Granted Patent B2

US 12,724,913 · App. 18/947,108 · Granted Sep 1, 2026

Inventors: Oded Sofer (Midreshet Ben Gurion, IL); Shlomit Avrahami Tomer (Jerusalem, IL)

Assignee: International Business Machines Corporation

G06F21/6218G06F16/2322G06F16/285

Abstract

Claims (51)

1 . A computer-implemented method of inter-layer mapping of sensitive data, the method comprising:

processing circuitry monitoring execution of an application providing an application interface through which a user can access a database, wherein monitoring execution of the application includes noting data fields of the application interface in which data is presented;

the processing circuitry monitoring accesses to the database made by a database management system based on user interaction with the application interface;

the processing circuitry determining mappings between the data fields of the application interface and object-fields in the database based on the monitoring of execution of the application and monitoring of accesses to the database;

based on the mappings, the processing circuitry identifying sensitive data in the database by performing classification processing; and

the processing circuitry updating a data access policy governing access to the database based on the identification of sensitive data in the database.

2 . The method of claim 1 , wherein determining mappings includes determining the mappings based on matches between data values of data fields of the application interface and object-fields of the database.

3 . The method of claim 1 , further comprising:

the processing circuitry deduplicating potential mappings between data fields of the application interface and object-fields in the database.

4 . The method of claim 1 , wherein performing classification processing includes performing classification based on data patterns detected utilizing regular expressions.

5 . The method of claim 1 , wherein performing classification processing includes performing classification based on database column names.

6 . The method of claim 1 , wherein performing classification processing includes performing classification utilizing natural language processing.

7 . The method of claim 1 , further comprising the processing circuitry identifying additional sensitive data by:

determining a regular expression satisfied by known sensitive data; and

applying the regular expression to additional data within the database.

8 . The method of claim 1 , further comprising:

the processing circuitry identifying additional sensitive data utilizing at least one selected from a group consisting of: timestamp matching between application events and database events, statistical matching, and context matching.

9 . A computer program product, comprising:

one or more computer-readable storage media; and

program instructions stored on the one or more computer-readable storage media to perform computer operations for inter-layer mapping of sensitive data, the computer operations including:

monitoring execution of an application providing an application interface through which a user can access a database, wherein monitoring execution of the application includes noting data fields of the application interface in which data is presented;

monitoring accesses to the database made by a database management system based on user interaction with the application interface;

determining mappings between the data fields of the application interface and object-fields in the database based on the monitoring of execution of the application and monitoring of accesses to the database;

based on the mappings, identifying sensitive data in the database by performing classification processing; and

updating a data access policy governing access to the database based on the identification of sensitive data in the database.

10 . The computer program product of claim 9 , wherein determining mappings includes determining the mappings based on matches between data values of data fields of the application interface and object-fields of the database.

11 . The computer program product of claim 9 , wherein the computer operations include:

deduplicating potential mappings between data fields of the application interface and object-fields in the database.

12 . The computer program product of claim 9 , wherein performing classification processing includes performing at least one selected from a group consisting of: classifying based on data patterns detected utilizing regular expressions, classifying based on database column names, and classifying utilizing natural language processing.

13 . The computer program product of claim 9 , wherein the computer operations include identifying additional sensitive data by:

determining a regular expression satisfied by known sensitive data; and

applying the regular expression to additional data within the database.

14 . The computer program product of claim 9 , wherein the computer operations include:

identifying additional sensitive data utilizing at least one selected from a group consisting of: timestamp matching between application events and database events, statistical matching, and context matching.

15 . A data processing system, comprising:

processing circuitry; and

one or more computer-readable storage media communicatively coupled to the processing circuitry, wherein the one or more computer-readable storage media includes program instructions to perform operations including:

monitoring execution of an application providing an application interface through which a user can access a database, wherein monitoring execution of the application includes noting data fields of the application interface in which data is presented;

monitoring accesses to the database made by a database management system based on user interaction with the application interface;

determining mappings between the data fields of the application interface and object-fields in the database based on the monitoring of execution of the application and monitoring of accesses to the database;

based on the mappings, identifying sensitive data in the database by performing classification processing; and

updating a data access policy governing access to the database based on the identification of sensitive data in the database.

16 . The data processing system of claim 15 , wherein determining mappings includes determining the mappings based on matches between data values of data fields of the application interface and object-fields of the database.

17 . The data processing system of claim 15 , wherein the operations include:

deduplicating potential mappings between data fields of the application interface and object-fields in the database.

18 . The data processing system of claim 15 , wherein performing classification processing includes performing at least one selected from a group consisting of: classifying based on data patterns detected utilizing regular expressions, classifying based on database column names, and classifying utilizing natural language processing.

19 . The data processing system of claim 15 , wherein the operations include identifying additional sensitive data by:

determining a regular expression satisfied by known sensitive data; and

applying the regular expression to additional data within the database.

20 . The data processing system of claim 15 , wherein the operations include:

identifying additional sensitive data utilizing at least one selected from a group consisting of: timestamp matching between application events and database events, statistical matching, and context matching.

Assignments (1)

Continuity (1)

References Cited (15)