Adaptive distributive data protection system
Embodiments for protecting data stored and transmitted in a computer network, by receiving confidential data from a client, the data organized into labeled fields and corresponding data elements; filtering the received data to identify fields that require data masking; generating a security prediction on the corresponding data elements using a machine learning process; separating the masked data into tokenized data having a respective token associated with each corresponding data element; and storing the tokenized data on a blockchain secure ledger to ensure integrity of the received data and prevent an ability to tamper with the received data.
1. A method of protecting data stored and transmitted in a computer network, comprising:
receiving confidential data from a client, the data organized into labeled fields and corresponding data elements;
filtering the received data to identify fields that require data masking;
masking the data elements of the received data corresponding to the identified fields;
separating the masked data into tokenized data having a respective token associated with each corresponding data element;
storing the tokenized data on a blockchain secure ledger to ensure integrity of the received data and prevent an ability to tamper with the received data, wherein storing the tokenized data on the blockchain secure ledger comprises splitting the tokenized data into a sequence of two or more tokens for storage at two or more storage locations on one or more storage systems;
generating a first sequence identifier and a second sequence identifier, wherein the first sequence identifier and the second sequence identifier when combined provide information for re-assembling the sequence of the two or more tokens;
providing, to the client, the first sequence identifier; and
saving the second sequence identifier in association with an identifier of the client.
2. The method of claim 1 wherein the network comprises a multi-tenant network, and wherein the tokenized data is split and separated on the basis of individual tenant ownership among multiple tenants.
3. The method of claim 2 wherein the network comprises an enterprise scale network having storage devices storing the data in geographically distributed locations.
4. The method of claim 1 further comprising generating a security prediction on the corresponding data elements using a machine learning process.
5. The method of claim 4 wherein the machine learning process comprises at least one of a logistic regression algorithm and a decision tree algorithm.
6. The method of claim 5 wherein the decision tree algorithm comprises one of a random forest algorithm and a boosting tree algorithm.
7. The method of claim 5 wherein the machine learning process further categorizes data rules by data type, data usage, system context, confidentiality level, and minimum required encryption strength.
8. The method of claim 7 wherein the machine learning process further categorizes law for protection by at least one of: data type, rationale, data type patterns, and confidentiality range.
9. The method of claim 7 wherein an encryption method sets an encryption method, encryption strength, and encryption API (application programming interface) location and type.
10. The method of claim 1 further comprising:
receiving a request from the client to access the stored data, the request including the identifier of the client;
finding the second sequence identifier based on the received identifier of the client;
combining the first sequence identifier and the second sequence identifier to obtain the sequence of the two or more tokens;
retrieving the data from the one or more storage systems using the obtained sequence; and
sending the data to the client.
11. An apparatus protecting data stored and transmitted in a computer network, comprising:
an interface receiving confidential data from a client, the data organized into labeled fields and corresponding data elements;
a data encryption processor filtering the received data to identify fields that require data masking;
a masking processor masking the data elements of the received data corresponding to the identified fields;
a data tokenization processor separating the masked data into tokenized data having a respective token associated with each corresponding data element;
a blockchain secure ledger data storage processor storing the tokenized data on a blockchain secure ledger to ensure integrity of the received data and prevent an ability to tamper with the received data, wherein storing the tokenized data on the blockchain secure ledger comprises splitting the tokenized data into a sequence of two or more tokens for storage at two or more storage locations on one or more storage systems;
a first processing component generating a first sequence identifier and a second sequence identifier, wherein the first sequence identifier and the second sequence identifier when combined provide information for re-assembling the sequence of the two or more tokens; and
the interface being further configured to provide, to the client, the first sequence identifier and to save the second sequence identifier in association with an identifier of the client.
12. The apparatus of claim 11 wherein the network comprises a multi-tenant network, and wherein the tokenized data is split and separated on the basis of individual tenant ownership among multiple tenants, and wherein the network comprises an enterprise scale network having storage devices storing the data in geographically distributed locations.
13. The apparatus of claim 11 further comprising a machine learning data identification processor generating a security prediction on the corresponding data elements using a machine learning process.
14. The apparatus of claim 13 wherein the machine learning process comprises at least one of a logistic regression algorithm and a decision tree algorithm, the decision tree algorithm comprising one of a random forest algorithm and a boosting tree algorithm.
15. The apparatus of claim 13 wherein the machine learning process further categorizes data rules by data type, data usage, system context, confidentiality level, and minimum required encryption strength.
16. The apparatus of claim 15 wherein the machine learning process further categorizes law for protection by at least one of: data type, rationale, data type patterns, and confidentiality range.
17. The apparatus of claim 16 wherein an encryption method sets an encryption method, encryption strength, and encryption API (application programming interface) location and type.
18. The apparatus of claim 11 further comprising a second processing component:
receiving a request from the client to access the stored data, the request including the identifier of the client;
finding the second sequence identifier based on the received identifier of the client;
combining the first sequence identifier and the second sequence identifier to obtain the sequence of the two or more tokens;
retrieving the data from the one or more storage systems using the obtained sequence; and
sending the data to the client.
19. A computer program product, comprising a non-transitory computer-readable medium having a computer-readable program code embodied therein, the computer-readable program code adapted to be executed by one or more processors to perform a method of protecting data stored and transmitted in a computer network, by:
receiving confidential data from a client, the data organized into labeled fields and corresponding data elements;
filtering the received data to identify fields that require data masking;
masking the data elements of the received data corresponding to the identified fields;
separating the masked data into tokenized data having a respective token associated with each corresponding data element;
storing the tokenized data on a blockchain secure ledger to ensure integrity of the received data and prevent an ability to tamper with the received data, wherein storing the tokenized data on the blockchain secure ledger comprises splitting the tokenized data into a sequence of two or more tokens for storage at two or more storage locations on one or more storage systems;
generating a first sequence identifier and a second sequence identifier, wherein the first sequence identifier and the second sequence identifier when combined provide information for re-assembling the sequence of the two or more tokens;
providing, to the client, the first sequence identifier; and
saving the second sequence identifier in association with an identifier of the client.
20. The computer program product of claim 19 wherein the network comprises a multi-tenant network, and wherein the tokenized data is split and separated on the basis of individual tenant ownership among multiple tenants, and further wherein the network comprises an enterprise scale network having storage devices storing the data in geographically distributed locations.