Systems and methods for sharing data between entities

• US 7,805,415 B1
• Filed: 05/18/2005
• Issued: 09/28/2010
• Est. Priority Date: 06/10/2003
• Status: Active Grant

• Current Assignee: Leidos Innovations Technology, Inc.
• Original Assignee: Lockheed Martin Corporation (Martin Marietta Corporation)
• Inventors: Shaw, Geoff, Flesher, Kevin E.
• Primary Examiner(s): Morrison; Jay A
• Application Number:
  US11/131,940
• Time in Patent Office: 1,959 Days
• Field of Search: None
• US Class Current: 707/694
• CPC Class Codes: H04L 63/105 Multiple levels of security
• CPC Class Codes: H04L 63/12 Applying verification of the received information cryptographic mechanisms or cryptographic arrangements for data integrity or data verification H04L9/32

Abstract

The present invention is generally directed to methods and apparatus for sharing data. A system maintains the integrity of the data by controlling access to and from the data. For example, one entity may wish to cooperate with another entity by sharing information with the other entity. The sharing entity may, however, wish to block access to certain portions of the data. The system, therefore, includes a processor configured for processing stored rules that, when processed, control transfer of the data to the other entity. The processor maintains integrity of the data because, among other reasons, the processor can determine that certain portions of the data to be transferred should be excluded from an intended recipient based upon a processed rule. Examples of such data sanitization include the deletion of information regarding the data owner, the data provider and/or other entity specific sensitive portions of the data.

Claims

1. A system for sharing data, comprising:

a storage element configured for storing a plurality of rules, wherein the rules include rule information regarding a policy framework, a data type, a data transfer and a data classification; and

a processor including an information segmentation module configured for processing at least one of the plurality of rules, wherein said processor is responsive to a processed said at least one rule to control transfer of the data to a first entity and to maintain integrity of the data within the system based on the rule information, said information segmentation module being operative to segment the data into data segments and tag the data segments with sub component identifiers in accordance with policy information of the policy framework, wherein the policy information is selected from a group consisting of;

a data owner;

a data provider;

a data user; and

a data use;

wherein said information segmentation module is further operative to detect private information in the data, segment the private information into a plurality of subsegments with each subsegment being identified with a particular private information sensitivity, and organize the data according to the private information sensitivity whereby the segmented data may be transferred to the first entity according to a rule designating which of the segments may be transferred to the first entity according to the private information sensitivity;

wherein said information segmentation module is further operative to detect one or more classification standards within the data, segment the data according to the one or more classification standards, and organize the data by the one or more classification standards whereby a rule may be generated that governs the transfer of information with respect to the one or more classification standards and prevents the transfer of classified data to an unauthorized entity; and

wherein said information segmentation module is further operative to sanitize and aggregate portions of the private information.

2. The system of claim 1, wherein the policy information includes policy rules defined by the data owner, data provider or the data to provide a framework for implementing policy formulated by entities sharing the data.

3. The system of claim 1, wherein the data type includes entity information selected from a group consisting of:

an individual'"'"'s information;

a company'"'"'s information;

a government organization'"'"'s information;

a name;

an address;

an account;

an affiliation; and

a relationship.

4. The system of claim 1, wherein the data type includes transactional information between entities, wherein the transactional information is selected from a group consisting of:

purchases;

shipments;

travel;

attendance; and

contacts.

5. The system of claim 1, wherein the data classification is selected from a group consisting of:

a public record;

a private record;

a government security classification;

a law enforcement classification and a sensitivity classification.

6. The system of claim 1, wherein the data transfer includes transfer information selected from a group consisting of:

a routing indicator;

message field indicator; and

a time stamp.

7. The system of claim 1, further comprising a communication portal communicatively coupled to the processor, wherein the communication portal is configured for allowing a second entity to transfer data between the second entity and the system.

8. The system of claim 1, further comprising a communication portal communicatively coupled to the processor, wherein the communication portal is configured for allowing the first entity to retrieve the data from the system.

9. The system of claim 1, further comprising a compliance auditor to review transferred data to ensure policy compliance.

10. The system of claim 9, wherein the compliance auditor is further configured for providing confirmation to a transferring entity in response to a requesting entity being granted access to the data.

19. The system of claim 1 wherein the subsegments of private information are selected from a group consisting of:

an entity identification subsegment, a georeference subsegment, an identifying indices subsegment, a Title V indices subsegment, a batch credentialing subsegment, a transaction credentialing subsegment, and a relationships subsegment.

11. A method of sharing stored data, comprising:

tagging data from a plurality of entities with one or more operational identifiers;

operating a processor to execute an information segmentation module within said processor, wherein the information segmentation module segments the data based on one or more of the operational identifiers, wherein the information segmentation module further detects private information in the data, segments the private information into a plurality of subsegments with each subsegment being identified with a particular private information sensitivity, and organizes the data according to the private information sensitivity whereby the segmented data may be transferred to an entity according to a rule designating which of the segments may be transferred to an entity according to the private information sensitivity, and wherein the information segmentation module further detects one or more classification standards within the data, segments the data according to the one or more classification standards, and organizes the data by the one or more classification standards whereby a rule may be generated that governs the transfer of information with respect to the one or more classification standards and prevents the transfer of classified data to an unauthorized entity;

storing segmented said data on a storage element in operative communication with said processor;

processing said stored segmented said data with said processor according to at least one rule, wherein a processed said at least one rule configures said processor to exclude from a first entity of said plurality of entities a one or more data segments of said stored segmented said data from a second entity of said plurality of entities;

aggregating a plurality of data segments of said stored segmented said data according to one or more of the operational identifiers, wherein the operational identifiers are selected from a group consisting of;

a policy framework, a data type, a data transfer, and a data classification; and

recognizing a pattern within aggregated said plurality of data segments of said stored segmented said data to generate a message and to transfer the message to one or more of the plurality of entities according to an entity specific concern.

12. The method of claim 11, wherein the policy framework comprises operational identifier subsegments selected from a group consisting of:

a data owner;

a data provider, a data user; and

a data use.

13. The method of claim 11, wherein the data type comprises operational identifier subsegments selected from a group consisting of:

an individual'"'"'s information subsegment;

a company'"'"'s information subsegment;

a government organization'"'"'s information subsegment;

a name subsegment;

an address subsegment;

an account subsegment;

an affiliation subsegment; and

a relationship subsegment.

14. The method of claim 13, wherein the data type includes transactional information between entities, wherein the transactional information is selected from a group consisting of:

purchases;

shipments;

travel;

attendance; and

contacts.

15. The method of claim 11, wherein the data classification comprises operational identifier subsegments selected from a group consisting of:

a public record;

a private record;

a government security classification;

a law enforcement classification; and

a sensitivity classification.

16. The method of claim 11, wherein the data transfer comprises operational identifier subsegments selected from a group consisting of:

a routing indicator;

message field indicator; and

a time stamp.

17. The method of claim 11, further comprising transferring at least a portion of aggregated said stored data to the first entity in response to processing.

20. The method of claim 11 wherein the subsegments of private information are selected from a group consisting of:

an entity identification subsegment, a georeference subsegment, an identifying indices subsegment, a Title V indices subsegment, a batch credentialing subsegment, a transaction credentialing subsegment, and a relationships subsegment.

18. A method of sharing data and protecting sensitive information within the data, comprising:

storing data of a plurality of entities on a storage element in operative communication with a processor;

storing a plurality of rules on the storage element, wherein the rules include rule information regarding a policy framework, a data type, a data transfer and a data classification;

operating a processor to execute an information segmentation module within said processor, wherein the information segmentation module is configured for processing at least one of the plurality of rules, wherein said processor is responsive to a processed said at least one rule to control transfer of the data to a first entity and to maintain integrity of the data within the system based on the rule information;

wherein said information segmentation module segments the data into data segments and tags the data segments with sub component identifiers in accordance with policy information of the policy framework, wherein the policy information is selected from a group consisting of;

a data owner;

a data provider;

a data user; and

a data use;

wherein the information segmentation module detects private information in the data, segments the private information into a plurality of subsegments with each subsegment being identified with a particular private information sensitivity, and organizes the data according to the private information sensitivity whereby the segmented data may be transferred to an entity according to a rule designating which of the segments may be transferred to an entity according to the private information sensitivity; and

wherein the information segmentation module further detects one or more classification standards within the data, segments the data according to the one or more classification standards, and organizes the data by the one or more classification standards whereby a rule may be generated that governs the transfer of information with respect to the one or more classification standards and prevents the transfer of classified data to an unauthorized entity;

processing said plurality of rules with said processor, wherein at least one rule is associated with a first entity of said plurality of entities and wherein a processed said at least one rule is configurable to exclude from the first entity one or more segments of data of a second entity of said plurality of entities; and

allowing the first entity to retrieve stored data with the one or more segments of data from the second entity excluded.

21. The method of claim 18 wherein the subsegments of private information are selected from a group consisting of:

an entity identification subsegment, a georeference subsegment, an identifying indices subsegment, a Title V indices subsegment, a batch credentialing subsegment, a transaction credentialing subsegment, and a relationships subsegment.