Data processing and scanning systems for generating and populating a data inventory

Patent metadata

Field	Value
Publication number	US-11240273-B2
Application number	US-202117222523-A
Country	US
Kind code	B2
Filing date	Apr 5, 2021
Priority date	Jun 10, 2016
Publication date	Feb 1, 2022
Grant date	Feb 1, 2022

Abstract

In particular embodiments, a data processing data inventory generation system is configured to: (1) generate a data model (e.g., a data inventory) for one or more data assets utilized by a particular organization; (2) generate a respective data inventory for each of the one or more data assets; and (3) map one or more relationships between one or more aspects of the data inventory, the one or more data assets, etc. within the data model. In particular embodiments, a data asset (e.g., data system, software application, etc.) may include, for example, any entity that collects, processes, contains, and/or transfers personal data (e.g., such as a software application, “internet of things” computerized device, database, website, data-center, server, etc.). The system may be configured to identify particular data assets and/or personal data in data repositories using any suitable intelligent identity scanning technique.

First claim

What is claimed is:

1. A data processing intelligent data repository scanning system comprising:
one or more computer processors;
computer memory; and
a computer-readable medium storing computer-executable instructions that, when executed by the one or more computer processors, cause the one or more computer processors to perform operations comprising:
connecting the data processing intelligent data repository scanning system to a database configured on one or more remote computing devices, wherein the database is configured to store one or more pieces of personal data;
scanning the database on the one or more remote computing devices to identify one or more data fields, wherein each of the identified one or more data fields comprises at least one piece of personal data;
analyzing the one or more data fields to determine a first subset of the one or more data fields associated with a first type of personal data;
analyzing the one or more data fields to determine a second subset of the one or more data fields associated with a second type of personal data, wherein the second type of personal data is distinct from the first type of personal data;
determining an association between a first piece of data in a first field of the first subset of the one or more data fields and a second piece of data in a second field of the second subset of data fields;
generating a catalog comprising the first piece of data, the second piece of data, and an indication of the association between the first piece of data and the second piece of data;
scanning one or more data repositories using the catalog to identify one or more data attributes associated with at least one of the first piece of data and the second piece of data;
at least partially in response to identifying one or more data attributes associated with at least one of the first piece of data and the second piece of data, determining whether a data model associated with at least one of the first piece of data and the second piece of data includes the one or more data repositories; and
at least partially in response to determining that the data model associated with at least one of the first piece of data and the second piece of data does not include the one or more data repositories, modifying the data model to include the one or more data repositories and one or more of:
an indication of an association between the first piece of data and the one or more data repositories; and
an indication of an association between the second piece of data and the one or more data repositories.

2. The data processing intelligent data repository scanning system of claim 1 , wherein the operations further comprise modifying the data model to include an indication of a location of the one or more data repositories.

3. The data processing intelligent data repository scanning system of claim 1 , wherein analyzing the one or more data fields to determine the first subset of the one or more data fields associated with the first type of personal data comprises:
determining a location of the database; and
determining that each data field in the first subset of the one or more data fields is associated with the first type of personal data based at least in part on the location of the database.

4. The data processing intelligent data repository scanning system of claim 3 , wherein the first type of personal data is selected from a group consisting of:
(a) a name;
(b) an address;
(c) a telephone number;
(d) an e-mail address;
(e) a social security number;
(f) banking information; and
(g) location data.

5. The data processing intelligent data repository scanning system of claim 1 , wherein scanning the database on the one or more remote computing devices to identify the one or more data fields comprises analyzing one or more access logs to identify the one or more data fields.

6. The data processing intelligent data repository scanning system of claim 1 , wherein scanning the database on the one or more remote computing devices to identify the one or more data fields comprises:
providing a communication channel between the data processing intelligent data repository scanning system and an application configured at the one or more remote computing devices, wherein the application is configured to communicate with the data processing intelligent data repository scanning system via a firewall; and
receiving data comprising the one or more data fields from the application via the communication channel.

7. The data processing intelligent data repository scanning system of claim 1 , wherein the operations further comprise at least partially in response to determining that the data model associated with at least one of the first piece of data and the second piece of data does not include the one or more data repositories, generating a second data model associated with the one or more data repositories.

8. A computer-implemented data processing method for identifying related data stored across data sources, the method comprising:
initiating, by one or more computer processors, a communication channel with one or more data sources configured to store one or more pieces of personal data;
scanning, by one or more computer processors via the communication channel, the one or more data sources to identify one or more data fields, wherein each of the identified one or more data fields comprises at least one piece of personal data;
analyzing, by one or more computer processors, the one or more data fields to determine a first subset of the one or more data fields associated with a first type of personal data;
analyzing, by one or more computer processors, the one or more data fields to determine a second subset of the one or more data fields associated with a second type of personal data, wherein the second type of personal data is distinct from the first type of personal data;
determining, by one or more computer processors, an association between a first piece of data in a first field of the first subset of the one or more data fields and a second piece of data in a second field of the second subset of data fields;
generating, by one or more computer processors, a catalog comprising the first piece of data, the second piece of data, and an indication of the association between the first piece of data and the second piece of data;
scanning, by one or more computer processors, one or more data repositories using the catalog to identify one or more data attributes associated with at least one of the first piece of data and the second piece of data;
at least partially in response to identifying one or more data attributes associated with at least one of the first piece of data and the second piece of data, determining by one or more computer processors, whether a data model associated with at least one of the first piece of data and the second piece of data includes the one or more data repositories; and
at least partially in response to determining that the data model associated with at least one of the first piece of data and the second piece of data does not include the one or more data repositories:
generating, by one or more computer processors, a data inventory for the one or more data repositories comprising an indication of an association between the one or more data repositories and at least one of the first piece of data and the second piece of data; and
modifying, by one or more computer processors, the data model associated with at least one of the first piece of data and the second piece of data to include the data inventory for the one or more data repositories.

9. The computer-implemented data processing method of claim 8 , wherein generating the data inventory for the one or more d

Assignees

• Onetrust Llc

Inventors

• Barday Kabir A
• Karanjkar Mihir S
• Finch Steven W
• Browne Ken A
• Heard Nathan W
• Patel Aakash H
• Sabourin Jason L
• Daniel Richard L
• Patton-Kuhl Dylan D
• Brannon Jonathan Blake

Classifications

• G06Q10/06

  Resources, workflows, human or project management; Enterprise or organisation planning; Enterprise or organisation modelling · CPC title

• H04L63/20 Primary

  for managing network security; network security policies in general (filtering policies H04L63/0227) · CPC title

• H04L63/04

  for providing a confidential data exchange among entities communicating through data packet networks · CPC title