smart data object. In addition, sending the first smart data object to the enterprise data storage platform may cause the enterprise data storage platform to store the first smart data object in a repository comprising a plurality of smart data objects maintained by the enterprise data storage platform.

In some embodiments, determining the one or more tags to be applied to the first enterprise data received from the enterprise user computing device may include identifying at least one tag to be applied to the first enterprise data received from the enterprise user computing device based on user-defined specifications received from the enterprise user computing device.

In some embodiments, determining the one or more tags to be applied to the first enterprise data received from the enterprise user computing device may include identifying at least one tag to be applied to the first enterprise data received from the enterprise user computing device based on contents of the first enterprise data received from the enterprise user computing device and one or more machine-learned tagging templates maintained by the computing platform.

In some embodiments, the one or more tags determined to be applied to the first enterprise data received from the enterprise user computing device may include at least one tag identifying a first computer system that created the first enterprise data and at least one tag identifying a second computer system that is authorized to access the first enterprise data.

In some embodiments, the one or more tags determined to be applied to the first enterprise data received from the enterprise user computing device may include at least one tag identifying a first network zone in which the first enterprise data was created and at least a second network zone in which the first enterprise data is authorized to be accessed.

In some embodiments, generating the first smart data object based on the first enterprise data received from the enterprise user computing device and the one or more tags determined to be applied to the first enterprise data received from the enterprise user computing device may include generating the first smart data object based on an object template defining a locator portion for storing unencrypted tag information and a payload portion for storing encrypted enterprise information.

In some embodiments, generating the first smart data object based on the first enterprise data received from the enterprise user computing device and the one or more tags determined to be applied to the first enterprise data received from the enterprise user computing device may include populating the locator portion of the first smart data object with the one or more tags determined to be applied to the first enterprise data received from the enterprise user computing device.

In some embodiments, generating the first smart data object based on the first enterprise data received from the enterprise user computing device and the one or more tags determined to be applied to the first enterprise data received from the enterprise user computing device may include: encrypting the first enterprise data received from the enterprise user computing device to produce encrypted enterprise data; and populating the payload portion of the first smart data object with the encrypted enterprise data.

In some embodiments, generating the first smart data object based on the first enterprise data received from the enterprise user computing device and the one or more tags determined to be applied to the first enterprise data received from the enterprise user computing device may include generating a sequence of linked objects associated with the first enterprise data received from the enterprise user computing device.

In some embodiments, the computing platform may update a first data movement pattern corresponding to the first smart data object based on sending the first smart data object to the enterprise data storage platform.

In some embodiments, the computing platform may receive, via the communication interface, from the enterprise data storage platform, a first movement notification indicating that the first smart data object is being transferred to enterprise computing infrastructure based on an access request. Subsequently, the computing platform may update the first data movement pattern corresponding to the first smart data object based on receiving the first movement notification indicating that the first smart data object is being transferred to the enterprise computing infrastructure based on the access request.

In some embodiments, the computing platform may detect an unauthorized movement event involving the first smart data object based on the first data movement pattern corresponding to the first smart data object.

In some embodiments, in response to detecting the unauthorized movement event involving the first smart data object, the computing platform may generate one or more alert messages comprising alert information associated with the unauthorized movement event involving the first smart data object. Subsequently, the computing platform may send, via the communication interface, to the enterprise user computing device, at least one alert message of the one or more alert messages.

In some embodiments, in response to detecting the unauthorized movement event involving the first smart data object, the computing platform may halt a transfer of the first smart data object.

In some embodiments, the computing platform may receive, via the communication interface, from the enterprise data storage platform, a second movement notification indicating that a second smart data object is being transferred from a first network location to a second network location based on a second access request, wherein the second smart data object is different from the first smart data object. Subsequently, the computing platform may update a second data movement pattern corresponding to the second smart data object based on receiving the second movement notification indicating that the second smart data object is being transferred from the first network location to the second network location based on the second access request.

In some embodiments, the computing platform may evaluate one or more tags associated with the second smart data object. Subsequently, the computing platform may determine that the one or more tags associated with the second smart data object are related to one or more tags associated with the first smart data object.

In some embodiments, the computing platform may detect an unauthorized movement event involving the second smart data object based on the first data movement pattern corresponding to the first smart data object.

In some embodiments, in response to detecting the unauthorized movement event involving the second smart data object, the computing platform may generate one or more alert messages comprising alert information associated with the unauthorized movement event involving the second smart data object. Subsequently, the computing platform may send, via the communication interface, to the enterprise user computing device, at least one alert message of the one or more alert messages. Then, the computing platform may halt a transfer of the second smart data object.

DETAILED DESCRIPTION

Some aspects of the disclosure relate to using smart data to track, manage, and control the transmission and usage of entity-linked data. For example, a smart data system may tag data as it moves through an operating environment, so that an entity linked to the data (e.g., a bank customer associated with transaction record data) can know where such data exists, who can access it, who has accessed it, and for what purposes. In some instances, data may be tagged based on who interacts with it and where it is modified (e.g., if a user creates or interacts with data through the bank, it may be tagged as INT-XX, whereas if the user creates or interacts with data through another organization, it may be tagged as EXT-YY). When data is exchanged with another system/entity or commingled with other data having different tags, an alerting component of the smart data system may generate an alert or notification to the linked entity (i.e., the user who owns the data) regarding the exchange or commingling of the data. In some instances, blockchain technology may be used to record the owner of specific data, tags may be added to the record in the blockchain as different entities interact with the data, and the alerting component may monitor the blockchain to notify the owner of the data when it is accessed. This proactive monitoring, provided by the smart data system, may follow data wherever it goes. In some instances, the data may be encrypted as it moves between different systems, and the smart data system may have a key management component that centrally maintains the access key(s) required to decrypt and access the data from any destination system. In some instances, an artificial intelligence (AI) engine may be used to identify out-of-pattern attempts to access the data and trigger alerts for the data owner.

FIGS. 1A and 1Bdepict an illustrative computing environment for preventing unauthorized access to information resources by utilizing smart data tags to track and control secure enterprise data in accordance with one or more example embodiments. Referring toFIG. 1A, computing environment100may include one or more computer systems. For example, computing environment100may include a data tracking computing platform110, an enterprise data storage platform120, enterprise computing infrastructure130, an enterprise user computing device140, an administrative computing device150, and an external computer system160.

As illustrated in greater detail below, data tracking computing platform110may include one or more computing devices configured to perform one or more of the functions described herein. For example, data tracking computing platform110may include one or more computers (e.g., laptop computers, desktop computers, servers, server blades, or the like).

Enterprise data storage platform120may include one or more computing devices and/or other computer components (e.g., processors, memories, communication interfaces). In addition, and as illustrated in greater detail below, enterprise data storage platform120may be configured to store and/or otherwise maintain enterprise data. Enterprise computing infrastructure130may include one or more computing devices and/or other computer components (e.g., processors, memories, communication interfaces). In addition, and as illustrated in greater detail below, enterprise computing infrastructure130may be configured to provide various enterprise and/or back-office computing functions for an organization, such as a financial institution. For example, enterprise computing infrastructure130may include various servers and/or databases that store and/or otherwise maintain account information, such as financial account information including account balances, transaction history, account owner information, and/or other information. In addition, enterprise computing infrastructure130may process and/or otherwise execute transactions on specific accounts based on commands and/or other information received from other computer systems included in computing environment100. Additionally or alternatively, enterprise computing infrastructure130may load data from enterprise data storage platform120, manipulate and/or otherwise process such data, and return modified data and/or other data to enterprise data storage platform120and/or to other computer systems included in computing environment100.

Enterprise user computing device140may be a personal computing device (e.g., desktop computer, laptop computer) or mobile computing device (e.g., smartphone, tablet). In addition, enterprise user computing device140may be linked to and/or used by a specific enterprise user (who may, e.g., be an employee or other affiliate of an enterprise organization operating data tracking computing platform110). Administrative computing device150may be a personal computing device (e.g., desktop computer, laptop computer) or mobile computing device (e.g., smartphone, tablet). In addition, administrative computing device150may be linked to and/or used by an administrative user (who may, e.g., be a network administrator of an enterprise organization operating data tracking computing platform110). External computer system160may include one or more computing devices and/or other computer components (e.g., processors, memories, communication interfaces). In addition, external computer system160may be linked to and/or used by one or more external users (who may, e.g., not be associated with an enterprise organization operating data tracking computing platform110).

Computing environment100also may include one or more networks, which may interconnect one or more of data tracking computing platform110, enterprise data storage platform120, enterprise computing infrastructure130, enterprise user computing device140, administrative computing device150, and external computer system160. For example, computing environment100may include a private network170(which may, e.g., interconnect data tracking computing platform110, enterprise data storage platform120, enterprise computing infrastructure130, enterprise user computing device140, administrative computing device150, and/or one or more other systems which may be associated with an organization, such as a financial institution) and public network180(which may, e.g., interconnect external computer system160with private network170and/or one or more other systems, public networks, sub-networks, and/or the like).

In one or more arrangements, enterprise data storage platform120, enterprise computing infrastructure130, enterprise user computing device140, administrative computing device150, external computer system160, and/or the other systems included in computing environment100may be any type of computing device capable of receiving a user interface, receiving input via the user interface, and communicating the received input to one or more other computing devices. For example, enterprise data storage platform120, enterprise computing infrastructure130, enterprise user computing device140, administrative computing device150, external computer system160, and/or the other systems included in computing environment100may, in some instances, be and/or include server computers, desktop computers, laptop computers, tablet computers, smart phones, or the like that may include one or more processors, memories, communication interfaces, storage devices, and/or other components. As noted above, and as illustrated in greater detail below, any and/or all of data tracking computing platform110, enterprise data storage platform120, enterprise computing infrastructure130, enterprise user computing device140, administrative computing device150, and external computer system160may, in some instances, be special-purpose computing devices configured to perform specific functions.

Referring toFIG. 1B, data tracking computing platform110may include one or more processors111, memory112, and communication interface113. A data bus may interconnect processor111, memory112, and communication interface113. Communication interface113may be a network interface configured to support communication between data tracking computing platform110and one or more networks (e.g., network170, network180, or the like). Memory112may include one or more program modules having instructions that when executed by processor111cause data tracking computing platform110to perform one or more functions described herein and/or one or more databases that may store and/or otherwise maintain information which may be used by such program modules and/or processor111. In some instances, the one or more program modules and/or databases may be stored by and/or maintained in different memory units of data tracking computing platform110and/or by different computing devices that may form and/or otherwise make up data tracking computing platform110. For example, memory112may have, store, and/or include a data tracking module112a, a data tracking database112b, and a data tracking machine learning engine112c. Data tracking module112amay have instructions that direct and/or cause data tracking computing platform110to prevent unauthorized access to information resources by utilizing smart data tags to track and control secure enterprise data, as discussed in greater detail below. Data tracking database112bmay store information used by data tracking module112aand/or data tracking computing platform110in preventing unauthorized access to information resources by utilizing smart data tags to track and control secure enterprise data. Data tracking machine learning engine112cmay build and/or update one or more data object models, one or more data movement patterns, and/or one or more other machine-learned models based on captured and/or received data.

FIGS. 2A-2Fdepict an illustrative event sequence for preventing unauthorized access to information resources by utilizing smart data tags to track and control secure enterprise data in accordance with one or more example embodiments. Referring toFIG. 2A, at step201, data tracking computing platform110may receive first enterprise data from enterprise user computing device140. For example, at step201, data tracking computing platform110may receive, via the communication interface (e.g., communication interface113), from an enterprise user computing device (e.g., enterprise user computing device140), first enterprise data. The first enterprise data received by data tracking computing platform110from enterprise user computing device140may, for instance, be and/or include transaction data, inventory data, personal data, user data, and/or other data. In some instances, the first enterprise data received by data tracking computing platform110from enterprise user computing device140may, for instance, be and/or include mortgage application data received by a financial institution from a loan applicant; such information may be securely maintained by the financial institution, and in some instances, select portions of this information might need to be shared within the financial institution and/or with other external parties, such as a settlement agent, insurance company, or the like.

At step202, data tracking computing platform110may determine one or more tags to be applied to the first enterprise data. For example, at step202, data tracking computing platform110may determine one or more tags to be applied to the first enterprise data received from the enterprise user computing device (e.g., enterprise user computing device140).

In some embodiments, determining the one or more tags to be applied to the first enterprise data received from the enterprise user computing device may include identifying at least one tag to be applied to the first enterprise data received from the enterprise user computing device based on user-defined specifications received from the enterprise user computing device. For example, in determining the one or more tags to be applied to the first enterprise data received from the enterprise user computing device (e.g., enterprise user computing device140), data tracking computing platform110may identify at least one tag to be applied to the first enterprise data received from the enterprise user computing device (e.g., enterprise user computing device140) based on user-defined specifications received from the enterprise user computing device (e.g., enterprise user computing device140). For instance, a user of enterprise user computing device140may specify one or more tags to be applied to the first enterprise data, and these specifications may be received by data tracking computing platform110and used by data tracking computing platform110to select and/or otherwise identify at least one tag to be applied to the first enterprise data.

In some embodiments, determining the one or more tags to be applied to the first enterprise data received from the enterprise user computing device may include identifying at least one tag to be applied to the first enterprise data received from the enterprise user computing device based on contents of the first enterprise data received from the enterprise user computing device and one or more machine-learned tagging templates maintained by the computing platform. For example, in determining the one or more tags to be applied to the first enterprise data received from the enterprise user computing device (e.g., enterprise user computing device140), data tracking computing platform110may identify at least one tag to be applied to the first enterprise data received from the enterprise user computing device (e.g., enterprise user computing device140) based on contents of the first enterprise data received from the enterprise user computing device (e.g., enterprise user computing device140) and one or more machine-learned tagging templates maintained by the computing platform (e.g., data tracking computing platform110). For instance, data tracking computing platform110may create, update, and/or use one or more machine-learned tagging templates based on past evaluation and/or tagging of other enterprise data, and these templates may be used by data tracking computing platform110in selecting and/or otherwise identifying at least one tag to be applied to the first enterprise data.

In some embodiments, the one or more tags determined to be applied to the first enterprise data received from the enterprise user computing device may include at least one tag identifying a first computer system that created the first enterprise data and at least one tag identifying a second computer system that is authorized to access the first enterprise data. For example, the one or more tags determined to be applied to the first enterprise data received from the enterprise user computing device (e.g., enterprise user computing device140) by data tracking computing platform110at step202may include at least one tag identifying a first computer system that created the first enterprise data and at least one tag identifying a second computer system that is authorized to access the first enterprise data. For instance, data tracking computing platform110may determine to apply a tag identifying enterprise user computing device140as the computer system that created the first enterprise data and one or more additional tags identifying one or more other computer systems (e.g., administrative computing device150, external computer system160) that are authorized to access the first enterprise data.

In some embodiments, the one or more tags determined to be applied to the first enterprise data received from the enterprise user computing device may include at least one tag identifying a first network zone in which the first enterprise data was created and at least a second network zone in which the first enterprise data is authorized to be accessed. For example, the one or more tags determined to be applied to the first enterprise data received from the enterprise user computing device (e.g., enterprise user computing device140) by data tracking computing platform110at step202may include at least one tag identifying a first network zone in which the first enterprise data was created and at least a second network zone in which the first enterprise data is authorized to be accessed. For instance, the different network zones may encompass different computer systems with different security levels and/or authentication requirements. In addition, these zone-based tags may help to improve information security and/or prevent data loss in enterprise organizations with highly sensitive information. For instance, intelligent firewalls operating in computing environment100may read these tags and prevent data from moving outside of permitted zones and/or report data movement events back to data tracking computing platform110.

At step203, data tracking computing platform110may generate a first smart data object (e.g., based on the one or more tags determined by data tracking computing platform110at step202). For example, at step203, data tracking computing platform110may generate a first smart data object based on the first enterprise data received from the enterprise user computing device (e.g., enterprise user computing device140) and the one or more tags determined to be applied to the first enterprise data received from the enterprise user computing device (e.g., enterprise user computing device140).

In some embodiments, generating the first smart data object based on the first enterprise data received from the enterprise user computing device and the one or more tags determined to be applied to the first enterprise data received from the enterprise user computing device may include generating the first smart data object based on an object template defining a locator portion for storing unencrypted tag information and a payload portion for storing encrypted enterprise information. For example, in generating the first smart data object based on the first enterprise data received from the enterprise user computing device (e.g., enterprise user computing device140) and the one or more tags determined to be applied to the first enterprise data received from the enterprise user computing device (e.g., enterprise user computing device140), data tracking computing platform110may generate the first smart data object based on an object template defining a locator portion for storing unencrypted tag information and a payload portion for storing encrypted enterprise information. For instance, data tracking computing platform110may maintain and/or use this object template for securely managing and storing enterprise data, such that the substantive enterprise data itself is encrypted, while the tags are kept readable and unencrypted on the outside of a secure container for the enterprise data. In some instances, the locator portion of the template and/or the object generated from the template may include a “call home” script that allows the object to communicate back to data tracking computing platform110if the object is transferred to a system that is not connected to an enterprise network associated with data tracking computing platform110or that does not have an enterprise monitoring node associated with the enterprise network associated with data tracking computing platform110. In some instances, the object may have a quiet-mode setting that allows for reduced notifications (e.g., from such a call home script) and/or a self-destruct setting that allows for automatic deletion of secure data (e.g., within such a call home script, e.g., if the object is transferred to an unauthorized system or network location).

In some embodiments, generating the first smart data object based on the first enterprise data received from the enterprise user computing device and the one or more tags determined to be applied to the first enterprise data received from the enterprise user computing device may include populating the locator portion of the first smart data object with the one or more tags determined to be applied to the first enterprise data received from the enterprise user computing device. For example, in generating the first smart data object based on the first enterprise data received from the enterprise user computing device (e.g., enterprise user computing device140) and the one or more tags determined to be applied to the first enterprise data received from the enterprise user computing device (e.g., enterprise user computing device140), data tracking computing platform110may populate the locator portion of the first smart data object with the one or more tags determined to be applied to the first enterprise data received from the enterprise user computing device (e.g., enterprise user computing device140).

In some embodiments, generating the first smart data object based on the first enterprise data received from the enterprise user computing device and the one or more tags determined to be applied to the first enterprise data received from the enterprise user computing device may include: encrypting the first enterprise data received from the enterprise user computing device to produce encrypted enterprise data; and populating the payload portion of the first smart data object with the encrypted enterprise data. For example, in generating the first smart data object based on the first enterprise data received from the enterprise user computing device (e.g., enterprise user computing device140) and the one or more tags determined to be applied to the first enterprise data received from the enterprise user computing device (e.g., enterprise user computing device140), data tracking computing platform110may encrypt the first enterprise data received from the enterprise user computing device (e.g., enterprise user computing device140) to produce encrypted enterprise data. In addition, data tracking computing platform110may populate the payload portion of the first smart data object with the encrypted enterprise data.

In some embodiments, generating the first smart data object based on the first enterprise data received from the enterprise user computing device and the one or more tags determined to be applied to the first enterprise data received from the enterprise user computing device may include generating a sequence of linked objects associated with the first enterprise data received from the enterprise user computing device. For example, in generating the first smart data object based on the first enterprise data received from the enterprise user computing device (e.g., enterprise user computing device140) and the one or more tags determined to be applied to the first enterprise data received from the enterprise user computing device (e.g., enterprise user computing device140), data tracking computing platform110may generate a sequence of linked objects associated with the first enterprise data received from the enterprise user computing device (e.g., enterprise user computing device140). For instance, data tracking computing platform110may generate a plurality of linked objects based on receiving enterprise data that includes a relatively large data set or a sequence of linked data blocks. Each object in the sequence may, for instance, be linked to preceding and/or subsequent blocks, and these objects in the sequence all may have the same and/or similar tags but different payloads. Information identifying the sequence and/or linking the objects may, for instance, be inserted into the locator portion of each object by data tracking computing platform110so that the objects can be rearranged in their correct sequence if there are transferred between systems in a different order.

At step204, data tracking computing platform110may send the first smart data object to enterprise data storage platform120. For example, at step204, data tracking computing platform110may send, via the communication interface (e.g., communication interface113), to an enterprise data storage platform (e.g., enterprise data storage platform120), the first smart data object. In addition, by sending the first smart data object to the enterprise data storage platform (e.g., enterprise data storage platform120), data tracking computing platform110may cause the enterprise data storage platform (e.g., enterprise data storage platform120) to store the first smart data object in a repository comprising a plurality of smart data objects maintained by the enterprise data storage platform (e.g., enterprise data storage platform120).

Referring toFIG. 2B, at step205, enterprise data storage platform120may store the first smart data object in a repository that includes a plurality of smart data objects maintained by enterprise data storage platform120(e.g., based on and/or in response to receiving the first smart data object from data tracking computing platform110). At step206, data tracking computing platform110may update a first data movement pattern associated with the first smart data object. For example, at step206, data tracking computing platform110may update a first data movement pattern corresponding to the first smart data object based on sending the first smart data object to the enterprise data storage platform (e.g., enterprise data storage platform120). For instance, data tracking computing platform110may update a first data movement pattern corresponding to the first smart data object to indicate that the first smart data object was created based on enterprise data received from enterprise user computing device140and stored with enterprise data storage platform120. As this data object moves through the computing environment, the data movement pattern may, for instance, track where the object has been and where it is going; in addition, data tracking computing platform110may record the data movement pattern in a blockchain maintained by data tracking computing platform110, along with one or more other data movement patterns for other data objects. Thus, data tracking computing platform110may track the movement of data as well as how different objects with different tags move through the computing environment, which may enable data tracking computing platform110to identify future out-of-pattern data movement events, as illustrated below.

At step207, enterprise computing infrastructure130may request the first smart data object from enterprise data storage platform120. For instance, at step207, enterprise computing infrastructure130may receive an access request (e.g., from a user of enterprise computing infrastructure130and/or another system included in computing environment100, such as enterprise user computing device140, administrative computing device150, external computer system160) and may send a request to enterprise data storage platform120for the first smart data object based on the access request.

At step208, data tracking computing platform110may receive, from enterprise data storage platform120, a first movement notification (which may, e.g., be generated by enterprise data storage platform120based on receiving the request for the first smart data object from enterprise computing infrastructure130). For example, at step208, data tracking computing platform110may receive, via the communication interface (e.g., communication interface113), from the enterprise data storage platform (e.g., enterprise data storage platform120), a first movement notification indicating that the first smart data object is being transferred to enterprise computing infrastructure (e.g., enterprise computing infrastructure130) based on an access request. For instance, the first movement notification received by data tracking computing platform110may indicate that the first smart data object is being transferred to enterprise computing infrastructure130for manipulation based on an access request received from one or more other enterprise devices and/or non-enterprise devices.

Referring toFIG. 2C, at step209, data tracking computing platform110may update the first data movement pattern (e.g., based on the movement notification received from enterprise data storage platform120). For example, at step209, data tracking computing platform110may update the first data movement pattern corresponding to the first smart data object based on receiving the first movement notification indicating that the first smart data object is being transferred to the enterprise computing infrastructure (e.g., enterprise computing infrastructure130) based on the access request. For instance, data tracking computing platform110may add information to the first data movement pattern corresponding to the first smart data object to indicate that the first smart data object is being transferred to enterprise computing infrastructure130based on the access request. As data objects move in the computing environment, recipient systems and/or monitoring nodes deployed on such systems may report the arrival and/or presence of specific data objects back to data tracking computing platform110, for instance, by sending messages with object identifiers and/or tag information pulled from the locator portions of corresponding objects back to data tracking computing platform110.

At step210, data tracking computing platform110may detect an unauthorized movement event. For example, at step210, data tracking computing platform110may detect an unauthorized movement event involving the first smart data object based on the first data movement pattern corresponding to the first smart data object. For instance, data tracking computing platform110may detect the unauthorized movement event involving the first smart data object based on determining that the recently received movement notification is out of pattern for the first smart data object and/or for similar data objects having similar tags as the first smart data object (e.g., based on one or more movement patterns of such similar objects having similar tags).

At step211, data tracking computing platform110may generate one or more alert messages. For example, at step211, in response to detecting the unauthorized movement event involving the first smart data object, data tracking computing platform110may generate one or more alert messages comprising alert information associated with the unauthorized movement event involving the first smart data object. At step212, data tracking computing platform110may send one or more alert messages to enterprise user computing device140. For example, at step212, data tracking computing platform110may send, via the communication interface (e.g., communication interface113), to the enterprise user computing device (e.g., enterprise user computing device140), at least one alert message of the one or more alert messages. By sending the at least one alert message of the one or more alert messages to enterprise user computing device140, data tracking computing platform110may cause enterprise user computing device140to display and/or otherwise present a graphical user interface similar to graphical user interface300, which is depicted inFIG. 3. As seen inFIG. 3, graphical user interface300may include text and/or other information identifying the detected unauthorized movement event (e.g., “An unauthorized movement event has been detected involving: first smart data object; tags: YYY-AA; ZZZ-AA; system: {enterprise computing infrastructure}”) and/or information identifying one or more remedial actions (e.g., “The data transfer will be halted automatically to enforce the data perimeter defined for this object.”).

Referring toFIG. 2D, at step213, enterprise user computing device140may display the one or more alert messages received from data tracking computing platform110. For instance, at step213, enterprise user computing device140may display and/or otherwise present graphical user interface300.

At step214, data tracking computing platform110may halt the transfer of the first smart data object. For example, at step214, in response to detecting the unauthorized movement event involving the first smart data object, data tracking computing platform110may halt a transfer of the first smart data object. For instance, after data tracking computing platform110detects that the data movement associated with the unauthorized movement event involving the first smart data object is out of pattern or that secure data has arrived at the wrong endpoint, data tracking computing platform110may halt the data transfer and/or reroute or move the data to the correct system (e.g., by generating and/or sending one or more commands to intermediary and/or endpoint systems to stop an in-progress transfer, terminate one or more connections, and/or execute other functions).

At step215, enterprise computing infrastructure130may request a second smart data object from enterprise data storage platform120. For instance, at step215, enterprise computing infrastructure130may receive an access request (e.g., from a user of enterprise computing infrastructure130and/or another system included in computing environment100, such as enterprise user computing device140, administrative computing device150, external computer system160) and may send a request to enterprise data storage platform120for the second smart data object based on the access request.

At step216, data tracking computing platform110may receive, from enterprise data storage platform120, a second movement notification (which may, e.g., be generated by enterprise data storage platform120based on receiving the request for the second smart data object from enterprise computing infrastructure130). For example, at step216, data tracking computing platform110may receive, via the communication interface (e.g., communication interface113), from the enterprise data storage platform (e.g., enterprise data storage platform120), a second movement notification indicating that a second smart data object is being transferred from a first network location to a second network location based on a second access request. In addition, the second smart data object may be different from the first smart data object. For instance, the second movement notification received by data tracking computing platform110may indicate that the second smart data object is being transferred to enterprise computing infrastructure130for manipulation based on an access request received from one or more other enterprise devices and/or non-enterprise devices.

Referring toFIG. 2E, at step217, data tracking computing platform110may update the second data movement pattern (e.g., based on the movement notification received from enterprise data storage platform120). For example, at step217, data tracking computing platform110may update a second data movement pattern corresponding to the second smart data object based on receiving the second movement notification indicating that the second smart data object is being transferred from the first network location to the second network location based on the second access request. For instance, data tracking computing platform110may add information to the second data movement pattern corresponding to the second smart data object to indicate that the second smart data object is being transferred from the first network location to the second network location based on the second access request. As data objects move in the computing environment, recipient systems and/or monitoring nodes deployed on such systems may report the arrival and/or presence of specific data objects back to data tracking computing platform110, for instance, by sending messages with object identifiers and/or tag information pulled from the locator portions of corresponding objects back to data tracking computing platform110.

At step218, data tracking computing platform110may evaluate one or more tags of the second smart data object. For example, at step218, data tracking computing platform110may evaluate one or more tags associated with the second smart data object. At step219, data tracking computing platform110may determine one or more relationships associated with the second smart data object based on the one or more tags associated with the second smart data object. For example, at step219, data tracking computing platform110may determine that the one or more tags associated with the second smart data object are related to one or more tags associated with the first smart data object. In determining that the one or more tags associated with the second smart data object are related to one or more tags associated with the first smart data object, data tracking computing platform110may recognize, identify, and/or otherwise determine that more than a predetermined threshold number of tags associated with the second smart data object match corresponding tags associated with the first smart data object. Such a threshold may, for instance, be a seventy-five percent match in some instances.

At step220, data tracking computing platform110may detect an unauthorized movement event. For example, at step220, data tracking computing platform110may detect an unauthorized movement event involving the second smart data object based on the first data movement pattern corresponding to the first smart data object. For instance, data tracking computing platform110may detect the unauthorized movement event involving the second smart data object based on determining that the recently received movement notification is out of pattern for the second smart data object in view of the first data movement pattern corresponding to the first smart data object. For instance, because both of these data objects and other data objects in the computing environment are tagged with identifiers, data tracking computing platform110and its machine learning engine may track types of data objects moving in specific patterns. This tracking may, for instance, enable data tracking computing platform110to generate alerts when similar types of data are moving in directions that are out of alignment with patterns for those types of data.

Referring toFIG. 2F, at step221, data tracking computing platform110may generate one or more alert messages. For example, at step221, in response to detecting the unauthorized movement event involving the second smart data object, data tracking computing platform110may generate one or more alert messages comprising alert information associated with the unauthorized movement event involving the second smart data object. At step222, data tracking computing platform110may send one or more alert messages to enterprise user computing device140. For example, at step222, data tracking computing platform110may send, via the communication interface (e.g., communication interface113), to the enterprise user computing device (e.g., enterprise user computing device140), at least one alert message of the one or more alert messages. By sending the at least one alert message of the one or more alert messages to enterprise user computing device140, data tracking computing platform110may cause enterprise user computing device140to display and/or otherwise present a graphical user interface similar to graphical user interface400, which is depicted inFIG. 4. As seen inFIG. 4, graphical user interface400may include text and/or other information identifying the detected unauthorized movement event (e.g., “An unauthorized movement event has been detected involving: second smart data object; tags: YYY-AA; QQQ-BB; system: {enterprise computing infrastructure}”) and/or information identifying one or more remedial actions (e.g., “The data transfer will be halted automatically to enforce the data perimeter typically associated with objects of this type.”).

At step223, enterprise user computing device140may display the one or more alert messages received from data tracking computing platform110. For instance, at step223, enterprise user computing device140may display and/or otherwise present graphical user interface400. At step224, data tracking computing platform110may halt a transfer of the second smart data object. For instance, after data tracking computing platform110detects that the data movement associated with the unauthorized movement event involving the second smart data object is out of pattern or that secure data has arrived at the wrong endpoint, data tracking computing platform110may halt the data transfer and/or reroute or move the data to the correct system (e.g., by generating and/or sending one or more commands to intermediary and/or endpoint systems to stop an in-progress transfer, terminate one or more connections, and/or execute other functions).

FIG. 5depicts an illustrative method for preventing unauthorized access to information resources by utilizing smart data tags to track and control secure enterprise data in accordance with one or more example embodiments. Referring toFIG. 5, at step505, a computing platform having at least one processor, a communication interface, and memory may receive, via the communication interface, from an enterprise user computing device, first enterprise data. At step510, the computing platform may determine one or more tags to be applied to the first enterprise data received from the enterprise user computing device. At step515, the computing platform may generate a first smart data object based on the first enterprise data received from the enterprise user computing device and the one or more tags determined to be applied to the first enterprise data received from the enterprise user computing device. At step520, the computing platform may send, via the communication interface, to an enterprise data storage platform, the first smart data object, and sending the first smart data object to the enterprise data storage platform may cause the enterprise data storage platform to store the first smart data object in a repository comprising a plurality of smart data objects maintained by the enterprise data storage platform.