Apparatus and method for data redaction in a semi-structured document database
An apparatus has a processor and a memory connected to the processor. The memory stores instructions executed by the processor to store a semi-structured document database including a collection of documents having semi-structured data formats. Data redaction rules are defined. Each data redaction rule includes a redaction type and a path expression to a redaction location within a semi-structured data format of a document within the collection of documents. At least one data redaction rule includes a configurable range of redaction values and a configurable format for the redaction values. The data redaction rules are applied to form redacted documents. The redacted documents are supplied.
1. An apparatus, comprising:
a processor; and
a memory connected to the processor, the memory storing instructions executed by the processor to:
store a semi-structured document database including a collection of documents having semi-structured data formats,
define data redaction rules, wherein each data redaction rule includes a redaction type and a path expression to a redaction location within a semi-structured data format of a document within the collection of documents, wherein at least one data redaction rule includes a configurable range of redaction values and a configurable format for the redaction values,
apply the data redaction rules to form redacted documents, and
supply the redacted documents.
2. The apparatus of claim 1 wherein the configurable range of redaction values is a collection of characters from American Standard Code for Information Interchange (ASCII).
3. The apparatus of claim 1 wherein the configurable range of redaction values is a numeric range bound by a minimum numeric value and a maximum numeric value.
4. The apparatus of claim 3 wherein the numeric range has an associated numeric type.
5. The apparatus of claim 4 wherein the numeric type is selected from integer, decimal and floating-point.
6. The apparatus of claim 1 wherein the configurable format for the redaction values includes additional format fields that augment an original data value.
7. The apparatus of claim 6 wherein the additional format fields include a user specified string.
8. The apparatus of claim 7 wherein the additional format fields include the user specified string and an additional value.
9. The apparatus of claim 6 further comprising instructions executed by the processor to execute a hash function on a concatenation of the original data value and the additional format fields to support deterministic masking of redacted values.
10. The apparatus of claim 1 wherein the configurable format for the redaction values is a temporal format.
11. The apparatus of claim 10 wherein the temporal format specifies a date.
12. The apparatus of claim 10 wherein the temporal format specifies time in a single day.