Method and system for protecting data from unauthorized disclosure

• US 20030101341A1
• Filed: 11/26/2001
• Published: 05/29/2003
• Est. Priority Date: 11/26/2001
• Status: Abandoned Application

• Current Assignee: Electronic Data Systems Corporation (Perspecta, Inc.)
• Original Assignee: Electronic Data Systems Corporation (Perspecta, Inc.)
• Inventors: Pollitt, Jerry D., Kettler, Edward W. III
• Application Number:
  US09/996,099
• Publication Number:
  US 20030101341A1
• Time in Patent Office: Days
• US Class Current: 713/162
• CPC Class Codes: G06F 21/6245 Protecting personal data, e.g. for financial or medical purposes

Abstract

According to one embodiment of the invention, a computerized method for managing a plurality of data protection rules includes receiving and storing the data protection rules in a database, receiving and storing a plurality of permissions generated by a data owner in the database, accepting a query from a data requester with respect to a particular set of data, accessing the database to validate that a permission exists for the data requester, accessing the database to validate that the particular set of data may be accessed by the data requester, and generating a response to the query.

Claims

1. A system for managing a plurality of data protection rules, comprising:

a processor;

a database coupled to the processor, the database operable to receive and store the data protection rules and to receive and store a plurality of permissions generated by a data owner;

a memory coupled to the processor;

an authorization management tool residing in the memory and executable by the processor, the authorization management tool operable to;

accept a query from a data requester, the query related to a particular set of data;

access the database to validate that a permission exists for the data requester;

access the data protection rules in the database to validate that the particular set of data may be accessed by the data requester; and

generate a response to the query.

2. The system of claim 1, wherein the authorization management tool is further operable to store identifying information about the data requester in the database.

3. The system of claim 1, wherein the authorization management tool is further operable to store a query result in the database, the query result related to whether the response was generated.

4. The system of claim 1, further comprising a user acceptance tool residing in the memory and executable by the processor, the user acceptance tool operable to:

query a user about a user preference with respect to the data protection rules;

accept the user preference; and

store the user preference in the database.

5. The system of claim 4, wherein the authorization management tool is further operable to access the user preferences in the database to validate that the particular set of data may be accessed by the data requester.

6. The system of claim 1, further comprising a state change tool residing in the memory and executable by the processor, the state change tool operable to:

receive a state change of an entity;

compare the state change to the data protection rules stored in the database;

determine whether the state change complies with the data protection rules; and

update the database with the state change.

7. The system of claim 6, wherein the entity is a user and the state change tool is further operable to:

query the user about a user preference with respect to the data protection rules;

accept the user preference; and

store the user preference in the database.

8. The system of claim 7, wherein the authorization management tool is further operable to access the user preferences in the database to validate that the particular set of data may be accessed by the data requester.

9. The system of claim 1, wherein the authorization management tool is further operable to access one or more corporate policies in the database to validate that the particular set of data may be accessed by the data requester.

10. A computerized method for managing a plurality of data protection rules, comprising:

receiving and storing the data protection rules in a database;

receiving and storing a plurality of permissions generated by a data owner in the database;

accepting a query from a data requester, the query related to a particular set of data;

accessing the database to validate that a permission exists for the data requester;

accessing the database to validate that the particular set of data may be accessed by the data requester; and

generating a response to the query.

11. The computerized method of claim 10, further comprising storing identifying information about the data requester in the database.

12. The computerized method of claim 10, further comprising storing a query result in the database, the query result related to whether the response was generated.

13. The computerized method of claim 10, further comprising:

querying a user about a user preference with respect to the data protection rules;

accepting the user preference; and

storing the user preference in the database.

14. The computerized method of claim 13, further comprising accessing the user preferences in the database to validate that the particular set of data may be accessed by the data requester.

15. The computerized method of claim 10, further comprising:

receiving a state change of an entity;

comparing the state change to the data protection rules stored in the database;

determining whether the state change complies with the data protection rules; and

updating the database with the state change.

16. The computerized method of claim 15, further comprising:

querying the user about a user preference with respect to the data protection rules;

accepting the user preference; and

storing the user preference in the database.

17. The computerized method of claim 16, further comprising accessing the user preferences in the database to validate that the particular set of data may be accessed by the data requester.

18. The computerized method of claim 10, further comprising accessing one or more corporate policies stored in the database to validate that the particular set of data may be accessed by the data requester.

19. A system for managing a plurality of data protection rules, comprising:

a processor;

a database coupled to the processor, the database operable to receive and store the data protection rules and a plurality of corporate policies;

a memory coupled to the processor;

a user acceptance tool residing in the memory and executable by the processor, the user acceptance tool operable to;

query a user about a user preference with respect to one or more data protection rules stored in the database;

accept the user preference; and

store the user preference in the database.

20. The system of claim 19, wherein the user acceptance tool is further operable to:

query a user about one or more corporate policies; and

accept an acknowledgement from the user, the acknowledgement indicating that the user has agreed to the corporate policies.

21. The system of claim 20, wherein the user acceptance tool is further operable to send the acknowledgement to a security system database.

22. The system of claim 19, further comprising an authorization management tool residing in the memory and executable by the processor, the authorization management tool operable to:

accept a query from a data requester, the query related to a particular set of data;

access the database to validate that a permission exists for the data requester;

access the data protection rules, the corporate policies, and the user preferences in the database to validate that the particular set of data may be accessed by the data requester; and

generate a response to the query.

23. The system of claim 22, wherein the authorization management tool is further operable to store identifying information about the data requester in the database.

24. The system of claim 22, wherein the authorization management tool is further operable to store a query result in the database, the query result related to whether the response was generated.

25. The system of claim 19, further comprising a state change tool residing in the memory and executable by the processor, the state change tool operable to:

receive a state change of the user;

compare the state change to the data protection rules, the corporate policies, and the user preferences stored in the database;

determine whether the state change complies with the data protection rules, the corporate policies, and the user preferences; and

update the database with the state change.

26. The system of claim 25, wherein the state change tool is further operable to:

query, based on the state change, the user about a new user preference with respect to the data protection rules;

accept the new user preference; and

update the database with the new user preference.

27. A computerized method for managing a plurality of data protection rules, comprising:

receiving and storing the data protection rules and a plurality of corporate policies in a database;

querying a user about a user preference with respect to one or more data protection rules stored in the database;

accepting the user preference; and

storing the user preference in the database.

28. The computerized method of claim 27, further comprising:

querying a user about one or more corporate policies; and

accepting an acknowledgement from the user, the acknowledgement indicating that the user has agreed to the corporate policies.

29. The computerized method of claim 28, further comprising sending the acknowledgement to a security computerized method database.

30. The computerized method of claim 27, further comprising:

accepting a query from a data requester, the query related to a particular set of data;

accessing the database to validate that a permission exists for the data requester;

accessing the data protection rules, the corporate policies, and the user preferences in the database to validate that the particular set of data may be accessed by the data requester; and

generating a response to the query.

31. The computerized method of claim 30, further comprising storing identifying information about the data requester in the database.

32. The computerized method of claim 30, further comprising storing a query result in the database, the query result related to whether the response was generated.

33. The computerized method of claim 27, further comprising:

receiving a state change of the user;

comparing the state change to the data protection rules, the corporate policies, and the user preferences stored in the database;

determining whether the state change complies with the data protection rules, the corporate policies, and the user preferences; and

updating the database with the state change.

34. The computerized method of claim 33, further comprising:

querying, based on the state change, the user about a new user preference with respect to the data protection rules;

accepting the new user preference; and

updating the database with the new user preference.

35. A system for managing a plurality of data protection rules, comprising:

a processor;

a database coupled to the processor, the database operable to receive and store a first set of data protection rules;

a memory coupled to the processor;

an impact analysis tool residing in the memory and executable by the processor, the impact analysis tool operable to;

receive a second set of data protection rules;

compare the second set of data protection rules to the first set of data protection rules to determine an impact on existing information;

notify a data owner of the impact; and

update the database with the second set of data protection rules.

36. The system of claim 35, wherein the existing information is one or more corporate policies.

37. The system of claim 36, wherein the impact analysis tool is further operable to receive one or more revised corporate policies, and update the database with the corporate policies.

38. The system of claim 35, wherein the existing information is one or more managed systems.

39. The system of claim 38, wherein the impact analysis tool is further operable to receive a revised managed system, and update the database with the managed system.

40. The system of claim 35, wherein the existing information is one or more user preferences associated with one or more of the second set of data protection rules.

41. The system of claim 40, wherein the impact analysis tool is further operable to:

query a user about the user preferences;

accept the user preference; and

update the database with the user preferences.

42. The system of claim 35, further comprising an authorization management tool residing in the memory and executable by the processor, the authorization management tool operable to:

accept a query from a data requester, the query related to a particular set of data;

access the database to validate that a permission exists for the data requester;

access the second set of data protection rules in the database to validate that the particular set of data may be accessed by the data requester; and

generate a response to the query.

43. The system of claim 42, wherein the authorization management tool is further operable to store identifying information about the data requester in the database.

44. The system of claim 42, wherein the authorization management tool is further operable to store a query result in the database, the query result related to whether the response was generated.

45. The system of claim 41, further comprising a state change tool residing in the memory and executable by the processor, the state change tool operable to:

receive a state change of the user;

compare the state change to the second set of data protection rules and the user preferences stored in the database;

determine whether the state change complies with the second set of data protection rules and the user preferences; and

update the database with the state change.

46. A computerized method for managing a plurality of data protection rules, comprising:

receiving and storing a first set of data protection rules;

receiving a second set of data protection rules;

comparing the second set of data protection rules to the first set of data protection rules to determine an impact on existing information;

notifying a data owner of the impact; and

updating the database with the second set of data protection rules.

47. The computerized method of claim 46, wherein the existing information is one or more corporate policies.

48. The computerized method of claim 47, further comprising receiving one or more revised corporate policies and updating the database with the corporate policies.

49. The computerized method of claim 46, wherein the existing information is one or more managed systems.

50. The computerized method of claim 49, further comprising receiving a revised managed system and updating the database with the managed system.

51. The computerized method of claim 46, wherein the existing information is one or more user preferences associated with one or more of the second set of data protection rules.

52. The computerized method of claim 51, further comprising:

querying a user about the user preferences;

accepting the user preference; and

updating the database with the user preferences.

53. The computerized method of claim 46, further comprising:

accepting a query from a data requester, the query related to a particular set of data;

accessing the database to validate that a permission exists for the data requester;

accessing the second set of data protection rules in the database to validate that the particular set of data may be accessed by the data requester; and

generating a response to the query.

54. The computerized method of claim 53, further comprising storing identifying information about the data requester in the database.

55. The computerized method of claim 53, further comprising storing a query result in the database, the query result related to whether the response was generated.

56. The computerized method of claim 52, further comprising:

receiving a state change of the user;

comparing the state change to the second set of data protection rules and the user preferences stored in the database;

determining whether the state change complies with the second set of data protection rules and the user preferences; and

updating the database with the state change.

57. A system for managing a plurality of data protection rules, comprising:

a processor;

a database coupled to the processor, the database operable to receive and store the data protection rules and to receive and store one or more states of an entity;

a memory coupled to the processor;

a state change tool residing in the memory and executable by the processor, the state change tool operable to;

receive a state change of the entity;

compare the state change to the data protection rules stored in the database;

determine whether the state change complies with the data protection rules; and

update the database with the state change.

58. The system of claim 57, wherein the state change tool is further operable to notify a data owner of the state change.

59. The system of claim 57, further comprising an authorization management tool residing in the memory and executable by the processor, the authorization management tool operable to:

accept a query from a data requester, the query related to a particular set of data;

access the database to validate that a permission exists for the data requester;

access the data protection rules in the database to validate that the particular set of data may be accessed by the data requester; and

generate a response to the query.

60. The system of claim 59, wherein the authorization management tool is further operable to store identifying information about the data requester in the database.

61. The system of claim 59, wherein the authorization management tool is further operable to store a query result in the database, the query result related to whether the response was generated.

62. The system of claim 59, further comprising a user acceptance tool residing in the memory and executable by the processor, the user acceptance tool operable to:

query a user about a user preference with respect to the data protection rules;

accept the user preference; and

store the user preference in the database.

63. The system of claim 62, wherein the authorization management tool is further operable to access the user preferences in the database to validate that the particular set of data may be accessed by the data requester.

64. A computerized method for managing a plurality of data protection rules, comprising:

receiving and storing the data protection rules in a database;

receiving and storing one or more states of an entity in the database;

receiving a state change of the entity;

comparing the state change to the data protection rules stored in the database;

determining whether the state change complies with the data protection rules; and

updating the database with the state change.

65. The computerized method of claim 64, further comprising notifying a data owner of the state change.

66. The computerized method of claim 64, further comprising:

accepting a query from a data requester, the query related to a particular set of data;

accessing the database to validate that a permission exists for the data requester;

accessing the data protection rules in the database to validate that the particular set of data may be accessed by the data requester; and

generating a response to the query.

67. The computerized method of claim 66, further comprising storing identifying information about the data requester in the database.

68. The computerized method of claim 66, further comprising storing a query result in the database, the query result related to whether the response was generated.

69. The computerized method of claim 66, further comprising:

querying a user about a user preference with respect to the data protection rules;

accepting the user preference; and

storing the user preference in the database.

70. The computerized method of claim 69, further comprising accessing the user preferences in the database to validate that the particular set of data may be accessed by the data requester.

71. A system for managing a plurality of data protection rules, comprising:

a processor;

a data protection database coupled to the processor, the data protection database operable to receive and store a first set of data protection rules;

a managed system database coupled to the processor, the managed system database operable to receive and store managed system information;

a memory coupled to the processor;

an audit and compliance tool residing in the memory and executable by the processor, the audit and compliance tool operable to;

extract meta data from the managed system database and store the meta data in the data protection database, the meta data associated with the managed system information;

receive a second set of data protection rules;

compare, by utilizing the meta data, the second set of data protection rules to the managed system information to determine if the managed system information complies with the second set of data protection rules;

notify a data owner of one or more results of the comparison; and

update the data protection database with the second set of data protection rules.

72. The system of claim 71, wherein the audit and compliance tool is further operable to generate a report of the first and second data protection rules.

73. The system of claim 71, further comprising an impact analysis tool residing in the memory and executable by the processor, the impact analysis tool operable to:

receive the second set of data protection rules;

compare the second set of data protection rules to the first set of data protection rules to determine an impact on existing information;

notify a data owner of the impact; and

update the data protection database with the second set of data protection rules.

74. The system of claim 73, wherein the existing information is one or more corporate policies.

75. The system of claim 74, wherein the impact analysis tool is further operable to receive one or more revised corporate policies, and update the data protection database with the corporate policies.

76. The system of claim 73, wherein the existing information is one or more user preferences associated with one or more of the second set of data protection rules.

77. The system of claim 76, wherein the impact analysis tool is further operable to:

query a user about the user preferences;

accept the user preference; and

update the data protection database with the user preferences.

78. The system of claim 71, further comprising an authorization management tool residing in the memory and executable by the processor, the authorization management tool operable to:

accept a query from a data requester, the query related to a particular set of data;

access the managed system database to validate that a permission exists for the data requester;

access the second set of data protection rules in the data protection database to validate that the particular set of data may be accessed by the data requester; and

generate a response to the query.

79. The system of claim 78, wherein the authorization management tool is further operable to store identifying information about the data requester in the managed system database.

80. The system of claim 78, wherein the authorization management tool is further operable to store a query result in the managed system database, the query result related to whether the response was generated.

81. The system of claim 77, further comprising a state change tool residing in the memory and executable by the processor, the state change tool operable to:

receive a state change of a user;

compare the state change to the second set of data protection rules and the user preferences stored in the data protection database;

determine whether the state change complies with the second set of data protection rules and the user preferences; and

update the managed system database with the state change.

82. A computerized method for managing a plurality of data protection rules, comprising:

receiving and storing a first set of data protection rules in a data protection database;

receiving and storing managed system information in a managed system database;

extracting meta data from the managed system database and storing the meta data in the data protection database, the meta data associated with the managed system information;

receiving a second set of data protection rules;

comparing, by utilizing the meta data, the second set of data protection rules to the managed system information to determine if the managed system information complies with the second set of data protection rules;

notifying a data owner of one or more results of the comparison; and

updating the data protection database with the second set of data protection rules.

83. The computerized method of claim 82, further comprising generating a report of the first and second data protection rules.

84. The computerized method of claim 82, further comprising:

receiving the second set of data protection rules;

comparing the second set of data protection rules to the first set of data protection rules to determine an impact on existing information;

notifying a data owner of the impact; and

updating the data protection database with the second set of data protection rules.

85. The computerized method of claim 84, wherein the existing information is one or more corporate policies.

86. The computerized method of claim 85, further comprising receiving one or more revised corporate policies and updating the data protection database with the corporate policies.

87. The computerized method of claim 84, wherein the existing information is one or more user preferences associated with one or more of the second set of data protection rules.

88. The computerized method of claim 87, further comprising:

querying a user about the user preferences;

accepting the user preference; and

updating the data protection database with the user preferences.

89. The computerized method of claim 82, further comprising:

accepting a query from a data requester, the query related to a particular set of data;

accessing the managed system database to validate that a permission exists for the data requester;

accessing the second set of data protection rules in the data protection database to validate that the particular set of data may be accessed by the data requester; and

generating a response to the query.

90. The computerized method of claim 89, further comprising storing identifying information about the data requester in the database.

91. The computerized method of claim 89, further comprising storing a query result in the managed system database, the query result related to whether the response was generated.

92. The computerized method of claim 88, further comprising:

receiving a state change of a user;

comparing the state change to the second set of data protection rules and the user preferences stored in the data protection database;

determining whether the state change complies with the second set of data protection rules and the user preferences; and

updating the managed system database with the state change.

93. A system for managing a plurality of data protection rules, comprising:

a processor;

a data protection database coupled to the processor, the data protection database operable to receive and store the data protection rules;

a managed system database coupled to the processor, the managed system database operable to receive and store a first set of managed system information;

a memory coupled to the processor;

an audit and compliance tool residing in the memory and executable by the processor, the audit and compliance tool operable to;

extract meta data from the managed system database and store the meta data in the data protection database, the meta data associated with the first set of managed system information;

receive a second set of managed system information;

compare, by utilizing the meta data, the data protection rules to the second set of managed system information to determine if the second set of managed system information complies with the data protection rules;

notify a data owner of one or more results of the comparison; and

update the managed system database with the second set of managed system information.

94. The system of claim 93, wherein the audit and compliance tool is further operable to generate a report of the data protection rules.

95. The system of claim 93, further comprising an impact analysis tool residing in the memory and executable by the processor, the impact analysis tool operable to:

receive the second set of data protection rules;

compare the second set of data protection rules to the first set of data protection rules to determine an impact on existing information;

notify a data owner of the impact; and

update the data protection database with the second set of data protection rules.

96. The system of claim 95, wherein the existing information is one or more corporate policies.

97. The system of claim 96, wherein the impact analysis tool is further operable to receive one or more revised corporate policies, and update the data protection database with the corporate policies.

98. The system of claim 95, wherein the existing information is one or more user preferences associated with one or more of the second set of data protection rules.

99. The system of claim 98, wherein the impact analysis tool is further operable to:

query a user about the user preferences;

accept the user preference; and

update the data protection database with the user preferences.

100. The system of claim 93, further comprising an authorization management tool residing in the memory and executable by the processor, the authorization management tool operable to:

accept a query from a data requester, the query related to a particular set of data;

access the managed system database to validate that a permission exists for the data requester;

access the second set of data protection rules in the data protection database to validate that the particular set of data may be accessed by the data requester; and

generate a response to the query.

101. The system of claim 100, wherein the authorization management tool is further operable to store identifying information about the data requester in the managed system database.

102. The system of claim 100, wherein the authorization management tool is further operable to store a query result in the managed system database, the query result related to whether the response was generated.

103. The system of claim 99, further comprising a state change tool residing in the memory and executable by the processor, the state change tool operable to:

receive a state change of a user;

compare the state change to the second set of data protection rules and the user preferences stored in the data protection database;

determine whether the state change complies with the second set of data protection rules and the user preferences; and

update the managed system database with the state change.

104. A system for managing a plurality of data protection rules, comprising:

receiving and storing the data protection rules in a data protection database;

receiving and storing a first set of managed system information in a managed system database;

extracting meta data from the managed system database and storing the meta data in the data protection database, the meta data associated with the first set of managed system information;

receiving a second set of managed system information;

comparing, by utilizing the meta data, the data protection rules to the second set of managed system information to determine if the second set of managed system information complies with the data protection rules;

notifying a data owner of one or more results of the comparison; and

updating the managed system database with the second set of managed system information.

105. The system of claim 104, further comprising generating a report of the data protection rules.

106. The computerized method of claim 104, further comprising:

receiving a second set of data protection rules;

comparing the second set of data protection rules to the first set of data protection rules to determine an impact on existing information;

notifying a data owner of the impact; and

updating the data protection database with the second set of data protection rules.

107. The computerized method of claim 106, wherein the existing information is one or more corporate policies.

108. The computerized method of claim 107, further comprising receiving one or more revised corporate policies and updating the data protection database with the corporate policies.

109. The computerized method of claim 106, wherein the existing information is one or more user preferences associated with one or more of the second set of data protection rules.

110. The computerized method of claim 109, further comprising:

querying a user about the user preferences;

accepting the user preference; and

updating the data protection database with the user preferences.

111. The computerized method of claim 104, further comprising:

accepting a query from a data requester, the query related to a particular set of data;

accessing the managed system database to validate that a permission exists for the data requester;

accessing the data protection rules in the data protection database to validate that the particular set of data may be accessed by the data requester; and

generating a response to the query.

112. The computerized method of claim 111, further comprising storing identifying information about the data requester in the managed system database.

113. The computerized method of claim 111, further comprising storing a query result in the managed system database, the query result related to whether the response was generated.

114. The computerized method of claim 110, further comprising:

receiving a state change of a user;

comparing the state change to the second set of data protection rules and the user preferences stored in the data protection database;

determining whether the state change complies with the second set of data protection rules and the user preferences; and

updating the managed system database with the state change.

115. A system for managing a plurality of data protection rules, comprising:

a processor;

a data protection database coupled to the processor, the data protection database operable to receive and store the data protection rules, a plurality of corporate policies, a plurality of permissions generated by a data owner, and one or more states of an entity;

a managed system database coupled to the processor, the managed system database operable to receive and store managed system information;

a memory coupled to the processor;

an authorization management tool residing in the memory and executable by the processor, the authorization management tool operable to;

accept a query from a data requester, the query related to a particular set of data;

access the managed system database to validate that a permission exists for the data requester;

access the data protection rules and the corporate policies in the data protection database to validate that the particular set of data may be accessed by the data requester; and

generate a response to the query;

a user acceptance tool residing in the memory and executable by the processor, the user acceptance tool operable to;

query a user about a user preference with respect to one or more data protection rules stored in the data protection database;

accept the user preference; and

store the user preference in the data protection database;

an impact analysis tool residing in the memory and executable by the processor, the impact analysis tool operable to;

receive a new set of data protection rules;

compare the new set of data protection rules to the data protection rules to determine an impact on existing information;

notify a data owner of the impact; and

update the data protection database with the new set of data protection rules;

a state change tool residing in the memory and executable by the processor, the state change tool operable to;

receive a state change of an entity;

compare the state change to the data protection rules stored in the data protection database;

determine whether the state change complies with the data protection rules; and

update the managed system database with the state change; and

an audit and compliance tool residing in the memory and executable by the processor, the audit and compliance tool operable to;

extract meta data from the managed system database and store the meta data in the data protection database, the meta data associated with the managed system information;

receive the new set of data protection rules;

compare, by utilizing the meta data, the new set of data protection rules to the managed system information to determine if the managed system information complies with the new set of data protection rules;

notify the data owner of one or more results of the comparison; and

update the data protection database with the new set of data protection rules.