Data management platform

Patent metadata

Field	Value
Publication number	US-12443740-B2
Application number	US-202519094636-A
Country	US
Kind code	B2
Filing date	Mar 28, 2025
Priority date	Apr 14, 2023
Publication date	Oct 14, 2025
Grant date	Oct 14, 2025

Abstract

A network system to allow global usage of data while allowing regional jurisdictions control over sensitive data. Different jurisdictions may declare different types of data as sensitive data that is not to be discoverable by a third party. The system allows the data to be shared across jurisdiction boundaries with complete auditability, traceability, and compliance. The system allows a first jurisdiction computing device to control the usage of the data that is stored outside of the jurisdiction. The technology allows the first jurisdiction to propagate rules, tokenization protocols, and updates to the system to manage the sensitive data. The system detokenizes the data when the data is to be used for an approved purpose by an approved party. If the original jurisdiction has a change in permissions for sensitive data, the jurisdiction can propagate a tokenization to all data stored in the data management system outside of the jurisdiction.

First claim

What is claimed is:

1. A data management system, comprising:
one or more first processors communicatively coupled to a first storage device operating on a first computing device in a first jurisdiction, wherein the one or more first processors execute application code instructions that are stored in the first storage device to:
transmit data from the first computing device in the first jurisdiction to a second computing device in a second jurisdiction, the data comprising data fields with a first data field classified as a sensitive data field having sensitive data and a second data field classified as a non-sensitive data field having non-sensitive data, the sensitive data field being tokenized by the first computing device according to a first tokenization protocol before transfer;
transmit detokenization controls to the second jurisdiction, the detokenization controls comprising conditions under which the second computing device may detokenize tokenized data;
cause storage of the tokenized data on the second computing device in the second jurisdiction, wherein the second computing device is unable to access the data without satisfying the conditions;
receive an indication that the second data field has been reclassified into a second sensitive data field;
responsive to the indication that the second data field has been reclassified into the second sensitive data field, cause tokenization of the data in the second data field at the first computing device using a second tokenization protocol, wherein the tokenization generates new tokenized data for the second data field and renders the new tokenized data inaccessible to the second computing device until the tokenized data is retokenized; and
propagate the new tokenized data to the second computing device in the second jurisdiction.

2. The data management system of claim 1 , wherein the application code instructions for propagating the new tokenized data further cause the one or more first processors to:
access the sensitive data in the second computing device in the second jurisdiction; and
replace the second data field on the second computing device with the new tokenized data.

3. The data management system of claim 1 , wherein the application code instructions further cause the one or more first processors to:
identify the sensitive data by filtering the data for content, identifiers, metadata, or any other data characteristic that identifies the data as sensitive; and
label the data as the sensitive data.

4. The data management system of claim 1 , wherein the second tokenization protocol comprises a mathematically reversible cryptographic function with a key for each instance of the sensitive data.

5. The data management system of claim 1 , wherein the detokenization controls comprise rules based on location of a third party.

6. The data management system of claim 1 , wherein the detokenization controls comprise rules based on a legal agreement between a third party and the data management system.

7. The data management system of claim 1 , wherein satisfaction of the conditions and detokenization of the data occurs in real time.

8. The data management system of claim 1 , wherein detokenization of the data is only permitted for a third party within a particular geographic location or jurisdiction.

9. A method to provide data management security across jurisdictional boundaries, the method comprising:
transmitting data from a first computing device in a first jurisdiction to a second computing device in a second jurisdiction, the data comprising data fields with a first data field classified as a sensitive data field having sensitive data and a second data field classified as a non-sensitive data field having non-sensitive data, the sensitive data field being tokenized by the first computing device according to a first tokenization protocol before transfer;
transmit detokenization controls to the second jurisdiction, the detokenization controls comprising conditions under which the second computing device may detokenize tokenized data;
cause storage of the tokenized data on the second computing device in the second jurisdiction, wherein the second computing device is unable to access the data without satisfying the conditions;
receive an indication that the second data field has been reclassified into a second sensitive data field;
responsive to the indication that the second data field has been reclassified into the second sensitive data field, cause tokenization of the data in the second data field at the first computing device using a second tokenization protocol, wherein the tokenization generates new tokenized data for the second data field and renders the new tokenized data inaccessible to the second computing device until the tokenized data is retokenized; and
propagate the new tokenized data to the second computing device in the second jurisdiction.

10. The method of claim 9 , wherein the detokenization controls comprise rules based on a legal agreement between two or more parties.

11. The method of claim 9 , further comprising:
identifying the sensitive data by filtering the data for content, identifiers, metadata, or any other data characteristic that identifies the data as sensitive; and
labelling the data as sensitive.

12. The method of claim 9 , propagating the new tokenized data further comprises:
accessing the sensitive data in the second computing device in the second jurisdiction; and
replacing the second data field on the second computing device with the new tokenized data.

13. The method of claim 9 , wherein the second tokenization protocol comprises a mathematically reversible cryptographic function with a key for each instance of data.

14. The method of claim 9 , wherein satisfaction of the conditions and detokenization of the data occurs in real time.

15. The method of claim 9 , wherein detokenization of the data is only permitted for a third party within a particular geographic location or jurisdiction.

16. One or more non-transitory computer-readable media having computer-readable program instructions embodied thereon, the computer-readable program instructions causing one or more processors to:
transmit data from a first computing device in a first jurisdiction to a second computing device in a second jurisdiction, the data comprising a first data field classified as a sensitive data field having sensitive data and a second data field classified as a non-sensitive data field having non-sensitive data, the sensitive data field being tokenized by the first computing device before transmission;
transmit detokenization controls to the second jurisdiction, the detokenization controls comprising conditions under which the second computing device may detokenize tokenized data;
cause storage of the tokenized data on the second computing device in the second jurisdiction, wherein the second computing device is unable to access the data without satisfying the conditions;
receive an indication that the second data field has been reclassified into a second sensitive data field;
responsive to the indication that the second data field has been reclassified into the second sensitive data field, cause tokenization of the data in the second data field at the first computing device using a second tokenization protocol, wherein the tokenization generates new tokenized data for the second data field and renders the new tokenized data inaccessible to the second computing device until the tokenized data is retokenized; and
propagate the new tokenized data to the second computing device in the second jurisdiction.

Assignees

• Citibank Na

Inventors

• Trotta Walter
• Kumar Vaibhav
• Kass Samuel J
• Shanmugasundaram Sasisekar

Classifications

• G06F21/6254

  by anonymising data, e.g. decorrelating personal data from the owner's identification · CPC title

• G06F21/6245

  Protecting personal data, e.g. for financial or medical purposes · CPC title

• G06F21/6218 Primary

  to a system of files or objects, e.g. local or distributed file system or database · CPC title