Data processing and scanning systems for generating and populating a data inventory

• US 10,791,150 B2
• Filed: 02/24/2020
• Issued: 09/29/2020
• Est. Priority Date: 06/10/2016
• Status: Active Grant

• Current Assignee: OneTrust LLC
• Original Assignee: OneTrust LLC
• Inventors: Barday, Kabir A., Karanjkar, Mihir S., Finch, Steven W., Browne, Ken A., Heard, Nathan W., Patel, Aakash H., Sabourin, Jason L., Daniel, Richard L., Patton-Kuhl, Dylan D., Brannon, Jonathan Blake
• Primary Examiner(s): To, Baotran N
• Application Number:
  US16/798,818
• Publication Number:
  US 20200195690A1
• Time in Patent Office: 218 Days
• CPC Class Codes: G06Q 10/06 Resources, workflows, human or project management; Enterprise or organisation planning; Enterprise or organisation modelling
• CPC Class Codes: H04L 63/04 for providing a confidential data exchange among entities communicating through data packet networks
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

In particular embodiments, a data processing data inventory generation system is configured to: (1) generate a data model (e.g., a data inventory) for one or more data assets utilized by a particular organization; (2) generate a respective data inventory for each of the one or more data assets; and (3) map one or more relationships between one or more aspects of the data inventory, the one or more data assets, etc. within the data model. In particular embodiments, a data asset (e.g., data system, software application, etc.) may include, for example, any entity that collects, processes, contains, and/or transfers personal data (e.g., such as a software application, “internet of things” computerized device, database, website, data-center, server, etc.). The system may be configured to identify particular data assets and/or personal data in data repositories using any suitable intelligent identity scanning technique.

Claims

1. A data processing intelligent data repository scanning system comprising:

one or more processors;

computer memory; and

a computer-readable medium storing computer-executable instructions that, when executed by the one or more processors, cause the one or more processors to perform operations comprising;

connecting the data processing intelligent data repository scanning system to an application executing on one or more remote computing devices using an application programming interface;

scanning one or more data repositories on the one or more remote computing devices to identify one or more data attributes, wherein the one or more data attributes are associated with a processing activity, and wherein the processing activity is associated with one or more individuals;

generating a catalog of one or more pieces of information associated with the one or more individuals, wherein one of the one or more pieces of information is associated with the processing activity;

analyzing the one or more data attributes and correlating metadata for the scanned one or more data repositories with particular attributes of the one or more data attributes discovered in the one or more data repositories;

using one or more machine learning techniques to categorize one or more data elements from the generated catalog based at least in part on a confidence score;

analyzing a data flow of the particular attributes of the one or more data attributes between the one or more data repositories; and

storing the categorized one or more data elements and the data flow in the computer memory.

2. The data processing intelligent data repository scanning system of claim 1, wherein the one or more remote computing devices comprise one or more remote computing devices that make up a network of computing devices associated with a particular organization.

3. The data processing intelligent data repository scanning system of claim 2, wherein the computer-readable medium further stores computer-executable instructions that, when executed by the one or more processors, cause the one or more processors to perform operations comprising:

providing a software application for installation on a computing device that is networked with the one or more remote computing devices; and

providing a communication channel between one or more remote scanning servers and the software application, wherein;

the software application is configured to communicate with the one or more remote scanning servers through a firewall; and

the software application is configured to transmit the one or more data attributes associated with the one or more individuals to the one or more remote scanning servers.

4. The data processing intelligent data repository scanning system of claim 3, wherein the software application comprises at least one virtual machine configured to perform the step of scanning the one or more data repositories on the one or more remote computing devices to identify the one or more data attributes.

5. The data processing intelligent data repository scanning system of claim 1, wherein using the one or more machine learning techniques to categorize the one or more data elements from the generated catalog based at least in part on the confidence score comprises:

receiving input from one or more users confirming or denying a categorization of the one or more data elements; and

at least partially in response to receiving the input, modifying the confidence score.

6. The data processing intelligent data repository scanning system of claim 1, wherein the computer-readable medium further stores computer-executable instructions that, when executed by the one or more processors, cause the one or more processors to perform operations comprising analyzing the one or more data repositories to determine whether each particular data repository of the one or more data repositories is part of an existing data model of data assets.

7. The data processing intelligent data repository scanning system of claim 6, wherein the computer-readable medium further stores computer-executable instructions that, when executed by the one or more processors, cause the one or more processors to perform operations comprising, in response to determining that a particular data repository of the one or more data repositories is not part of the existing data model of data assets, electronically storing a location of the particular data repository in a new data model and electronically linking the location of the particular data repository with one or more data elements in the new data model.

8. A computer-implemented data processing method for scanning one or more data repositories to identify one or more attributes of data associated with a processing activity, the method comprising:

connecting, by one or more processors, via one or more computer networks, to one or more databases;

scanning, by one of more processors, the one or more databases to generate a catalog of one or more pieces of information associated with one or more individuals, wherein the one or more pieces of information identify one or more processing activities undertaken by a particular organization that include processing of personal data associated with the one or more individuals;

storing the generated catalog in computer memory;

scanning one or more data repositories based at least in part on the generated catalog to identify one or more attributes of data associated with the one or more individuals by searching one or more data fields in the one or more databases for the one or more processing activities;

analyzing and correlating the one or more attributes of data and metadata for the scanned one or more data repositories;

using one or more machine learning techniques to categorize one or more data elements from the generated catalog;

analyzing a flow of the one or more data elements between the one or more data repositories and at least one known data asset;

modifying an existing data model of data assets to include an attribute defined by the one or more data elements; and

electronically linking the at least one known data asset and the attribute in the existing data model of data assets.

9. The computer-implemented data processing method of claim 8, further comprising:

providing a software application for installation on a computing device that is networked with the one or more data repositories associated with the particular organization; and

providing a communication channel between one or more remote scanning servers and the software application, wherein;

the software application is configured to communicate with the one or more remote scanning servers through a firewall; and

the software application is configured to transmit the one or more attributes of data associated with the one or more individuals to the one or more remote scanning servers.

10. The computer-implemented data processing method of claim 9, wherein using the one or more machine learning techniques to categorize the one or more data elements from the generated catalog comprises the one or more remote scanning servers using the one or more machine learning techniques to categorize the one or more data elements from the generated catalog.

11. The computer-implemented data processing method of claim 9, wherein the software application comprises at least one virtual machine configured to perform the step of scanning the one or more data repositories based at least in part on the generated catalog.

12. The computer-implemented data processing method of claim 11, wherein the software application is configured to cause the computing device to perform the step of scanning the one or more data repositories during non-peak networking hours.

13. The computer-implemented data processing method of claim 8, wherein the one or more attributes of data comprise one or more data attributes selected from a group consisting of:

(a) transfer data;

(b) personal data; and

(c) storage data.

14. The computer-implemented data processing method of claim 8, wherein using the one or more machine learning techniques to categorize the one or more data elements from the generated catalog comprises using the one or more machine learning techniques to determine whether the one or more data elements are associated with the one or more individuals.

15. A non-transitory computer-readable medium storing computer-executable instructions for scanning one or more data repositories to identify one or more attributes of data associated with one or more individuals, the computer-executable instructions comprising computer-executable instructions for:

connecting, by one or more processors via one or more computer networks, to one or more remote compute devices;

analyzing, by one or more processors, one or more applications on the one or more remote computing devices to identify one or more data repositories on the one or more remote computing devices;

scanning, by one or more processors, the one or more data repositories on the one or more remote computing devices to identify one or more data attributes, wherein the one or more data attributes are associated with a processing activity, and wherein the processing activity is associated with one or more individuals;

generating, by one or more processors, a catalog of one or more pieces of information associated with the one or more individuals, wherein one of the one or more pieces of information are associated with the processing activity;

storing, by one or more processors, the generated catalog in computer memory;

analyzing, by one or more processors, the one or more data attributes and correlating metadata for the scanned one or more data repositories with particular attributes of the one or more data attributes discovered in the one or more data repositories;

using one or more machine learning techniques to categorize one or more data elements from the generated catalog;

analyzing a flow of the one or more data elements between the one or more data repositories and at least one known data asset;

modifying an existing data model of data assets to include an attribute defined by the one or more data elements; and

electronically linking the at least one known data asset and the attribute in the existing data model of data assets.

16. The non-transitory computer-readable medium of claim 15, wherein the computer-executable instructions further comprise computer-executable instructions for analyzing the one or more data repositories to determine whether each data repository the one or more data repositories is represented in the existing data model of data assets.

17. The non-transitory computer-readable medium of claim 16, wherein the computer-executable instructions further comprise computer-executable instructions for, in response to determining that a particular repository of the one or more data repositories is not part of the existing data model:

generating a data inventory for the particular repository of the one or more data repositories;

populating the data inventory with the one or more data elements; and

storing the data inventory in computer memory.

18. The non-transitory computer-readable medium of claim 15, wherein categorizing the one or more data elements from the generated catalog is further based a confidence score.

19. The non-transitory computer-readable medium of claim 15, wherein scanning one or more data repositories on the one or more remote computing devices to identify one or more data attributes comprises:

searching one or more data fields of the one or more data attributes to identify information in each of the one or more data fields that may include information identifying the processing activity; and

using one or more natural language processing techniques to identify the information in each of the one or more data fields.

20. The non-transitory computer-readable medium of claim 15, wherein the catalog comprises one or more data fields selected from the group consisting of:

(1) name;

(2) address;

(3) telephone number;

(4) e-mail address;

(5) social security number;

(6) banking information; and

(7) location data.