Reducing access to sensitive information

• US 7,941,859 B2
• Filed: 06/23/2004
• Issued: 05/10/2011
• Est. Priority Date: 06/23/2004
• Status: Expired due to Fees

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Pfitzmann, Birgit M., Schunter, Matthias, Camenisch, Jan L., Waidner, Michael P.
• Primary Examiner(s): Moazzami; Nasser
• Assistant Examiner(s): Traore; Fatoumata
• Application Number:
  US10/874,421
• Publication Number:
  US 20050289340A1
• Time in Patent Office: 2,512 Days
• Field of Search: 726 2- 5, 726 26- 27
• US Class Current: 726/27
• CPC Class Codes: G06F 21/6245 Protecting personal data, e.g. for financial or medical purposes

Abstract

Method, system, and storage medium for reducing or minimizing access to sensitive information. A method includes identifying processes and data associated with a computer system and classifying each of the data as one of either sensitive information or non-sensitive information. The sensitive information includes at least one of: data that is personal to an individual, confidential data, and data that is legally subject to conditions of restricted use. For each of the processes the method includes selecting a process and a sensitive data item, modifying the sensitive data item, analyzing the behavior of at least the selected process, and preventing access of the sensitive data item by the selected process if, as a result of the analyzing, the sensitive data item is determined not to be needed by the selected process.

Claims

1. A method for reducing access to sensitive information, comprising:

identifying processes and data associated with a computer system;

classifying each of said data as one of sensitive information and non-sensitive information;

wherein said sensitive information includes at least one of;

data that is personal to an individual;

confidential data; and

data that is subject to conditions of restricted use;

for each of said processes;

selecting a process and a sensitive data item;

modifying said sensitive data item to form a modified data item each time the selected process accesses the sensitive data;

analyzing behavior of at least said selected process;

preventing access to said sensitive data item by said selected process if, as a result of said analyzing, said sensitive data item is determined not to be needed by said selected process, wherein said preventing access includes substituting a value of said sensitive data item with an alternate data value whenever said selected process requests access to said sensitive data item, and wherein if said selected process does not have changeable code, said substituting a value of said sensitive data item with an alternate data value is performed by inserting a replacement layer between said sensitive data item and said selected process,

wherein said substituting a value of said sensitive date item is performed by;

randomly generating said alternate data value;

mapping said alternate data value to said sensitive data item; and

storing mapped alternate data value and corresponding sensitive data item in a table within said replacement layer, said table being accessible to said

selected process; and

minimizing access to sensitive information by transforming a process P into a process P′

such that P′

is limited to receiving less personal information than P when it has been determined that P does not require extensive personal information.

2. The method of claim 1, wherein said substituting a value of said sensitive data item with an alternate data value is performed by:

generating an alternate data value; and

modifying code of said selected process operable for directing said selected process to access said alternate data value in place of said sensitive data item.

3. The method of claim 2, wherein if said selected process has changeable code, said substituting a value of said sensitive data item with an alternate data value is performed by inserting a replacement layer into said selected process.

4. The method of claim 1, wherein said replacement layer is local to said selected process if said sensitive data item is not needed by said selected process, said local replacement layer being operable for preventing said selected process from accessing said sensitive data item.

5. The method of claim 1, wherein said replacement layer is global to said selected process and at least one other of said processes if said sensitive data item is not needed by said selected process and at least one other of said processes, said global replacement layer being operable for permitting said selected process and said at least one other of said processes to access said sensitive data item.

6. The method of claim 1, wherein said analyzing is performed using static analysis.

7. The method of claim 1, wherein said analyzing is performed by executing said processes.

8. The method of claim 1, further comprising reversing said substituting a value of said sensitive data item when said selected process has completed, said reversing being operable for returning said sensitive data item from said replacement layer to a database.

9. The method of claim 1, wherein said substituting is performed using encryption;

wherein said sensitive data item is encrypted to a key that is not available to said selected process.

10. The method of claim 1, wherein the step of analyzing behavior of at least said selected process includes:

executing all of said processes, said selected process accessing said modified data item in its execution; and

determining one or more of the said processes that are affected during the executing of all of said processes.

11. The method of claim 1, wherein the alternate data value does not change each time the selected process requests access to the sensitive data item.

12. A method for reducing access to sensitive information, comprising:

identifying processes and data associated with a computer system;

classifying each of said data as one of sensitive information and non-sensitive information;

wherein said sensitive information includes at least one of;

data that is personal to an individual;

confidential data; and

data that is subject to conditions of restricted use;

for each of said processes;

selecting a process and a sensitive data item;

modifying said sensitive data item to form a modified data item each time the selected process accesses the sensitive data;

analyzing behavior of at least said selected process;

preventing access to said sensitive data item by said selected process if, as a result of said analyzing, said sensitive data item is determined not to be needed by said selected process, wherein said preventing access includes substituting a value of said sensitive data item with an alternate data value whenever said selected process requests access to said sensitive data item and wherein if said selected process does not have changeable code, said substituting a value of said sensitive data item with an alternate data value is performed by inserting a replacement layer between said sensitive data item and said selected process,

wherein said substituting a value of said sensitive date item is performed by;

randomly generating said alternate data value;

mapping said alternate data value to said sensitive data item; and

storing mapped alternate data value and corresponding sensitive data item in a table within said replacement layer, said table being accessible to said selected process;

shifting a function of a first selected process associated with said sensitive data item to a second selected process if, as a result of said analyzing, it is determined that said second selected process utilizes said sensitive data item more frequently than said first selected process; and

minimizing access to sensitive information by transforming a process P into a process P′

such that P′

is limited to receiving less personal information than P when it has been determined that P does not require extensive personal information.

13. A computer system for reducing access to sensitive information, comprising

a processor;

a plurality of processes executable by said computer system;

a database storing data items utilized by said at least one process;

a replacement layer in communication with said at least one of said plurality of processes, said replacement layer operable for controlling access to said data items; and

an access minimization system associated with said computer system, said access minimization system performing;

identifying said plurality of processes and said data items associated with said computer system;

classifying each of said data items as one of sensitive information and non-sensitive information;

for each of said processes;

selecting a process and a sensitive data item;

modifying said sensitive data item;

analyzing behavior of at least said selected process; and

preventing access of said sensitive data item by said selected process if, as a result of said analyzing, said sensitive data item is determined not to be needed by said selected process, wherein said preventing access includes substituting a value of said sensitive data item with an alternate data value whenever said selected process requests access to said sensitive data item, and wherein if said selected process does not have changeable code, said substituting a value of said sensitive data item with an alternate data value is performed by inserting a replacement layer between said sensitive data item and said selected process,

wherein said substituting a value of said sensitive date item is performed by;

randomly generating said alternate data value;

mapping said alternate data value to said sensitive data item; and

storing mapped alternate data value and corresponding sensitive data item in a table within said replacement layer, said table being accessible to said selected process; and

minimizing access to sensitive information by transforming a process P into a process P′

such that P′

is limited to receiving less personal information than P when it has been determined that P does not require extensive personal information.

14. The computer system of claim 13, wherein said sensitive information includes at least one of:

data that is personal to an individual;

confidential data; and

data that is legally subject to conditions of restricted use.

15. The computer system of claim 13, wherein said substituting a value of said sensitive data item with an alternate data value is performed by:

generating an alternate data value; and

modifying code of said selected process operable for directing said selected process to access said alternate data value in place of said sensitive data item.

16. The computer system of claim 15, wherein if said selected process has changeable code, said substituting a value of said sensitive data item with an alternate data value is performed by inserting a replacement layer into said selected process.

17. The computer system of claim 13, wherein said replacement layer is local to said selected process if said sensitive data item is not needed by said selected process, said local replacement layer being operable for preventing said selected-process from accessing said sensitive data item.

18. The computer system of claim 13, wherein said replacement layer is global to said selected process and at least one other of said processes, and if said sensitive data item is not needed by said selected process and at least one other of said processes, said global replacement layer being operable for permitting said selected process and said at least one other of said processes to access said sensitive data item.

19. The computer system of claim 13, wherein said analyzing is performed using static analysis.

20. The computer system of claim 13, wherein said analyzing is performed by executing said processes.

21. The computer system of claim 13, further comprising reversing said substituting a value of said sensitive data item when said selected process has completed, said reversing being operable for returning said sensitive data item from said replacement layer to a database.

22. The computer system of claim 13, wherein said substituting is performed using encryption;

wherein said sensitive data item is encrypted to a key that is not available to said selected process.

23. A non-transitory computer readable storage medium storing machine-readable computer program code for reducing access to sensitive information, said storage medium including instructions for causing a computer system to implement a method, comprising:

identifying processes and data associated with a computer system;

classifying each of said data as one of sensitive information and non-sensitive information;

wherein said sensitive information includes at least one of;

data that is personal to an individual;

confidential data; and

data that is legally subject to conditions of restricted use;

for each of said processes;

selecting said process and a sensitive data item;

modifying said sensitive data item;

analyzing behavior of at least said selected process; and

preventing access of said sensitive data item by said selected process if, as a result of said analyzing, said sensitive data item is determined not to be needed by said selected process, wherein said preventing access includes substituting a value of said sensitive data item with an alternate data value whenever said selected process requests access to said sensitive data item, and wherein if said selected process does not have changeable code, said substituting a value of said sensitive data item with an alternate data value is performed by inserting a replacement layer between said sensitive data item and said selected process,

wherein said substituting a value of said sensitive date item is performed by;

randomly generating said alternate data value;

mapping said alternate data value to said sensitive data item; and

storing mapped alternate data value and corresponding sensitive data item in a table within said replacement layer, said table being accessible to said selected process; and

minimizing access to sensitive information by transforming a process P into a process P′

such that P′

is limited to receiving less personal information than P when it has been determined that P does not require extensive personal information.