Data security

Patent metadata

Field	Value
Publication number	US-12367310-B2
Application number	US-202418416728-A
Country	US
Kind code	B2
Filing date	Jan 18, 2024
Priority date	Oct 18, 2018
Publication date	Jul 22, 2025
Grant date	Jul 22, 2025

Abstract

A computer system is configured to receiving a data set from a data provider and automatically save the data set in a quarantine database where copying, moving, and sharing of the data set are restricted until the data set is released by a data provider. The data set is parsed to find and mark portions with potentially sensitive information. At least those parts are reviewed by a data governor, who can confirm, add, edit, or remove markers. Those parts can be visually indicated to the data governor, along with a preview of, metadata about, and analysis of the data set. After reviewing at least the automatically marked portions, the data governor can release the data set to a non-quarantine database where another user can use the data set. The user is restricted from accessing the quarantine database.

First claim

What is claimed is:

1. A computer-implemented method comprising:
storing a data set in a quarantine database;
determining that at least a portion of the data set matches criteria indicative of potentially sensitive data;
in response to an input from a first user, applying a sensitivity marker to at least the portion of the data set or confirming the sensitivity marker's application to at least the portion of the data set; and
in response to application of the sensitivity marker, releasing at least the portion of the data set to a second database where copying, moving, or sharing of the data set are permitted.

2. The computer-implemented method of claim 1 , further comprising:
receiving, from the first user, an authorization to release at least the portion of the data set, including the portion of the data set to which the sensitivity marker has been applied, from the quarantine database, wherein said releasing is performed in response to receiving the authorization and application of the sensitivity marker; and
receiving, from the second user, instructions for applying an ontology to the data set;
wherein the second user is granted access to the data set that is in the second database;
wherein the second user is not authorized to access the data set in the quarantine database; and
wherein copying, moving, and share of the data set are prohibited for the data set while the data set is in the quarantine database until the data set is released from the quarantine database.

3. The computer-implemented method of claim 2 , wherein:
the first user is not authorized to use or share the data set that is in the second database; and
the second user is not authorized to view, copy, move, share, or release the data set in the quarantine database.

4. The computer-implemented method of claim 3 , wherein:
the data set is received from a data provider; and
the data provider is not authorized to release the data set from the quarantine database.

5. The computer-implemented method of claim 4 , wherein:
the data provider is not authorized to write data sets to the second database.

6. The computer-implemented method of claim 1 , further comprising:
receiving a regular expression or a selection of the regular expression;
wherein the regular expression is used as the criteria indicative of potentially sensitive data.

7. The computer-implemented method of claim 6 , further comprising:
determining, based on matching the regular expression to the portion of the data set, an indication of a type of sensitive information; and
transmitting data to visually indicate that the portion of the data set is the type of sensitive information.

8. The computer-implemented method of claim 7 , wherein:
the data set is received from a data provider; and
the regular expression is provided or selected by the data provider.

9. The computer-implemented method of claim 2 , further comprising:
transmitting data to display, to the second user, a list of a plurality of data sets in the second database;
wherein the list of the plurality of data sets includes the data set; and
wherein the list of the plurality of data sets is filtered to exclude any data sets associated with markers that the second user is not authorized to view.

10. The computer-implemented method of claim 1 , further comprising:
performing a statistical analysis on the portion of the data set; and
transmitting data to display, to the first user, results of the statistical analysis about the portion of the data set, wherein the statistical analysis is indicative of a uniqueness of the portion of the data set.

11. The computer-implemented method of claim 10 , wherein the statistical analysis includes at least one of:
a graph indicating a distribution of values;
a histogram;
a report about a number of unique entries; or
a report about a number of repeated entries.

12. A computer system comprising:
one or more non-transitory, computer readable storage devices configured to store computer-readable instructions; and
one or more processors configured to execute the computer-readable instructions to cause the computer system to perform operations comprising:
storing a data set in a quarantine database;
parsing the data set to determine that at least a portion of the data set matches criteria indicative of potentially sensitive data;
in response to an input from a first user, applying a sensitivity marker to at least the portion of the data set or confirming the sensitivity marker's application to at least the portion of the data set; and
in response to application of the sensitivity marker, releasing at least the portion of the data set to a second database where copying, moving, or sharing of the data set are permitted.

13. The computer system of claim 12 , wherein the operations further include:
receiving, from the first user, an authorization to release at least the portion of the data set, including the portion of the data set to which the sensitivity marker has been applied, from the quarantine database, wherein said releasing is performed in response to receiving the authorization and application of the sensitivity marker; and
receiving, from the second user, instructions for applying an ontology to the data set;
wherein the second user is granted access to the data set that is in the second database;
wherein the second user is not authorized to access the data set in the quarantine database; and
wherein copying, moving, and share of the data set are prohibited for the data set while the data set is in the quarantine database until the data set is released from the quarantine database.

14. The computer system of claim 12 , wherein:
the first user is not authorized to use or share the data set that is in the second database; and
the second user is not authorized to view, copy, move, share, or release the data set in the quarantine database.

15. The computer system of claim 12 , wherein:
the data set is received from a data provider; and
the data provider is not authorized to release the data set from the quarantine database.

16. The computer system of claim 12 , wherein the operations further include:
receiving a regular expression or a selection of the regular expression;
wherein the regular expression is used as the criteria indicative of potentially sensitive data.

17. The computer system of claim 16 , wherein the operations further include:
determining, based on matching the regular expression to the portion of the data set, an indication of a type of sensitive information; and
transmitting data to visually indicate that the portion of the data set is the type of sensitive information.

18. The computer system of claim 17 , wherein:
the data set is received from a data provider; and
the regular expression is provided or selected by the data provider.

19. The computer system of claim 12 , wherein the operations further include:
transmitting data to display, to the second user, a list of a plurality of data sets in the second database;
wherein the list of the plurality of data sets includes the data set; and
wherein the list of the plurality of data sets is filtered to exclude any data sets associated with markers that the second user is not authorized to view.

20. The computer system of claim 12 , wherein the operations further include:
performing a statistical analysis on the portion of the data set; and
transmitting data to display, to the first user, results of the statistical analysis about the po

Assignees

• Palantir Technologies Inc

Inventors

• Szuflita Samuel
• Yu Alice
• Wang Emily
• Dang Hao
• Arora Megha
• Gates Nicholas
• Rogerson Samuel

Classifications

• G06F16/90344

  by using string matching techniques · CPC title

• G06F16/367

  Ontology · CPC title

• G06F16/9024

  Graphs; Linked lists (G06F16/9027 takes precedence) · CPC title

• G06F2221/2141

  Access rights, e.g. capability lists, access control lists, access tables, access matrices · CPC title

• G06F21/604

  Tools and structures for managing or administering access control systems · CPC title