Systems and method of contextual data masking for private and secure data linkage
The present disclosure relates to methods and systems for contextual data masking and registration. A data masking process may include classifying ingested data, processing the data, and tokenizing the data while maintaining security/privacy of the ingested data. The data masking process may include data configuration that comprises generating anonymized labels of the ingested data, validating an attribute of the ingested data, standardizing the attribute into a standardized format, and processing the data via one or more rules engines. One rules engine can include an address standardization that generates a list of standard addresses that can provide insights into columns of the ingested data without externally transmitting the client data. The masked data can be tokenized as part of the data masking process to securely maintain an impression of the ingested data and generate insights into the ingested data.
1. A computer-implemented method for securely classifying and tokenizing data, the method comprising:
ingesting a dataset corresponding to a client;
inspecting the dataset to identify a classifier that is indicative of a characteristic of an attribute included in the dataset;
retrieving client-specific encryption information and client-specific configuration information that includes a listing of anonymized labels that are indicative of types of information included in the dataset;
identifying a label included in the listing of anonymized labels that corresponds to a type of information in the attribute based on the identified classifier;
responsive to determining that the attribute corresponds to the label, processing the attribute of the dataset to generate a modified attribute that is modified into a standardized format according to a set of standardization rules; and
generating a tokenized version of the modified attribute, including:
hashing the modified attribute using a hash salt and encryption key included in the client-specific encryption information to generate a hashed modified attribute;
comparing the label with a tag store including a series of client-specific tags to identify a first tag that corresponds to the label; and
generating a contextualized token of the modified attribute that includes the first tag:
wherein processing the attribute of the dataset to generate the modified attribute further comprises:
retrieving a set of validation rules and the set of standardization rules that correspond to the attribute, the set of validation rules providing rules indicative of whether the attribute corresponds to the label, and the set of standardization rules providing rules to modify the attribute into the standardized format; and
comparing the attribute with the set of validation rules to determine whether the attribute corresponds to the label.
2. The computer-implemented method of claim 1 , wherein at least a portion of the data included in the dataset includes personally identifiable information (PII).
3. The computer-implemented method of claim 1 , wherein the classifier includes any of a domain classifier, a subdomain classifier, an attribute classifier, and an entity classifier.
4. The computer-implemented method of claim 1 , wherein the client-specific encryption information is retrieved from a secure server, the client-specific encryption information encrypted using a hashed message authentication code (HMAC) protocol or transmitted via TLS protocol, and wherein the hash salt includes a computer-generated SHA2 512/256 token, and AES256 encryption key.
5. The computer-implemented method of claim 1 , wherein processing the attribute of the dataset to generate the modified attribute further comprises applying a name engine that associates the attribute with commonly associated names included in a listing of associated names and an address library engine that adds the attribute to a library of addresses associated with the client.
6. The computer-implemented method of claim 1 , further comprising:
encrypting the hashed modified attribute using a client-specific encryption key included in the client-specific encryption information.
7. The computer-implemented method of claim 1 , further comprising:
responsive to identifying the label, generating a first set of insights of the dataset based on the label and the attribute;
responsive to generating the modified attribute, generating a second set of insights for the dataset based on the modified attribute; and
storing the first set of insights and the second set of insights in a network-accessible server system.
8. A method performed by a computing node to generate a tokenized impression of client data, the method comprising:
obtaining a stream of data corresponding to a client from a client node, the stream of data including a series of datasets;
for each dataset included in the stream of data:
inspecting the dataset to identify a classifier that is indicative of a characteristic of an attribute included in the dataset;
identifying a label included in a listing of client-specific labels that corresponds to the dataset;
responsive to determining that the attribute corresponds to the label, processing the attribute to generate a modified attribute that is modified into a standardized format according to a series of rules engines; and
generating a token that includes a tokenized version of the modified attribute; and
sending generated tokens for the stream of data to a network-accessible server system configured to maintain the generated tokens:
wherein processing the attribute using the series of rules engines further comprises:
retrieving a set of validation rules and the set of standardization rules that correspond to the label, the set of validation rules providing rules indicative of whether the attribute corresponds to the label, and the set of standardization rules providing rules to modify the attribute into the standardized format; and
comparing the attribute with the set of validation rules to determine whether the attribute corresponds to the label.
9. The method of claim 8 , further comprising:
retrieving client-specific encryption information that includes a hash code and a client-specific encryption key from a secure server; and
retrieving client-specific configuration information that includes the listing of client-specific labels that are indicative of types of information included in the dataset, wherein each label is configured to anonymize information relating to the stream of data such that identifying information relating to the stream of data using the label is only discernable using the client-specific configuration information.
10. The method of claim 9 , wherein said generating the tokenized version of the modified attribute includes:
hashing the modified attribute using the hash code included in the client-specific encryption information to generate a hashed modified attribute;
comparing the classifier with a tag store including a series of client-specific tags to identify a first tag that corresponds to the classifier; and
generating a contextualized token of the modified attribute that includes the first tag, the token including the contextualized token.
11. The method of claim 9 , further comprising:
encrypting the modified attribute using the client-specific encryption key included in the client-specific encryption information.
12. The method of claim 8 , wherein said identifying the classifier further includes:
determining a domain classifier from a listing of domain classifiers, each domain classifier indicative of a type of information included in the dataset;
determining a subdomain classifier from a listing of subdomain classifiers, each subdomain classifier indicative of a subset of the selected information type identified in the domain classifier;
determining an attribute classifier from a listing of attribute classifiers, each attribute classifier indicative of a type of identifiable information included in the dataset; and
determining an entity classifier from a listing of entity classifiers, each entity classifier indicative of a division of an organization associated with the client.
13. A tangible, non-transitory computer-readable medium having instructions stored thereon that, when executed by a processor, cause the processor to:
ingest a dataset corresponding to a client;
identify a classifier that is indicative of a characteristic of an attribute included in the dataset;
retrieve client-specific encryption information and client-specific configuration information that includes a listing of anonymized labels that are indicative of types of information included in the dataset;
identify a label included in the listing of anonymized labels that corresponds to a type of information included in the attribute based on the identified classifier;
responsive to determining that the attribute corresponds to the label, modify the attribute of the dataset to generate a modified attribute into a standardized format according to a set of standardization rules; and
generate a tokenized version of the modified attribute, including:
hash the modified attribute using a hash code included in the client-specific encryption information to generate a hashed modified attribute;
compare the label with a tag store including a series of client-specific tags to identify a first tag that corresponds to the label; and
generate a contextualized token of the modified attribute that includes the first tag:
wherein said process the attribute of the dataset to generate the modified attribute further comprises:
retrieving a set of validation rules and the set of standardization rules that correspond to the label, the set of validation rules providing rules indicative of whether the attribute corresponds to the label, and the set of standardization rules providing rules to modify the attribute into the standardized format; and
comparing the attribute with the set of validation rules to determine whether the attribute corresponds to the label.
14. The computer-readable medium of claim 13 , wherein the attribute includes an impression of data included in the dataset while preventing transmission of the dataset from a client node maintaining the dataset.
15. The computer-readable medium of claim 13 , wherein the classifier includes any of a domain classifier indicative of a type of information included in the dataset, a subdomain classifier indicative of a subset of the selected information type identified in the domain classifier, an attribute classifier indicative of a type of identifiable information included in the dataset, and an entity classifier indicative of a division of an organization associated with the client.
16. The computer-readable medium of claim 13 , wherein the client-specific encryption information is retrieved from a secure server, the client-specific encryption information is encrypted using a hashed message authentication code (HMAC) protocol, and wherein the hash code includes a computer-generated SHA2 512/256 token.
17. The computer-readable medium of claim 13 , further causing the processor to: encrypt the hashed modified attribute using a client-specific encryption key included in the client-specific encryption information.