Patent ID: 12254111

DETAILED DESCRIPTION

Information security is a critical factor in protecting and safeguarding confidential and proprietary data used to support data warehouses. Having accurate data classifications for data early in the development cycle is an important tool for safeguarding sensitive information. Typically, data classification is a subjective decision based on the best judgment of an individual. With employee turnover and flexible job assignments, classification of data may become inconsistent, inaccurate, or even nonexistent. In addition, data classification is labor intensive that is often a reactive exercise rather than proactive.

To address these and other problems with existing information security systems, this disclosure contemplates system and methods that provide for the early detection of sensitive data elements in databases. The disclosed embodiments proactively monitor multiple databases for any changes or additions to the database. Once a change or addition is detected, the disclosed embodiments extract any data columns that were changed or added. If the extracted column does not currently have any data classifications, attributes of the extracted column (e.g., column name, size, data type, etc.) are compared in real time to similar attributes of pre-trained classification models. Once a particular classification model is matched to the extracted column, embodiments apply data classifications of the classification model to the extracted column. As a result, data classifications may be automatically applied to data columns that are lacking data classifications. In situations where the data classifications indicate sensitive information (e.g., social security numbers, account numbers, etc.), the data column may be automatically protected from unwanted access by the automatic application of the data classification.

FIGS.1through3show example systems and methods for early change detection and data protection.FIG.1illustrates an example system for early change detection and data protection.FIG.2illustrates example operations of the system for early change detection and data protection ofFIG.1.FIG.3illustrates an example method for early change detection and data protection.

FIG.1illustrates an example data security system100for providing early change detection and data protection, according to certain embodiments. Data security system100includes a computer system110, multiple data servers120(e.g.,120A-120C), a classification server, and a network140. Computer system110is communicatively coupled to data servers120and classification server130via network140using any appropriate wired or wireless telecommunication technology.

In general, computer system110of data security system100periodically accesses data servers120to check whether any data table within any database125(e.g.,125A-C) has been created or modified at the column level since the last periodic check. If computer system110detects that a data table within a particular database125has been created or modified at the column level since the last periodic check, computer system110extracts the newly-created or newly-modified data column121. Computer system110then determines whether the data column121already has a data classification. If data column121does not have a data classification, computer system110analyzes and selects a particular classification model150from classification models150stored in memory114. For example, computer system110may compare data attributes (e.g., a column name, a datatype, a data size, etc.) to similar data attributes of classification models150in order to select a particular classification model150for data column121. Once a particular classification model150is chosen for data column121, computer system110then applies a data classification160of the particular classification model150to the data column121. This may include sending data classification160to a classification server130where it is applied to data column121in classification database135. As a result, data classification160may be applied to data column121where data column121may otherwise linger for long amounts of time without a data classification. In situations where data within data column121is sensitive or private information (e.g., social security numbers), the automatic application of data classification160to data column121secures the data and prevents unwanted access by unauthorized personnel.

Computer system110may be any appropriate computing system in any suitable physical form. As example and not by way of limitation, computer system110may be an embedded computer system, a system-on-chip (SOC), a single-board computer system (SBC) (such as, for example, a computer-on-module (COM) or system-on-module (SOM)), a desktop computer system, a laptop or notebook computer system, a mainframe, a mesh of computer systems, a mobile telephone, a personal digital assistant (PDA), a server, a tablet computer system, an augmented/virtual reality device, or a combination of two or more of these. Where appropriate, computer system110may include one or more computer systems110; be unitary or distributed; span multiple locations; span multiple machines; span multiple data centers; or reside in a cloud, which may include one or more cloud components in one or more networks. Where appropriate, one or more computer systems110may perform without substantial spatial or temporal limitation one or more steps of one or more methods described or illustrated herein. As an example and not by way of limitation, one or more computer systems110may perform in real time or in batch mode one or more steps of one or more methods described or illustrated herein. One or more computer systems110may perform at different times or at different locations one or more steps of one or more methods described or illustrated herein, where appropriate.

Processor112is any electronic circuitry, including, but not limited to a microprocessor, an application specific integrated circuits (ASIC), an application specific instruction set processor (ASIP), and/or a state machine, that communicatively couples to memory114and controls the operation of remote computing system110. Processor112may be 8-bit, 16-bit, 32-bit, 64-bit or of any other suitable architecture. Processor112may include an arithmetic logic unit (ALU) for performing arithmetic and logic operations, processor registers that supply operands to the ALU and store the results of ALU operations, and a control unit that fetches instructions from memory and executes them by directing the coordinated operations of the ALU, registers and other components. Processor112may include other hardware that operates software to control and process information. Processor112executes software stored in memory to perform any of the functions described herein. Processor112controls the operation and administration of computer system110by processing information received from data servers120and memory114. Processor112may be a programmable logic device, a microcontroller, a microprocessor, any suitable processing device, or any suitable combination of the preceding. Processor112is not limited to a single processing device and may encompass multiple processing devices.

Memory114may store, either permanently or temporarily, data such as classification models150, operational software such as data security module116, or other information for processor112. Memory114may include any one or a combination of volatile or non-volatile local or remote devices suitable for storing information. For example, memory114may include random access memory (RAM), read only memory (ROM), magnetic storage devices, optical storage devices, or any other suitable information storage device or a combination of these devices.

Data security module116represents any suitable set of instructions, logic, or code embodied in a computer-readable storage medium. For example, data security module116may be embodied in memory114, a disk, a CD, or a flash drive. In particular embodiments, data security module116may include instructions117(e.g., a software application) executable by processor112to perform one or more of the functions described herein. In general, data security module116sends data classifications160to classification server130via network140.

Data server120is any appropriate computing or networking element or node. In some embodiments, data server120is a database server that stores or is otherwise communicatively coupled to one or more databases125. Data server120may be, for example, a SQL server, an Oracle server, a Hive server, a Teradata server, a Hadoop server, and the like. Databases125may either stored internally within data servers120or on another computing system within the same data center.

Likewise, classification server130is any appropriate computing or networking element or node. In some embodiments, classification server130is a database server that stores or is otherwise communicatively coupled to one or more classification databases135. classification server130may be, for example, a SQL server, an Oracle server, a Hive server, a Teradata server, a Hadoop server, and the like. Classification database135may either stored internally within classification server130or on another computing system within the same data center.

Network140allows communication between and amongst the various components of data security system100. For example, computing system110, data servers120, and classification server130may communicate via network140. This disclosure contemplates network140being any suitable network operable to facilitate communication between the components of data security system100. Network140may include any interconnecting system capable of transmitting audio, video, signals, data, messages, or any combination of the preceding. Network140may include all or a portion of a local area network (LAN), a wide area network (WAN), an overlay network, a software-defined network (SDN), a virtual private network (VPN), a packet data network (e.g., the Internet), a mobile telephone network (e.g., cellular networks, such as 4G or 5G), a Plain Old Telephone (POT) network, a wireless data network (e.g., WiFi, WiGig, WiMax, etc.), a Long Term Evolution (LTE) network, a Universal Mobile Telecommunications System (UMTS) network, a peer-to-peer (P2P) network, a Bluetooth network, a Near Field Communication (NFC) network, a Zigbee network, and/or any other suitable network.

Classification models150, in general, are used to apply data classifications160to data columns121that do not already have data classifications. Each classification model150stores or otherwise indicates a particular data classification160that may be applied to one or more data columns121of databases125. Each classification model150may have attributes such as a name, datatype, data size, creator information, etc. that may be compared to similar attributes of data column121in order to select an appropriate matching classification model150for data column121. As an example, a particular classification model150B may have a name attribute of “social security number” and a data classification160of “Classification B.” When a newly-created data column121having a column name attribute of “social security number” is needing a data classification, computer system110may match the name attribute of the newly-created data column121to classification model150B and proceed to apply data classification160of classification model150B (e.g., “Classification B”) to the newly-created data column121.

In some embodiments, data security system100utilizes a data collection and training operation to create classification models150. For example, data security system100may first access data servers120to collect database inventory and data classifications stored in databases125. Data security system100may then consolidate the collected database inventory and data classifications in order to create classification models150. For example, if data security system100collect multiple data columns121that each have a name attribute of “department” and an existing data classification160of “Classification C,” data security system100may create a classification model150C that has a name attribute of “department” and an existing data classification160of “Classification C.” In some embodiments, data security system100utilizes various analysis techniques to evaluate the accuracy of each created classification models150. For example, data security system100may utilize natural language processing, bayes classifiers, linear classifiers, deep neural networks, support vector machines, and the like to evaluate the accuracy of each classification model150.

Data classification160is any appropriate label, setting, etc. that may be applied to data column121in order to indicate a type of data that is stored in data column121. For example, data classification160may be “ss number” for social security numbers. As another example, data classification160may be “act number” for customer account numbers. As yet another example, data classification160may be “dept name” for the names of employees' assigned departments. In some embodiments, each data classification160may have an associated security setting. For example, data classifications160of “ss number” and “act number” may each have an associated security setting of “restricted” or “private” in order to limit access to the data in data column121to only authorized personnel, while data classification160of “dept name” may have an associated security setting of “unrestricted” or “public” in order to allow access to the data in data column121to anyone.

In operation, computer system110of data security system100periodically accesses data servers120to check whether any data table within any database125(e.g.,125A-C) has been created or modified at the column level since the last periodic check. For example, computer system110may access each database125every hour to check whether any data table has been created or modified at the column level since the last periodic check. If computer system110detects that a data table within a particular database125has been created or modified at the column level since the last periodic check, computer system110extracts the newly-created or newly-modified data column121.

Once data column121is extracted, computer system110analyzes data column121to determine whether data column121currently has an applied data classification. If computer system110determines that data column121does not have a data classification, computer system110analyzes and selects a particular classification model150from classification models150stored in memory114. For example, computer system110may compare data attributes (e.g., a column name, a datatype, a data size, etc.) to similar data attributes of classification models150in order to select a particular classification model150for data column121. Once a particular classification model150is chosen for data column121, computer system110then applies a data classification160of the particular classification model150to the data column121. In some embodiments, computer system110applies data classification160to data column121by sending data classification160to a classification server130where it is applied to data column121in classification database135. In other embodiments, computer system110may send data classification160to the data server120where data column121was extracted, and data classification160is applied to data column121in database125. As a result, data classification160may be applied to data column121where data column121may otherwise linger for long amounts of time without a data classification. In situations where data within data column121is sensitive information (e.g., social security numbers), the automatic application of data classification160to data column121secures the data and prevents unwanted access by unauthorized personnel.

FIG.2illustrates example operations of the system for early change detection and data protection ofFIG.1, according to certain embodiments. This figure illustrates three different situations where a data table122of a database125within data server120has been updated or created by a user, thereby triggering computer system110to apply data classifications160to a particular data column121. As a result, the newly-created or modified data column121may automatically have a data classification160applied to data column121where otherwise data column121may remain unclassified for long periods of time.

In a first example operation, a user updates or creates an employee data table122A in database125A of data server120A. In this example, employee data table122A contains two data columns121: a “name” data column121A-1and an “office” data column121A-2. Computer system110periodically accesses data server120A (e.g., once every hour) to check whether any data table122within database125A has been created or modified at the column level since the last periodic check. In this scenario, computer system110detects that data table122A has been created or modified at the column level since the last periodic check. Computer system110then determines whether each data column121A-1and121A-2already has a data classification. In this example, computer system110determines that data column121A-2already contains a data classification, but that data column121A-1does not contain a data classification. Computer system110therefore ignores data column121A-2but extracts data column121A-1. Computer system110then determines a particular classification model150from classification models150stored in memory114to use for data column121A-1. For example, computer system110may compare data attributes (e.g., the column name of “office”, a datatype of column “office”, a data size of column “office”, etc.) to similar data attributes of classification models150in order to select a particular classification model150for data column121A-1. In this example, computer system110determines that classification model150A has similar data attributes to data column121A-1and is therefore chosen for data column121A-1. Computer system110then applies a data classification160A of “Classification A” from classification model150A to data column121A-1by sending data classification160A to classification server130. At classification server130, data classification160A is applied to data column121A-1in classification database135. As a result, data classification160A is applied to data column121A-1where data column121A-1may otherwise linger for long amounts of time without a data classification.

In a second example operation, a user updates or creates an employee data table122B in database125B of data server120B. In this example, employee data table122B contains two data columns121: a “name” data column121B-1and a “social security number” data column121B-2. Computer system110periodically accesses data server120B (e.g., once every hour) to check whether any data table122within database125B has been created or modified at the column level since the last periodic check. In this scenario, computer system110detects that data table122B has been created or modified at the column level since the last periodic check. Computer system110then determines whether each data column121B-1and121B-2already has a data classification. In this example, computer system110determines that data column121B-1already contains a data classification, but that data column121B-2does not contain a data classification. Computer system110therefore ignores data column121B-1but extracts data column121B-2. Computer system110then determines a particular classification model150from classification models150stored in memory114to use for data column121B-2. For example, computer system110may compare data attributes (e.g., the column name of “social security number”, a datatype of column “social security number”, a data size of column “social security number”, etc.) to similar data attributes of classification models150in order to select a particular classification model150for data column121B-2. In this example, computer system110determines that classification model150B has similar data attributes to data column121B-2and is therefore chosen for data column121B-2. Computer system110then applies a data classification160B of “Classification B” from classification model150B to data column121B-2by sending data classification160B to classification server130. At classification server130, data classification160B is applied to data column121B-2in classification database135. As a result, data classification160B is applied to data column121B-2where data column121B-2may otherwise linger for long amounts of time without a data classification.

In a third example operation, a user updates or creates a salary data table122C in database125C of data server120C. In this example, salary data table122C contains three data columns121: a “name” data column121C-1, a “salary” data column121C-2, and a “department” data column121C-3. Computer system110periodically accesses data server120C (e.g., once every hour) to check whether any data table122within database125C has been created or modified at the column level since the last periodic check. In this scenario, computer system110detects that data table122C has been created or modified at the column level since the last periodic check. Computer system110then determines whether each data column121C-1,121C-2, and121C-3already has a data classification. In this example, computer system110determines that data columns121C-1and121C-2already contain a data classification, but that data column121C-3does not contain a data classification. Computer system110therefore ignores data columns121C-1and121C-2but extracts data column121C-3. Computer system110then determines a particular classification model150from classification models150stored in memory114to use for data column121C-3. For example, computer system110may compare data attributes (e.g., the column name of “department”, a datatype of column “department”, a data size of column “department”, etc.) to similar data attributes of classification models150in order to select a particular classification model150for data column121C-3. In this example, computer system110determines that classification model150C has similar data attributes to data column121C-3and is therefore chosen for data column121C-3. Computer system110then applies a data classification160C of “Classification C” from classification model150C to data column121C-3by sending data classification160C to classification server130. At classification server130, data classification160C is applied to data column121C-3in classification database135. As a result, data classification160C is applied to data column121C-3where data column121C-3may otherwise linger for long amounts of time without a data classification.

FIG.3illustrates an example method300for early change detection and data protection, according to certain embodiments. At operation310, method300periodically accesses one or more databases stored in a plurality of data servers. In some embodiments, the one or more databases are databases125and the plurality of data servers are data servers120. In some embodiments, method300accesses the one or more databases once in a predefined interval such as one hour. In some embodiments, the one or more databases are pre-production development databases (e.g., software development databases that are not currently being used for production/released software).

At operation320, method300determines that a data table in the one or more databases of operation310has been newly created or modified. In some embodiments, the data table is data table122. In some embodiments, method300determines that a data table in the one or more databases of operation310has been newly created or modified by analyzing a time stamp of the data table. The time stamp may indicate, for example, a time/date that the data table was created or last modified. If method300determines that the date/time of the time stamp is after the previous access of the data table by method300, method300may determine that the data table is newly created or modified and therefore proceed to operation330.

At operation330, method300extracts a data column from the data table that has been newly created or modified of operation320. In some embodiments, the data column is data column121. In some embodiments, the data column includes attributes such as a column name, a datatype, a data size, and creator information.

At operation340, method300determines whether the data column of operation330has an existing data classification. In some embodiments, the data classification is data classification160. If method300determines in operation340that the data column of operation330does not have an existing data classification, method300proceeds to operation350. Otherwise, if method300determines in operation340that the data column of operation330has an existing data classification, method300may end.

At operation350, method300accesses a plurality of classification models and determines a particular classification model to use for the data column of operation330. In some embodiments, the classification models are classification models150. In some embodiments, each classification model indicates or stores a data classification to apply to one or more data columns of the one or more databases. In some embodiments, operation350determines the particular classification model to use for the data column of operation330by comparing data attributes of the data column to data attributes of the plurality of classification models. For example, certain embodiments utilize natural language processing (NLP) to compare a name attribute of the data column to name attributes of the classification models. Once method300matches the name attribute of the data column to a particular name attribute of a particular classification model within a predetermined accuracy, method300selects the particular classification model to use for the data column. The selected classification model indicates or stores a particular data classification to apply to the data column.

At operation360, method300sends one or more instructions to a classification server to apply the particular data classification of the selected classification model to the data column. In some embodiments, the classification server stores a classification database such as classification database135. The classification server stores the particular data classification in the classification database and associates the particular data classification with the data column, thereby applying the particular data classification of the selected classification model to the data column.

Modifications, additions, or omissions may be made to the systems and apparatuses described herein without departing from the scope of the disclosure. The components of the systems and apparatuses may be integrated or separated. Moreover, the operations of the systems and apparatuses may be performed by more, fewer, or other components. Additionally, operations of the systems and apparatuses may be performed using any suitable logic comprising software, hardware, and/or other logic.

Modifications, additions, or omissions may be made to the methods described herein without departing from the scope of the disclosure. The methods may include more, fewer, or other steps. Additionally, steps may be performed in any suitable order. That is, the steps of any method disclosed herein do not have to be performed in the exact order disclosed, unless explicitly stated.

As used in this document, “each” refers to each member of a set or each member of a subset of a set. Furthermore, as used in the document “or” is not necessarily exclusive and, unless expressly indicated otherwise, can be inclusive in certain embodiments and can be understood to mean “and/or.” Similarly, as used in this document “and” is not necessarily inclusive and, unless expressly indicated otherwise, can be inclusive in certain embodiments and can be understood to mean “and/or.” All references to “a/an/the element, apparatus, component, means, step, etc.” are to be interpreted openly as referring to at least one instance of the element, apparatus, component, means, step, etc., unless explicitly stated otherwise.

Furthermore, reference to an apparatus or system or a component of an apparatus or system being adapted to, arranged to, capable of, configured to, enabled to, operable to, or operative to perform a particular function encompasses that apparatus, system, component, whether or not it or that particular function is activated, turned on, or unlocked, as long as that apparatus, system, or component is so adapted, arranged, capable, configured, enabled, operable, or operative.

Although several embodiments have been illustrated and described in detail, it will be recognized that substitutions and alterations are possible without departing from the spirit and scope of the present disclosure, as defined by the appended claims.