Categorization Of Privacy Data And Data Flow Detection With Rules Engine To Detect Privacy Breaches

• US 20120005720A1
• Filed: 07/01/2010
• Published: 01/05/2012
• Est. Priority Date: 07/01/2010
• Status: Abandoned Application

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Zurko, Mary Ellen, McGloin, Mark Alexander, Pieczul, Olgierd Stanislaw
• Application Number:
  US12/828,988
• Publication Number:
  US 20120005720A1
• Time in Patent Office: Days
• US Class Current: 726/1
• CPC Class Codes: G06F 21/6263 during internet communication, e.g. revealing personal data from cookies

Abstract

A runtime approach receives a request from a target location. Data elements are received from a data store. Privacy data type categories corresponding to retrieved data elements are identified. Data flow category is identified based on the target location. Privacy actions are performed modifying some data elements based on the identified privacy data type categories and the data flow category so that the modified data elements comply with one or more data privacy rules pertaining to the target location. A design-time approach retrieves data types included in a software application data design. Privacy categories are selected that correspond to the retrieved data types. Flow categorization data is retrieved that correspond to software application processes. Privacy categories and flow categorization data are compared to privacy rules. A user is informed if privacy rules are violated to facilitate software application modification in order to comply with the privacy rules.

Claims

1. A processor-implemented method comprising:

receiving, at a source location, a request from a requestor, wherein the requestor is at a target location;

retrieving one or more data elements from a data store responsive to the request;

identifying a privacy data type category corresponding to one or more of the retrieved data elements;

identifying a data flow category based on the target location; and

performing one or more privacy actions modifying one or more of the data elements based on the privacy data type category of the data elements and the data flow category so that the modified data elements comply with one or more data privacy rules pertaining to the target location.

2. The method of claim 1 further comprising:

selecting a software application from a plurality of software applications, wherein the selected software application is based on the received request; and

sending the data request to the selected software application, wherein the software application retrieves the data elements from the data store.

3. The method of claim 1 wherein at least one of the privacy actions is an encryption action that encrypts one or more of the data elements in order to comply with the privacy rules.

4. The method of claim 1 wherein the identification of the data flow category further comprises:

identifying the target location of the requestor, wherein the identification of the target location comprises;

comparing request data included in the request with a plurality of registered user data records retrieved from a second data store.

5. The method of claim 1 further comprising:

searching a privacy rules data store for a combination of the privacy data type category corresponding to each of the data elements and the data flow category.

6. An information handling system comprising:

one or more processors;

a memory coupled to at least one of the processors;

a nonvolatile storage area that is accessible by at least one of the processors and that stores one or more data stores;

a network adapter that connects the information handling system to a computer network; and

a set of instructions stored in the memory and executed by at least one of the processors in order to perform actions of;

receiving, at the network adapter, a request from a requestor, wherein the requestor is at a target location;

retrieving one or more data elements from a data store responsive to the request;

identifying a privacy data type category corresponding to one or more of the retrieved data elements;

identifying a data flow category based on the target location; and

performing one or more privacy actions modifying one or more of the data elements based on the privacy data type category of the data elements and the data flow category so that the modified data elements comply with one or more data privacy rules pertaining to the target location.

7. The information handling system of claim 6 further comprising actions of:

selecting a software application from a plurality of software applications, wherein the selected software application is based on the received request; and

sending the data request to the selected software application, wherein the software application retrieves the data elements from the data store.

8. The information handling system of claim 6 wherein at least one of the privacy actions is an encryption action that encrypts one or more of the data elements in order to comply with the privacy rules.

9. The information handling system of claim 6 wherein the identification of the data flow category further comprises actions of:

identifying the target location of the requestor, wherein the identification of the target location comprises;

comparing request data included in the request with a plurality of registered user data records retrieved from a second data store.

10. The information handling system of claim 6 further comprising actions of:

searching a privacy rules data store for a combination of the privacy data type category corresponding to each of the data elements and the data flow category.

11. A computer program product stored in a computer readable medium, comprising functional descriptive material that, when executed by an information handling system, causes the information handling system to perform actions that include:

receiving, at a source location, a request from a requestor, wherein the requestor is at a target location;

retrieving one or more data elements from a data store responsive to the request;

identifying a privacy data type category corresponding to one or more of the retrieved data elements;

identifying a data flow category based on the target location; and

performing one or more privacy actions modifying one or more of the data elements based on the privacy data type category of the data elements and the data flow category so that the modified data elements comply with one or more data privacy rules pertaining to the target location.

12. The computer program product of claim 11 wherein the actions further comprise:

selecting a software application from a plurality of software applications, wherein the selected software application is based on the received request; and

sending the data request to the selected software application, wherein the software application retrieves the data elements from the data store.

13. The computer program product of claim 11 wherein at least one of the privacy actions is an encryption action that encrypts one or more of the data elements in order to comply with the privacy rules.

14. The computer program product of claim 11 wherein the identification of the data flow category includes further actions comprising:

identifying the target location of the requestor, wherein the identification of the target location comprises;

comparing request data included in the request with a plurality of registered user data records retrieved from a second data store.

15. The computer program product of claim 11 wherein the actions further comprise:

searching a privacy rules data store for a combination of the privacy data type category corresponding to each of the data elements and the data flow category.

16. The computer program product of claim 11 wherein the functional descriptive material are stored in a computer readable storage medium in an information handling system, and wherein the functional descriptive material was downloaded over a computer network from a remote information handling system.

17. The computer program product of claim 11 wherein the functional descriptive material are stored in a first computer readable storage medium in a server information handling system, and wherein the functional descriptive material is downloaded over a computer network to a remote information handling system for use in a second computer readable storage medium with the remote information handling system.

18. A processor-implemented method comprising:

retrieving a plurality of data types included in a data design of a software application;

selecting one or more privacy categories wherein each of the selected privacy categories correspond to one or more of the plurality of retrieved data types;

retrieving flow categorization data corresponding to one or more processes included in the software application;

comparing the selected privacy categories and the retrieved flow categorization data to one or more privacy rules; and

informing a user when the comparison reveals that one or more of the privacy rules is violated to facilitate modification of the software application in order to comply with the privacy rules.

19. The method of claim 18 further comprising:

storing the selected privacy categories in a first data store; and

storing the retrieved flow categorization data in a second data store.

20. The method of claim 19 further comprising:

selecting a data representation corresponding to at least one of the data types; and

storing the selected data representation in the first data store.

21. The method of claim 20 wherein one of the selected data representations is an encryption representation used to encrypt a corresponding data element prior to transmitting the data element to a target location.

22. The method of claim 18 further comprising:

receiving an action corresponding to one of the selected privacy categories and one of the retrieved flow categorization data so that the action is performed when a responsive data element matches the one selected privacy category and a target location matches the retrieved flow categorization data; and

storing the action in a data store.

23. A computer program product stored in a computer readable medium, comprising functional descriptive material that, when executed by an information handling system, causes the information handling system to perform actions that include:

retrieving a plurality of data types included in a data design of a software application;

selecting one or more privacy categories wherein each of the selected privacy categories correspond to one or more of the plurality of retrieved data types;

retrieving flow categorization data corresponding to one or more processes included in the software application;

comparing the selected privacy categories and the retrieved flow categorization data to one or more privacy rules; and

informing a user when the comparison reveals that one or more of the privacy rules is violated to facilitate modification of the software application in order to comply with the privacy rules.

24. The computer program product of claim 23 further comprising:

storing the selected privacy categories in a first data store; and

storing the retrieved flow categorization data in a second data store.

25. The computer program product of claim 24 further comprising:

selecting a data representation corresponding to at least one of the data types; and

storing the selected data representation in the first data store.

26. The computer program product of claim 25 wherein one of the selected data representations is an encryption representation used to encrypt a corresponding data element prior to transmitting the data element to a target location.

27. The computer program product of claim 23 further comprising:

receiving an action corresponding to one of the selected privacy categories and one of the retrieved flow categorization data so that the action is performed when a responsive data element matches the one selected privacy category and a target location matches the retrieved flow categorization data; and

storing the action in a data store.

28. The computer program product of claim 23 wherein the functional descriptive material are stored in a computer readable storage medium in an information handling system, and wherein the functional descriptive material was downloaded over a computer network from a remote information handling system.

29. The computer program product of claim 23 wherein the functional descriptive material are stored in a first computer readable storage medium in a server information handling system, and wherein the functional descriptive material is downloaded over a computer network to a remote information handling system for use in a second computer readable storage medium with the remote information handling system.