METHOD AND APPARATUS FOR RULE-BASED MASKING OF DATA

• US 20090048997A1
• Filed: 08/16/2007
• Published: 02/19/2009
• Est. Priority Date: 08/16/2007
• Status: Active Grant

• Current Assignee: Workday Incorporated
• Original Assignee: Verizon Data Services India Pvt Limited (Verizon Communications Inc.)
• Inventors: Padegal, Ramanjaneyulu Rmanjaneyulu, Manickam, S.A. Vetha
• Granted Patent: US 8,341,104 B2
• Time in Patent Office: Days
• US Class Current: 706/47
• CPC Class Codes: G06F 21/62 Protecting access to data via a platform, e.g. using keys or access control rules
• CPC Class Codes: G06F 21/6209 to a single file or object, e.g. in a secure envelope, encrypted and accessed using a key, or with access control rules appended to the object itself
• CPC Class Codes: G06F 21/6245 Protecting personal data, e.g. for financial or medical purposes
• CPC Class Codes: G06F 2221/2119 Authenticating web pages, e.g. with suspicious links
• CPC Class Codes: H04L 63/0407 wherein the identity of one or more communicating identities is hidden cryptographic mechanisms or cryptographic arrangements for anonymous credentials or for identity based cryptographic systems H04L9/00
• CPC Class Codes: H04L 67/306 User profiles

Abstract

An approach is provided for de-personalizing data. Content from a data source is retrieved in response to a request by a user. A rule for masking data (e.g., web data) is determined, wherein the rule is specified in a profile associated with the user. A search, within the content, for data that satisfy the rule is performed. The data that satisfy the rule is masked. The content is then modified with the masked data for delivery to the user.

Claims

1. A method comprising:

retrieving content from a data source in response to a request by a user;

determining a rule for masking data, wherein the rule is specified in a profile associated with the user;

searching, within the content, data that satisfy the rule;

masking the data that satisfy the rule; and

modifying the content with the masked data for delivery to the user.

2. A method as recited in claim 1, further comprising:

determining scope of the rule as specified in the policy, wherein the rule is applied to the content based on the determined scope.

3. A method as recited in claim 2, wherein the data source is a website and the content represents a web page, the scope being either limited to the web page or being global to the website.

4. A method as recited in claim 1, wherein the rule specifies either a string token-based rule, a hyperlink-based rule, a pattern value-based rule, a pattern key-based rule, or a table column-based rule.

5. A method as recited in claim 1, wherein the content is formatted according to a HyperText Markup Language (HTML), and the request is submitted from a browser application.

6. A method as recited in claim 5, wherein the data source is web server, the method further comprising:

intercepting the request destined for the web server.

7. A method according to claim 1, wherein the user modifies the rule or the policy via a policy configuration engine.

8. A method as recited in claim 1, wherein the content is formatted according to an extended markup language (XML), and the request is submitted from a browser application.

9. An apparatus comprising:

a request listener configured to receive a request by a user for retrieval of content from a data source;

a rule processing engine configured to determine a rule for masking data, wherein the rule is specified in a profile associated with the user, the rule processing engine being further configured to search, within the content, data that satisfy the rule;

a masking engine configured to mask the data that satisfy the rule and

a response broker configured to modify the content with the masked data for delivery to the user.

10. An apparatus as recited in claim 9, wherein the rule processing engine is further configured to determine scope of the rule as specified in the policy, the rule being applied to the content based on the determined scope.

11. An apparatus as recited in claim 10, wherein the data source is a website and the content represents a web page, the scope being either limited to the web page or being global to the website.

12. An apparatus as recited in claim 9, wherein the rule specifies either a string token-based rule, a hyperlink-based rule, a pattern value-based rule, a pattern key-based rule, or a table column-based rule.

13. An apparatus as recited in claim 9, wherein the content is formatted according to a HyperText Markup Language (HTML), and the request is submitted from a browser application.

14. An apparatus as recited in claim 13, wherein the data source is web server, and the request listener is further configured to intercept the request destined for the web server.

15. An apparatus according to claim 9, wherein the user modifies the rule or the policy via a policy configuration engine.

16. An apparatus according to claim 9, wherein the content is formatted according to an extended markup language (XML), and the request is submitted from a browser application.

17. A system comprising:

a policy store configured to store a policy of a user, the policy relating to data masking; and

a web proxy including,

a request listener configured to receive a request by a user for retrieval of content from a data source,

a rule processing engine configured to determine a rule for masking data, wherein the rule is specified in the profile, the rule processing engine being further configured to search, within the content, data that satisfy the rule,

a masking engine configured to mask the data that satisfy the rule and

a response broker configured to modify the content with the masked data for delivery to the user.

18. A system as recited in claim 17, wherein the rule processing engine is further configured to determine scope of the rule as specified in the policy, the rule being applied to the content based on the determined scope.

19. A system as recited in claim 18, wherein the data source is a website and the content represents a web page, the scope being either limited to the web page or being global to the website.

20. A system as recited in claim 17, wherein the rule specifies either a string token-based rule, a hyperlink-based rule, a pattern value-based rule, a pattern key-based rule, or a table column-based rule.

21. A system as recited in claim 17, wherein the content is formatted according to a HyperText Markup Language (HTML), and the request is submitted from a browser application.

22. A system as recited in claim 21, wherein the data source is web server, and the request listener is further configured to intercept the request destined for the web server.

23. A system according to claim 17, further comprising:

a policy configuration engine coupled to the policy store and configured to permit the user to modify the rule or the policy.