Policy aware configurable data redaction based on sensitivity and use factors
The present invention generally relates to systems and methods for document redaction. The disclosed techniques adapt to the needs of different levels of data sensitivity and different needs for disclosure or analysis by using pre-defined templates related to use cases, and mapping those to the relative sensitivity of private data types both in their natural form and after redaction by various redaction types. In this way, data is given the appropriate level of protection within the needs of a given use case.
1. A computer-implemented method for redacting data, the method comprising:
obtaining from a user, using an electronic interface, for each of a plurality of redaction types, a corresponding identification scope conferred by a respective redaction type and a corresponding disclosure impact indicating an amount of harm, whereby a plurality of triples are obtained, each triple comprising a redaction type, a corresponding identification scope, and a corresponding disclosure impact, wherein each identification scope is selected from the group consisting of: identify a person uniquely, identify a person uniquely in an application, identify a group uniquely, identify a group uniquely in an application, and not needed for identification, and wherein each disclosure impact comprises a level of trust required of a third party to which a value is disclosed;
generating an initial redaction matrix comprising the plurality of triples wherein the initial redaction matrix is incomplete, and wherein the initial redaction matrix comprises at least one blank entry for at least one trust requirement and disclosure impact pair;
obtaining from a user, using an electronic interface, a selection of a policy, wherein the policy specifies a technique for completing the initial redaction matrix;
applying the policy to the initial redaction matrix using an electronic processor, whereby a completed redaction matrix is obtained, the completed redaction matrix associating a redaction type to each of a plurality of pairs of identification scope and disclosure impact;
obtaining, from a user, using an electronic interface, an indication of a need to know a content for each of a plurality of data types used in an application; and
applying the completed redaction matrix to a corresponding data type used in the application, whereby an application template is obtained, wherein the application template specifies a particular redaction type for each of the plurality of data types used in the application; and
applying the application template to the application, whereby data used by the application is redacted.
2. The method of claim 1 , wherein each redaction type is selected from the group consisting of: mask, tokenize, encrypt, categorize, randomize, and aggregate.
3. The method of claim 1 , wherein the policy is defined to favor one of usefulness or protection.
4. The method of claim 1 , wherein the obtaining an indication of a need to know a content for each of a plurality of data types used in an application comprises obtaining a positive response for a specific data type, the method further comprising obtaining an indication of an identification scope and an indication of an intended audience for the specific data type.
5. The method of claim 1 , further comprising notifying a user of a policy violation.
6. The method of claim 5 , wherein the policy violation is one of a usefulness violation and a protection violation.
7. A system for redacting data, the system comprising at least one processor configured to:
obtain from a user, using an electronic interface, for each of a plurality of redaction types, a corresponding identification scope conferred by a respective redaction type and a corresponding disclosure impact indicating an amount of harm, whereby a plurality of triples are obtained, each triple comprising a redaction type, a corresponding identification scope, and a corresponding disclosure impact, wherein each identification scope is selected from the group consisting of: identify a person uniquely, identify a person uniquely in an application, identify a group uniquely, identify a group uniquely in an application, and not needed for identification, and wherein each disclosure impact comprises a level of trust required of a third party to which a value is disclosed;
generate an initial redaction matrix comprising the plurality of triples, wherein the initial redaction matrix is incomplete, and wherein the initial redaction matrix comprises at least one blank entry for at least one trust requirement and disclosure impact pair;
obtain from a user, using an electronic interface, a selection of a policy, wherein the policy specifies a technique for completing the initial redaction matrix;
apply the policy to the initial redaction matrix, whereby a completed redaction matrix is obtained;
obtain, from a user, using an electronic interface, an indication of a need to know a content for each of a plurality of data types used in an application; and
apply the completed redaction matrix to a corresponding data type used in the application, whereby an application template is obtained, wherein the application template specifies a particular redaction type for each of the plurality of data types used in the application; and
apply the application template to the application, whereby data used by the application is redacted.
8. The system of claim 7 , wherein each redaction type is selected from the group consisting of: mask, tokenize, encrypt, categorize, randomize, and aggregate.
9. The system of claim 7 , wherein the policy is defined to favor one of usefulness or protection.
10. The system of claim 7 , wherein the at least one processor is further configured to, upon obtaining a positive indication of a need to know for a specific data type, further obtain an indication of an identification scope and an indication of an intended audience for the specific data type.
11. The system of claim 7 , further configured to notify a user of a policy violation.
12. The system of claim 11 , wherein the policy violation is one of a usefulness violation and a protection violation.
13. Non-transitory computer readable media including instructions which, when executed by at least one electronic processor, cause the at least one processor to:
obtain from a user, using an electronic interface, for each of a plurality of redaction types, a corresponding identification scope conferred by a respective redaction type and a corresponding disclosure impact indicating an amount of harm, whereby a plurality of triples are obtained, each triple comprising a redaction type, a corresponding identification scope, and a corresponding disclosure impact, wherein each identification scope is selected from the group consisting of: identify a person uniquely, identify a person uniquely in an application, identify a group uniquely, identify a group uniquely in an application, and not needed for identification, and wherein each disclosure impact comprises a level of trust required of a third party to which a value is disclosed;
generate an initial redaction matrix comprising the plurality of triples, wherein the initial redaction matrix is incomplete, wherein the initial redaction matrix comprises at least one blank entry for at least one trust requirement and disclosure impact pair;
obtain from a user, using an electronic interface, a selection of a policy, wherein the policy specifies a technique for completing the initial redaction matrix;
apply the policy to the initial redaction matrix, whereby a completed redaction matrix is obtained;
obtain, from a user, using an electronic interface, an indication of a need to know a content for each of a plurality of data types used in an application; and
apply the completed redaction matrix to a corresponding data type used in the application, whereby an application template is obtained, wherein the application template specifies a particular redaction type for each of the plurality of data types used in the application; and
apply the application template to the application, whereby data used by the application is redacted.