Data protection compliant deletion of personally identifiable information

• US 9,317,715 B2
• Filed: 08/24/2012
• Issued: 04/19/2016
• Est. Priority Date: 08/24/2012
• Status: Active Grant

• Current Assignee: SAP SE
• Original Assignee: SAP SE
• Inventors: Schuette, Mark T., Schneider, Juergen, Khoury, Paul El
• Primary Examiner(s): Wang, Harris C
• Application Number:
  US13/594,158
• Publication Number:
  US 20140059355A1
• Time in Patent Office: 1,334 Days
• Field of Search: 713/189
• US Class Current: 1/1
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: G06F 21/6254 by anonymising data, e.g. decorrelating personal data from the owner's identification
• CPC Class Codes: G06F 2221/2143 Clearing memory, e.g. to prevent the data from being stolen

Abstract

The disclosure generally describes computer-implemented methods, software, and systems for modeling and deploying decision services. One computer-implemented method includes encrypting, by operation of a computer, personally-identifiable information (PII) data using a first cryptographic key, wherein the PII data is associated with non-encrypted associated data, encrypting the encrypted first cryptographic key with a second cryptographic key, determining that the occurrence of a PII data disassociation event associated with the second cryptographic key has occurred, and rendering the PII data inaccessible by disassociating the second cryptographic key from the encrypted first cryptographic key.

Claims

1. A computer-implemented method, comprising:

encrypting, by operation of a computer, personally-identifiable information (PII) data using a first cryptographic key, wherein the PII data is associated with non-encrypted associated data, and wherein the first cryptographic key is a record key of a data record storing the PII data;

encrypting the first cryptographic key with a second cryptographic key, wherein the second cryptographic key is a purpose key associated with a particular purpose providing a justification for the use of the second cryptographic key to encrypt the first cryptographic key, wherein the second cryptographic key is associated with a cryptographic key record used to associate the second cryptographic key with a purpose key identifier, the particular purpose, and one or more conditions, wherein the purpose key identifier provides a mapping between the particular purpose and the second cryptographic key, and wherein the condition determines whether the second cryptographic key has expired;

determining that the occurrence of a PII data disassociation event associated with the second cryptographic key has occurred; and

rendering the PII data inaccessible by disassociating the second cryptographic key from the encrypted first cryptographic key.

2. The computer-implemented method of claim 1, further comprising analyzing the second cryptographic key using at least one of a condition associated with the second cryptographic key or a decision rule.

3. The computer-implemented method of claim 1, wherein the PII data disassociation event includes at least one of exceeding a chronological retention period deadline, a security alert, or a PII data destruction request.

4. The computer-implemented method of claim 1, wherein the disassociation of the second cryptographic key from the first cryptographic key is performed by at least one of permanently erasing the second cryptographic key, expiring the second cryptographic key, or encrypting the second cryptographic key with a third cryptographic key.

5. The computer-implemented method of claim 4, wherein the second cryptographic key expires based on a chronological value.

6. The computer-implemented method of claim 4, wherein the second cryptographic key expires based on a data value.

7. The computer-implemented method of claim 1, wherein the disassociation of the second cryptographic key from the encrypted first cryptographic key preserves a referential integrity between the encrypted PII data and the non-encrypted associated data.

8. A computer-program product, comprising computer-readable instructions embodied on tangible, non-transitory, computer-readable media, the instructions operable when executed to perform operations to:

encrypt personally-identifiable information (PII) data using a first cryptographic key, wherein the PII data is associated with non-encrypted associated data, and wherein the first cryptographic key is a record key of a data record storing the PII data;

encrypt the first cryptographic key with a second cryptographic key, wherein the second cryptographic key is a purpose key associated with a particular purpose providing a justification for the use of the second cryptographic key to encrypt the first cryptographic key, wherein the second cryptographic key is associated with a cryptographic key record used to associate the second cryptographic key with a purpose key identifier, the particular purpose, and one or more conditions, wherein the purpose key identifier provides a mapping between the particular purpose and the second cryptographic key, and wherein the condition determines whether the second cryptographic key has expired;

determine that the occurrence of a PII data disassociation event associated with the second cryptographic key has occurred; and

render the PII data inaccessible by disassociating the second cryptographic key from the encrypted first cryptographic key.

9. The computer-program product of claim 8, further comprising analyzing the second cryptographic key using at least one of a condition associated with the second cryptographic key or a decision rule.

10. The computer-program product of claim 8, wherein the PII data disassociation event includes at least one of exceeding a chronological retention period deadline, a security alert, or a PII data destruction request.

11. The computer-program product of claim 8, wherein the disassociation of the second cryptographic key from the first cryptographic key is performed by at least one of permanently erasing the second cryptographic key, expiring the second cryptographic key, or encrypting the second cryptographic key with a third cryptographic key.

12. The computer-program product of claim 11, wherein the second cryptographic key expires based on a chronological value.

13. The computer-program product of claim 11, wherein the second cryptographic key expires based on a data value.

14. The computer-program product of claim 8, wherein the disassociation of the second cryptographic key from the encrypted first cryptographic key preserves a referential integrity between the encrypted PII data and the non-encrypted associated data.

15. A system, comprising:

memory operable to store at least personally-identifiable information (PII) data; and

at least one hardware processor interoperably coupled to the memory and operable to;

encrypt the PII data using a first cryptographic key, wherein the PII data is associated with non-encrypted associated data, and wherein the first cryptographic key is a record key of a data record storing the PII data;

encrypt the first cryptographic key with a second cryptographic key, wherein the second cryptographic key is a purpose key associated with a particular purpose providing a justification for the use of the second cryptographic key to encrypt the first cryptographic key, wherein the second cryptographic key is associated with a cryptographic key record used to associate the second cryptographic key with a purpose key identifier, the particular purpose, and one or more conditions, wherein the purpose key identifier provides a mapping between the particular purpose and the second cryptographic key, and wherein the condition determines whether the second cryptographic key has expired;

determine that the occurrence of a PII data disassociation event associated with the second cryptographic key has occurred; and

render the PII data inaccessible by disassociating the second cryptographic key from the encrypted first cryptographic key.

16. The system of claim 15, further comprising analyzing the second cryptographic key using at least one of a condition associated with the second cryptographic key or a decision rule.

17. The system of claim 15, wherein the PII data disassociation event includes at least one of exceeding a chronological retention period deadline, a security alert, or a PII data destruction request.

18. The system of claim 15, wherein the disassociation of the second cryptographic key from the first cryptographic key is performed by at least one of permanently erasing the second cryptographic key, expiring the second cryptographic key, or encrypting the second cryptographic key with a third cryptographic key.

19. The system of claim 18, wherein the second cryptographic key expires based on a chronological value.

20. The system of claim 18, wherein the second cryptographic key expires based on a data value.

21. The system of claim 15, wherein the disassociation of the second cryptographic key from the encrypted first cryptographic key preserves a referential integrity between the encrypted PII data and the non-encrypted associated data.

22. A computer-implemented method, comprising:

encrypting, by operation of a computer, personally-identifiable information (PII) data using a first cryptographic key, wherein the PII data is associated with non-encrypted associated data, and wherein the first cryptographic key is a record key of a data record storing the PII data;

encrypting the first cryptographic key with a second cryptographic key, wherein the second cryptographic key is a purpose key associated with a particular purpose providing a justification for the use of the second cryptographic key to encrypt the first cryptographic key, wherein the second cryptographic key is associated with a cryptographic key record used to associate the second cryptographic key with a purpose key identifier, the particular purpose, and one or more conditions, wherein the purpose key identifier provides a mapping between the particular purpose and the second cryptographic key, and wherein the condition determines whether the second cryptographic key has expired;

analyzing the second cryptographic key using at least one of a condition associated with the second cryptographic key or a decision rule;

determining that the occurrence of a PII data disassociation event associated with the second cryptographic key has occurred, wherein the PII data disassociation event includes at least one of exceeding a chronological retention period deadline, a security alert, or a PII data destruction request; and

rendering the PII data inaccessible by disassociating the second cryptographic key from the encrypted first cryptographic key, wherein the disassociation of the second cryptographic key from the first cryptographic key is performed by at least one of permanently erasing the second cryptographic key, expiring the second cryptographic key, or encrypting the second cryptographic key with a third cryptographic key, and wherein the disassociation of the second cryptographic key from the encrypted first cryptographic key preserves a referential integrity between the encrypted PII data and the non-encrypted associated data.