Integrated data extraction and retrieval system

Patent metadata

Field	Value
Publication number	US-2017223003-A1
Application number	US-201715486480-A
Country	US
Kind code	A1
Filing date	Apr 13, 2017
Priority date	Jan 19, 2015
Publication date	Aug 3, 2017
Grant date	—

Abstract

A first computing device connected to an internal network de-anonymizes data. A record including a surrogate key is received from a second computing device connected to an external network to the internal network. Each identity data record includes a second surrogate key, an entity identifier field value, a record type field value, and a de-identified field value. The second surrogate key uniquely identifies the respective record. The surrogate key is compared to the second surrogate key to identify a matching record. The matching entity identifier field value is selected and compared to the entity identifier field value of the plurality of records to identify a master record for the surrogate key. The record type field value includes an indicator indicating whether the record is the master record. The de-identified field value included in the identified master record is selected. The received record is supplemented with the selected de-identified field value.

First claim

What is claimed is:

1 . A non-transitory computer-readable medium having stored thereon computer-readable instructions that when executed by a first computing device control the first computing device to:
receive a record from a second computing device connected to an external network separated from an internal network by a firewall, wherein the first computing device is connected to the internal network, wherein the record includes a surrogate key; read identity data stored on the internal network that includes a plurality of records, wherein each record includes a second surrogate key, an entity identifier field value, a record type field value, and a de-identified field value, wherein the second surrogate key uniquely identifies the respective record; compare the surrogate key to the second surrogate key to identify a matching record from the read identity data; select the entity identifier field value included in the identified matching record; compare the selected entity identifier field value to the entity identifier field value of the plurality of records to identify a master record for the surrogate key from the read identity data, wherein the record type field value includes an indicator that indicates whether or not the respective record is the master record; select the de-identified field value included in the identified master record; supplement the received record with the selected de-identified field value; and store the supplemented record on the internal network.

2 . The non-transitory computer-readable medium of claim 1 , wherein each record includes a plurality of de-identified field values, wherein the de-identified field value is one of the plurality of de-identified field values.

3 . The non-transitory computer-readable medium of claim 1 , wherein, before selecting the entity identifier field value, the computer-readable instructions further control the first computing device to:
receive a result type value, wherein the result type value indicates whether or not to retrieve the master record; when the received result type value indicates to retrieve the master record, the entity identifier field value is selected, the selected entity identifier field value is compared to the entity identifier field value of the plurality of records, and the de-identified field value included in the identified master record is selected; and when the received result type value does not indicate to retrieve the master record, the de-identified field value is selected from the identified matching record.

4 . The non-transitory computer-readable medium of claim 1 , wherein, before comparing the surrogate key to the second surrogate key, the computer-readable instructions further control the first computing device to decrypt the received record, wherein the decrypted surrogate key is compared to the second surrogate key.

5 . The non-transitory computer-readable medium of claim 1 , wherein, before receiving the record, the computer-readable instructions further control the first computing device to:
read retrieval instructions stored on the internal network, wherein the retrieval instructions include connection information used to connect to the second computing device; and connect to the second computing device using the read retrieval instructions.

6 . The non-transitory computer-readable medium of claim 5 , wherein the retrieval instructions are read from a handle lookup table using a predefined output handle name.

7 . The non-transitory computer-readable medium of claim 5 , wherein the connection information includes a protocol, credentials, and a connectivity option.

8 . The non-transitory computer-readable medium of claim 7 , wherein the credentials include a username and a password for connecting to the second computing device.

9 . The non-transitory computer-readable medium of claim 7 , wherein the connectivity option includes a hostname of the second computing device and a port number of the second computing device to which to connect.

10 . The non-transitory computer-readable medium of claim 7 , wherein the connection information further includes an indicator defining whether receipt of the record is sequential or parallel.

11 . The non-transitory computer-readable medium of claim 1 , wherein the computer-readable instructions further control the first computing device to:
read a post-process script stored on the internal network; and execute the post-process script with the supplemented record on the internal network.

12 . The non-transitory computer-readable medium of claim 11 , wherein the post-process script streams the supplemented record to an event stream processing engine.

13 . A computing device comprising:
a processor; and a non-transitory computer-readable medium operably coupled to the processor, the computer-readable medium having computer-readable instructions stored thereon that, when executed by the processor, control the computing device to
receive a record from a second computing device connected to an external network separated from an internal network by a firewall, wherein the computing device is connected to the internal network, wherein the record includes a surrogate key;
read identity data stored on the internal network that includes a plurality of records, wherein each record includes a second surrogate key, an entity identifier field value, a record type field value, and a de-identified field value, wherein the second surrogate key uniquely identifies the respective record;
compare the surrogate key to the second surrogate key to identify a matching record from the read identity data;
select the entity identifier field value included in the identified matching record;
compare the selected entity identifier field value to the entity identifier field value of the plurality of records to identify a master record for the surrogate key from the read identity data, wherein the record type field value includes an indicator that indicates whether or not the respective record is the master record;
select the de-identified field value included in the identified master record;
supplement the received record with the selected de-identified field value; and
store the supplemented record on the internal network.

14 . The computing device of claim 13 , wherein the computer-readable instructions further control the computing device to:
read a post-process script stored on the internal network; and execute the post-process script with the supplemented record on the internal network.

15 . The computing device of claim 14 , wherein the post-process script streams the supplemented record to an event stream processing engine.

16 . The computing device of claim 13 , wherein each record includes a plurality of de-identified field values, wherein the de-identified field value is one of the plurality of de-identified field values.

17 . The computing device of claim 13 , wherein, before selecting the entity identifier field value, the computer-readable instructions further control the computing device to:
receive a result type value, wherein the result type value indicates whether or not to retrieve the master record; when the received result type value indicates to retrieve the master record, the entity identifier field value is selected, the selected entity identifier field value is compared to the entity identifier field value of the plurality of records, and the de-identified field value included in the identified master record is selected; and when the received result type value does not indicat

Assignees

• Sas Inst Inc

Inventors

• Miles Brian Oneal
• Adams Keith

Classifications

• H04L63/02

  for separating internal from external traffic, e.g. firewalls · CPC title

• H04L63/08 Primary

  for authentication of entities (cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32) · CPC title

• G06F21/6209

  to a single file or object, e.g. in a secure envelope, encrypted and accessed using a key, or with access control rules appended to the object itself · CPC title

• G06F21/6254

  by anonymising data, e.g. decorrelating personal data from the owner's identification · CPC title

• G06F16/116 Primary

  Details of conversion of file system types or formats · CPC title