Patent ID: 12189815

DETAILED DESCRIPTION

A network computer system to selectively replace data items of a collection of data structures. As described by various examples, the network computer system can be implemented as a web service, intercept service, or combination thereof. In some examples, the network computer system replaces data items when one or more scripts execute in a backend scripting engine of a third-party network service.

According to examples, a network computer system identifies whether a respective data item of a data structure meets one or more conditions for replacement. In examples, in the context of data items, replacement includes substituting at least a portion of a data item having a format, referred to herein as the substituted data, with a token that also has a corresponding format. The substituted data may include a character string that matches a particular format. The replacement prevents the storage of the substituted data by a third-party network service, such as to prevent the storage of sensitive data by the third-party network service.

In examples, the network computer system may implement a reversible data substitution procedure, such as by storing a token mapping so that the original data item may be reconstructed by replacing the token with the substituted data.

As an addition or alternative, the network computer system may implement an irreversible data substitution procedure, such as for anonymization. In examples, to permanently anonymize the data, no token mapping is stored between the substituted data and the corresponding token.

The conditions may include a format condition in which at least a portion of the respective data item has a format that coincides with a designated or predetermined format. The network computer system may operate to replace a set of characters of the respective data item, where the data item has a format that coincides with the predetermined format. The network computer system can replace the identified set of characters with the string of characters of a respective token, where the token is uniquely generated and stored as part of a token pool. The network computer system can further cause the respective data to be stored by a respective third-party network service after substitution.

In examples, the network computer system may dynamically determine a format condition. For example, the network computer system may process input data and identify a recurring format as a candidate for data replacement. The network computer system may operate to replace a set of characters in one or more data items where the data has a format that coincides with the dynamically-identified format. After determining the dynamically-identified format, the network computer system may generate a token pool that includes unique tokens with the dynamically-identified format.

In examples, a data item refers to a collection of data elements (e.g., alphanumeric characters, special characters, etc.), such as provided by a sequence of characters that represent a name, a government identifier (e.g., social security number), a telephone number, credit card information, a physical address, an email or other messaging identifier, or predefined codes relating to health or demographic information. Data items can be a part of an underlying data structure, such as a record or document. In some examples, data items that are subject to replacement can exist in a structured form as part of a data structure (e.g., field value), or alternatively, as part of the content of a record or document.

The term “format” and its variants (e.g., “subformat”), in context of a data item, means one or more discernable characteristics relating to any one of (i) an individual constituent data element, (ii) a subportion or combination of constituent data elements, and/or (iii) the collective constituent data elements of the data item. In examples, a format can be defined by a set of rules that correlate to, or otherwise define a corresponding set of discernable characteristics of a type of data item. By way of examples, the rule set can define the format of a data item by (i) a character length of the data item and/or portion(s) of the data item (e.g., number of characters that comprise the data item or portion of the data item), (ii) type, presence or placement (e.g., sequential placement) of special characters (e.g., “@”, “-”, “.”) within a series of characters that constitute the data item, (iii) a characteristic in the arrangement of data elements of the data item (e.g., data elements that are of a first type (e.g., alphabetical) are sequentially before data elements that are of another value type (e.g., numbering)), (iv) a type of value (e.g., alphabetical, numerical, special character, etc.) for any part of the data item, (v) a value range of a set of data elements that constitute the data item (e.g., between 01 and 12 to denote month of year on credit card), and/or (vi) a computational discerned characteristic as between data elements or portions of the data item, such as may be discernable through use of an algorithm (e.g., a checksum algorithm, such as the Luhn algorithm for credit card numbers).

A format of a data item is said to coincide with a format of a token if the format of the data item maps to, or is the same as the format of the token. Depending on implementation, for example, a data item may match to a format of a token if (i) the data item has the same number of characters, along with a same placement of a set of special characters as that of the token; or (ii) the data item is different in length, use or placement of special characters as compared to the token, but can be mapped to the format by a format rule (e.g., replace each character of the format with a byte value). As additional illustrative examples, the format of the data item and the token may coincide if, for example, a format of a portion of the data item (e.g., value range, type of value, arrangement characteristic, etc.) corresponds or otherwise maps to a corresponding portion of the token. As another example, the format of the data item and the token may also coincide if a computationally discerned characteristic is shared (e.g., checksum computation, in accordance with Luhn algorithm) between the data item and the token.

One or more examples described herein provide that methods, techniques, and actions performed by a computing device are performed programmatically, or as a computer-implemented method. Programmatically, as used herein, means through the use of code or computer-executable instructions. These instructions can be stored in one or more memory resources of the computing device. A programmatically performed step may or may not be automatic.

One or more examples described herein can be implemented using programmatic modules, engines, or components. A programmatic module, engine, or component can include a program, a sub-routine, a portion of a program, or a software component or a hardware component capable of performing one or more stated tasks or functions. As used herein, a module or component can exist on a hardware component independently of other modules or components. Alternatively, a module or component can be a shared element or process of other modules, programs or machines.

Furthermore, one or more examples described herein may be implemented through the use of instructions that are executable by one or more processors. These instructions may be carried on a computer-readable medium. Machines shown or described with figures below provide examples of processing resources and computer-readable mediums on which instructions for implementing examples described herein can be carried and/or executed. In particular, the numerous machines shown with examples described herein include processor(s) and various forms of memory for holding data and instructions. Examples of computer-readable mediums include permanent memory storage devices, such as hard drives on personal computers or servers. Other examples of computer storage mediums include portable storage units, such as CD or DVD units, flash memory (such as carried on smartphones, multifunctional devices or tablets), and magnetic memory. Computers, terminals, servers, network enabled devices (e.g., mobile devices, such as cell phones) are all examples of machines and devices that utilize processors, memory, and instructions stored on computer-readable mediums. Additionally, examples may be implemented in the form of computer-programs, or a computer usable carrier medium capable of carrying such a program.

Data Substitution System

FIG.1illustrates a network computer system to selectively replace data for storage with a third-party network service (“TPNS”). In examples, a data substitution system100is implemented using a network computer system, such as a server, or combination of servers. As described by various examples, the data substitution system100can replace portions of data structures that are transmitted from client terminals, servers or systems to the data substitution system100for storage with the TPNS10. As an addition or variation, the data substitution system100can replace portions of data structures that are stored with TPNS10, such that stored data structures are updated to reflect the replacement of select values. In such examples, the TPNS10can correspond to a cloud, SaaS or web service, and data structures that are subject to replacement by the data substitution system100can be associated with target account data12corresponding to a target account (e.g., enterprise or customer accounts).

The data substitution system100may implement an irreversible data substitution procedure, such as to anonymize the data. To permanently anonymize the data, no token mapping is stored between the substituted data and the corresponding token. As an addition or alternative, the data substitution system100may implement a reversible data substitution procedure, such as by storing information regarding a replacement operation so that the replacement operation on a data item may be reversed using the stored information. For example, the data substitution system100may store token mapping data152that associates a token and substituted data that originally appeared in one or more data items. The token mapping data152may be used to reconstruct an original data item from a modified data item by replacing a particular token appearing in the modified data item with the substituted data associated with the particular token.

According to examples, the data substitution system100includes one or more input interfaces110, a substitution component120, and one or more output interfaces130. As described by examples, the substitution component120utilizes tokens141from a token pool142to replace at least a portion of select data items, for storage with the TPNS10. Each of the input interface110and the output interface130can include a combination of processes, including processes to implement a REST, SOAP and/or client interface, as well as processes to retrieve and/or write data to the TPNS10. For example, modified data items may be written to the TPNS10when a client terminal20submits a web form that includes data items. As another example, modified data items may be retrieved from the TPNS10when a client terminal20loads a web page that includes data items.

In examples, data substitution system100is implemented as part of an intercept service that replaces at least a portion of data sets, communicated from client terminals20or other entities, for storage with target account data12(e.g., enterprise account) of the TPNS10. In such examples, the input interface110can include a client interface112to receive client communications. The client communications can be processed for data sets that are subjected to replacement, using the substitution component120. The output interface130can include TPNS interface132to cause the TPNS10to store modified versions of the data sets with the target account data12.

As another variation, the data substitution system100is implemented as a web-service to selectively replace account data that is stored with the target account data12of the TPNS10. In such examples, a web service interface114,134can be called or otherwise triggered by other programmatic components or processes, to retrieve data from a target location (e.g., target account data12of the TPNS10). In examples, a web service interface114,134can be triggered by a request from an enterprise (e.g., client terminal20) and/or from the TPNS10. For example, a script executing in the backend of the TPNS10may make a request to the web service interface114,134, as described in greater detail hereinafter with respect toFIG.3.

Still further, in other examples, a web service interface114,134can be triggered by a configuration or setting, such as based on a schedule or response to a predetermined event. By way of examples, (i) a web service interface134can be programmatically triggered to retrieve data sets123(e.g., all data sets that were created or modified before a specific date) from the target account data12on a monthly basis; and/or (ii) a web service interface134can be triggered to receive specific data sets123as part of a workflow that is initiated by a specific user or entity requesting replacement of a particular set of data (e.g., user requests to have their data anonymized and/or not stored at the TPNS10). In such examples, the received data sets123are subject to replacement to generate modified versions of the data sets (“modified data sets125”). The output interface130can utilize the TPNS interface132to update existing data sets of the target account data12. In variations, the output interface130can include a web service interface134that returns modified data sets125to another entity (e.g., separate intercept service) or direct web service call, for storage with the target account data12of TPNS10.

In some variations, the TPNS10can initiate or otherwise use the data substitution system100as a web service, by using, for example, a call request to trigger the input interface110, passing the data sets123from the target account data12of TPNS10. In such variations, the TPNS10can use a web service interface134to return modified data sets125to the TPNS10.

In examples, the substitution component120includes an extraction component122to select data items103from respective data sets123for replacement, and a data replacement component124to replace data of the selected data items103with a randomly-generated and unique set of tokens.

In examples, the extraction component122can operate to extract data structures101from the data sets123, and further to identify data items103within each identified data structure101which meets a condition, or set of conditions for replacement. An extracted data structure101can correspond to, for example, (i) a structured record in which respective data items103are field values of the record; or (ii) a document or file in which respective data items form part of the document's content (e.g., column or cell of a CSV file, delineated set of items in a text file, word of a document file, etc.), or (iii) the entire content of the document.

In some examples, the extraction component122includes a set of filters126that identify data items103designated portions of the respective data sets123for replacement. Each filter of the filter set126can identify a condition, or set of conditions, for identifying data items which are to be modified. For example, the filter set126can include one or multiple filters to identify one or more specific fields of a data record, where each identified field is pre-selected for replacement. In such examples, the filter set126can implement a format-driven replacement, by implementing the extraction component122to use the filter set126to identify the collection of data items103that are to be modified.

As an addition or alternative, the filter set126can include a second filter to identify data items of a particular format from a larger set of data. Each filter of the filter set126can, for example, identify a condition or rule for identifying a candidate set of character strings as being a data item of a predetermined type and/or a dynamically identified type. In examples, a condition for each filter can include (i) a length of the data item (e.g., 7 or 10 characters for phone number), (ii) a type of characters used by the data item (e.g., numbers for phone numbers), and/or (iii) presence of special markers in the character string. By way of example, character markers such as “P” or “PH:” or “Cell” can serve as a marker for a phone number, when the marker is followed by a series of characters that are numbers, in a given format (e.g., ten numbers formatted as X-XXX-XXX-XXXX or 1(XXX) XXX-XXXX, etc.). As another example, a character of “@” can mark an email address if the character marker is positioned in a string of characters that meet other conditions (e.g., . . . X@xxx.YYY where Y is one of the set of top-level domains, such as “.com”, “.org”, “.biz”, or “.gov”). Similar conditions can be defined for other types of data items103which may be substituted, such as names, which can include special markers (e.g., “Mr.”, “Ms.” or “Mrs.”) and formats.

Still further, the extraction component122can deploy the filter set126with an additional set of conditions128, including rules or other logic. The additional conditions128can, for example, restrict the filters126to identifying data items that meet an additional criterion or set of criteria, such as an age of the data item (e.g., based on creation date, modification date or other associated metadata). As another example, the additional conditions128can be based on data that is not part of the data item103where the replacement is to occur. For example, the additional conditions can be applied to data items103that meet the conditions of the filter set126, and further meet a value condition of a particular value of an associated data item. To illustrate, fields that represent Personal Identifiable Information (“PII”) of a person can be identified as data items103for replacement if the additional condition of a check field (e.g., representing a corresponding input indicating a desire of the person in question or the value of some other field value (e.g., representing an age of the person in question) meets a predetermined threshold (e.g., above the age of 13).

In examples, the extraction component122is configured to dynamically generate one or more filters. For example, the extraction component122may identify a recurring pattern in input data items associated with a field of one or more data records. After identifying the recurring pattern, the extraction component122may create a dynamically-generated filter that corresponds to potentially sensitive data or other data that is suitable for substitution. In examples, an administrator may specify a particular field, and the extraction component122processes input data items associated with the particular field to identify recurring patterns and/or create the dynamically-generated filter. After creating the dynamically-generated filter, the extraction component122may use the dynamically-generated filter to identify data items which are to be modified.

In examples, the filter set126and the additional conditions128can be configurable by, for example, an administrator of the target account data12, where the modified data is to be stored. The substitution component120can, for example, include an operator interface146to enable an administrator user to specify conditions for implementing filters or other rules by which data items103are selected for replacement.

To replace data of the selected data items103, examples provide for the data replacement component124to use tokens141from a pre-existing token pool142, where each token141is a cohesive and non-alterable sequence of values (e.g., characters), having a format that coincides with a format of the data item or portion thereof that is to be replaced by the particular token. The token pool142may be populated and replenished by a token generator140, which can, based on implementation, be included with the data substitution system100, or provided as a separate component.

In examples, the token generator140can generate tokens141for the token pool142that are unique, such that each generated token141, whether created at inception of token pool142or at a later time for its replenishment, is unique from all other existing or previously used tokens141of the token pool142. In examples, each token141of the token pool142can correspond to a string of characters that have a predetermined format. As an alternative or addition, each token of the token pool142may correspond to a string of characters that have a dynamically-identified format. For example, after a dynamically-identified format is created, the token generator140may generate tokens141for the token pool142that includes unique tokens with the dynamically-identified format.

The token pool142can include one or multiple collections of tokens, where the tokens of each collection have a respective format that coincides with a corresponding format of data items that are to be anonymized with the respective tokens. The tokens141of a given format can include characters that are randomly selected from a character library, which can include, depending on implementation, alphanumeric characters, including characters of one or more alphabets (e.g., Latin alphabet, Chinese alphabet, Arabic alphabet, Devanagari alphabet, etc.) or a customized convention. In examples, the data substitution system100replaces strings of characters of multiple formats, and the token generator140can maintain multiple token pools142for a plurality of formats.

The data replacement component124replaces data of select data items103, as identified by the extraction component122, with tokens141from the token pool142, without losing structure or utility of the data structure101from which the data item103was extracted. In particular, the token generator140can generate tokens that have a format that coincides with the format of the type of data item103which is to be anonymized. By adhering the format of the tokens to that of the data item103that is to be anonymized, the substituted form of the data items (modified data item105) can maintain its utility within the TPNS10. Moreover, since the tokens141are generated to be unique over time from all other tokens, there is no risk that any given modified data item105will be inconsistent with another data item, as could otherwise occur if two data items from unrelated records inadvertently have the same value. In examples, the data replacement component124stores an association between a particular token and the corresponding substituted data that the particular token was used to replace. For example, the data replacement component124may maintain token mapping data152so that the association between the particular token and the corresponding substituted data may be used in the future, such as to generate the original data item103from the modified data item105. In examples, the modified data items105can be used to generate an updated data set for associated data structure(s) of the target account data12, residing the TPNS10. The TPNS interface132can, for example, update respective records of the target account data12of TPNS10with modified data items105(or their respective data structures), meaning records and/or field values or updated with corresponding modified records and/or respective modified field values.

To illustrate, an enterprise network can be operated by an organization that has a policy to not use live PII production data in a SaaS environment. To protect the policy, the substitution component120can be configured to implement filters126and additional conditions128which identify PII-type information (e.g., phone numbers, names, email addresses) from a variety of data structures which the organization may use with the TPNS10. If an employee uploads, for example, a CSV file or other data structure (e.g., text document) that contains some data items which qualify as PII-type information, the data substitution system100can intercept and inspect the CSV file. The substitution component120can use the filter set126and additional conditions128to extract data items contained in the file which qualify as PII-type information. The CSV file is then modified to replace the identified PII type information with similarly formatted character sequences, each of which correspond to a randomly generated, pre-existing and unique token. This data structure (e.g., CSV file) with the anonymized data is passed on to the TPNS10.

As another illustration, an enterprise network can provide a feature that a user can select to replace data on demand in a live instance of the TPNS10. For example, a user can edit an existing record by selecting a checkbox that specifies that data items of the record are to be modified. The user submits the record, and the data substitution system100intercepts the data, identifies the data as having a pre-configured format, and modifies the record by selectively replacing the PII fields with tokens141. This modified record is then used to update a corresponding record maintained with the TPNS10.

As described with various examples, modified data items105maintain their format. For example, when an email address is replaced by the data substitution system100, the anonymized form the email address meets standard for email address format. For example, the substitution component120can alter the email address john.smith@example.com to “ab332.wwswe@fe23qpxm.csd”—the appropriate format for an email. The modified email address is acceptable to, for example, the TPNS10, as it meets the relevant format requirements, whilst being constructed from one or more tokens.

Intercept Computer System

FIG.2illustrates an intercept computer system on which an example service is implemented. In more detail, an intercept computer system200can be implemented using a network computing system, such as either a physical or virtual server, or combination of such servers, to receive and forward communications between the group of client terminals20and the third-party network service10(“TPNS10”). Each of the client terminals20may correspond to, for example, an end user terminal, workstation or other computer system capable of communicating with the intercept system200over the World Wide Web and/or other data networks.

In examples, the intercept system200provides data replacement as an intercept service (represented by substitution service230), as between client terminals20and the TPNS10. The intercept system200may implement an irreversible data substitution procedure, such as to anonymize the data. As an addition or alternative, the intercept system200may implement a reversible data substitution procedure, such as by storing information regarding the replacement so that a replacement operation on a data item may be reversed using the stored information.

As an intercept service, the substitution service230can modify data extracted from client requests211, before non-modified forms of the extracted data are communicated to the TPNS10. While some examples provide for the substitution service230to be implemented as an intercept service, in variations, the substitution service230can be implemented as on-demand process that can retrieve data for substitution from the TPNS10as a response to a triggering event or condition. Such triggering events can be detected through use of other intercept services, such as described with some examples below. However, as described with some examples ofFIG.1, the substitution service230can also be implemented as a backend web service that can be called or otherwise utilized by, for substitution, an automated cloud or SaaS process (such as where target data for substitution may reside). As an addition or variation, the substitution service230can be called or otherwise utilized by a programmatic administrative component of the enterprise network14. Still further, in some examples, the substitution service230can operate as a hybrid implementation (e.g., intercept-capable service), having processes for operating as both an intercept service and a programmatically driven or automated backend service. In addition, while the substitution service230is described as a service that may be separate or distinct from other services of the system200, in variations, the substitution service230can be implemented as an integrated component or functional aspect of a larger service that includes functionality of one or more other services, such as described with examples provided below.

As illustrated by an example ofFIG.2, the intercept system200can implement the substitution service230with one or more additional intercept services. In examples, the intercept system200includes a client interface202to communicate with a set of client terminals20, a service interface204to communicate with the TPNS10, and one or multiple intercept or intercept-capable services. In an example as described, the services of the intercept system200includes a network proxy service210, archival service220and the substitution service230. As an addition or alternative, the substitution service230can be used with other types of proxy or intercept services, such as, for example, a traffic monitoring service, a policy enforcement service, and/or a content configuration service. Still further, as described with other examples, the substitution service230can be used as an independent intercept service.

In examples, the network proxy service210can proxy for client terminals20in a manner that facilitates the respective client terminals20in accessing account data residing on sub-domains of the TPNS10. The network proxy service210can, for example, enable the client terminals20to utilize a single certificate that is issued by the network proxy service210to access domains and subdomains of the TPNS10. In some examples, the network proxy service210can implement a link structuring scheme, in which client requests211that are intended for forwarding to the TPNS10are communicated with links that are structured (“packed links”) in a manner that is specific to, for example, the domain of the network proxy service210(“proxy-domain specific structure”). The network proxy service210can restructure the packed links (or “unpack” the links) communicated with or as part of client requests211, into a link structure that is native to the TPNS10. In other words, the packed links of the client requests211can be unpacked to have the native structure of the TPNS10, before the client requests211are forwarded to the TPNS10as restructured/unpacked client requests213. As part of the proxy service, the network proxy service210can implement the link structuring scheme so that response communications221from the TPNS10are received in the native (or unpacked) structure of the TPNS10, then restructured into the proxy-domain specific structure (i.e. “packed”) before the response communications are forwarded to a respective client terminal20as restructured client responses223.

As an example, the network proxy service210can receive (via the client interface202) client requests211that specify links of the TPNS10in a packed structure, where the links in the packed structure include alternative syntax (e.g., “-” or hyphen) to identify sub-domains. The network proxy service210can parse URLs of individual client request211to identify the alternative syntax markers of the sub-domains, and to remove corresponding domain components from the respective links. The network proxy service210can also structure the syntax of the respective links to include a suffix proxy format. In examples, the network proxy service210restructures the links from the packed structure into an unpacked or native structure, where the alternative syntax of the packed links is replaced with target syntax (e.g., “.” or dot) that is recognized by the TPNS10to designate, for example, subdomains of the TPNS10. For response communications221, the network proxy service210can parse the communication to identify an unpacked (or natively structured) link of the response communication221. The network proxy service210can restructure the unpacked link into a packed structure, where, for example, alternative syntax (e.g., “-” or hyphen) is used to designate a subdomain portion of the individual links that specified or embedded in the response communication221.

In providing the proxy service, some examples provide that the network proxy service210can also issue a single proxy-domain specific SSL certificate to each of the client terminals20. The individual client terminals20can use the single proxy-domain specific SSL certificate for verification when sending client requests211and receiving client responses223from the TPNS10. The network proxy service210can further store and utilize a collection of SSL certificates that are issued by, or for use with, the TPNS10, in order to access sub-domains of the TPNS10on behalf of requesting client terminals20. As a result, the network proxy service210can enable, for example, browsers running on the client terminals20to access domains and sub-domains of the TPNS10, using a single proxy-domain specific certificate. The network proxy service210can receive and verify client requests211using the proxy-domain specific SSL certificate, then forward the client request211with the unpacked links to the TPNS10, and use one or multiple stored SSL certificates of the TPNS10to access sub-domains specified or used with the client request211. In this way, the network proxy service210can be implemented to enable the client terminals20to utilize browsers to have full access to the respective account's data collection, as hosted by the TPNS10(e.g., including domains and sub-domains), while alleviating burdensome certificate requisites that may otherwise be required from the TPNS10.

Additionally, the intercept system200can include an archival service220that can selectively archive data sets in communications that the system receives and forwards as between client terminals20(e.g., operating as part of the enterprise network14) and the TPNS10. In examples, the archival service220can implement data filters to identify target data sets for archival. The archival service220can, for example, implement archive filters (not shown inFIG.2) with the client interface202and/or service interface204, to filter respective client requests211and/or response communications221, from which archival can be extracted. As described by various examples, the archival service220can generate an archival data set for storage with an archival data store260that is independent of the TPNS10.

In some examples, the archival data store260can be configured to store an archive representation of select portions of the target account data12, such as portions of the account data that are pre-identified or deemed to be mission critical data for the respective enterprise account. The archival representation can include data that reflects a change or update to the target account data12, as well as data that reflects a state of select data items that are pre-associated, or otherwise identified, as being relevant to the change or update. For example, the archival data representation can include data that reflect a field (e.g., cell of table) that is changed by a client request211, as well as data that reflects other fields (e.g., other cells) that are pre-associated or are otherwise contextually relevant to the changed data item. In such examples, the other fields can be identified from, for example, one or more service response communications221that are made in context of the corresponding client request211, such as during the client terminal's session, as well as prior to or in response to the client request211in which the data item is changed. The service response(s) can reflect, for example, a state or value of the other pre-associated data items at the time when the change resulting from the client request211is made to the target account data12of the TPNS10.

According to some examples, the archival service220can be used in connection with the archival data store260being configured to be available to client terminal(s)20, independent of the TPNS10. Still further, in some variations, the archival data store260can reside within the enterprise network14of the client terminals20, such that client terminals20can access the data subject to rules and policies of the enterprise, and independent of the TPNS10. In variations, the archival data store260can be integrated with the intercept system200, independently of the TPNS10.

Additionally, the archival data representation(s) of the data of the target account data12can be generated from data included with the processed client requests211and/or service response communications221. Still further, the archival service220can generate the archival data representation(s) of the target account's data exclusively from data extracted from client requests211and/or service response communications221. In this way, the data of the archival data store260is generated without the intercept system200having to separately query the TPNS10for data from the target account data12.

The substitution service230can be implemented using, for example, the data substitution system100of examples ofFIG.1. Accordingly, reference to components ofFIG.1are intended to illustrate an example of functionality that can be implemented with respect to an example described. As an intercept service, the substitution service230can employ filters to identify select data items from client requests211, for which data substitution processes can be triggered. The client requests211can specify, for example, write operations to store data in the target account data12of TPNS10. When implemented as an intercept service, the substitution service230can identify, for example, a specific data structure or item, as part of the client requests211. The substitution service230can implement an extraction process (e.g., using the extraction component122) to identify which data items of the client request211meet one or more conditions for replacement. The substitution service230can further access a token store242to retrieve a token241for implementing the substitution process on select data items that are included in the client requests211and which meet the replacement condition(s). The substitution service230can use the token241to generate a modified form of the select data items without altering a format of the data set that contains the modified data items. In turn, the substitution service230can, through service interface204, write and/or update a data structure (e.g., record or document) that corresponds to the data set of the client request211. For example, the substitution service230can, through the service interface204, update a TPNS record that is specified by the client request211, with field values that have been modified by the substitution service230.

As described with other examples, once modified, the records of the target account data12can be made to include field values that include randomly generated sequences of characters that replace the information that would otherwise be conveyed by those field values. While the modified data items do not contain the original portion of data that was replaced, the underlying data structures of those data items can retain their respective utility within the larger set of the target account data12.

In examples, the services of the intercept system200can be integrated, with some services utilizing other services of the intercept system200. For example, the substitution service230can use the network proxy service210to locate the subdomains where records or other data structures that coincide with data sets of the client requests211. For example, the substitution service230can implement write-type operations to update select records of the client request211where data has been identified for substitution, as determined by the network proxy service210.

In some examples, the substitution service230modifies records that are stored with the target account data12of TPNS10, as well as corresponding data representations as stored with the archival data store260. In this manner, the intercept system200can deploy substitution service230to modify archive data (e.g., such as archival data stored in the archival data store260), as well as data that may be in otherwise active use as part of the target account data12.

While some examples ofFIG.2describe implementations in which the substitution service230modifies datasets identified from client request211, the substitution service230can also be implemented as a backend service that can be used with the intercept computer system200and or/one or more intercept services, such as described. In some examples, the substitution service230can be implemented with a web service interface232, to receive service calls or triggers from other processes or programmatic entities. The web service interface232can correspond to, for example, a Representation State Transfer (REST) interface. In examples in which the substitution service230is implemented as a hybrid, the substitution service230can process client requests211to identify data files, records or other structures that may be subject to substitution. The substitution service230can also be responsive to triggers, processes or other or other events, including to calls and/or instructions or data received through the web service interface232.

FIG.3illustrates a network computer system to selectively replace data for storage with a third-party network service when one or more programmatic components or processes are triggered at a third-party network service. In examples, a data substitution system100is implemented using a network computer system, such as a server or combination of servers. The data substitution system100includes a web service interface134. The web service interface134may be called or otherwise triggered by other programmatic components or processes. For example, Operation A and Operation B, each show the web service interface134being triggered by programmatic components or processes at the TPNS10. In examples, the TPNS10may implement a backend scripting engine14that allows an enterprise associated with a target account to provide executable code, such as but not limited to substitution script16and restoration script18, to execute in response to certain actions associated with the target account.

Operation A is initiated when a web form is submitted at a client terminal20. The web form includes a data item103containing sensitive information. The TPNS10handles the submission of the data item103in the web form by submitting a request to the web service interface134of the data substitution system100. In examples, the TPNS10automatically submits the request when a script is executed in the backend of the TPNS10.

In examples, the substitution script16executes automatically in response to submission of the web form by the client terminal20. When the substitution script16executes, the TPNS10submits a request comprising the data item103to the web service interface134. In examples, the request may include additional data, such as additional portions of the web form data. In response to the request, the substitution component120identifies data to substitute that includes at least a portion of the data item103to be replaced, selects a token from the token pool142, and stores a mapping associating the token and the substituted data in the token mapping data152. The substituted data may include a character string that matches a particular format, and the token also has the particular format. The data substitution system100generates and returns a modified data item105to the TPNS10in response to the request. As an alternative, the web service interface134may respond with data necessary for the TPNS10to generate the modified data item105. The substitution script16replaces the data item103with the modified data item105so that the modified data item105is stored in the target account data12of the TPNS10instead of the data item103.

Operation B is initiated when a web page is requested by the client terminal20. The web page is intended to include the originally submitted data item103, which is not stored at the target account data12maintained by the TPNS10. The TPNS10handles the web page request by submitting a request to the web service interface134of the data substitution system100. In examples, the TPNS10automatically submits the request when a script is executed in the backend of the TPNS10, such as the restoration script18.

In examples, the restoration script18executes automatically in response to web page request by the client terminal20. When the restoration script18executes, the TPNS10submits a request comprising the modified data item105to the web service interface134. In examples, the request may include additional data, such as a portion of the web page requested by the client terminal20that includes the modified data item105. In response to the request, the substitution component120identifies a token in the modified data item105, retrieves an association between the token and the corresponding substituted data in the token mapping data152, and replaces the token in the modified data item105with the substituted data to restore the original data item103. The substituted data may include a character string that matches a particular format, and the token also has the particular format. The data substitution system100returns data including the restored data item103to the TPNS10in response to the request. As an alternative, the web service interface134may respond with data necessary for the TPNS10to generate the restored data item103. When the web page is served to the client terminal20, the web page includes the restored data item103even though the data item103is not stored in the target account data12of the TPNS10.

Methodology

FIGS.4A-4Billustrate example methods for implementing a data replacement service for use with a third-party network service. A method such as described with examples ofFIGS.4A-4Bcan be implemented using, for example, a network computer system, such as described with examples ofFIGS.1-3. Accordingly, reference may be made to elements ofFIG.1-3for purpose of implementing a step or sub-step being described.

With reference to an example ofFIG.4A, a data substitution system100maintains a token pool including a plurality of unique tokens (405). Each unique token includes a string of characters having a particular format. The data substitution system100receives a first web service call from a third-party network service (TPNS)10(410). The first web service call corresponds to data that includes a data item. The first web service call may be triggered by programmatic components or processes at the TPNS10. In examples, the first web service call is triggered by a first script that executes in a backend scripting engine of the TPNS10. For example, the first script may be configured to execute in response to submission of a web form to the TPNS10by a client terminal associated20with a target account.

The data substitution system100identifies a character string in the data item that has a format that coincides with the particular format (415). The data substitution system100selects a token from the token pool (420). The data substitution system100provides a response to the first web service call that causes the TPNS10to store a modified data item (425). The modified data item is generated by replacing the character string in the data item with the token. In examples, the first web service call includes the data item, and the response includes the modified data item. As an alternative, the TPNS (10) may receive and use the token to generate the modified data item.

The data substitution system100replenishes the token pool with one or more unique tokens having the particular format. In examples, method ofFIG.4Ais used for irreversible data anonymization, reversible data substitution, or the combination thereof.

In examples, method ofFIG.4Bis used for reversible data substitution. With reference to an example ofFIG.4B, the data substitution system100stores a token mapping that associates the token selected from the token pool with the character string that originally appeared in the data item (435).

The data substitution system100receives a second web service call from the TPNS10(440). The second web service call corresponds to data that includes the modified data item. The second web service call may be triggered by programmatic components or processes at the TPNS10. In examples, second web service call is triggered by a second script that executes in a backend scripting engine of the TPNS10. For example, the second script may be configured to execute in response to a request from a client terminal20associated with a target account to the TPNS10, for a web page that displays the data item.

The data substitution system100determines that the particular token appears in the modified data item (445). The data substitution system100retrieves the token mapping that associates the particular identifying token and the character string that originally appeared in the data item (450). The data substitution system100provides a second response to the second web service call that causes the TPNS10to use a reconstructed data item that is equivalent to the data item (455). The reconstructed data item is generated by replacing the token with the character string from the token mapping.

Hardware Diagram

FIG.5is a block diagram that illustrates a computer system upon which embodiments described herein may be implemented. For example, in the context ofFIG.1and/orFIG.3, the data substitution system100can be implemented using a computer system such as described byFIG.5. Likewise, in the context ofFIG.2, the intercept system200can be implemented using a computer system such as described with an example ofFIG.5. Additionally, a method such as described with an example ofFIG.4can be implemented using a computer system such as described with an example ofFIG.5. Still further, examples ofFIG.1,FIG.2,FIG.3, and/orFIG.4can be implemented using a combination of multiple computer systems as described byFIG.5.

In one implementation, a computer system500includes processor(s)510, a main memory520, a read only memory (ROM)530, a storage device540, and a communication interface550. The computer system500includes the at least one processor510for processing information and executing instructions stored in the main memory520. The main memory520can correspond to, for example, a random-access memory (RAM) or other dynamic storage device, for storing information and instructions to be executed by the processor510. The main memory520can also be used for storing temporary variables or other intermediate information during execution of instructions to be executed by the processor510. The computer system500may also include the ROM530and/or other static storage device for storing static information and instructions for the processor510. A storage device540, such as a magnetic disk, solid state drive or optical disk, can be provided to store data sets, such as provided by the archival data store260. The main memory520can store instructions542for implementing a data anonymization system or service, such as described with examples ofFIG.1orFIG.2. Additionally, the processor510can execute the instructions542to implement a method such as described with an example ofFIG.3.

The communication interface550can enable the computer system500to communicate with one or more networks580(e.g., cellular network) through use of the network link (wireless or wireline). Using the network link, the computer system500can communicate with, for example, client terminals20, servers and one or more third-party network services10.

Examples described herein are related to the use of the computer system500for implementing the techniques described herein. According to one embodiment, those techniques are performed by the computer system500in response to the processor510executing one or more sequences of one or more instructions contained in the main memory520. Such instructions may be read into the main memory520from another machine-readable medium, such as the storage device540. Execution of the sequences of instructions contained in the main memory520causes the processor510to perform the process steps described herein. In alternative implementations, hard-wired circuitry may be used in place of or in combination with software instructions to implement examples described herein. Thus, the examples described are not limited to any specific combination of hardware circuitry and software.

CONCLUSION

It is contemplated for examples described herein to extend to individual elements and concepts described herein, independently of other concepts, ideas or system, as well as for examples to include combinations of elements recited anywhere in this application. Although examples are described in detail herein with reference to the accompanying drawings, it is to be understood that the concepts are not limited to those precise examples. Accordingly, it is intended that the scope of the concepts be defined by the following claims and their equivalents. Furthermore, it is contemplated that a particular feature described either individually or as part of an example can be combined with other individually described features, or parts of other examples, even if the other features and examples make no mentioned of the particular feature. Thus, the absence of describing combinations should not preclude having rights to such combinations.