Systems and methods for preparing a secure search index for securely detecting personally identifiable information

1. A computer-implemented method for preparing a secure search index for securely detecting personally identifiable information, at least a portion of the method being performed by a computing device comprising at least one processor, the method comprising:

receiving, at the computing device, a dataset comprising a first record, wherein the first record has a first field comprising a first value describing personally identifiable information; and

performing, at the computing device, a security action comprising:

generating, using a perfect hash function, a respective hashed key from the first value, wherein generating the respective hashed key comprises:

generating, using a base hash function, a first hashed key from the first value;

detecting a collision between the first hashed key and a second hashed key already in a set of valid hash values;

responsive to the collision:

generating the respective hashed key from the first hashed key, a first shift value, a first split value, and a value of a first bit in a binary representation of the first hashed key by:

 aggregating the first shift value with the first hashed key to obtain an aggregated value;

 multiplying the first split value with the value of the first bit in the binary representation of the first hashed key to obtain an adjusted value; and

 aggregating the aggregated value with the adjusted value to obtain the respective hashed key; and

adding, to the secure search index:

the respective hashed key; or

a subsequent hashed key created from the respective hashed key.

2. The method of claim 1 , wherein the first value comprises a social security number.

3. The method of claim 1 , wherein generating the respective hashed key further comprises:

blocking, responsive to the collision, the first hashed key and the second hashed key from use in the set of valid hash values;

generating a third hashed key from the second hashed key, a second shift value, a second split value, and a value of a first bit in a binary representation of the second hashed key; and

when the third hashed key and the respective hashed key are different:

adding the third hashed key and the respective hashed key to the set of valid hash values.

4. The method of claim 3 , further comprising generating, using the base hash function, the second hashed key from a second value from a first field of a second record.

5. The method of claim 1 , wherein the first shift value and the first split value are random numbers.

6. The method of claim 1 , further comprising

randomly selecting a base value; and

generating the first shift value, the first split value, a subsequent shift value, and a subsequent split value by repeatedly applying a cryptographic hash function to the base value.

7. The method of claim 3 , wherein the second hashed key is generated from a second value, and the method further comprising:

detecting a collision between the third hashed key and the respective hashed key;

blocking, responsive to the collision, the third hashed key and the respective hashed key from use in the set of valid hash values;

generating a fifth hashed key from the base hash function, a third shift value, a third split value, and a value of a second bit in a binary representation of the base hash function applied to the first value;

generating a sixth hashed key from the base hash function, a fourth shift value, a fourth split value, and a value of a second bit in a binary representation of the base hash function applied to the second value; and

when the fifth hashed key and the sixth hashed key are different:

adding the fifth hashed key and the sixth hashed key to the set of valid hash values; and

using the fifth hashed key as the respective hashed key.

8. The method of claim 3 , further comprising storing the blocked first hashed key and the blocked second hashed key.

9. The method of claim 1 , further comprising:

generating a concatenated value by concatenating the respective hashed key with a second value from a second field of the first record;

applying a cryptographic hash function to the concatenated value to create the subsequent hashed key; and

adding the subsequent hashed key to the secure search index.

10. The method of claim 9 , wherein the cryptographic hash function is a Hash Message Authentication Code algorithm.

11. The method of claim 9 , further comprising:

receiving a request to search a document;

extracting a first token and a second token from the document;

generating a candidate hashed key from the first token and the second token;

querying the secure search index to determine whether the candidate hashed key matches any hashed key in the secure search index; and

responding, upon determining the candidate hashed key matches a hashed key in the secure search index, to the request with information about the document.

12. The method of claim 11 , wherein:

values in the first field follow a known pattern;

the request to search the document specifies the first token is required to be within a specified distance from the second token; and

extracting the first token and the second token from the document comprises:

using the known pattern to identify the first token within the document; and

identifying the second token within the specified distance from the first token.

13. The method of claim 11 , wherein:

values in the first field follow a known pattern; and

extracting the first token from the document comprises using a regular expression based on the known pattern to identify the first token within the document.

14. The method of claim 11 , wherein:

the computing device is a server-side computing device; and

extracting the first token and the second token, generating the candidate hashed key, and querying the secure search index are performed at a client-side computing device to which the secure search index has been distributed.

15. The method of claim 11 , wherein generating the candidate hashed key further comprises:

generating, using the perfect hash function, an intermediate hashed key from the first token;

generating an intermediate concatenated value by concatenating the intermediate hashed key with the second token; and

applying a cryptographic hash function to the intermediate concatenated value to create the candidate hashed key.

16. A system for preparing a secure search index for securely detecting personally identifiable information, the system comprising:

at least one physical processor; and

physical memory comprising computer-executable instructions that, when executed by the physical processor, cause the physical processor to:

receive a dataset comprising a record, wherein the record has a field comprising a value describing personally identifiable information; and

perform a security action comprising:

generating, using a perfect hash function, a respective hashed key from the value, wherein generating the respective hashed key comprises:

generating, using a base hash function, a first hashed key from the value;

detecting a collision between the first hashed key and a second hashed key already in a set of valid hash values;

responsive to the collision:

generating the respective hashed key from the first hashed key, a first shift value, a first split value, and a value of a first bit in a binary representation of the first hashed key by:

aggregating the first shift value with the first hashed key to obtain an aggregated value;

multiplying the first split value with the value of the first bit in the binary representation of the first hashed key to obtain an adjusted value; and

aggregating the aggregated value with the adjusted value to obtain the respective hashed key; and

adding, to the secure search index:

the respective hashed key; or

a subsequent hashed key created from the respective hashed key.

17. A non-transitory computer-readable medium comprising one or more computer-executable instructions that, when executed by at least one processor of a computing device, cause the computing device to:

receive, by the computing device, a dataset comprising a record, wherein the record has a field comprising a value describing personally identifiable information; and

perform, by the computing device, a security action comprising:

generating, using a perfect hash function, a respective hashed key from the value, wherein generating the respective hashed key comprises:

generating, using a base hash function, a first hashed key from the value;

detecting a collision between the first hashed key and a second hashed key already in a set of valid hash values;

responsive to the collision:

generating the respective hashed key from the first hashed key, a first shift value, a first split value, and a value of a first bit in a binary representation of the first hashed key by:

aggregating the first shift value with the first hashed key to obtain an aggregated value;

multiplying the first split value with the value of the first bit in the binary representation of the first hashed key to obtain an adjusted value; and

aggregating the aggregated value with the adjusted value to obtain the respective hashed key; and

adding, to a secure search index:

the respective hashed key; or

a subsequent hashed key created from the respective hashed key.