Data processing and scanning systems for generating and populating a data inventory

• US 10,284,604 B2
• Filed: 07/20/2018
• Issued: 05/07/2019
• Est. Priority Date: 06/10/2016
• Status: Active Grant

• Current Assignee: OneTrust LLC
• Original Assignee: OneTrust LLC
• Inventors: Barday, Kabir A., Karanjkar, Mihir S., Finch, Steven W., Browne, Ken A., Heard, Nathan W., Patel, Aakash H., Sabourin, Jason L., Daniel, Richard L., Patton-Kuhl, Dylan D., Brannon, Jonathan Blake
• Primary Examiner(s): Hirl, Joseph P
• Assistant Examiner(s): Murphy, J. Brant
• Application Number:
  US16/041,468
• Publication Number:
  US 20180351999A1
• Time in Patent Office: 291 Days
• CPC Class Codes: G06Q 10/06 Resources, workflows, human or project management; Enterprise or organisation planning; Enterprise or organisation modelling
• CPC Class Codes: H04L 63/04 for providing a confidential data exchange among entities communicating through data packet networks
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

In particular embodiments, a data processing data inventory generation system is configured to: (1) generate a data model (e.g., a data inventory) for one or more data assets utilized by a particular organization; (2) generate a respective data inventory for each of the one or more data assets; and (3) map one or more relationships between one or more aspects of the data inventory, the one or more data assets, etc. within the data model. In particular embodiments, a data asset (e.g., data system, software application, etc.) may include, for example, any entity that collects, processes, contains, and/or transfers personal data (e.g., such as a software application, “internet of things” computerized device, database, website, data-center, server, etc.). The system may be configured to identify particular data assets and/or personal data in data repositories using any suitable intelligent identity scanning technique.

Claims

1. A computer-implemented data processing method for scanning one or more data repositories to identify one or more attributes of data associated with one or more individuals, the method comprising:

connecting, by one or more processors, via one or more computer networks, to one or more databases;

scanning, by one of more processors, the one or more databases to generate a catalog of one or more individuals and one or more pieces of personal information associated with the one or more individuals;

storing the catalog in computer memory;

scanning one or more data repositories based at least in part on the generated catalog to identify one or more attributes of data associated with the one or more individuals by searching one or more data fields in the one or more databases for the one or more pieces of personal information;

analyzing and correlating the one or more attributes and metadata for the scanned one or more data repositories;

using one or more machine learning techniques to categorize one or more data elements from the generated catalog;

analyzing a flow of the one or more data elements between the one or more data repositories and at least one known data asset;

categorizing the one or more data elements based on a confidence score;

receiving input from one or more users confirming or denying a categorization of the one or more data elements; and

in response to receiving the input, modifying the confidence score.

2. The computer-implemented data processing method of claim 1, further comprising:

providing a software application for installation on a computing device that is networked with the one or more data repositories associated with an organization; and

providing a communication channel between one or more remote scanning servers and the software application, wherein;

the software application is configured to communicate with the one or more remote scanning servers through a firewall; and

the software application is configured to transmit the one or more attributes of data associated with the one or more individuals to the one or more remote scanning servers.

3. The computer-implemented data processing method of claim 2, wherein the step of categorizing the one or more data elements is performed by the one or more remote scanning servers.

4. The computer-implemented data processing method of claim 2, wherein the software application comprises at least one virtual machine configured to perform the step of scanning the one or more data repositories based at least in part on the generated catalog.

5. The computer-implemented data processing method of claim 4, wherein the software application is configured to cause the computing device to perform the step of scanning the one or more data repositories during non-peak networking hours.

6. The computer-implemented data processing method of claim 1, wherein using one or more machine learning techniques to categorize one or more data elements from the generated catalog comprises using the one or more machine learning techniques to determine whether the one or more data elements are associated with the one or more individuals.

7. The computer-implemented data processing method of claim 1, further comprising analyzing the one or more data repositories to determine whether each particular data repository is part of an existing data model of data assets.

8. The computer-implemented data processing method of claim 7, further comprising in response to determining that a particular repository of the one or more data repositories is not part of an existing data model:

generating a data inventory for the particular data-repository;

populating the data inventory with the one or more data elements; and

storing the data inventory in computer memory.

9. The computer-implemented data processing method of claim 1, wherein the catalog comprises one or more data fields selected from the group consisting of:

(1) name;

(2) address;

(3) telephone number;

(4) e-mail address;

(5) social security number;

(6) banking information; and

(7) location data.

10. A data processing intelligent data repository scanning system comprising:

one or more processors;

computer memory; and

a computer-readable medium storing computer-executable instructions that, when executed by the one or more processors, cause the one or more processors to perform operations comprising;

connecting the data processing intelligent data repository scanning system to one or more remote computing devices;

scanning one or more data repositories on the one or more remote computing devices to identify one or more data attributes;

analyzing the one or more data attributes and correlate metadata for the scanned one or more data repositories with particular attributes of the one or more data attributes discovered in the one or more data repositories;

using one or more machine learning techniques to categorize one or more data elements based at least in part on a confidence score;

analyzing a data flow of the particular data attributes between the one or more data repositories; and

storing the categorized one or more data elements and the data flow in the computer memory, wherein;

analyzing the one or more data attributes and correlating metadata for the scanned one or more data repositories with the particular attributes of the one or more data attributes discovered in the one or more data repositories comprises retrieving schema details for each of the one or more data attributes from the scanned one or more data repositories;

the schema details comprise one or more schema details selected from a group consisting of;

an asset ID;

a Schema ID; and

a connection string; and

the computer-readable medium further stores computer-executable instructions that, when executed by the one or more processors, cause the one or more processors to perform operations comprising identifying and storing a location of any slipcovered data assets discovered from the scanned one or more data repositories.

11. The data processing intelligent data repository scanning system of claim 10, wherein the one or more remote computing devices comprise one or more remote computing devices that make up a network of computing devices associated with a particular organization.

12. The data processing intelligent data repository scanning system of claim 11, wherein the computer-readable medium further stores computer-executable instructions that, when executed by the one or more processors, cause the one or more processors to perform operations comprising:

providing a software application for installation on a computing device that is networked with the one or more remote computing devices; and

providing a communication channel between one or more remote scanning servers and the software application, wherein;

the software application is configured to communicate with the one or more remote scanning servers through a firewall; and

the software application is configured to transmit the one or more data attributes associated with the one or more individuals to the one or more remote scanning servers.

13. The data processing intelligent data repository scanning system of claim 12, wherein the software application comprises at least one virtual machine configured to perform the step of scanning the one or more data repositories on the one or more remote computing devices to identify the one or more data attributes.

14. The data processing intelligent data repository scanning system of claim 10, wherein the computer-readable medium further stores computer-executable instructions that, when executed by the one or more processors, cause the one or more processors to perform operations comprising analyzing the one or more data repositories to determine whether each particular data repository is part of an existing data model of data assets.

15. The data processing intelligent data repository scanning system of claim 14, wherein the computer-readable medium further stores computer-executable instructions that, when executed by the one or more processors, cause the one or more processors to perform operations comprising, in response to determining that each particular data repository is not part of the existing data model of data assets, electronically storing a location of each particular data repository in a new data model and electronically linking the location of each particular data repository with the one or more data elements in the new data model.

16. The data processing intelligent data repository scanning system of claim 10, wherein using one or more machine learning techniques to categorize the one or more data elements based at least in part on a confidence score comprises:

receiving input from a user confirming or denying a categorization of the one or more data elements; and

in response to receiving the input, modifying the confidence score.

17. The data processing intelligent data repository scanning system of claim 10, wherein scanning one or more data repositories on the one or more remote computing devices to identify one or more data attributes comprises:

searching one or more data fields of the one or more data attributes to identify information in each of the one or more data fields that may include personal data; and

using one or more natural language processing techniques to identify the information in each of the one or more data fields that may include personal data.