Configurable automated redaction of log data

Patent metadata

Field	Value
Publication number	US-12488133-B2
Application number	US-202318297563-A
Country	US
Kind code	B2
Filing date	Apr 7, 2023
Priority date	Apr 7, 2023
Publication date	Dec 2, 2025
Grant date	Dec 2, 2025

Abstract

Configurable automated redaction of log data, including: selecting, based on one or more configurable rules, one or more portions of log data; generating obfuscated log data by replacing the one or more portions of log data with one or more obfuscated values; presenting the obfuscated log data; and providing, in response to receiving an approval of the obfuscated log data, the obfuscated log data to a remotely disposed computing device.

First claim

What is claimed is:

1 . A method comprising:
selecting, based on one or more configurable rules, one or more portions of log data generated by one or more components of a storage system; generating, based on the one or more configurable rules, obfuscated log data by replacing the selected one or more portions of log data generated by one or more components of the storage system with one or more obfuscated values, wherein the one or more obfuscated values comprise values that provide information about the one or more portions of log data while rendering the one or more portions of log data non-identifiable; and providing, in response to receiving an approval of the obfuscated log data, the obfuscated log data to a remotely disposed computing device, wherein the obfuscated log data includes one or more obfuscated portions of log data and unobfuscated portions of log data.

2 . The method of claim 1 , wherein selecting the one or more portions of log data comprises applying one or more expressions to the log data to select the one or more portions of log data.

3 . The method of claim 1 , wherein selecting the one or more portions of log data comprises selecting the one or more portions of log data based on at least one tag applied to the one or more portions of the log data.

4 . The method of claim 1 , wherein generating the obfuscated log data comprises determining the one or more obfuscated values based on the one or more configurable rules for determining obfuscated values.

5 . The method of claim 4 , wherein the one or more configurable rules for determining obfuscated values correspond to one or more security levels for obfuscating the log data.

6 . The method of claim 1 , wherein the one or more configurable rules comprise one or more nested lists indicating types of log data to be obfuscated.

7 . The method of claim 1 , further comprising maintaining, in memory of the storage system, a dictionary mapping the one or more portions of the log data to the one or more obfuscated values.

8 . The method of claim 7 , further comprising:
unobfuscating, based on the dictionary, an obfuscated value in the obfuscated log data to generate an unobfuscated value; and providing the unobfuscated value to the remotely disposed computing device.

9 . The method of claim 7 , further comprising generating, based on other log data, other obfuscated log data consistent with one or more mappings in the dictionary.

10 . The method of claim 1 , further comprising providing, to the remotely disposed computing device, an indication to obfuscate one or more unobfuscated portions of the obfuscated log data.

11 . An apparatus comprising a computer processor, and a computer memory operatively coupled to the computer processor, the computer processor configured to:
select, based on one or more configurable rules, one or more portions of log data generated by one or more components of a storage system; generate, based on the one or more configurable rules, obfuscated log data by replacing the selected one or more portions of log data generated by one or more components of the storage system with one or more obfuscated values, wherein the one or more obfuscated values comprise values that provide information about the one or more portions of log data while rendering the one or more portions of log data non-identifiable; and provide, in response to receiving an approval of the obfuscated log data, the obfuscated log data to a remotely disposed computing device, wherein the obfuscated log data includes one or more obfuscated portions of log data and unobfuscated portions of log data.

12 . The apparatus of claim 11 , wherein to select the one or more portions of log data the computer processor is configured to apply one or more expressions to the log data to select the one or more portions of log data.

13 . The apparatus of claim 11 , wherein to select the one or more portions of log data the computer processor is configured to select the one or more portions of log data based on at least one tag applied to the one or more portions of the log data.

14 . The apparatus of claim 11 , wherein to generate the obfuscated log data the computer processor is configured to determine the one or more obfuscated values based on the of one or more configurable rules for determining obfuscated values.

15 . The apparatus of claim 14 , wherein the one or more configurable rules for determining obfuscated values correspond to one or more security levels for obfuscating the log data.

16 . The apparatus of claim 11 , wherein the one or more configurable rules comprise one or more nested lists indicating types of log data to be obfuscated.

17 . The apparatus of claim 11 , wherein the computer processor is further configured to maintain, in memory of the storage system, a dictionary mapping the one or more portions of the log data to the one or more obfuscated values.

18 . The apparatus of claim 17 , wherein the computer processor is further configured to:
unobfuscate, based on the dictionary, an obfuscated value in the obfuscated log data to generate an unobfuscated value; and provide the unobfuscated value to the remotely disposed computing device.

19 . The apparatus of claim 17 , wherein the computer processor is further configured to generate, based on other log data, other obfuscated log data consistent with one or more mappings in the dictionary.

20 . A non-transitory computer readable medium storing instructions thereon that, when executed, by a processing device, cause the processing device to:
select, based on one or more configurable rules, one or more portions of log data generated by one or more components of a storage system; generate, based on the one or more configurable rules, obfuscated log data by replacing the selected one or more portions of log data generated by one or more components of the storage system with one or more obfuscated values, wherein the one or more obfuscated values comprise values that provide information about the one or more portions of log data while rendering the one or more portions of log data non-identifiable; and provide, in response to receiving an approval of the obfuscated log data, the obfuscated log data to a remotely disposed computing device, wherein the obfuscated log data includes one or more obfuscated portions of log data and unobfuscated portions of log data.

Assignees

• Pure Storage Inc

Inventors

• Seipp Kyle
• Borowiec Benjamin
• Subramanian Jayakumar
• Kutner Andrew
• Jibaja Ivan

Classifications

• G06F2221/2125

  Just-in-time application of countermeasures, e.g., on-the-fly decryption, just-in-time obfuscation or de-obfuscation · CPC title

• G06F21/6254

  by anonymising data, e.g. decorrelating personal data from the owner's identification · CPC title

• G06F21/6227 Primary

  where protection concerns the structure of data, e.g. records, types, queries · CPC title