Patent Publication Number: US-11393046-B1

Title: System and method for perpetual rekeying of various data columns with a frequency and encryption strength based on the sensitivity of the data columns

Description:
BACKGROUND 
     Data security is rapidly becoming the most important, and potentially limiting factor in the fields of data store, data security, and data processing. While the emergence of portable data, “cloud computing,” and other forms of distributed data processing and data sharing have the potential to provide truly revolutionary and paradigm shifting advances in human activity, the current inability to provide adequate levels of data security has prevented the realization of the full potential of these advances and capabilities. 
     In a cloud computing environment, an organization can control which resources a given party has access to by controlling access secrets, such as passwords and other authentication credentials that enable users to gain access to data. Nevertheless, in spite of the tremendous lengths to which organizations go to prevent unauthorized access to data, fraudsters still find ways to access the data. For example, fraudsters often find and exploit flaws in security and access protocols in order to gain unauthorized access to data. When this occurs, it is possible that fraudsters may find and exploit very sensitive data related to users of the data management system. 
     Due to these risks, traditional data management systems take further measures to prevent fraudsters who have gained access to sensitive data from making use of the sensitive data. For example, traditional data management systems typically encrypt their data so that if a fraudster gains access to the data, the data is not in a form that is useful to the fraudster without the proper encryption keys. However, resourceful fraudsters, given enough time, can still find ways to break the encryption and gain full access to the data. 
     Another common problem with traditional data management systems is that many traditional data management systems only encrypt data a single time. Once the data is encrypted, these traditional data management systems never re-encrypt the data. If a fraudster gains access to the encrypted data, the fraudster may have an indefinite period of time during which to break the encryption. Some traditional data management systems may re-encrypt data on occasion. However, this weak re-encryption is typically handled in an ad-hoc manner such that years may pass before an organization that maintains a data management system will decide to manually enact a re-encryption process. A fraudster that gains access to the encrypted data may have years to break the encryption before the data is re-encrypted. Eventually, the fraudster will succeed. 
     Furthermore, some traditional data management systems may encrypt an entire database with a single encryption key. If a fraudster breaks this single encryption scheme, the fraudster gains exploitable access to the entire data base. Other traditional data management systems may encrypt various portions of a database with different encryption keys. However, these traditional data management systems still suffer from the drawback that if a fraudster breaks the encryption on one portion of the database, the fraudster will be able to exploit that portion of the database to the detriment of the data management system and the users whose data has been compromised. 
     Consequently, there is a long standing technical problem in the data management arts in the form of a need to provide more effective data encryption procedures. 
     SUMMARY 
     Embodiments of the present disclosure address some of the shortcomings associated with current data storage security schemes by providing methods and systems that provide automatic and continuous re-encryption of data. Embodiments of the present disclosure provide a data management system that stores a large amount of data in one or more data stores. The data is organized in data groups. When the data management system initially writes data to the one or more data stores, the data management system writes the data in an encrypted format. After the data management system has initially encrypted the data, the data management system enhances security beyond merely initially encrypting the data a single time. In particular, the data management system continuously and automatically re-encrypts the data in a periodic manner in accordance with a re-encryption policy that determines how often the data management system will re-encrypt the data. Furthermore, the data management system re-encrypts each data group with a respective periodicity and with a respective level of encryption. The re-encryption periodicity and the level of encryption for each data group can be selected based on the sensitivity of the data in each data group. Data groups that include more sensitive data can be re-encrypted more frequently and with higher levels of encryption than data groups that include less sensitive data. The re-encryption periodicity can be selected so that the data management system automatically re-encrypts the data within a sufficiently short period of time to ensure that it would be highly improbable for a fraudster who gains access to the data to break the encryption on any of the data columns before the data management system re-encrypts the data. In this way, even if a fraudster gains unauthorized access to the data, the fraudster will not be able to break the encryption of the data before the data management system re-encrypts the data. The probability that a fraudster can break the encryption on a sensitive data group is further reduced because the sensitive data group is re-encrypted more frequently and with stronger encryption. Embodiments of the present disclosure overcome some of the drawbacks of traditional data management systems by automatically and continuously re-encrypting data and by re-encrypting individual data groups with different periodicities and strengths based on the sensitivity of the data groups. This can severely limit the ability of a fraudster to make use of data to which the fraudster has gained access. This also eliminates problems associated with manual ad hoc re-encryption procedures in which very long stretches of time may elapse before any re-encryption takes place or in which unfocused technicians may forget to implement any re-encryption processes. Additionally, providing different encryption to the various data groups can eliminate the ability of the fraudster to gain any amount of exploitable information by breaking encryption on a single data group because the data entries in a given data column cannot, by themselves, be linked to any individual or to corroborating data entries from other data groups. Embodiments of the present disclosure enhance the security and reliability of data management systems and reduce the wasteful use of human and computing resources in implementing outdated, unwieldy, and insufficient data security procedures. This transforms computing systems into more efficient computing systems. 
     In one embodiment, the data management system stores data related to a plurality of individuals. For example, data related to any particular individual can include a user identification number of the individual, a name of the individual, a Social Security number of the individual, a home address of the individual, a birth date of the individual, an income of the individual, an employer of the individual, and many other kinds of data. The data management system stores these types of data for large number of individuals. The data management system organizes the data in data groups. Each data group can be a data column or can include multiple data columns. One data column can include a list of user identification numbers of the individuals. One data column can include a list of given names of the individuals. One data column can include a list of Social Security numbers of the individuals. One data called can include a list of home addresses of the individuals. One data column can include a list of dates of birth of the individuals. One data column can include a list of incomes of the individuals. One data column can include a list of employers of the individuals. Thus, each data column includes a plurality of data entries of a particular data type or category. Each data entry is related to one of the individuals. 
     Some data columns include data that is more sensitive than data in other data columns. For example, a data column that includes Social Security numbers may be considered more sensitive than a data column that includes ZIP Codes. The data management system can devote more system resources to the re-encryption of those data columns that include more sensitive data. 
     In one embodiment, the data management system encrypts and re-encrypts each of the data columns with a level of encryption and a re-encryption periodicity that depends in part on the sensitivity of the data column. In one example, the data management system can encrypt the data column that includes Social Security numbers with 128-bit encryption and a re-encryption periodicity of 24 hours. The data management system can encrypt the data column that includes ZIP Codes with 64-bit encryption and a re-encryption periodicity of 7 days. Thus, system resources can be selectively managed such that more system resources are devoted to the re-encryption of high-priority data than to low priority data. 
     A further benefit of organizing the data in data columns is that a fraudster that wants to exploit the data will have to break encryption on multiple data columns in order to be able to exploit any of the data. For example, if the fraudster gains access to the data and manages to break the encryption on the data column that includes Social Security numbers, the Social Security numbers are largely useless to the fraudster if the fraudster cannot also break the encryption on the data columns that includes the given names of the individuals, the dates of birth of the individuals, etc. 
     In one embodiment, the data management system initially encrypts each data group with one or more encryption keys. The data management system then periodically re-encrypts each data group. When the data management system re-encrypts a given data group, the data management system reads the data from the data group in the data store by decrypting the data group using the one or more encryption keys associated with the most recent encryption process of the data group. The data management system then writes the data of the data group back to the data store in an encrypted format utilizing one or more new encryption keys that are different from the encryption keys associated with the previous encryption process of the data group. In this way, the data management system re-encrypts the data from a data group in the data store. After the data management system has re-encrypted the data group, the data management system again re-encrypts the data group within a time period specified by the selected periodicity for that data group. Each time the data management system re-encrypts the data group, the data management system reads the data in the data column from the data store and decrypts the data, then writes the data back to the data store and re-encrypts it. The data management system automatically and continuously re-encrypts each data group in this manner. In this way, the data management system continuously and automatically re-encrypts data in a data store. 
     In one embodiment, the data management system includes an encryption management module. The encryption management module manages encryption and re-encryption of the data stored in a data store. The encryption management module includes re-encryption policy data that defines a policy for re-encrypting the data. The re-encryption policy data can define a respective re-encryption policy for each data group. The re-encryption policy data can include, for each data group, periodicity data that defines the periodicity or frequency with which the data management system will re-encrypt the data group. 
     In one embodiment, the periodicity data for a particular data group can define that the data group should be re-encrypted once every specified number of months. In one embodiment, the periodicity data for a particular data group can define that the data group should be re-encrypted once every specified number of weeks. In one embodiment, the periodicity data for a particular data group can define that the data group should be re-encrypted once every specified number of days. In one embodiment, the periodicity data for a particular data group can define that the data group should be re-encrypted once every specified number of hours. Thus, the periodicity data can specify a re-encryption period of months, weeks, days, hours, or even minutes. The encryption management module will cause continuous re-encryption of the data groups based on the periodicity data. 
     In one embodiment, the data management system can include an encryption policy control module. The encryption policy control module enables an expert, a technician, an authorized application, or an authorized computing system to enter new re-encryption policy data to the encryption management module. In this way, the re-encryption policy data can be initially provided, can be adjusted, or revised as needed by authorized personnel, applications, or systems. 
     In one embodiment, the data management system includes an encryption engine that performs the encryption and re-encryption of the data under the control of the encryption management module. The encryption engine can include encryption algorithm data that defines one or more algorithms with which the data will be encrypted and re-encrypted. The encryption engine periodically re-encrypts the data groups in accordance with the re-encryption policy data under the direction of the encryption management module. The encryption engine utilizes or generates encryption key data including, for each data group, one or more encryption keys to encrypt the data in accordance with the one or more encryption algorithms of the encryption algorithm data. In one embodiment, the encryption engine utilizes or generates, for each data group, decryption key data including one or more decryption keys for decrypting the data as part of a re-encryption process. 
     In one embodiment, the data store includes one or more physical or virtual data storage devices. The data storage devices can be located in diverse locations. For example, the data management system can include multiple data centers each including a large number of data storage devices. The multiple data centers can be located in various geographic locations around the world. These multiple data centers and data storage devices can collectively store the data. A single data group of the data may include data stored in a single location or in multiple locations. 
     In one embodiment, the data management system can include a user services provider system that provides data storage and data management services for a large number of users. The individuals associated with the data can correspond to users of the user services provider system. Thus, the data stored in the data store can include data related to the users of the user services provider system. In some cases, the users may not directly access the data. Instead the users access the user services provider system in order to receive services from the user services provider system. The user services provider system may access the data in order to provide various services to the user related to the data. In some cases, the user may directly access the data through the user services provider system. 
     In one embodiment, the user services provider system can include a financial management system. The financial management system can include one or more of a tax return preparation system, a payroll management system, a budgeting system, or a system that provides any other kind of financial management service to users. The data can include financial data related to the large number of users. In this case, the data can include the names of the users, Social Security numbers of the users, identification numbers of the users, birthdates of the users, addresses of the users, financial transaction data related to the users, banking data, loan data, credit card data, and many other kinds of financial data related to the users. Each data group can be a data column that includes a single data type or category of the financial related data. 
     When users access the financial management system, the financial management system accesses the data related to the users in order to provide financial management services to the user, such as a tax return preparation interview in order to prepare the tax return. In this case, the user may not directly access the data. Instead the financial management system accesses the data and helps the user to fill out electronic versions of tax forms. Thus, the user may not access the data in order to directly retrieve or download the user data, but instead the financial management system accesses the data, in addition to or including data provided by the user, in order to provide tax return preparation services to the user. 
     The financial data related to the users can include very sensitive data. If this very sensitive data is compromised by a fraudster in a way that the sensitive data can be made use of by the fraudster, e.g. by breaking the encryption on the sensitive data, the users of the financial management system can suffer great harm. Accordingly, the data management system, of which the financial management system is a part, continuously and automatically re-encrypts the data columns of the financial related data. Thus, even if a fraudster is able to access the encrypted financial data, the financial data would be re-encrypted so quickly as to prevent the fraudster from being able to break the encryption before the financial data is re-encrypted. Even if the fraudster is able to break the encryption on any given data column, the fraudster will not be able to exploit the data unless the fraudster is also able to break the encryption on other data columns that include data entries that can be linked to the data entries in the first data column. Furthermore, because the most sensitive data columns are re-encrypted more frequently and with stronger encryption, even if a fraudster can break the encryption on one or more of the data columns, it is unlikely that the fraudster can break the encryption on the more sensitive data columns. In this way, the data management system enhances the security of the users&#39; financial data. 
     In one example, the data management system manages the data in conjunction with a third-party cloud platform service provider that provides cloud platform services. The cloud platform service provider includes a cloud platform service provider such as Amazon Web Services (AWS), Microsoft Azure, Rackspace, Joyent, Google Cloud, or other cloud platform service providers. The data store can include data centers external to the data management system. The data management system can work with the cloud platform service provider to manage the data in various external and internal data stores. 
     The disclosed embodiments provide one or more technical solutions to the technical problem of security deficiencies in data management systems by automatically and continuously re-encrypting data in a data store. These and other embodiments of the data management system are discussed in further detail below. 
     Providing automatic and continuous re-encryption of data in a data store is a technical solution to a long standing technical problem and is not an abstract idea for at least a few reasons. First, providing automatic and continuous re-encryption of data in a data store is not an abstract idea because it is not merely an idea itself (e.g., can be performed mentally or using pen and paper). Second, providing automatic and continuous re-encryption of data in a data store is not an abstract idea because it is not a fundamental economic practice (e.g., is not merely creating a contractual relationship, hedging, mitigating a settlement risk, etc.). Third, providing automatic and continuous re-encryption of data in a data store is not an abstract idea because it is not a method of organizing human activity (e.g., managing a game of bingo). Fourth, although mathematics may be used in encrypting and re-encrypting data, the disclosed and claimed methods and systems of providing automatic and continuous re-encryption of data in a data store are not an abstract idea because the methods and systems are not simply a mathematical relationship/formula. 
     In addition, providing automatic and continuous re-encryption of data in a data store is not an abstract idea because improving the security of users&#39; data allows for significant improvement to the technical fields of user experience, customer service, customer retention, and electronic data management, according to one embodiment. The present disclosure adds significantly to the field of electronic data management because the disclosed data management system: decreases the likelihood that a user will be forced to undergo the psychological insecurity of learning that their personal data may have been comprised; increases the likelihood that users will not suffer harmful real world consequences from their personal data actually being obtained and exploited by fraudsters; and increases the likelihood of improving/maintaining a user&#39;s trust in the data management system, according to one embodiment. 
     As a result, embodiments of the present disclosure allow for reduced usage of processor cycles, memory, and power consumption, by reducing the time and resources spent by data management systems to increase access controls and other aspects of data security to compensate for deficient data encryption. Consequently, computing and communication systems implementing or providing the embodiments of the present disclosure are transformed into more operationally efficient devices and systems. 
     In addition to improving overall computing performance, providing automatic and continuous re-encryption of data in a data store significantly improves the field of data management systems by reducing the inefficient and ad-hoc nature of data encryption management, according to one embodiment. Therefore, both human and non-human resources are utilized more efficiently. Furthermore, by providing automatic and continuous re-encryption of data in a data store, loyalty in the data management system is increased, which results in repeat customers, efficient re-encryption and security practices, and reduced abandonment of use of the data management system, according to one embodiment. 
    
    
     
       BRIEF DESCRIPTION OF THE DRAWINGS 
         FIG. 1  is a functional block diagram of software architecture for automatically and continuously re-encrypting data in a data store, in accordance with one embodiment; 
         FIG. 2  is a representation of data organized into data columns in relation to software architecture for automatically and continuously re-encrypting data in a data store, in accordance with one embodiment. 
         FIG. 3  is a block diagram of a process for automatically and continuously re-encrypting data in a data store in accordance with one embodiment; and 
         FIG. 4  is a flow chart diagram of a process for automatically and continuously re-encrypting data in a data store in accordance with one embodiment. 
         FIG. 5  is a flow chart diagram of a process for automatically and continuously re-encrypting data in a data store in accordance with one embodiment. 
     
    
    
     Common reference numerals are used throughout the FIGS. and the detailed description to indicate like elements. One skilled in the art will readily recognize that the above FIGS. are examples and that other architectures, modes of operation, orders of operation and elements/functions can be provided and implemented without departing from the characteristics and features of the invention, as set forth in the claims. 
     DETAILED DESCRIPTION 
     Embodiments will now be discussed with reference to the accompanying FIGS., which depict one or more exemplary embodiments. 
     Embodiments may be implemented in many different forms and should not be construed as limited to the embodiments set forth herein, shown in the FIGS., and/or described below. Rather, these exemplary embodiments are provided to allow a complete disclosure that conveys the principles of the invention, as set forth in the claims, to those of skill in the art. 
     Herein, the term “production environment” includes the various components, or assets, used to deploy, implement, access, and use, a given application as that application is intended to be used. In various embodiments, production environments include multiple assets that are combined, communicatively coupled, virtually and/or physically connected, and/or associated with one another, to provide the production environment implementing the application. 
     As specific illustrative examples, the assets making up a given production environment can include, but are not limited to, one or more computing environments used to implement the application in the production environment such as a data center, a cloud computing environment, a dedicated hosting environment, and/or one or more other computing environments in which one or more assets used by the application in the production environment are implemented; one or more computing systems or computing entities used to implement the application in the production environment; one or more virtual assets used to implement the application in the production environment; one or more supervisory or control systems, such as hypervisors, or other monitoring and management systems, used to monitor and control assets and/or components of the production environment; one or more communications channels for sending and receiving data used to implement the application in the production environment; one or more access control systems for limiting access to various components of the production environment, such as firewalls and gateways; one or more traffic and/or routing systems used to direct, control, and/or buffer, data traffic to components of the production environment, such as routers and switches; one or more communications endpoint proxy systems used to buffer, process, and/or direct data traffic, such as load balancers or buffers; one or more secure communication protocols and/or endpoints used to encrypt/decrypt data, such as Secure Sockets Layer (SSL) protocols, used to implement the application in the production environment; one or more databases used to store data in the production environment; one or more internal or external services used to implement the application in the production environment; one or more backend systems, such as backend servers or other hardware used to process data and implement the application in the production environment; one or more software systems used to implement the application in the production environment; and/or any other assets/components making up an actual production environment in which an application is deployed, implemented, accessed, and run, e.g., operated, as discussed herein, and/or as known in the art at the time of filing, and/or as developed after the time of filing. 
     As used herein, the terms “computing system”, “computing device”, and “computing entity”, include, but are not limited to, a virtual asset; a server computing system; a workstation; a desktop computing system; a mobile computing system, including, but not limited to, smart phones, portable devices, and/or devices worn or carried by a user; a database system or storage cluster; a switching system; a router; any hardware system; any communications system; any form of proxy system; a gateway system; a firewall system; a load balancing system; or any device, subsystem, or mechanism that includes components that can execute all, or part, of any one of the processes and/or operations as described herein. 
     In addition, as used herein, the terms computing system and computing entity, can denote, but are not limited to, systems made up of multiple: virtual assets; server computing systems; workstations; desktop computing systems; mobile computing systems; database systems or storage clusters; switching systems; routers; hardware systems; communications systems; proxy systems; gateway systems; firewall systems; load balancing systems; or any devices that can be used to perform the processes and/or operations as described herein. 
     As used herein, the term “computing environment” includes, but is not limited to, a logical or physical grouping of connected or networked computing systems and/or virtual assets using the same infrastructure and systems such as, but not limited to, hardware systems, software systems, and networking/communications systems. Typically, computing environments are either known environments, e.g., “trusted” environments, or unknown, e.g., “untrusted” environments. Typically, trusted computing environments are those where the assets, infrastructure, communication and networking systems, and security systems associated with the computing systems and/or virtual assets making up the trusted computing environment, are either under the control of, or known to, a party. 
     In various embodiments, each computing environment includes allocated assets and virtual assets associated with, and controlled or used to create, and/or deploy, and/or operate an application. 
     In various embodiments, one or more cloud computing environments are used to create, and/or deploy, and/or operate an application that can be any form of cloud computing environment, such as, but not limited to, a public cloud; a private cloud; a Virtual Private Cloud (VPC); or any other cloud-based infrastructure, sub-structure, or architecture, as discussed herein, and/or as known in the art at the time of filing, and/or as developed after the time of filing. 
     In many cases, a given application or service may utilize, and interface with, multiple cloud computing environments, such as multiple VPCs, in the course of being created, and/or deployed, and/or operated. 
     As used herein, the term “virtual asset” includes any virtualized entity or resource, and/or virtualized part of an actual, or “bare metal” entity. In various embodiments, the virtual assets can be, but are not limited to, virtual machines, virtual servers, and instances implemented in a cloud computing environment; databases associated with a cloud computing environment, and/or implemented in a cloud computing environment; services associated with, and/or delivered through, a cloud computing environment; communications systems used with, part of, or provided through, a cloud computing environment; and/or any other virtualized assets and/or sub-systems of “bare metal” physical devices such as mobile devices, remote sensors, laptops, desktops, point-of-sale devices, etc., located within a data center, within a cloud computing environment, and/or any other physical or logical location, as discussed herein, and/or as known/available in the art at the time of filing, and/or as developed/made available after the time of filing. 
     In various embodiments, any, or all, of the assets making up a given production environment discussed herein, and/or as known in the art at the time of filing, and/or as developed after the time of filing, can be implemented as one or more virtual assets. 
     In one embodiment, two or more assets, such as computing systems and/or virtual assets, and/or two or more computing environments, are connected by one or more communications channels including but not limited to, Secure Sockets Layer communications channels and various other secure communications channels, and/or distributed computing system networks, such as, but not limited to: a public cloud; a private cloud; a combination of different network types; a public network; a private network; a satellite network; a cable network; or any other network capable of allowing communication between two or more assets, computing systems, and/or virtual assets, as discussed herein, and/or available or known at the time of filing, and/or as developed after the time of filing. 
     As used herein, the term “network” includes, but is not limited to, any network or network system such as, but not limited to, a peer-to-peer network, a hybrid peer-to-peer network, a Local Area Network (LAN), a Wide Area Network (WAN), a public network, such as the Internet, a private network, a cellular network, any general network, communications network, or general network/communications network system; a wireless network; a wired network; a wireless and wired combination network; a satellite network; a cable network; any combination of different network types; or any other system capable of allowing communication between two or more assets, virtual assets, and/or computing systems, whether available or known at the time of filing or as later developed. 
     As used herein, the term “user” includes, but is not limited to, any party, parties, entity, or entities using, or otherwise interacting with any of the methods or systems discussed herein. For instance, in various embodiments, a user can be, but is not limited to, a person, a commercial entity, an application, a service, or a computing system. 
     As used herein, the term “relationship(s)” includes, but is not limited to, a logical, mathematical, statistical, or other association between one set or group of information, data, and/or users and another set or group of information, data, and/or users, according to one embodiment. The logical, mathematical, statistical, or other association (i.e., relationship) between the sets or groups can have various ratios or correlation, such as, but not limited to, one-to-one, multiple-to-one, one-to-multiple, multiple-to-multiple, and the like, according to one embodiment. As a non-limiting example, if the disclosed system and method for providing access control and enhanced encryption determines a relationship between a first group of data and a second group of data, then a characteristic or subset of a first group of data can be related to, associated with, and/or correspond to one or more characteristics or subsets of the second group of data, or vice-versa, according to one embodiment. Therefore, relationships may represent one or more subsets of the second group of data that are associated with one or more subsets of the first group of data, according to one embodiment. In one embodiment, the relationship between two sets or groups of data includes, but is not limited to similarities, differences, and correlations between the sets or groups of data. 
     As used herein, the term “data store” or “data storage device” includes, but is not limited to, any physical or virtual data source or storage device. For instance, in various embodiments, a data store or storage container can be, but is not limited to, one or more of a hard disk drive, a solid-state drive, an EEPROM, an optical disk, a server, a memory array, a database, a virtual database, a virtual memory, a virtual data directory, or other physical or virtual data sources. 
     As used herein, the term file includes, but is not limited to, a data entity that is a sequence of bytes that can be accessed individually or collectively. 
     As used herein the term data object includes, but is not limited to, a data entity that is stored and retrieved as a whole, or in large chunks, rather than as a sequence of bytes. 
     Hardware Architecture 
       FIG. 1  illustrates a block diagram of a production environment  100  for automatically and continuously re-encrypting data in a data store, according to one embodiment. Embodiments of the present disclosure provide methods and systems for automatically and continuously re-encrypting data in a data store, according to one embodiment. Embodiments of the present disclosure store large amounts of data in a data store. The data is related to a large number of individuals and is organized in data groups. When data is first written to or stored in the data store, embodiments of the present disclosure store the data in an encrypted format in accordance with one or more encryption processes. Each data group is encrypted with a different respective encryption. Thereafter, embodiments of the present disclosure continuously and automatically re-encrypt the data groups in the data store. In particular, embodiments re-encrypt the data groups in accordance with a re-encryption policy that defines, for each data group, a periodicity and a level of encryption with which the data group will be re-encrypted. The periodicity and the level of encryption for a given data group can be selected based on the sensitivity of the data included in the data group such that more sensitive data groups can be re-encrypted more frequently and with stronger levels of encryption. The periodicity can include a period of months, weeks, days, hours, or minutes. Embodiments of the present disclosure will re-encrypt each data group at least once in each defined period for that data group. The re-encryption period for a given group can be set to be sufficiently small so that breaking the encryption on that data group before the data group is re-encrypted is so improbable as to be practically impossible. Thus, if a fraudster gains access to the encrypted data groups, the fraudster will not be able to decrypt or break the encryption on any of the data groups before the data groups are re-encrypted. Because the data is perpetually re-encrypted, the fraudster never has sufficient time to decrypt the data before the data is re-encrypted with a different encryption. Furthermore, because the more sensitive data groups are re-encrypted more frequently and with stronger encryption, it is even more unlikely that a fraudster can break the encryption on a data group that includes sensitive data. By providing automatic and continuous re-encryption of data in a data store, security of the data is increased. 
     In addition, the disclosed method and system for automatically and continuously re-encrypting data in a data store provides for significant improvements to the technical fields of electronic data security, data processing, data management, and user experience. 
     In addition, as discussed above, the disclosed method and system for automatically and continuously re-encrypting data in a data store provides for the processing and storage of smaller amounts of data related to security systems, i.e., fewer security systems are needed and less effective security measures can be discarded; thereby eliminating unnecessary data analysis and storage. Consequently, using the disclosed method and system for automatically and continuously re-encrypting data in a data store results in more efficient use of human and non-human resources, fewer processor cycles being utilized, reduced memory utilization, and less communications bandwidth being utilized to relay data to, and from, backend systems and client systems, and various investigative systems and parties. As a result, computing systems are transformed into faster, more efficient, and more effective computing systems by implementing the method and system for automatically and continuously re-encrypting data in a data store. 
     The production environment  100  includes a service provider computing environment  110 , a cloud platform service provider  150 , a fraudster computing environment  160 , a user computing environment  170 , and a data store  180 . The various components of the production environment  100  are coupled together by one or more physical or virtual networks  101 , according to one embodiment. 
     The computing environment  110  represents one or more computing systems such as a server or distribution center that is configured to receive, execute, and host one or more data management systems, according to one embodiment. The computing environment  110  represents a traditional data center computing environment, a virtual asset computing environment (e.g., a cloud computing environment), or a hybrid between a traditional data center computing environment and a virtual asset computing environment, according to one embodiment. 
     In one embodiment, the data management system  112  manages data stored in a data store. The data is related to a large number of individuals and is organized in data groups. When the data management system  112  initially writes data to the one or more databases, the data management system  112  writes the data in an encrypted format. The data management system encrypts each data group with a different encryption. However, after the data management system  112  has initially written the data in an encrypted format, the data management system  112  enhances security beyond merely initially encrypting the data a single time. In particular, the data management system  112  continuously and automatically re-encrypts the data. The data management system  112  continuously and automatically re-encrypts each data group with a respective different encryption and a different re-encryption periodicity. The respective different encryption is different from the prior encryption of the data group and from the new encryptions of the other data groups. The data management system  112  re-encrypts each data groups in accordance with a respective re-encryption periodicity that determines how often the data management system  112  will re-encrypt the data group. The re-encryption periodicity can be selected so that the data management system  112  automatically re-encrypts the data groups within a sufficiently short period of time that it would be practically impossible for a fraudster who gains access to the data to break the encryption on any of the data groups before the data management system  112  re-encrypts the data groups with a new encryption. In this way, even if a fraudster gains unauthorized access to the data, the fraudster will not be able to break encryption on any of the data groups before the data management system  112  re-encrypts the data groups. Additionally, more sensitive data groups can be encrypted more frequently and with a higher level of encryption, thereby making it further unlikely that a fraudster could gain access to particularly sensitive data. Embodiments of the present disclosure overcome some of the drawbacks of previous data management systems by automatically and continuously re-encrypting data and in particular by continuously and automatically re-encrypting each data group with its own encryption and with its own re-encryption periodicity. This can greatly limit the opportunity for a fraudster to make use of data to which the fraudster has gained access. Embodiments of the present disclosure enhance the security and reliability of data management systems and reduce the wasteful use of human and computing resources in implementing outdated, unwieldy, and insufficient data security procedures. This transforms computing systems into more efficient computing systems. 
     The present disclosure makes reference to encrypting data groups and data columns. Encrypting a data group or data column corresponds to encrypting the data assigned to the data group or data column, associated with the data group or data column, or contained within the data group or data column. Thus, to encrypt a data group or data column is to encrypt the data of the data group or data column. Furthermore, organizing data in a data group or data column does not necessarily refer to a physical distribution of the data in any physical memory or memories. 
     In one embodiment, the data management system  112  includes a data store  114 , an encryption management module  116 , an encryption engine  118 , an encryption policy control module  120 , an access control module  122 , a user services provider system  124 , and a user interface module  126 . The data management system  112  utilizes these modules, engines, and systems to securely manage and utilize data stored in the data store  114 , in one embodiment. 
     In one embodiment, the data store  114  stores data  130 . The data  130  can include data related to a large number of users of the data management system  112 . The data  130  is organized in data groups  131 . The data  130  can include data stored on behalf of organizations, individuals, businesses, government agencies, or other entities. The individuals, businesses, government agencies, or other entities can request that the data be stored by the data management system  112  in the data store  114 . In some cases, the data  130  may be stored not at the request of or on behalf of individuals, organizations, businesses, government agencies, or other entities, but rather as a general data collection of an electronic services provider that provides one or more data services for customers or for other purposes. The data  130  can be received from one or more data sources including the individuals, organizations, businesses, or government agencies with which the data  130  is associated. The data  130  can also be received from third party data sources. The data  130  can be generated or collected by the data management system  112 . 
     In one embodiment, each data group  131  includes one or more data columns  132 . Each data column  132  includes data entries of a particular data type or category. In one embodiment, each data entry is related to one of a plurality of individuals. 
     In one embodiment, the data store  114  includes one or more data storage devices or systems. The data storage devices or systems can be located in diverse locations. For example, the data management system  112  can include multiple data centers each having a large number of data storage devices or systems. The multiple data centers can be located in various geographic locations. These multiple data centers and data storage devices can collectively store the data  130 . The data store  114  can include one or more servers, hard disk drives, solid state drives, EEPROMs, optical disks, memory arrays, databases, virtual databases, virtual memories, virtual data directories, or other physical or virtual data sources. 
     In one embodiment, the data store  114  can store multiple copies of the various files or data objects of the data  130  in multiple locations, databases, or devices. In this way, if a particular data item is to be accessed from a default location in the data store  114 , but the default location is inaccessible for some reason, a copy of that data can be accessed from an alternate location within the data store  114 . 
     The data  130  can include very sensitive information. The sensitive information can include personal information associated with individuals such as names, government identification numbers, birth dates, data related to children and spouses, medical data, financial data, account numbers, passwords, or other types of sensitive data related to individuals. The data  130  can include sensitive data related to business organizations. The sensitive data related to business organizations can include organizational operating secrets, strategies, financial data, account numbers, passwords, accounting data, payroll data, budgeting data, financial transaction data, or other types of sensitive data. 
     As set forth above, the data  130  can be organized in data columns  132 . Each data column  132  can include a plurality of data entries of a particular data type or category. For example, the data  130  can include, for each user of the data management system, a user identification number, a given name of the user a government identification number of the user, a birth date of the user, a marital status of the user, a mailing address of the user, an employer identification number of the user, a number of children of the user, and other types of data. If a fraudster is able to gain access to all of the data related to an individual user, the fraudster will be able to exploit the data in a way that can be very harmful to the user and to the data management system  112 . For this reason, in one embodiment the data management system  112  organizes the data  130  in data columns  132 . A first data column  132  can include user identification numbers of the users. A second data column  132  can include given names of the users. A third data column  132  can include government identification numbers of the users. A fourth data column can include birthdates of the users. A fifth data column can include marital status data of the users. A sixth data column  132  can include mailing addresses of the users. A seventh data column  132  can include employer identification numbers of the users. Additional data columns  132  can include data entries of other types or categories. 
     In one embodiment, because the data  130  can include sensitive data, the data management system  112  stores the data  130  in an encrypted format in the data store  114 . Each data column  132  is encrypted with its own encryption. The data management system  112  utilizes the encryption management module  116  and the encryption engine  118  to write new data to the data columns  132  of the data  130  in the data store  114  in an encrypted format in accordance with the various encryptions of the data columns  132 . Writing the data in an encrypted format is a security measure to prevent easy access and exploitation of the data  130  by fraudsters and malfeasants, or even by others who accidentally gain access to the data  130  through error or fluke. Organizing the data  130  in data columns  132  as set forth above and encrypting each data column  132  with a unique encryption is an additional security measure to further inhibit fraudsters or malfeasants from being able to exploit the data  130  in a way that is harmful to individuals and to the data management system  112 . 
     In one embodiment, the encryption management module  116  manages encryption of the data  130 . The encryption management module  116  manages encryption of the data  130  by controlling the encryption engine  118 . The encryption engine  118  performs the actual encryption of the data  130 . The encryption management module  116  manages or controls the encryption engine  118 . Thus, the encryption management module  116  causes the encryption engine  118  to encrypt the data groups  131  of the data  130 . This can include causing the encryption engine  118  to write new data to the data groups  131  of the data  130  in accordance with the respective encryptions of the data groups  131 . 
     In one embodiment, the encryption engine  118  includes encryption algorithm data  138 . The encryption algorithm data  138  includes one or more encryption algorithms by which the encryption engine  118  encrypts the data groups  131  of the data  130 . The encryption algorithm data  138  can specify one or more types of encryption or encryption processes to be used by the encryption engine  118  in encrypting each data group  131  of the data  130 . For example, the encryption algorithm data  138  can specify a level of encryption such as 16-bit encryption, 32-bit encryption, 128-bit encryption, etc. The encryption algorithm data  138  can include symmetric encryption algorithms, asymmetric encryption algorithms, or other types of encryption algorithms. 
     In one embodiment, the encryption algorithm data  138  can specify multiple encryption algorithms for encrypting the various data groups  131  of the data  130  with different types or levels of encryption. For example, less sensitive data groups  131  may be encrypted using a less resource intensive encryption algorithm. More sensitive data groups  131  may be encrypted using a more resource intensive and more secure encryption algorithm. 
     In one embodiment, the encryption management module  116  manages the encryption engine  118  based on re-encryption policy data  133 . The re-encryption policy data  133  includes data specifying how and when the encryption engine  118  should re-encrypt the data  130 . The re-encryption policy data  133  can identify, for each data group  131 , one or more respective algorithms for encrypting the data group  131 . The re-encryption policy data  133  can specify, for each data group  131  a respective level of encryption for the data group  131 . 
     As described previously, it is possible that a fraudster may gain access to a portion of the data  130 . The encryption of the data  130 , and in particular, the encryption of the data groups  131 , helps to inhibit the fraudster from being able to obtain the portion of the data in a useful format. In particular, the encryption renders the data groups  131  unreadable unless the data groups  131  can be decrypted. While simply encrypting the data  130  is helpful to inhibit some fraudsters, resourceful or determined fraudsters may eventually be able to decrypt the data  130  and obtain a plainly readable form of the data  130 . Typically, the lower the level of encryption, the more quickly a fraudster may be able to break the encryption. The higher the level of encryption, the longer it will take for a fraudster to break the encryption. One reason for this is that the fraudster may need to generate a vast number of encryption keys and attempt to decrypt the data  130  with each of the generated encryption keys until an encryption key has been found that can decrypt the data  130 . Thus, even though the data  130  may be encrypted with a high-level or highly secure encryption algorithm, given enough time the fraudster will be able to break the encryption and gain access to the data  130  in a manner that allows the fraudster to exploit the data to the benefit of the fraudster and to the detriment of the parties related to the data  130 . 
     Accordingly, in one embodiment, the data management system  112  overcomes some of the drawbacks associated with typical encryption practices by including in the re-encryption policy data  133 , re-encryption periodicity data  134  and the re-encryption level data  135 . The re-encryption periodicity data  134  indicates, for each data group  131 , a respective periodicity with which the encryption management module  116  should continuously and automatically re-encrypt the data group  131 . The re-encryption level data  135  indicates, for each data group  131 , a respective level of encryption with which the encryption management module  116  should continuously and automatically re-encrypt the data group  131 . 
     In one embodiment, the re-encryption periodicity data  134  and the re-encryption level data  135  are selected such that data groups  131  that include more sensitive data are encrypted more frequently and with a higher level of encryption than data groups  131  that include less sensitive data. This allows the data management system  112  to more efficiently utilize the resources of the data management system  112  in focusing re-encryption efforts more heavily on the data groups  131  for which higher levels of security are desired. The data management system  112  can devote fewer resources to the re-encryption of less sensitive data groups  131 . This helps transform the data management system  112  into a more efficient data management system by reducing the amount human and computing resources devoted to the re-encryption of less sensitive data groups  131  and increasing the security of more sensitive data groups  131 . 
     The continuous and automatic re-encryption of the data groups  131  of the data  130  serves to inhibit fraudsters from breaking encryption on the data  130  and gaining exploitable access to the data  130 . For example, if a fraudster is able to access the data  130 , the fraudster will begin the process of trying to decrypt one or more of the data groups  131  of the data  130 . However, the re-encryption periodicity data  134  causes the encryption management module  116  to instruct the encryption engine  118  to re-encrypt the data groups  131  of the data  130  with a new encryption in a continuous or repeating manner. Thus, before the fraudster can get very far in the decryption process of any of the data groups  131 , the encryption engine  118  will re-encrypt the data groups  131  of the data  130  with a new encryption, thereby frustrating the attempts by the fraudster to decrypt the data  130 . Additionally, the data groups  131  that include more sensitive data are re-encrypted more frequently and with more robust encryption such that it is even more unlikely that a fraudster can break the encryption on the most sensitive data groups  131  before the data groups  131  are re-encrypted. 
     As set forth above, the data groups  131  can each include one or more data columns  132 . Each data column  132  includes data entries of a particular data type or category. Each data entry is related to an individual or user of the data management system. Furthermore, in the unlikely event that a fraudster is able to break the encryption on one of the data columns  132  before re-encryption occurs, the data entries in the data column  132  will be largely useless to the fraudster unless the fraudster is able to break the encryption on additional data columns as well. In this way, the encryption management module  116 , in accordance with the re-encryption periodicity data  134  overcomes some of the drawbacks associated with traditional data management systems by continuously and automatically re-encrypting the data columns  132  of the data  130 . 
     In one embodiment, the re-encryption periodicity data  134  can define that a given data column  132  data should be re-encrypted once every specified number of months. In one embodiment, the periodicity data  134  can define that a given data column  132  should be re-encrypted once every specified number of weeks. In one embodiment, the periodicity data  134  can define that a given data column  132  should be re-encrypted once every specified number of days. In one embodiment, the periodicity data can define that a given data column  132  should be re-encrypted once every specified number of hours. In one embodiment, the periodicity data  134  can define that the a given data column  132  should be re-encrypted once every specified number of minutes. In one embodiment, the periodicity data  134  can define that a given data column  132  should be re-encrypted once in any period desired. Thus, the periodicity data  134  can specify, for each data column  132 , a respective re-encryption period of months, weeks, days, or even hours. The encryption management module  116  will enforce continuous re-encryption of the data  130  based on the periodicity data  134 . 
     In one embodiment, the periodicity data  134  can be selected based on the strength of the encryption with which the data  130  is encrypted, in order to efficiently manage the resources of the data management system  112 . The periodicity data  134  can specify a re-encryption period that, in combination with the level of encryption of the data  130 , defines a probability that is below a selected threshold probability that a fraudster would be able to break the encryption on the data  130  within the selected period defined by the periodicity data  134 . For example, the data management system  112  may specify that the combination of the re-encryption period and the level of encryption should result in a probability of less than one 1 millionth of one percent that a fraudster can break the encryption within the defined period. For higher levels of encryption strength, a larger period of time between re-encryption of the data  130  may be suitable. For low levels of encryption strength, a shorter period of time between re-encryption of the data  130  may be suitable. In this way, a balance can be struck between encryption strength and re-encryption periodicity that efficiently utilizes the resources of the data management system  112 . 
     In one embodiment, the re-encryption periodicity data  134  can specify, for a given data column  132 , a re-encryption periodicity that renders the probability that a fraudster can break the encryption on the data column  132  so small as to be practically impossible. 
     In one embodiment, the encryption management module  116  includes encryption key data  136 . The encryption key data  136  includes data, for each data group  131 , relating to one or more encryption keys generated by the encryption engine  118  for the data group  131  when encrypting the data group  131 . The encryption key data  136  enables the data groups  131  to be encrypted and decrypted. The encryption keys may be any one of a number of types of encryption keys, such as, but not limited to, public key infrastructure (“PKI”) encryption keys. In one example implementation, the encryption keys include symmetric encryption keys, so that encryption and decryption of the data columns  132  are both performed using the encryption keys. In another example implementation, each encryption key is one of an asymmetric encryption key pair, e.g., a private key or a public key, that may be used for encrypting a data group  131  or a portion of a data group  131  but that may not be used to decrypt the data group  131 . The encryption keys, according to other example embodiments, may represent other encryption algorithms as well. As used herein, encryption keys can also include decryption keys that are associated with particular encryption keys and that may be used to decrypt data that has been encrypted with particular encryption keys. 
     In one embodiment, when the data management system  112  re-encrypts a data group  131 , the encryption management module  116  causes the data group  131  to be decrypted and read so as to place the data group  131  in an unencrypted form. The encryption management module  116  then causes the encryption engine  118  to write the data from the data group  131  back to the data store  114  in a newly encrypted format. Thus, in a re-encryption process for a data group  131 , the data management system  112  decrypts and reads the data group  131  from the data store  114  by decrypting the data group  131  using one or more encryption or decryption keys associated with the most recent prior encryption process for the data group  131  and contained in the encryption key data  136 . The data management system  112  then writes the data from the data group  131  back to the data store  114  in an encrypted format utilizing one or more new or current encryption keys that are different from the encryption keys associated with the previous encryption process for the data group  131 . The new encryption keys are stored in the encryption key data  136 . In this way, the data management system re-encrypts a data group  131  in the data store  114 . After the data management system  112  has re-encrypted the data group  131 , the data management system  112  again re-encrypts the data group  131  within a time period specified by the selected periodicity. Each time the data management system  112  re-encrypts the data group  131 , the data management system  112  reads the data group  131  from the data store  114 , decrypts the data group  131 , then writes the data group  131  back to the data store  114  and re-encrypts it. 
     In one embodiment, the encryption management module  116 , in conjunction with the re-encryption policy data  133 , can continuously re-encrypt a given data group  131  such that there is little or no gap between re-encryption cycles for the encryption engine  118 . The amount of data in the data group  131  may be extremely large. The encryption engine  118  cannot instantaneously re-encrypt all of the data in the data group  131 . Accordingly, the encryption engine  118  may begin a new re-encryption process for a data group  131  nearly instantaneously upon finishing the previously re-encryption process for the data group  131 . Thus, if the encryption engine  118  requires a week to re-encrypt all of the data  130 , the encryption periodicity data  134  may simply specify that the encryption engine  118  should begin re-encrypting the data  130  immediately upon finishing the previously re-encryption cycle. Alternatively, in one embodiment, the data management system  112  can allocate processing resources to the encryption engine  118  sufficient to encrypt the entirety of the data group  131  within the period specified by the re-encryption periodicity data  134 . Thus, the encryption engine  118  can be configured with processing resources commensurate with the re-encryption period defined by the re-encryption periodicity data  134 . 
     In one embodiment, the encryption engine  118  can complete a re-encryption cycle for a given data group  131  well ahead of the beginning of the next specified re-encryption cycle as set forth in the re-encryption periodicity data  134 . In this case, the encryption engine  118  may be idle for some amount of time between the ending of one re-encryption cycle and the beginning of the next re-encryption cycle. 
     In one embodiment, the re-encryption policy data  133  can specify that various data groups  131  should be re-encrypted on respective staggered re-encryption cycles. For example, the re-encryption periodicity data  134  may specify, for multiple data groups  131 , a re-encryption period of two weeks. However, the re-encryption policy data  133  may specify that the encryption engine  118  should re-encrypt some data groups  131  on a first day of the encryption cycle, that the encryption engine  118  should re-encrypt a second set of data groups  131  on a second day of the encryption cycle, that the encryption engine  118  should re-encrypt a third set of data groups  131  on a third day of the encryption cycle, etc. In this way, the re-encryption policy data  133  can stagger the re-encryption of various data groups  131  at various times. 
     In one embodiment, the encryption policy data  133  can specify other re-encryption triggers. For example, standard and authorized accesses of the data  130  may fit into a known and recognizable pattern. Unauthorized attempts to access certain data groups  131  may fall outside of this known pattern. In one embodiment, the data management system  112  monitors all of the access attempts to the data groups  131 . In the event that fraudsters attempt to gain access to certain of the data groups  131 , this monitoring may notice an unusual pattern in accesses or access attempts to the data groups  131 . Accordingly, the re-encryption policy data  133  may indicate that the encryption management module  116  can initiate re-encryption of one or more of the data groups  131  or even the entirety of the data  130  in the event of abnormal patterns of attempts to access the data  130 . The re-encryption policy data  133  can specify the exact circumstances in which abnormal access attempts result in the initiation a re-encryption process. The re-encryption policy data  133  can also specify whether all of the data  130  should be re-encrypted based on these abnormal patterns, whether only certain data groups  131  should be re-encrypted based on these abnormal patterns, or whether only those data groups  131  that were the subject of abnormal access patterns should be re-encrypted. In this way, the re-encryption policy data  133  manages the re-encryption of the data  130  based on more than just periodicity or frequency of re-encryption cycles. This can further enhance the security of the data  130 . 
     In one embodiment, the data management system  112  utilizes the encryption policy control module  120  to provide, define, adjust, or revise the re-encryption policy data  133 . The encryption policy control module  120  enables an expert, a technician, an authorized application, or an authorized computing system to enter new re-encryption policy data  133  to the encryption management module  116 . In this way, the re-encryption policy data  133  can be initially provided or can be adjusted or revised as needed by authorized personnel, applications, or systems. 
     In one embodiment, the data management system  112  utilizes the access control module  122  to control access to the data  130 . The access control module  122  can include access control data  140  that determines what individuals, machines, virtual machines, applications, programs, or processes can access the data  130 . The access control data  140  can include sets of access secrets or lists of credentials that must be provided by an individual, machine, application, process, or program that seeks access to the data  130 . The access secrets can include passwords, keys, identification codes, serial numbers, or other data that can be used to verify the credentials of a requesting individual, machine, application, process, or program to gain access to the data  130 . 
     A fraudster seeking to gain access to data  130  may, through various methods, deceive the access control module  122  into granting access to data  130 . Alternatively, the fraudster may, through various methods, circumvent the access control module  122  entirely and gain direct access to the data  130  in the data store  114 . Nevertheless, the fraudster may lack the encryption keys needed to decrypt the data  130  and may need to attempt to break the encryption of the data  130  in order to obtain the data  130  in a useful form. Thus, in the event of the failure of the access control module  122 , the continuous re-encryption of data  130  may prevent the fraudster from exploiting the data  130  in a way that can be harmful to the data management system  112 , to users, to organizations, or other interested parties. 
     In one embodiment, the data management system  112  can include a user services provider system  124  that provides data storage and data management services for a large number of users. The data  130  stored in the data store  114  can include data related to the users of the user services provider system  124 . In one embodiment, users may directly access that portion of the data  130  that is theirs. For example, in an embodiment in which the data management system  112  provides a cloud-based data backup or data store service for users, users may gain direct access to the data  130  that is related to them. 
     In one embodiment, the users may not directly access the data  130 . Instead the users access the user services provider system  124  in order to receive services from the user services provider system  124 . The user services provider system  124  may access the data in order to provide various services to the user related to the data. 
     In one embodiment, the user services provider system  124  can include a financial management system. The financial management system can include one or more of a tax return preparation system, a payroll management system, a budgeting system, or a system that provides any other kind of financial management service to users. The data can include financial data related to the large number of users. In this case, the data can include, for each user, data such as, but not limited to, a name of the user, a name of the user&#39;s employer, an employer identification number (EID), a job title, annual income, salary and wages, bonuses, a Social Security number, a government identification, a driver&#39;s license number, a date of birth, an address, a zip code, home ownership status, marital status, W-2 income, an employer&#39;s address, spousal information, children&#39;s information, asset information, medical history, occupational information, information regarding dependents, salary and wages, interest income, dividend income, business income, farm income, capital gain income, pension income, IRA distributions, education expenses, health savings account deductions, moving expenses, IRA deductions, student loan interest, tuition and fees, medical and dental expenses, state and local taxes, real estate taxes, personal property tax, mortgage interest, charitable contributions, casualty and theft losses, unreimbursed employee expenses, alternative minimum tax, foreign tax credit, education tax credits, retirement savings contribution, child tax credits, residential energy credits, and any other information that is currently used, that can be used, or that may be used in the future, in a financial system or in the preparation of financial documents such as a user&#39;s tax return, according to various embodiments. Each data column  132  of the data  130  can include a set of data entries from a respective data type or category listed above. Each data entry in a data column  132  can be related to one of the users of the financial management system. 
     In one embodiment, the data management system  112  is a financial management system. 
     When users access the financial management system, the financial management system accesses the data related to the users in order to provide financial management services to the user, such as a tax return preparation interview in order to electronically prepare a tax return. In this case, the user may not directly access the data. Instead the financial management system accesses the data and helps the user to fill out electronic versions of tax forms with the financial data. Thus, the user may not access the data in order to directly retrieve or download the user data, but instead the financial management system accesses the data in order to provide tax return preparation services to the user. 
     The financial data related to the users can include very sensitive data. If this very sensitive data is compromised by a fraudster in a way that the sensitive data can be made use of by the fraudster, e.g. by breaking encryption on the sensitive data, the users of the financial management system can suffer great harm. Thus, the data management system  112 , of which the financial management system is a part, continuously and automatically re-encrypts the financial data as set forth above. Additionally, the financial data is organized in data columns  132  that are separately encrypted and re-encrypted. Because of this, even if a fraudster was able to access the encrypted financial data, the financial data would be re-encrypted so quickly as to prevent the fraudster from being able to break the encryption before the financial data was re-encrypted. Additionally, even if the fraudster was able to break the encryption on a single data column  132 , the data contained in the data column  132  would be largely useless to the fraudster and harmless to the users unless the fraudster can also decrypt other data columns  132 , which is even more unlikely. In this way, the data management system enhances the security of the users&#39; financial data. 
     Furthermore, because the more sensitive data columns  132  are re-encrypted more frequently and with stronger encryption, it is even more unlikely that a fraudster can break the encryption on a data column  132  that includes sensitive data. 
     In one embodiment, the data management system  112  utilizes the user interface module  126  to interface with the user computing environment  170 . Thus, when a user of the user services provider system  124  seeks to utilize the user services provider system  124 , the user computing environment  170  accesses the user interface module  126  to communicate with the user services provider system  124 . The user services provider system  124  may access the portion of the data  130  in conjunction with providing user services data  142  to the user computing environment  170 . The user services data  142  can include providing financial management services to the user such as a tax return preparation interview process by which the user services provider system  124  assists the user to prepare the user&#39;s tax return by utilizing, in part, the data  130 . 
     In one embodiment, the user computing environment  170  accesses the user interface module  126  of the data management system  112  via the network  101 . The network  101  can include, in one embodiment, the Internet. 
     In one embodiment, a fraudster may seek to access the data management system  112  from a fraudster computing environment  160  via the network  101 . In particular, the fraudster may seek to utilize the fraudster computing environment  160  to gain access to and decrypt the data  130  as described above. 
     In one embodiment, the data management system  112  may provide data management services in relation to an external data store  180  that includes data  182  organized in data groups  184 , as described in relation to the data store  114 . Each data group  184  may include one or more data columns  186 . The external data store  180  can include one or more data storage devices or facilities outside the direct control of the service provider computing environment  110 . In one embodiment, all of the data  130  can be included in the data  182 . In other words, the data management system  112  may manage data  130  that is stored in relation with virtual or physical storage that is not part of a service provider computing environment  110  associated with the data management system  112 . Thus, the data management system  112  may manage the continuous and automatic re-encryption of the data  182  stored in the data store  180 . In a manner similar to that described above. Some or all of the components of the data management system  112  that are shown as being within the service provider computing  110  can be implemented outside of the service provider computing environment  110  and may indeed be associated with third-party data management organizations or systems. 
     In one embodiment, the data management system  112  manages the data  130  in conjunction with a third-party cloud platform service provider  150  that provides cloud platform services the cloud platform service provider includes a cloud platform service provider such as Amazon Web Services (AWS), Microsoft Azure, Rackspace, Joyent, Google Cloud, or other cloud platform service providers. The data store can include data centers external to the data management system. The data management system  112  can work with the cloud platform service provider to manage the data in various external and internal data stores. In one embodiment, the data management system  112  utilizes the cloud platform service provider  150  to perform one or more of the functions involved in the process for continuously re-encrypt the data  130  or  182 . 
       FIG. 2  is a representation of a portion of the data  130  stored in the data store  114  and organized into data columns  132   a - 132   e , according to one embodiment. As set forth above, the data  130  can be organized in data columns  132 . In the example of  FIG. 2 , there are five data columns  132   a - 132   e . Each data column  132   a - 132   e  includes data entries of particular category or data type. Each data column includes an entry for each user. A row of data includes data for a particular user in each category or data type. 
     A first data column  132   a  includes the given names of the users. A second data column  132   b  includes Social Security numbers of users. A third data column  132   c  includes ZIP Codes of the users. A fourth data column  132   d  includes income data of the users. A fifth data column  132   e  includes dates of birth of the users. While  FIG. 2  shows five data columns  132  including data entries for nine users, in practice, the data  130  may include hundreds of data columns  132  each having data entries for millions of users. The data  130  can have data columns  132  for other categories such as a marital status of the user, an employer identification number of the user, a number of children of the user, a mailing address of the user, investment data of the user, banking data of the user, credit card data of the user, home ownership data of the user, real estate holdings data of the user, and other types of data. 
     If a fraudster was able to gain access to all of the data related to an individual user, the fraudster would be able to exploit the data in a way that can be very harmful to the user and to the data management system  112 . For this reason, the data management system  112  organizes the data  130  into data columns  132  and encrypts each of the data columns  132  with differing encryptions. Thus, if a fraudster gains access to the data  130  and desires to obtain the data  130  in an exploitable form, the fraudster will need to break the encryption on multiple data columns  132 . Furthermore, the data management system  112  continuously and automatically re-encrypts each of the data columns  132  to inhibit the fraudster from being able to break the encryption on even a single data column  132  before re-encryption occurs. 
     As set forth above, the re-encryption policy data  133  can include, for each data column  132 , re-encryption level data  135 . The re-encryption level data  135  indicates, for each data column  132 , a respective level of encryption with which the encryption management module  116  should continuously and automatically re-encrypt the data column  132 . In one embodiment, the re-encryption periodicity data  134  and the re-encryption level data  135  are selected such that data groups  131  that include more sensitive data are encrypted more frequently and with a higher level of encryption than data groups  131  that include less sensitive data. 
     In  FIG. 2  the data column  132   b  includes Social Security numbers and may be considered more sensitive than the data column  132   c  that includes ZIP codes. Thus, in one embodiment, the data management system  112  re-encrypts the data column  132   b  with a level of encryption that is higher than the data column  132   c . Additionally, the data management system  112  re-encrypts the data column  132   b  more frequently than the data column  132   c . Thus, it is even more unlikely that a fraudster can break the encryption on the data column  132   b  including Social Security numbers before the data management system  112  re-encrypts the data column  132   b.    
     In  FIG. 2  each of the data entries are represented by an “x”, indicating that the data entries are encrypted. 
     As noted above, the specific illustrative examples discussed above are but illustrative examples of implementations of embodiments of the method or process for automatically and continuously re-encrypting data in a data store. Those of skill in the art will readily recognize that other implementations and embodiments are possible. Therefore, the discussion above should not be construed as a limitation on the claims provided below. 
     Process 
       FIG. 3  illustrates a functional flow diagram of a process  300  for providing automatic and continuous re-encryption of data in a data store, in accordance with one embodiment. 
     At block  302 , the data store  114  stores data in data groups, according to one embodiment. From block  302  the process proceeds to block  304 . 
     At block  304 , the encryption engine  118  initially encrypts each data group in the data store  114  with a respective encryption key, according to one embodiment. The encryption engine  118  can initially encrypt the data groups as the data is written to the data store  114 , according to one embodiment. From block  304  the process proceeds to block  306 . 
     At block  306  the encryption management module  116  receives re-encryption policy data including re-encryption periodicity data and re-encryption level data, according to one embodiment. The re-encryption periodicity data defines, for each data group, a respective periodicity for automatically and periodically re-encrypting the data group, according to one embodiment. The re-encryption level data defines, for each data group, a respective level of encryption for re-encrypting the data group, according to one embodiment. From block  306  the process proceeds to block  308 . 
     At block  308 , the encryption management module  116  controls the encryption module  118  to periodically re-encrypt the data groups in the data store  114 , according to one embodiment. From block  308  the process proceeds to block  310 . 
     At block  310 , the encryption engine  118  periodically re-encrypts each data group with a respective periodicity and encryption level in accordance with the re-encryption periodicity data and the re-encryption level data, according to one embodiment. 
     Although a particular sequence is described herein for the execution of the process  300 , other sequences can also be implemented in accordance with principles of the present disclosure. 
       FIG. 4  illustrates a flow diagram of a process  400  for providing automatic and continuous re-encryption of data in a data store, according to various embodiments. 
     In one embodiment, process  400  for providing automatic and continuous re-encryption of data in a data store begins at BEGIN  402  and process flow proceeds to STORE DATA IN A DATA STORE  404 . 
     In one embodiment, at STORE DATA IN A DATA STORE  404  process  400  for providing automatic and continuous re-encryption of data in a data store stores data in a data store. 
     In one embodiment, once process  400  for providing automatic and continuous re-encryption of data in a data store stores data in a data store at STORE DATA IN A DATA STORE  404  process flow proceeds to ORGANIZE THE DATA INTO DATA GROUPS  406 . 
     In one embodiment, at ORGANIZE THE DATA INTO DATA GROUPS  406 , process  400  for providing automatic and continuous re-encryption of data in a data store organizes the data into data groups. 
     In one embodiment, once process  400  for providing automatic and continuous re-encryption of data in a data store organizes the data into data groups at ORGANIZE THE DATA INTO DATA GROUPS  406 , process flow proceeds to INITIALLY ENCRYPT EACH DATA GROUP  408 . 
     In one embodiment, at INITIALLY ENCRYPT EACH DATA GROUP  408 , process  400  for providing automatic and continuous re-encryption of data in a data store initially encrypts each data group. 
     In one embodiment, once process  400  for providing automatic and continuous re-encryption of data in a data store initially encrypts each data group at INITIALLY ENCRYPT EACH DATA GROUP  408 , process flow proceeds to RECEIVE RE-ENCRYPTION POLICY DATA DEFINING A RE-ENCRYPTION POLICY FOR PERIODICALLY RE-ENCRYPTING THE DATA  410 . 
     In one embodiment, at RECEIVE RE-ENCRYPTION POLICY DATA DEFINING A RE-ENCRYPTION POLICY FOR PERIODICALLY RE-ENCRYPTING THE DATA  410  the process  400  for providing automatic and continuous re-encryption of data in a data store receives re-encryption policy data defining a re-encryption policy for periodically re-encrypting the data. 
     In one embodiment, once process  400  for providing automatic and continuous re-encryption of data in a data store receives re-encryption policy data defining a re-encryption policy for periodically re-encrypting the data at RECEIVE RE-ENCRYPTION POLICY DATA DEFINING A RE-ENCRYPTION POLICY FOR PERIODICALLY RE-ENCRYPTING THE DATA  410 , process flow proceeds to RECEIVE RE-ENCRYPTION PERIODICITY DATA WITH THE RE-ENCRYPTION POLICY DATA, THE RE-ENCRYPTION PERIODICITY DATA DEFINING, FOR EACH DATA GROUP, A RESPECTIVE PERIODICITY FOR RE-ENCRYPTING THE DATA GROUP  412 . 
     In one embodiment, at RECEIVE RE-ENCRYPTION PERIODICITY DATA WITH THE RE-ENCRYPTION POLICY DATA, THE RE-ENCRYPTION PERIODICITY DATA DEFINING, FOR EACH DATA GROUP, A RESPECTIVE PERIODICITY FOR RE-ENCRYPTING THE DATA GROUP  412  the process  400  for providing automatic and continuous re-encryption of data in a data store receives re-encryption periodicity data with the re-encryption policy data, the re-encryption periodicity data defining, for each data group, a respective periodicity for re-encrypting the data group. 
     In one embodiment, once the process  400  for providing automatic and continuous re-encryption of data in a data store receives re-encryption periodicity data with the re-encryption policy data, the re-encryption periodicity data defining, for each data group, a respective periodicity for re-encrypting the data group at RECEIVE RE-ENCRYPTION PERIODICITY DATA WITH THE RE-ENCRYPTION POLICY DATA, THE RE-ENCRYPTION PERIODICITY DATA DEFINING, FOR EACH DATA GROUP, A RESPECTIVE PERIODICITY FOR RE-ENCRYPTING THE DATA GROUP  412 , process flow proceeds to AUTOMATICALLY AND PERIODICALLY RE-ENCRYPT EACH DATA GROUP BASED ON THE RE-ENCRYPTION PERIODICITY DATA  414 . 
     In one embodiment, at AUTOMATICALLY AND PERIODICALLY RE-ENCRYPT EACH DATA GROUP BASED ON THE RE-ENCRYPTION PERIODICITY DATA  414  the process  400  for providing automatic and continuous re-encryption of data in a data store automatically and periodically re-encrypts each data group based on the re-encryption periodicity data. 
     In one embodiment, once the process  400  for providing automatic and continuous re-encryption of data in a data store automatically and periodically re-encrypts each data group based on the re-encryption periodicity data at AUTOMATICALLY AND PERIODICALLY RE-ENCRYPT EACH DATA GROUP BASED ON THE RE-ENCRYPTION PERIODICITY DATA  414 , process flow proceeds to END  416 . 
       FIG. 5  illustrates a flow diagram of a process  500  for providing automatic and continuous re-encryption of data in a data store, according to various embodiments. 
     In one embodiment, process  500  for providing automatic and continuous re-encryption of data in a data store begins at BEGIN  502  and process flow proceeds to STORE DATA RELATED TO A PLURALITY OF INDIVIDUALS  504 . 
     In one embodiment, at STORE DATA RELATED TO A PLURALITY OF INDIVIDUALS  504  process  500  for providing automatic and continuous re-encryption of data in a data store stores data related to a plurality of individuals. 
     In one embodiment, once process  500  for providing automatic and continuous re-encryption of data in a data store stores data related to a plurality of individuals at STORE DATA RELATED TO A PLURALITY OF INDIVIDUALS  504  process flow proceeds to ORGANIZE THE DATA IN DATA COLUMNS, EACH DATA COLUMN INCLUDING A PLURALITY OF DATA ENTRIES, EACH DATA ENTRY BEING RELATED TO A RESPECTIVE INDIVIDUAL  506 . 
     In one embodiment, at ORGANIZE THE DATA IN DATA COLUMNS, EACH DATA COLUMN INCLUDING A PLURALITY OF DATA ENTRIES, EACH DATA ENTRY BEING RELATED TO A RESPECTIVE INDIVIDUAL  506 , process  500  for providing automatic and continuous re-encryption of data in a data store organizes the data in data columns, each data column including a plurality of data entries, each data entry being related to a respective individual. 
     In one embodiment, once process  500  for providing automatic and continuous re-encryption of data in a data store organizes the data in data columns, each data column including a plurality of data entries, each data entry being related to a respective individual at ORGANIZE THE DATA IN DATA COLUMNS, EACH DATA COLUMN INCLUDING A PLURALITY OF DATA ENTRIES, EACH DATA ENTRY BEING RELATED TO A RESPECTIVE INDIVIDUAL  506 , process flow proceeds to INITIALLY ENCRYPT EACH DATA COLUMN WITH A RESPECTIVE ENCRYPTION KEY  508 . 
     In one embodiment, at INITIALLY ENCRYPT EACH DATA COLUMN WITH A RESPECTIVE ENCRYPTION KEY  508 , process  500  for providing automatic and continuous re-encryption of data in a data store initially encrypts each data column with a respective encryption key. 
     In one embodiment, once process  500  for providing automatic and continuous re-encryption of data in a data store initially encrypts each data column with a respective encryption key at INITIALLY ENCRYPT EACH DATA COLUMN WITH A RESPECTIVE ENCRYPTION KEY  508 , process flow proceeds to RECEIVE RE-ENCRYPTION POLICY DATA DEFINING A RE-ENCRYPTION POLICY FOR PERIODICALLY RE-ENCRYPTING THE DATA  510 . 
     In one embodiment, at RECEIVE RE-ENCRYPTION POLICY DATA DEFINING A RE-ENCRYPTION POLICY FOR PERIODICALLY RE-ENCRYPTING THE DATA  510  the process  500  for providing automatic and continuous re-encryption of data in a data store receives re-encryption policy data defining a re-encryption policy for periodically re-encrypting the data. 
     In one embodiment, once process  500  for providing automatic and continuous re-encryption of data in a data store receives re-encryption policy data defining a re-encryption policy for periodically re-encrypting the data at RECEIVE RE-ENCRYPTION POLICY DATA DEFINING A RE-ENCRYPTION POLICY FOR PERIODICALLY RE-ENCRYPTING THE DATA  510 , process flow proceeds to RECEIVE RE-ENCRYPTION PERIODICITY DATA WITH THE RE-ENCRYPTION POLICY DATA, THE RE-ENCRYPTION PERIODICITY DATA DEFINING, FOR EACH DATA COLUMN, A RESPECTIVE PERIODICITY FOR RE-ENCRYPTING THE DATA COLUMN  512 . 
     In one embodiment, at RECEIVE RE-ENCRYPTION PERIODICITY DATA WITH THE RE-ENCRYPTION POLICY DATA, THE RE-ENCRYPTION PERIODICITY DATA DEFINING, FOR EACH DATA COLUMN, A RESPECTIVE PERIODICITY FOR RE-ENCRYPTING THE DATA COLUMN  512  the process  500  for providing automatic and continuous re-encryption of data in a data store receives re-encryption periodicity data with the re-encryption policy data, the re-encryption periodicity data defining, for each data column, a respective periodicity for re-encrypting the data column. 
     In one embodiment, once the process  500  for providing automatic and continuous re-encryption of data in a data store receives re-encryption periodicity data with the re-encryption policy data, the re-encryption periodicity data defining, for each data column, a respective periodicity for re-encrypting the data column at RECEIVE RE-ENCRYPTION PERIODICITY DATA WITH THE RE-ENCRYPTION POLICY DATA, THE RE-ENCRYPTION PERIODICITY DATA DEFINING, FOR EACH DATA COLUMN, A RESPECTIVE PERIODICITY FOR RE-ENCRYPTING THE DATA COLUMN  512 , process flow proceeds to RECEIVE RE-ENCRYPTION LEVEL DATA WITH THE RE-ENCRYPTION POLICY DATA, THE RE-ENCRYPTION LEVEL DATA DEFINING, FOR EACH DATA GROUP, A RESPECTIVE LEVEL OF ENCRYPTION FOR RE-ENCRYPTING THE DATA GROUP  514 . 
     In one embodiment, at RECEIVE RE-ENCRYPTION LEVEL DATA WITH THE RE-ENCRYPTION POLICY DATA, THE RE-ENCRYPTION LEVEL DATA DEFINING, FOR EACH DATA GROUP, A RESPECTIVE LEVEL OF ENCRYPTION FOR RE-ENCRYPTING THE DATA GROUP  514  the process  500  for providing automatic and continuous re-encryption of data in a data store receives re-encryption level data with the re-encryption policy data, the re-encryption level data defining, for each data group, a respective level of encryption for re-encrypting the data group. 
     In one embodiment, once the process  500  for providing automatic and continuous re-encryption of data in a data store receives re-encryption level data with the re-encryption policy data, the re-encryption level data defining, for each data group, a respective level of encryption for re-encrypting the data group at RECEIVE RE-ENCRYPTION LEVEL DATA WITH THE RE-ENCRYPTION POLICY DATA, THE RE-ENCRYPTION LEVEL DATA DEFINING, FOR EACH DATA GROUP, A RESPECTIVE LEVEL OF ENCRYPTION FOR RE-ENCRYPTING THE DATA GROUP  514 , process flow proceeds to AUTOMATICALLY AND PERIODICALLY RE-ENCRYPT EACH DATA COLUMN WITH A RESPECTIVE ENCRYPTION KEY AND WITH A RESPECTIVE PERIODICITY IN ACCORDANCE WITH THE RE-ENCRYPTION POLICY DATA  516 . 
     In one embodiment, at AUTOMATICALLY AND PERIODICALLY RE-ENCRYPT EACH DATA COLUMN WITH A RESPECTIVE ENCRYPTION KEY AND WITH A RESPECTIVE PERIODICITY IN ACCORDANCE WITH THE RE-ENCRYPTION POLICY DATA  516  the process  500  for providing automatic and continuous re-encryption of data in a data store automatically and periodically re-encrypts each data column with a respective encryption key and with a respective periodicity in accordance with the re-encryption policy data. 
     In one embodiment, once the process  500  for providing automatic and continuous re-encryption of data in a data store automatically and periodically re-encrypts each data column with a respective encryption key and with a respective periodicity in accordance with the re-encryption policy data at AUTOMATICALLY AND PERIODICALLY RE-ENCRYPT EACH DATA COLUMN WITH A RESPECTIVE ENCRYPTION KEY AND WITH A RESPECTIVE PERIODICITY IN ACCORDANCE WITH THE RE-ENCRYPTION POLICY DATA  516 , process flow proceeds to END  518 . 
     In one embodiment, at END  518  the process for providing automatic and continuous re-encryption of data in a data store is exited to await new data and/or instructions. 
     In one embodiment, a method for automatically and continuously re-encrypting data in a data store. The method includes storing data in a data store, organizing the data into data groups, and initially encrypting each data group. The method also includes receiving re-encryption policy data defining a re-encryption policy for periodically re-encrypting the data, receiving re-encryption periodicity data with the re-encryption policy data. The re-encryption periodicity data defines, for each data group, a respective periodicity for re-encrypting the data group. The method also includes automatically and periodically re-encrypting each data group based on the re-encryption periodicity data. 
     In one embodiment, a non-transitory computer-readable medium has a plurality of computer-executable instructions which, when executed by a processor, perform a method for automatically and continuously re-encrypting data in a data store. The instructions include a data store configured to store data organized in data groups. The instructions include an encryption engine configured to encrypt each data group with a respective encryption key. The instructions also include an encryption policy control module configured to receive re-encryption policy data including re-encryption periodicity data defining for each data group, a respective periodicity for re-encrypting the data group. The instructions also include an encryption management module configured to receive the re-encryption policy data from the encryption policy control module and to cause the re-encryption engine to automatically periodically re-encrypt each data group with the respective periodicity defined by the re-encryption periodicity data. 
     In one embodiment, a system for automatically and continuously re-encrypting data in a data store includes at least one processor and at least one memory coupled to the at least one processor. The at least one memory has stored therein instructions which, when executed by any set of the one or more processors, perform a process for automatically and continuously re-encrypting data in a data store. The process includes storing data related to a plurality of individuals and organizing the data in data columns, each data column including a plurality of data entries. Each data entry being related to a respective individual. The process also includes initially encrypting each data column with a respective encryption key, receiving re-encryption policy data defining a re-encryption policy for periodically re-encrypting the data, and receiving re-encryption periodicity data with the re-encryption policy data. The re-encryption periodicity data defines, for each data column, a respective periodicity for re-encrypting the data column. The process also includes receiving re-encryption level data with the re-encryption policy data. The re-encryption level data defines, for each data group, a respective level of encryption for re-encrypting the data group. The process also includes automatically and periodically re-encrypting each data column with a respective encryption key and with a respective periodicity in accordance with the re-encryption policy data. 
     In the discussion above, certain aspects of one embodiment include process steps, operations, or instructions described herein for illustrative purposes in a particular order or grouping. However, the particular order and/or grouping shown and discussed herein are illustrative only and not limiting. Those of skill in the art will recognize that other orders and/or grouping of the process steps and/or operations and/or instructions are possible and, in some embodiments, one or more of the process steps and/or operations and/or instructions discussed above can be combined and/or deleted. In addition, portions of one or more of the process steps and/or operations and/or instructions can be re-grouped as portions of one or more other of the process steps and/or operations and/or instructions discussed herein. Consequently, the particular order and/or grouping of the process steps and/or operations and/or instructions discussed herein do not limit the scope of the invention as claimed below. 
     As discussed in more detail above, using the above embodiments, with little or no modification and/or input, there is considerable flexibility, adaptability, and opportunity for customization to meet the specific needs of various parties under numerous circumstances. 
     In the discussion above, certain aspects of one embodiment include process steps and/or operations and/or instructions described herein for illustrative purposes in a particular order and/or grouping. However, the particular order and/or grouping shown and discussed herein are illustrative only and not limiting. Those of skill in the art will recognize that other orders and/or grouping of the process steps and/or operations and/or instructions are possible and, in some embodiments, one or more of the process steps and/or operations and/or instructions discussed above can be combined and/or deleted. In addition, portions of one or more of the process steps and/or operations and/or instructions can be re-grouped as portions of one or more other of the process steps and/or operations and/or instructions discussed herein. Consequently, the particular order and/or grouping of the process steps and/or operations and/or instructions discussed herein do not limit the scope of the invention as claimed below. 
     The present invention has been described in particular detail with respect to specific possible embodiments. Those of skill in the art will appreciate that the invention may be practiced in other embodiments. For example, the nomenclature used for components, capitalization of component designations and terms, the attributes, data structures, or any other programming or structural aspect is not significant, mandatory, or limiting, and the mechanisms that implement the invention or its features can have various different names, formats, or protocols. Further, the system or functionality of the invention may be implemented via various combinations of software and hardware, as described, or entirely in hardware elements. Also, particular divisions of functionality between the various components described herein are merely exemplary, and not mandatory or significant. Consequently, functions performed by a single component may, in other embodiments, be performed by multiple components, and functions performed by multiple components may, in other embodiments, be performed by a single component. 
     Some portions of the above description present the features of the present invention in terms of algorithms and symbolic representations of operations, or algorithm-like representations, of operations on information/data. These algorithmic or algorithm-like descriptions and representations are the means used by those of skill in the art to most effectively and efficiently convey the substance of their work to others of skill in the art. These operations, while described functionally or logically, are understood to be implemented by computer programs or computing systems. Furthermore, it has also proven convenient at times to refer to these arrangements of operations as steps or modules or by functional names, without loss of generality. 
     Unless specifically stated otherwise, as would be apparent from the above discussion, it is appreciated that throughout the above description, discussions utilizing terms such as, but not limited to, “activating”, “accessing”, “adding”, “aggregating”, “alerting”, “applying”, “analyzing”, “associating”, “calculating”, “capturing”, “categorizing”, “classifying”, “comparing”, “creating”, “defining”, “detecting”, “determining”, “distributing”, “eliminating”, “encrypting”, “extracting”, “filtering”, “forwarding”, “generating”, “identifying”, “implementing”, “informing”, “monitoring”, “obtaining”, “posting”, “processing”, “providing”, “receiving”, “requesting”, “saving”, “sending”, “storing”, “substituting”, “transferring”, “transforming”, “transmitting”, “using”, etc., refer to the action and process of a computing system or similar electronic device that manipulates and operates on data represented as physical (electronic) quantities within the computing system memories, resisters, caches or other information storage, transmission or display devices. 
     The present invention also relates to an apparatus or system for performing the operations described herein. This apparatus or system may be specifically constructed for the required purposes, or the apparatus or system can comprise a general-purpose system selectively activated or configured/reconfigured by a computer program stored on a computer program product as discussed herein that can be accessed by a computing system or other device. 
     Those of skill in the art will readily recognize that the algorithms and operations presented herein are not inherently related to any particular computing system, computer architecture, computer or industry standard, or any other specific apparatus. Various general purpose systems may also be used with programs in accordance with the teaching herein, or it may prove more convenient/efficient to construct more specialized apparatuses to perform the required operations described herein. The required structure for a variety of these systems will be apparent to those of skill in the art, along with equivalent variations. In addition, the present invention is not described with reference to any particular programming language and it is appreciated that a variety of programming languages may be used to implement the teachings of the present invention as described herein, and any references to a specific language or languages are provided for illustrative purposes only and for enablement of the contemplated best mode of the invention at the time of filing. 
     The present invention is well suited to a wide variety of computer network systems operating over numerous topologies. Within this field, the configuration and management of large networks comprise storage devices and computers that are communicatively coupled to similar or dissimilar computers and storage devices over a private network, a LAN, a WAN, a private network, or a public network, such as the Internet. 
     It should also be noted that the language used in the specification has been principally selected for readability, clarity and instructional purposes, and may not have been selected to delineate or circumscribe the inventive subject matter. Accordingly, the disclosure of the present invention is intended to be illustrative, but not limiting, of the scope of the invention, which is set forth in the claims below. 
     In addition, the operations shown in the FIGS., or as discussed herein, are identified using a particular nomenclature for ease of description and understanding, but other nomenclature is often used in the art to identify equivalent operations. 
     Therefore, numerous variations, whether explicitly provided for by the specification or implied by the specification or not, may be implemented by one of skill in the art in view of this disclosure.