RU2772300C2 - Obfuscation of user content in structured user data files - Google Patents

Abstract

FIELD: computer technology.

SUBSTANCE: method for providing data obfuscation infrastructure for a user application contains: provision of user content to a classification service configured so that to classify parts of user content as containing confidential content; reception from the classification service of location indications in a user data file of parts of user content that contain confidential content; provision of graphic annotations annotating each of parts of user content in a user interface as containing confidential content; provision of graphic selection elements that indicate obfuscation options for masking confidential content; and, in response to the user’s selection of obfuscation options, replacement of the mentioned associated user content with obfuscated content.

EFFECT: ensuring the protection from misappropriation and erroneous use of user confidential data.

20 cl, 9 dwg

Description

Prior Art

[0001] Various user operating applications enable data entry and analysis of user content. These applications may provide the ability to create, edit, and analyze content using spreadsheets, presentations, word processing documents, multimedia documents, messaging formats, or other user generated content formats. Among these user-generated content, various textual, alphanumeric, or other character-based information may include sensitive data that users or organizations may not wish to include in published or distributed works. For example, the spreadsheet may include social security numbers (SSNs), credit card information, health care identifiers, or other information. While the user entering this data or user content may have authorization to view sensitive data, other entities or distribution endpoints may not have such authorization.

[0002] Techniques for protecting and managing information may be referred to as data loss prevention (DLP), which attempts to avoid misappropriation and erroneous distribution of this sensitive data. In certain content formats or content types, such as the formats or types included in spreadsheets, slide presentations, and graphic charting applications, user-generated content may be included in various cells, objects, or other structured or semi-structured data objects. Moreover, sensitive data may be shared among more than one data entity. Difficulties can arise when trying to identify and protect against the loss of sensitive data when such documents include sensitive data.

Short review

[0003] Provided herein are systems, methods, and software for data obfuscation frameworks for user applications. An exemplary method includes providing user content to a classification service configured to process the user content to classify portions of the user content as containing sensitive content, and receiving indications from the classification service of the user content that contains sensitive content. The method includes presenting graphical indications in the user interface to the user application that annotate the user content as containing sensitive content, and presenting obfuscation options in the user interface for masking sensitive content within at least a selected portion of the user content. In response to a user selecting at least one of the obfuscation options, the method includes replacing the associated user content with obfuscated content that supports the data schema of the associated user content.

[0004] This summary is provided to present in a simplified form a selection of concepts that are further described below in the Detailed Description. It may be understood that this summary is not intended to identify key features or essential features of the claimed subject matter, and is not intended to be used to limit the scope of the claimed subject matter.

Brief description of the drawings

[0005] Many aspects of the disclosure can be better understood with reference to the following drawings. While several implementations are described in connection with these drawings, the disclosure is not limited to the implementations disclosed herein. On the contrary, it is intended to cover all alternatives, modifications and equivalents.

[0006] FIG. 1 illustrates a DLP environment with an example.

[0007] FIG. 2 illustrates the elements of a DLP environment with an example.

[0008] FIG. 3 illustrates the elements of a DLP environment with an example.

[0009] FIG. 4 illustrates the operations of DLP environments by example.

[0010] FIG. 5 illustrates the operations of DLP environments by example.

[0011] FIG. 6 illustrates the operations of DLP environments by example.

[0012] FIG. 7 illustrates the operations of DLP environments by example.

[0013] FIG. 8 illustrates the data threshold operations of DLP environments by example.

[0014] FIG. 9 illustrates a computing system suitable for implementing any of the architectures, processes, platforms, services, and operating scenarios disclosed herein.

Detailed description

[0015] User work applications (productivity applications) provide the ability to create, edit, and analyze user data and content using spreadsheets, slides, vector graphics, documents, email, messaging content, databases, or other formats and types of application data . Various textual, alphanumeric, or other character-based information may be included among the user-generated content. For example, a spreadsheet might include social security numbers (SSNs), credit card information, health care IDs, passport numbers, or other information. While the user entering this data or user content may have authorization to view sensitive data, other entities or distribution endpoints may not have such authorization. Various privacy policies or data privacy rules may be established that specify what types of data or user content are inherently sensitive. The Enhanced Data Loss Prevention (DLP) measures discussed in this document may be included to attempt to avoid misappropriation and misuse of this sensitive data.

[0016] In certain content formats or content types, such as the formats and types included in spreadsheets, slide presentations, and graphic charting applications, user-generated content may be included in various cells, objects, or other structured or semi-structured data objects. Moreover, sensitive data may be shared among more than one data element or record. The examples in this document enable enhanced identification of sensitive data in user data files that include structured data elements. Moreover, the examples in this document enable enhanced user interfaces to alert users to sensitive data. These user interface elements can include both the marking of individual data elements containing sensitive data, and thresholds for alerting during content editing.

[0017] In one exemplary application that uses structured data elements, such as a spreadsheet application, data may be entered into cells that are organized into columns and rows. Each cell may contain user data or user content and may also include one or more expressions that are used to perform calculations that may refer to user input in one or more other cells. Other custom applications, such as slideshow presentation applications, may include custom content on more than one slide, as well as within objects included on those slides.

[0018] Preferably, examples and implementations herein are provided for advanced operations and structures for data loss prevention services. These improved operations and structures have the technical effects of more quickly identifying sensitive content within documents, and especially for structured documents such as spreadsheets, presentations, graphics, and the like. Moreover, multiple applications can share a single classification service that provides detection and identification of sensitive content in user data files across multiple different applications and end user platforms. Annotation and obfuscation processes at the end user level also provide significant benefits and technical effects in user interfaces for applications. For example, users may be presented with graphical annotations of sensitive content and pop-up dialog boxes that present various obfuscation or masking options. Various advanced annotation thresholds can also be set to dynamically indicate sensitive content to users to make editing of user content and obfuscation of sensitive data more efficient and compliant with various DLP policies and regulations.

[0019] As a first example of a data loss prevention environment for a user application, FIG. 1. FIG. 1 illustrates a DLP environment 100 in an example. The environment 100 includes a user platform 110 and a DLP platform 120. The elements in FIG. 1 may communicate over one or more physical or logical links. In FIG. 1, links 160-161 are shown. However, it should be understood that these links are exemplary only, and one or more additional links may be included, which may include wireless, wired, optical, or logical portions.

[0020] The data loss prevention infrastructure may include a portion local to a particular user application and a shared portion applied across multiple applications. User platform 110 provides an application environment for a user to interact with elements of user application 111 via user interface 112. During user interaction with application 111, content input and content manipulation can be performed. Application data loss protection (DLP) module 113 may provide portions of functionality for annotating and replacing sensitive data in application 111. Application DLP module 113 is local to user platform 110 in this example, but may instead be separate from application 111 or integrated into him. The application DLP module 113 may provide the ability to annotate and replace sensitive data for users and the application 111. The DLP platform 120 provides a shared portion of the DLP infrastructure and provides a shared DLP service 121 for sharing by multiple applications, such as applications 190 with the associated local part 193 DLP.

[0021] In operation, the application 111 provides a user interface 112 through which users can interact with the application 111, for example, to enter, edit, and otherwise handle user content, which may be uploaded through one or more data files or entered through a user interface. interface 112. FIG. 1, a spreadsheet workbook is shown with cells organized in rows and columns. As part of application 111, a data loss prevention service is provided that identifies sensitive user content and allows users to replace sensitive user content with secure text or data. Confidential Content contains content that may have privacy issues, privacy policies/rules or other properties for which distribution would be undesirable or unnecessary. Data loss in this context refers to the dissemination of private or sensitive data to unauthorized users or endpoints.

[0022] In order to identify sensitive content, the application 111 provides (proportionate distributions) division of the user content into parts or portions of the user content in the data loss prevention service. In FIG. 1, content pieces 140 are shown with separate content pieces 141-145 provided over time to the DLP service 121. Typically, application 111 may process user content to parse user content during periods of inactivity, such as when one or more processing threads associated with application 111 are idle or below activity thresholds. As will be discussed herein, structured user content is converted to a 'flattened' or unstructured layout during the splitting process. This unstructured arrangement has several advantages for processing by the DLP service 121.

[0023] The DLP service 121 then processes each piece or 'chunk' of user content separately to determine if the pieces contain sensitive content. Various classification rules 125 such as data schemas, data templates, or privacy policies/rules may be introduced to allow the DLP service 121 to identify sensitive data. After the DLP service 121 parses each individual piece of user content, the sensitive data location offsets in the user data file are determined and indicated to the application DLP service 113 . The display module function in the application DLP service 113 defines a structural relationship between chunk offsets and document structure. Location offset indications, sensitive data lengths, and types of sensitive data may be provided to application 111, as seen for exemplary sensitive data indications 150. The location offsets indicated by the DLP service 121 may not create an exact or specific location among the structural elements of the user data file for sensitive content. In these cases, the mapping process may be used by the application DLP service 113 in the application 111 to determine specific structural elements that contain sensitive data.

[0024] When specific locations are determined, application 111 may annotate sensitive data within the user interface 112. This annotation may include a global or individual mark or label of sensitive data. Annotations may contain 'policy hints' presented in the user interface. Users may then be presented with one or more options to obfuscate or otherwise make the user content unidentifiable as the original confidential content. Various thresholds can be set on the notification of sensitive content that trigger counts or amounts of sensitive data present in the user data file.

[0025] In one example, user data file 114 includes content 115, 116, and 117 in specific cells of user data file 114 that may be associated with a particular worksheet or page of a spreadsheet workbook. Various content may be included in the associated cells, and this content may contain potentially sensitive data, such as the examples shown in FIG. 1 for SSNs, phone numbers and addresses. Some of this content may cross structural boundaries in the user data file, such as spanning multiple cells or spanning multiple graphics. If a 'chunk' separates data into rows or groups of rows, then aligned views (ie, separated from some structural content) may still identify sensitive data within one or more cells.

[0026] Elements of each of the user platform 110 and the DLP platform 120 may include communication interfaces, network interfaces, processing systems, computer systems, microprocessors, storage systems, storage media, or some other processing device or software system, and may be distributed among multiple devices or across multiple geographic locations. Examples of elements of each of the user platform 110 and the DLP platform 120 may include software such as an operating system, applications, logs, interfaces, databases, utilities, drivers, network software, and other software stored on a computer-readable medium. . The elements of each of the user platform 110 and the DLP platform 120 may comprise one or more platforms that are hosted by a distributed computing system or cloud computing service. The elements of each of the user platform 110 and the DLP platform 120 may contain logical interface elements such as software-defined interfaces and application programming interfaces (APIs).

[0027] The elements of the user platform 110 include an application 111, a user interface 112, and a DLP application module 113. In this example, application 111 contains a spreadsheet application. It should be understood that the user application 111 may comprise any user application, such as work applications, communications applications, social media applications, gaming applications, mobile applications, or other applications. The user interface 112 includes graphical user interface elements that can generate output for display to a user and receive input from the user. The user interface 112 may include the elements described below with reference to FIG. 9 for the system 908 user interface. The DLP application module 113 comprises one or more software elements configured to proportion content for delivery to a classification service, annotate data designated as sensitive, and obfuscate sensitive data, among other operations.

[0028] DLP platform 120 elements include a DLP service 121. The DLP service 121 includes an external interface in the form of an application programming interface (API) 122, although other interfaces may be used. The DLP service 121 also includes a tracker 123 and a classification service 124, which will be discussed in more detail below. API 122 may include one or more user interfaces such as web interfaces, APIs, terminal interfaces, console interfaces, command line shell interfaces, Extensible Markup Language (XML) interfaces, among others. The tracker 123 maintains counts or amounts of sensitive data found for a particular document within the aligned structured user content portions, and also maintains a record of location offsets within the aligned structured user content portions that correspond to sensitive data locations within the structured user content. Tracker 123 may also perform a threshold analysis to determine when threshold amounts of sensitive data are found and should be annotated by application DLP module 113. However, in other examples, parts of the threshold/count of the service 121 DLP may be included in the module 113 DLP. Classification service 124 parses aligned user content to determine the presence of sensitive data and may use various inputs that define rules and policies to identify sensitive data. The elements of the application DLP module 113 and the DLP shared service 121 may be configured in different layouts or distributions as shown in FIG. 1, for example, when parts of the shared DLP service 121 are included in the application DLP module 113 or the application 111, among other configurations. In one example, parts of the shared DLP service 121 comprise a dynamically linked library (DLL) included on the user platform 110 for use by the application 111 and the application DLP module 113.

[0029] Links 160-161, along with other links not shown among the elements in FIG. 1, for clarity, may each contain one or more links, such as one or more network links containing wireless or wired network links. Communication links may contain various logical, physical, or application programming interfaces. Exemplary communication lines may use metal, glass, optics, air, space, or some other material as the transport medium. Communication links can use various communication protocols such as Internet Protocol (IP), Ethernet, Hybrid Fiber Coaxial Cable (HFC), Synchronous Optical Network (SONET), Asynchronous Transfer Mode (ATM), Time Division Multiplexing (TDM), circuit-switched, communications signaling, wireless, or some other communications format, including combinations, enhancements, or variations thereof. The links may be direct links or may include intermediate networks, systems, or devices, and may include a logical network link transported over a plurality of physical links.

[0030] For further consideration of the elements and operation of environment 100, FIG. 2. FIG. 2 is a block diagram illustrating an exemplary configuration 200 of an application DLP module 113 that highlights exemplary operations of an application DLP module 113, among other elements. In FIG. 2, the DLP application module 113 includes a content separator 211, an annotation module 212, a display module 213, and an obfuscator 214. Each of the elements 211-214 may contain software modules used by the DLP application module 113 to operate as described below.

[0031] In operation, the user content is provided to the application DLP module 113, such as a file or spreadsheet workbook, as shown in FIG. 1 for the user data file 114. This user data file can be organized in a structured or semi-structured format such as cells organized in rows and columns for the example spreadsheet. Other data formats may be used instead, such as presentation slideshows having pages/slides and many individual graphic objects, vector drawing programs with different objects on different pages, word processing documents with different objects (tables, text boxes, pictures), databases, web page content, or other formats, including combinations thereof. User data files may contain sensitive content or sensitive data. This sensitive data may include any user content that matches one or more data patterns or schemas. Exemplary types of sensitive data include social security numbers, credit card numbers, passport numbers, addresses, phone numbers, or other information.

[0032] In parallel with editing or viewing the user data file, the content splitter 211 subdivides the user content into one or more parts or 'chunks' that are in aligned form from the original/native structured or hierarchical form. The content splitter 211 may then provide these chunks of content to the shared DLP service 121, along with chunk metadata for each chunk. Chunk metadata may indicate various properties of the chunk, such as the offset of the location of the chunk throughout the content, and the length of the chunk. The location offset corresponds to the location of the chunk relative to the entire user document/file, and the chunk length corresponds to the chunk size.

[0033] The shared DLP service 121 separately parses the content chunks to identify sensitive data among the aligned user content of the chunks, and provides indications of the sensitive data back to the application DLP module 113. In some examples discussed below, different thresholds are applied to counts or amounts of sensitive data before indications are provided to the DLP application module 113 . The hints contain offsets for each of the chunks that contain the sensitive data, chunk lengths, and optionally pointers to the data types or data schemas associated with the sensitive data. Sensitive data indications may be used to determine actual or specific locations of sensitive content within the structured data of the user data file. The data type pointers may be character- or numeric-encoded pointers, such as integer values, that are referenced in pointer enumeration, which mapper 213 can use to identify the data types for the annotation.

[0034] The mapping module 213 can be used to convert offsets and lengths to specific locations within a document or user file. The offsets and lengths correspond to particular chunk identifiers that are maintained by the mapper 213 and stored in association with the session identifier. The session identifier may be a unique identifier that persists for at least the duration of the session during which the user opened or viewed the document. Mapping module 213 may be provided with chunk metadata from content splitter 211 to generate mapped relationships between offsets, chunk lengths, and session identifiers. In response to receiving sensitive data indications, mapping module 213 may use the mapped relationships to identify coarse locations indicated for sensitive data within the document that correspond to the offset and chunk lengths. Since chunks may include more than one structural or hierarchical element of the user data file, mapper 213 may perform additional location processes to find specific locations in the user data file for sensitive data.

[0035] For example, offsets may indicate coarse locations, such as a particular row or a particular column in a spreadsheet. To determine a particular location, such as a cell within a specified row or column, mapper 213 may use offsets/lengths, along with local knowledge of the structured data and the user data file itself, to locate sensitive content within the structured data. The mapping module 213 determines where chunks are provided in the user data file, such as associated rows, columns, worksheets for spreadsheet examples, and associated slides/pages and objects for slideshow examples. Other examples, such as word processing examples, may not have this structure and the content aligns more easily, and offsets may be based on document word counts or similar positioning.

[0036] In some examples, specific locations are determined by searching for sensitive content in a specific coarse location. When a plurality of structural elements or hierarchical elements is implied by a particular offset, the mapping module 213 may iteratively search or go through each of the elements to locate the sensitive data. For example, if there are 'n' levels of structure/hierarchy in a document, then the renderer 213 may traverse the higher hierarchies first and then the lower hierarchies. In the spreadsheet examples, the hierarchy/structure may contain worksheets having associated rows and columns. In the presentation document examples, the hierarchy/structure may contain slides/pages having associated shapes/objects. Each worksheet and slide indicated by an offset can be navigated to find the exact cells or objects that contain sensitive content. In other examples, determining the location of the sensitive data may be done by re-creating one or more chunks associated with the coarse location and finding the sensitive data within those re-created chunks to find the particular location of the sensitive data.

[0037] Once the specific locations of the sensitive data have been determined, the annotation module 212 can be used to mark or otherwise mark the sensitive data to the user. This annotation may take the form of a global flag or banner that indicates to the user that sensitive content is present in the user data file. This annotation may take the form of individual flags that indicate markers that are close to sensitive data. In one example, FIG. 2 shows a configuration 201 with a spreadsheet user interface view that has a workbook currently open for viewing or editing. An annotation 220 of the banner is shown, as well as annotations of 221 individual cells. Single cell annotations 221 contain graphical guidelines that annotate one or more pieces of user-generated content and contain pointers close to one or more pieces that can be selected in the user interface 112 to present obfuscation options.

[0038] The user may be presented with one or more options when a particular annotation is selected. A popup menu 202 may be presented that includes various viewing/editing options such as cut, copy, paste, among others. The popup menu 202 may also include obfuscation options. Selecting one of the obfuscation options can generate obfuscated content that maintains the data schema of the associated user content and contains characters selected to prevent identification of the associated user content while maintaining the data schema of the associated user content. In some examples, characters are selected in part based on the data schema of the associated user content, among other considerations. For example, if the data schema includes a numeric data schema, then letters can be used as obfuscation characters. Similarly, if the data schema includes a literal data schema, then numbers can be used as obfuscation characters. Combinations of letters and numbers, or other characters, may be chosen as obfuscation characters in alphanumeric content examples.

[0039] FIG. 2, the first obfuscation option includes replacing sensitive content with masked or otherwise obfuscated text, while the second obfuscation option includes replacing all content with a template or data schema similar to the content of the currently selected annotation. For example, if the SSN is included in a cell, the user may be presented with options to replace the bits in the SSN with 'X' characters while leaving the SSN data schema unchanged, ie. remaining in the familiar "3–2–4" character layout, separated by dash characters. Moreover, another obfuscation option may include an option to replace all of the SSNs that match the pattern of the selected SSN with 'X' characters. It should be understood that different exemplary obfuscation options may be provided and different symbols may be used in the replacement process. However, regardless of the obfuscation characters used, sensitive data is made anonymous, depersonalized, 'clean' or unidentifiable as the original content.

[0040] With reference to FIG. 3, an exemplary configuration 300 is shown to focus on aspects of the DLP service 121. In FIG. 3, the DLP service 121 receives aligned user content pieces provided in one or more content chunks by the content splitter 211, along with chunk metadata that at least includes offsets throughout the content and chunk lengths. Two exemplary types of structured user content are shown in FIG. 3, namely the spreadsheet content 301 and the slideshow/presentation content 302. The spreadsheet content 301 has a structure reflecting rows 321 and columns 322 that define individual cells. Moreover, spreadsheet content 301 may have more than one worksheet 320 that is delimited by tab marks below the worksheet, and each worksheet may have a separate set of rows/columns. Each cell can have custom content such as characters, alphanumeric content, text content, numeric content, or other content. Slideshow content 302 may have one or more slides or pages 323 that include a plurality of objects 324. Each object may have custom content such as characters, alphanumeric content, text content, numeric content, or other content.

[0041] The content splitter 211 subdivides the user content into elements and removes any associated structure, for example, by extracting any user content such as text or alphanumeric content from cells or objects and then organizing the extracted content into aligned or linear chunks for delivery to the 121 DLP service. These chunks and chunk metadata are provided to the DLP service 121 to detect potentially sensitive data.

[0042] When individual portions of user content are received by the DLP service 121, various processing is performed on the portions by the classification service 124. Also, tracker 123 maintains data records 332 containing one or more data structures that associate offsets/lengths and a session ID with detected sensitive data samples. Data records 332 are stored for DLP service 121 to provide offsets/lengths for chunks that contain sensitive data back to the requesting application for further locating and annotating any sensitive content found therein.

[0043] Classification service 124 parses each of the chunks against various classification rules 331 to identify sensitive data or sensitive content. Classification rules 331 may establish one or more predefined data schemas defined by one or more expressions used to parse aligned chunks/data representations to identify chunk parts as indicating one or more predefined content patterns or one or more predefined content types.

[0044] Confidential content is typically identified based on a structural data pattern or data 'schema' that is associated with the confidential content. These patterns or schemas may identify when the exact contents of the chunks may differ, but the data may follow a pattern or layout that reflects sensitive data types. For example, the SSN may have a specific data arrangement having a predefined number of digits interspersed and separated by a predefined number of dashes. Classification rules 331 may include various definitions and policies used in identifying sensitive data. These classification rules may include privacy policies, data templates, data schemas, and threshold policies. Privacy policies may indicate that certain potentially sensitive data may not be listed as sensitive per application due to company, organization or user policies, among other considerations. Threshold policies may set minimum thresholds for finding sensitive data in various chunks before the presence of sensitive data is reported to the application. Classification rules 331 can be set by users or policy makers such as administrators.

[0045] Additionally, the service 124 classification can process the data content through one or more regular expressions processed by the service 333 regular expressions (regex). The regex service 333 may include regular expression matching and processing services, along with various regular expressions that a user or policy creator can deploy to identify sensitive data. Additional examples of service 333 regex are discussed below in FIG. 7.

[0046] As a specific example, classification process 341 illustrates multiple chunks C ₁ -C ₈ of content that are linearized versions of content originally in a structural or hierarchical arrangement in a document or user data file. Classification service 124 processes these chunks to identify those chunks that contain sensitive data. If any sensitive data is found, directions can be provided to the application. Hints may contain offsets and lengths for the sensitive data and are provided to the mapper 213 to locate the sensitive data in the user data file structure. The chunks themselves may be discarded by the classification service 124 after each chunk has been processed to identify sensitive data. Because offsets and lengths allow sensitive data to be found in the original data file, and the original content remains in the data file (unless intermediate edits have occurred), the actual chunks do not need to be preserved after processing.

[0047] To form chunks, the content separator 211 links alphanumeric content such as text into one or more linear data structures such as strings or BSTRs (basic strings or binary strings). Classification service 124 processes linear data structures and determines a list of results. Chunks are checked for sensitive data, and portions of linear data structures can be determined to have sensitive content. Classification service 124, in conjunction with tracker 123, determines offsets/lengths corresponding to chunks that contain sensitive data among linear data structures. These offsets may indicate coarse locations that may translate back to specific locations in the original document (eg, user data file) containing the user content. When chunks are received, tracker 123 may correlate each chunk with the offset/length information specified in the chunk metadata. This offset/length information can be used to map back to the structure or hierarchy of the original document by the mapping module 213 .

[0048] However, the DLP service 121 typically has only a partial context back to the original document or user data file, such as indicated by offsets to the originally generated linear data structures. Moreover, the linear data structures and the user content itself can be released/deleted by the classification service 124 at the end of the classification process. This may mean that the classification service 124 may not be able to directly search for sensitive content to specifically locate sensitive content in the source document, and even if the classification service 124 could search for the exact sensitive content, the classification service 124 may not be able to find sensitive content. content, since the 'chunking' algorithm may cross boundaries of hierarchical constructs or structures in the original document or data file. As a specific example, worksheet 320 in a spreadsheet document may have the text "SSN 123 45 6789" spanning four adjacent cells. Preferably, classification service 124 may find this text as containing sensitive content. However, due to the boundary crossing analysis by the classification service 124, at the end of policy rule evaluation, the classification service 124 typically does not have enough data to find sensitive content in the source document to present to the user. The user may be left with the wrong impression that sensitive content was not present.

[0049] In order to efficiently scan user content for sensitive content, classification service 124 reads one piece of user content at a time while the application is idle, performs a partial analysis, and continues the process. When the classification service 124 finishes reading all content, the classification service 124 only has coarse provisions for sensitive content in the original content, such as start/offset and length only. To efficiently perform mapping back to a structured or semi-structured document, a combination of techniques may be applied by mapping module 213 . It should be noted that these methods differ from how a spelling checker or a grammar checker might work, partly because it may take the full content, rather than just a word/sentence/paragraph, to understand if the content has exceeded a threshold.

[0050] For each level of physical hierarchy or structure present in the source document (i.e., worksheets in a workbook or slides in a presentation), the display module 213 uses an identifier to indicate the existence in the display data structure and further subdivide by a reasonable number hierarchy levels (ie, rows in a worksheet, shapes on a slide) content so that each piece is processed, the display module 213 keeps track of the length of the original content and, based on the order of insertion into the display, the implicit start of that element. The identifier may be a process duration identifier that persists between times a particular document is opened, or may be different in each instance of a particular document. In some examples, the computation to combine the presence/absence of sensitive content is held until there is no raw content left, nor any pending edits that might further change the content.

[0051] Assuming that there is sensitive content, the mapping module 213 receives from the DLP service 121 the start and length of each piece of sensitive content, and the mapping module 213 searches the mapping data structure of the sensitive content identifiers and tabs within the most accurately mapped area to find exact location. For performance reasons, only a certain number of hierarchy levels can be tracked, so a table within a form within a slide, or a cell within a row within a worksheet, cannot be tracked separately. Therefore, a partial re-pass may be performed after the reverse mapping is performed to find the exact location.

[0052] In a specific example, a workbook may have 20 worksheets but millions of rows, and each of the million rows may have 50 columns of user data. For a relatively small number of sensitive data items in this (i.e. one sheet has only one column of sensitive data), the classification process can become extremely memory intensive to have 20 * 1 million * 50 stored 'length+offset' elements data. Removing the last measurement is 50x memory saves, for low computational cost, at a time when sensitive data is actually identified in the original document. Preferably, the memory footprint can be maintained to back-map start/lengths to the original content.

[0053] To further illustrate the operation of the elements of FIG. 1-3, in Fig. 4 is a block diagram of the sequence of operations (flows). The two main streams are shown in Fig. 4, namely, a first stream 400 for identifying sensitive data and a second stream 401 for annotating and obfuscating sensitive data. The first stream 400 may be injected into the second stream 401, although other configurations are possible.

[0054] FIG. 4, DLP service 121 receives (410) subsets of structured user content consolidated into associated aligned views, each of the associated aligned views having a mapping to a corresponding subset of structured user content. As mentioned above, structured content may include spreadsheet content organized into sheets/rows/columns, or may instead include other structures such as slideshow content organized into slides/objects, paint program content organized into pages. /objects, or textual content organized into pages, among other structures. These structured user content subsets may include 'chunks' 141-146 shown in FIG. 1, or portions C ₁ -C ₈ in FIG. 3, among others. The structure of the main user content is flattened or removed in these subsets to form chunks, and each subset can be mapped back to the original structure by referring to structural identifiers or localizers such as sheets/rows/columns or slides/objects, for example.

[0055] The DLP service 121 receives these chunks and chunk metadata, for example, over link 160 or API 122 in FIG. 1 and separately parses (411) the aligned views to classify the parts as containing sensitive content corresponding to one or more predefined data schemas. Classification rules 125 may establish one or more predefined data schemas defined by one or more expressions used to parse representations of aligned chunks/data to identify chunk portions as pointers to one or more predefined content templates or one or more predefined content types.

[0056] If sensitive data is found (412), then for each of the parts, the DLP service 121 determines (413) an associated offset/length related to the structured user content indicated as being supported in the tracker 123 in the data records 332. The DLP service 121 then indicates (414) at least the associated offset/length for the parts to the user application 111 for marking sensitive content in the user interface 112 to the user application 111. If no sensitive data is found or if any associated thresholds are not satisfied, then additional portion processing or additional control of additional portions may continue as provided by the user application 111. Moreover, editing or modifying user content may offer additional or repeatable classification processes for any modified or edited user content.

[0057] The application DLP module 113 receives (415) from the classification service of the DLP service 121 indications of one or more pieces of user content that contain confidential content, where the indications contain offsets/lengths associated with the confidential content. The DLP application module 113 presents (416) graphical indications in the user interface 112 to the user application 111 that annotate one or more pieces of user content as containing sensitive content. The DLP application module 113 may then present (417) obfuscation options in the user interface 112 to mask sensitive content within at least a selected portion of one or more pieces of user content. In response to the user selecting at least one of the obfuscation options, the application DLP module 113 replaces (418) the associated user content with obfuscated content that supports the data schema of the associated user content.

[0058] FIG. 5 illustrates a sequence diagram 500 to further illustrate the operation of the elements of FIG. 1–3. Moreover, FIG. 5 includes a detailed exemplary structure 510 for some of the process steps in FIG. 5. In FIG. 5, application 111 may open the document for viewing or editing by the user. This document can be detected by the application DLP module 113 . Any associated policy or classification rules may be provided to the DLP service 121 to determine the appropriate classification policies. The DLP service 121 may then maintain an open document processing instance in record 332, which may include a listing of multiple open documents. When the idle processing time frames of the application 111 are detected by the DLP module 113, the idle indicator may be presented to the DLP service 121, which in response requests the user content chunks for classification. Alternatively, DLP module 113 may provide chunks of user content to DLP service 121 during periods of inactivity of application 111. DLP module 113 divides user content into chunks, and these chunks can be determined based on text or other content included in document structures or hierarchical objects. When the chunks are determined, the DLP module 113 transfers the chunks to the DLP service 121 for classification. The DLP service 121 classifies each chunk separately and applies classification rules to the chunks to identify potentially sensitive user content among the chunks. This classification process may be an iterative process to ensure that all chunks transferred by DLP module 113 have been processed. If sensitive data or content is found among the chunks, then the DLP service 121 indicates the presence of sensitive data to the DLP module 113 for further processing. As mentioned herein, sensitive data may be indicated by offsets, coarse locations, or other location information, as well as length information. The DLP module 113 may then perform one or more annotation processes and obfuscation processes on the sensitive data in the document.

[0059] Classification rules may be set prior to the classification process, such as by users, administrators, policy makers, or other entities. As seen in structure 510, the various rules 511 and 512 may be based on one or more assertions. Statements shown in two categories in FIG. 5 are content-related assertions 511 and access-related assertions 512. Content-related assertions 511 may contain data schemas that specify sensitive data, such as data patterns, data structure information, or regular expressions that define data schemas. Access-related claims 512 contain user-level, organization-level, or other access-based rules, such as content sharing rules that determine when sensitive data is undesirable for distribution or released by specific users, organizations, or other factors.

[0060] Policy rules 513 may be set to combine one or more of the content-related and access-related claims in policies 551-554. Each policy rule also has a priority and an associated action. In general, priority is consistent with the importance of the action. For example, a policy rule might specify that the application's 'save' properties should be disabled. In another exemplary policy rule, user-generated content may contain SSNs that are determined according to the content-related assertion, but according to the access-related assertion, these SSNs may be valid for distribution. Most policy rules contain at least one classification statement among statements 511-512. These policies can affect one or more actions 514. Actions can include various annotation operations that an application can take in response to an identity or sensitive content such as notifying a user, notifying a user override, blocking properties/functions ( ie 'keep' or 'copy' properties) and reasonable overrides, among other things.

[0061] FIG. 6 illustrates a flowchart 600 to further illustrate the operation of the elements of FIG. 1–3. Fig. 6 focuses on one exemplary complete process of identification, annotation, and obfuscation of sensitive data. Sub-process 601 contains the establishment, storage and retrieval of policies and rules. These policies and rules may be annotation rules, classification rules, regular expressions, organizational/user policies, among other information discussed in this document. At operation 611 in FIG. 6, various discovery rules 630 and replacement rules 631 may be entered via a user interface or API to configure discovery policies. The discovery rules 630 and the replacement rules 631 may contain various assertions and rules, as shown in FIG. 5, among others. Users, administrators, policy makers, or other entities may enter discovery rules 630 and replacement rules 631, such as by setting policies for users, organizations, or application usage, among other objects and actions. Discovery rules 630 and replace rules 631 may be stored on one or more storage systems at operation 612 for later use. When one or more clients wish to use the policies established by the discovery rules 630 and replacement rules 631, these policies can be loaded or retrieved in operation 613. For example, annotation rules can be loaded by an application for use in annotating sensitive content in a user interface, where the classification rules can uploaded by a shared DLP service to classify user content as sensitive content.

[0062] Sub-process 602 contains actions of the client-side application, such as loading documents for editing or viewing in the user interface and providing portions of these documents for classification. At operation 614, the client application may provide one or more end user experiences to process user content, edit user content, or view user content, among other operations. Operation 614 may also provide annotation and obfuscation processes, which are described below. Operation 615 provides portions of this user content to the shared DLP service to classify the user content. In some examples, parts contain aligned portions of user content that is separated from an associated structure or hierarchy from a source document.

[0063] Sub-process 603 includes classifying the user content to detect sensitive data among the user content, as well as annotating that sensitive data to the user. At operation 616, various discovery rules are applied, such as the regular expressions described below with reference to FIG. 7, among other rules and discovery processes. If sensitive data is found, then operation 617 determines whether to notify the user. Notification may not occur if the amount of sensitive data falls below the warning threshold. However, if the user needs to be alerted, then operation 619 can calculate the locations of sensitive data within the detected structured data regions. As described herein, a mapping process can be used to determine specific locations of sensitive data within structured elements or hierarchical elements from offsets of aligned data and lengths of strings or portions of sensitive data. Once these specific locations are determined, then operation 618 may display the locations to the user. Annotations or other UI highlighting elements are used to signal to the user that sensitive data is present in user content.

[0064] Sub-process 604 comprises obfuscation of sensitive data within user content containing structured or hierarchical elements. At operation 621, user input may be received to replace at least one element of sensitive data with 'secure' or obfuscated data/text. When the user is shown a highlighted area showing the piece of sensitive data that caused the annotation or 'policy hint' to appear, the user may be presented with the option to replace the sensitive data with 'safe text' that will obfuscate the sensitive data. Depending on the selections made by the entities initially setting the policies in operation 611, operations 622 and 624 determine and generate one or more replacement or obfuscation rules. Obfuscation rules can be used to replace an internal codename with a marketing name used to obfuscate personally identifiable information (PII) wildcard names can be used to replace numeric sensitive data with a set of characters that indicate to future users viewing the document the appropriate type of sensitive data (i.e. credit card numbers, social security numbers, vehicle identification numbers, among others) without disclosing actual sensitive data. Operation 623 replaces sensitive data with obfuscated data. The obfuscated data can be used to replace numeric sensitive data with a set of characters that can be used to validate a data schema or content type, but remain insufficient to extract the original data even from a specific person (i.e. to determine that a piece of content is an SSN, but not reveal the actual SSN). Users can perform individual or single replacement of sensitive content with obfuscated text or bulk replacement from a user interface that shows many samples of sensitive content.

[0065] Replacing sensitive content, such as textual or alphanumeric content, can be done using regular expressions, or alternatively through non-deterministic finite automata (NFA), deterministic finite automata (DFA), push-down automata (PDA), Turing machines, arbitrary functional code or other processes. Replacing sensitive content typically contains pattern matching among text or content. This pattern matching may leave unmasked characters or content, given that the target pattern has the ability for multiple characters to exist at a given location in the string, and those characters do not need to be masked, such as for delimiter characters. For example, the string "123-12-1234" might become "xxx-xx-xxxx", and the string "123 12 1234" might become "xxx xx xxxx" after the masking process. This pattern matching may also leave certain parts distinct for purposes of uniqueness, such as by the last predefined number of digits of a credit card number or SSN. For example, "1234-1234-1234-1234" can become "xxxx-xxxx-xxxx-1234" after the masking process. To mask/replace a codename, not all aspects are templates and may actually be internal codenames or other keywords. For example, the codename "Whistler" might become "Windows XP" after the masking process. Moreover, patterns that replace a variable number of characters with safe text may be allowed to keep a consistent length or set the length to a known constant. For example, the same rule can turn "1234-1234-1234-1234" into "xxxx-xxxx-xxxx-1234" and "xxxxx-xxxxx-x1234" after the masking process. This may require a template that contains sufficient data to handle any of these cases. Regular expressions can handle such scenarios by augmenting the regular expression by surrounding each elementary (atomic) matched expression with parentheses and keeping track of which augmented 'match' clauses are paired with which 'replacement' clauses. Additional examples of regular expression matching are shown in FIG. 7 below.

[0066] In order to maintain the integrity of the annotation and classification processes among more than one document/file, various processes may be established. Rules and policies for detection/classification, annotation and obfuscation are not usually included in document files. This allows policy changes and prevents obfuscation techniques from being reverse engineered. For example, if a user saves a document, then closes and loads the same document, then the rules for which parts of the document contain sensitive data to be considered, the issue of privacy policy, may have changed. Also, annotation marks should not be included in clipboard operations such as cut, copy, or paste. If the user were to copy content from one document and paste it into another, then the second document could apply different detection/classification, annotation, and obfuscation rules. If the user were to restrict the text from the first document and paste into the second document, then the annotations of the first document should be considered irrelevant until reclassified. Even if the user were to copy content from one document to the same document, any sensitive content counts may shift and what needs to be highlighted in the document may change.

[0067] FIG. 7 illustrates a flowchart 700 to further illustrate the operation of the elements of FIG. 1–3. Fig. 7 focuses on regular expression operations during sensitive data obfuscation processes. In FIG. 7, if there is a regular expression (regex), such an exemplary fictitious driver's license regular expression 730, and a string that matches it, then a full match can be generated by at least increasing the regular expression by surrounding each separated character-matching expression with parentheses (e.g. , of each atom (the elementary object in the language), as specified in operation 711. The augmented regular expression may then be reapplied or executed in operation 712 to perform the obfuscation or masking process.For each match, operations 713-714 determine the widest and narrowest sets of truly matching characters For example, when the matched character is "-", the character is narrow because it is a single character. When the matched character is the set of all alphabetic characters, it is wide. An absolute count of the characters that could be in any area, is as a key determinant. The obfuscation process at operation 715 may replace characters according to the width of the match. For those matching characters that are single characters, the obfuscation process may not be different. For those matched characters that are in wide groups, the obfuscation process replaces the characters with a 'safe' character that is not a member of the set. For example, the set of all letters becomes "0", the set of all numbers becomes "X", and the mixed alphanumeric content becomes "?", with a reserve list of characters to use until it is depleted. When the text or content has undergone the obfuscation or masking process, operation 716 confirms that the text or content has been successfully made obfuscated when the new line of text/content no longer matches the original regex.

[0068] FIG. 8 illustrates a graph diagram 800 to further illustrate the operation of the elements of FIG. 1–3. Fig. 8 focuses on advanced thresholding processes used in annotating sensitive data in user interfaces. The operations according to FIG. 8 may contain advanced hysteresis operations for annotating sensitive data, and various annotation thresholds or rules may be set by policy administrators or users, among other entities.

[0069] FIG. 8 includes a graph 800 that includes a vertical axis indicating the amount of sensitive data/content items present in a document and a horizontal axis indicating time. A first threshold 820 is set that can trigger the presentation or removal of annotations of sensitive content in the user interface. A second threshold 822 may be set, which may also trigger the presentation or removal of private content annotations. The elasticity factor 821 and the stability property 823 can be set to modify the behavior of the first and second thresholds.

[0070] When sensitive data has been annotated in the user interface, such as with flags, flags, or highlights, the user may edit the sensitive content to resolve sensitive content issues (eg, by selecting one or more obfuscation options). However, once the threshold number of sensitive content questions (items) has been resolved, there may not be enough remaining instances (cases) of a certain question to warrant an annotation of the document as being in complete conflict with the confidential content rules for the storage organization or location. Similarly, when new sensitive content is introduced into a document, there may be enough instances to ensure that the document is annotated to indicate the sensitive content to the user.

[0071] During user editing processes for content, enabling or disabling annotation pointers for one or more content items may be based at least in part on the current number of content items with respect to annotation rules. The annotation rules may comprise at least a first threshold quantity 820, an elasticity factor 821 for modifying the first threshold quantity 820 into a second threshold quantity 822 when triggered, and an indication of threshold stability or a 'stiffness' property 823 indicating when the second threshold quantity 822 overrides the first threshold. number 820. An annotation service, such as annotation module 212, may define or identify annotation rules, such as policy rules 513 and actions 514 described with reference to FIG. 5 that are set for targets associated with content editing. The targets may include the users performing the content editing, the organization that contains the user performing the content editing, or the application type of the user application, among other things. During user editing of a document that contains sensitive content or could potentially contain sensitive content, annotation module 212 controls the user content in the associated user data file presented for content editing in the user interface on the user application. The annotation module 212 identifies the number of content items containing sensitive content among the user content, according to one or more predefined data schemes described herein. Content elements may include cells, objects, shapes, words, or other structural or hierarchical data elements.

[0072] During editing, and based on at least the number of content items exceeding the first threshold, the annotation module 212 initiates the presentation of at least one annotation indicator in the user interface that marks the user content in the user interface as containing at least the first confidential content. In FIG. 8 (starting with annotations in the 'off' state), the first threshold 820 indicates an approximate number of '8's at the transition point 830 as triggering the presentation of the annotation pointers in the user interface. The number of content items with sensitive content can be increased, for example, through user editing, and then can be reduced after the user sees that sensitive content is presented and starts selecting obfuscation options to mask this sensitive content.

[0073] Based on at least the number of content items initially greater than the first threshold quantity 820 and then falling below the first threshold quantity 820, when the elasticity factor 821 is applied to the first threshold quantity 820, the annotation module 212 sets the second threshold quantity 822 based on at least measure of the elasticity factor. When the second threshold quantity 822 is active (i.e., when the elasticity factor 821 is applied to the first threshold quantity 820), the second threshold quantity 822 is used to trigger the removal of the representation of at least one annotation indicator when the quantity falls below the second threshold quantity 822, as seen at transition point 832. However, based on at least the number of content items initially exceeding the first threshold quantity 820 and then falling below the first threshold quantity 820, when the elasticity factor is not applied to the first threshold quantity 820, the representation of at least one annotation index is removed as indicated by point 831 transition.

[0074] The elasticity factor 821 may comprise a percentage in the range of 0-100 percent, or another metric. In a specific example, an annotation rule can be set that specifies that including more than 100 SSNs in a document violates corporate policy. During editing of a document that exceeds 100 SSNs, the annotation rule for the first threshold may cause all of the SSNs in the document to be highlighted. When a user starts SSN obfuscation, the number of unfussed SSNs remaining will decrease. The elasticity factor may support the annotation or SSN allocation even if the first threshold number 820 that triggered the annotation is no longer satisfied, such as when 99 SSNs remain unfussed. An elasticity factor of 100 will correspond to an unmodified first threshold, and an elasticity of 0 will correspond to annotations never removed until all SSNs are obfuscated. An intermediate value of 50 for the elasticity factor would correspond to deleting the annotations as soon as the 50th record is committed, after the annotations were originally run for the view. Thus, in the example of FIG. 8, the elasticity factor sets a second threshold amount for deleting annotations after the annotations have been presented to the user. In this example, the second threshold number 822 is '2', and thus, when the remaining pieces of confidential content fall below the remaining '2', the annotations will be removed as indicated by jump point 832.

[0075] If the second threshold number 822 falls below, and then additional sensitive content issues occur during content editing, then the annotation module 212 must decide when to alert the user by presenting the annotations again. Based on at least the number of content items first falling below the second threshold number 822 and then exceeding the second threshold number 822, when the threshold persistence property 823 is applied to the second threshold number 822, the annotation module 212 initiates the presentation of additional annotations in the user interface that marks the user content in the user interface as containing sensitive content, as indicated by the transition point 833.

[0076] The property of stability 823 contains the property 'inflexible' for the second threshold number 822 and is determined by on/off or a boolean condition. When disabled, the second threshold number 822 is not used to resubmit annotations when exceeded. When enabled, the second threshold number 822 is used to resubmit annotations when exceeded. Therefore, based on at least the number of content items initially falling below the second threshold number 822 and then exceeding the second threshold number 822, when the persistence capability is not applied to the second threshold number 822, the annotation module 212 refrains from presenting annotations that marks the user content in the user interface as containing at least sensitive content until the number of content items exceeds the first threshold number 820 again.

[0077] FIG. 9 depicts computing system 901. Computing system 901 is a representation of any system or collection of systems that may implement the various operating architectures, scenarios, and processes disclosed herein. For example, computing system 901 may be used to implement any of the user platform 110 or DLP platform 120 of FIG. 1. Examples of computing system 901 include, but are not limited to, server computers, cloud computing systems, distributed computing systems, software-defined network systems, computers, desktop computers, hybrid computers, rack servers, web servers, cloud computing platforms, and data center equipment, as well as any other type of physical or virtual server machine, and other computing systems and devices, as well as any other variation or combination thereof. When parts of the computing system 901 are implemented on user devices, exemplary devices include smartphones, laptops, tablets, desktop computers, gaming systems, entertainment systems, and the like.

[0078] Computing system 901 may be implemented as a single device, system, or device, or may be implemented in a distributed manner as multiple devices, systems, or devices. The computing system 901 includes, but is not limited to, a processing system 902, a storage system 903, software 905, a communications interface system 907, and a user interface system 908. Processing system 902 is operatively coupled to storage system 903, communication interface system 907, and user interface system 908.

[0079] The processing system 902 loads and executes the software 905 from the storage system 903. The software 905 includes an application DLP environment 906 and/or a shared DLP environment 909, as is representative of the processes discussed with reference to the previous drawings. When executed by processing system 902 to process user content to identify, annotate, and obfuscate sensitive content, software 905 directs processing system 902 to operate as described herein for at least the various processes, operating scenarios, and environments described in previous implementations. . Computing system 901 may optionally include additional devices, features, or functionality not described for purposes of brevity.

[0080] Still with reference to FIG. 9, processing system 902 may include a microprocessor and processing circuitry that retrieves and executes software 905 from storage system 903. Processing system 902 may be implemented within a single processor, but may also be distributed across multiple processors or subsystems that cooperate in executing program instructions. Examples of processing system 902 include general purpose CPUs, dedicated application processors, and logic devices, as well as any other type of processing device, combinations, or variations thereof.

[0081] Storage system 903 may include any computer-readable storage media readable by processing system 902 and capable of storing software 905. Storage system 903 may include volatile and non-volatile, removable and non-removable media implemented by any method or technology for storing information , such as computer-readable instructions, data structures, program modules, or other data. Examples of storage media include random access memory, read only memory, magnetic disks, resistive memory, optical disks, flash memory, virtual memory and non-virtual memory, magnetic cassettes, magnetic tape, magnetic disk storage, or other magnetic storage devices. or any other suitable storage media. In no case is computer-readable storage media a propagating signal.

[0082] In addition to computer-readable storage media, in some implementations, storage system 903 may also include computer-readable communication media over which at least some of the software 905 can communicate internally or externally. The storage system 903 may be implemented as a single storage device, but may also be implemented on multiple storage devices or subsystems co-located or distributed relative to each other. The storage system 903 may include additional elements, such as a controller capable of communicating with the processing system 902, or possibly other systems.

[0083] Software 905 may be implemented in program instructions and, among other functions, may, when executed by processing system 902, direct processing system 902 to operate as described in relation to the various operating scenarios, sequences, and processes illustrated herein. For example, software 905 may include program instructions for implementing the dataset processing environments and platforms discussed herein.

[0084] In particular, the program instructions may include various components or modules that work together or otherwise interact to perform the various processes and operating scenarios described herein. Various components or modules may be embodied in compiled or interpreted instructions, or in some other variation or combination of instructions. The various components or modules may execute in a synchronous or asynchronous manner, serially or in parallel, in a single-threaded or multi-threaded environment, or in accordance with any other suitable execution paradigm, variation, or combination thereof. Software 905 may include additional processes, programs, or components, such as operating system software or other application software, in addition to or including DLP application environment 906 or shared DLP environment 909. The software 905 may also include firmware or some other form of machine-readable processing instructions executable by the processing system 902.

[0085] In general, software 905 may, when loaded into processing system 902 and executed, convert a suitable device, system, or appliance (of which computing system 901 is a representation) entirely from a general-purpose computing system to a specialized computing system adapted to facilitate advanced processing user-generated content to identify, annotate, and obfuscate sensitive content. In fact, the encoding software 905 on the storage system 903 may transform the physical structure of the storage system 903. The specific transformation of the physical structure may depend on various factors in different implementations of the present description. Examples of such factors may include, but are not limited to, the technology used to implement the storage media of the storage system 903 and whether the computer storage media is characterized as primary or secondary storage, and other factors.

[0086] For example, if the computer-readable storage media is implemented as a semiconductor-based memory, the software 905 can transform the physical state of the semiconductor memory when program instructions are encoded therein, for example, by transforming the state of transistors, capacitors, or other discrete circuit elements that make up the semiconductor memory. memory. A similar conversion can occur with respect to magnetic or optical media. Other physical media conversions are possible without departing from the scope of the present disclosure, with the previous examples provided only to facilitate the present discussion.

[0087] Application DLP environment 906 or shared DLP environment 909 each includes one or more software elements such as OS 921/931 and applications 922/932. These elements may describe various parts of the computing system 901 with which users, data sources, data services, or other elements interact. For example, OS 921/931 may provide a software platform that runs an application 922/932 and that provides the ability to process user content to identify, annotate, and obfuscate sensitive content, among other functions.

[0088] In one example, the DLP service 932 includes a content splitter 924, an annotation module 925, a mapper 926, and an obfuscator 927. The content splitter 924 flattens structured or hierarchical user content elements into linear chunks for processing by the classification service. The annotation module 925 graphically highlights sensitive data or content in the user interface so that users can be alerted to the presence of a threshold amount of sensitive data. The mapping module 926 can obtain specific locations among documents for annotations of sensitive data, such as when only offsets/lengths/IDs are provided by a classification service to locate sensitive data in various structural or hierarchical elements of the document. Obfuscator 927 presents obfuscation options for masking/replacing user content that has been identified as sensitive data. The obfuscator 927 also replaces sensitive content in response to user selections of obfuscation options.

[0089] In another example, the DLP service 933 includes a classification service 934, a tracker 935, a policy/rules module 936, and a regex service 937. Classification service 934 parses linear chunks of data or content to identify sensitive data. Tracker 935 maintains counts or numbers of sensitive data items found by classification service 934 and indicates offsets and lengths of sensitive data per display module for an annotation in a document (such as display module 926 and annotation module 925). The policy/rules module 936 may accept and maintain various policies and rules for annotating, classifying, detecting, obfuscating, or other operations on user content. The Regex service 937 includes one exemplary classification method using regular expression matching to identify sensitive data using data patterns or data schemas and to replace the text of the matched content with obfuscated content.

[0090] The communication interface system 907 may include connections and communication devices that enable communication with other computing systems (not shown) over communication networks (not shown). Examples of connections and devices that together enable communications between systems may include network interface cards, antennas, power amplifiers, RF circuits, transceivers, and other communication circuits. Connections and devices may communicate over communication media to exchange messages with other computer systems or networks of systems, such as metal, glass, air, or any other suitable communication media. Physical or logical elements of the communication interface system 907 may receive data sets from telemetry sources, transfer data sets and control information between one or more distributed data storage elements, and interact with the user to accept data selections and provide rendered data sets, among other features.

[0091] The user interface system 908 is optional and may include a keyboard, mouse, voice input device, touch input device for receiving input from a user. Output devices such as a display, speakers, web interfaces, terminal interfaces, and other types of output devices may also be included in the user interface system 908. The user interface system 908 may provide output and receive input over a network interface, such as a communications interface system 907 . In network examples, the user interface system 908 may package display data or graphics for remote display by a display system or computing system linked over one or more network interfaces. The physical or logical elements of the user interface system 908 may accept classification rules or policies from users or policy makers, accept data editing actions from users, present sensitive content annotations to users, provide obfuscation options to users, and present obfuscated user content to users, among other operations. The user interface system 908 may also include associated user interface software executed by the processing system 902 in support of the various user input and output devices described above. Separately or in conjunction with each other and other hardware and software elements, the user interface software and user interface devices may support a graphical user interface, a native user interface, or any other type of user interface.

[0092] Communication between computer system 901 and other computer systems (not shown) may occur over a network or communication networks and in accordance with various communication protocols, combinations of protocols, or variations thereof. Examples include intranets, internets, the Internet, local area networks, wide area networks, wireless networks, wired networks, virtual networks, software-defined networks, data center buses, compute patch panels, or any other type of network, combination of networks, or variation thereof. The above networks and communication protocols are well known and need not be described in detail. However, some communication protocols that may be used include, but are not limited to, Internet Protocol (IP, IPv4, IPv6, etc.), Transmission Control Protocol (TCP), and User Datagram Protocol (UDP), as well as any other suitable communication protocol, variation or combination thereof.

[0093] Certain aspects of the invention may be understood from the foregoing disclosure, of which the following are various examples.

[0094] Example 1: A method for providing a data obfuscation infrastructure for a user application, the method comprising providing user content to a classification service configured to process user content to classify portions of the user content as containing sensitive content corresponding to one or more predefined data schemas, and receiving from the classification service indications of one or more pieces of user-generated content that contain confidential content. The method includes presenting graphical indications in a user interface to a user application that annotate one or more pieces of user content as containing sensitive content, and presenting obfuscation options in the user interface for masking sensitive content within at least a selected piece among one or more pieces. user content. In response to a user selecting at least one of the obfuscation options, the method includes replacing the associated user content with obfuscated content that supports the data schema of the associated user content.

[0095] Example 2: The method according to Example 1, further comprising presenting the obfuscation options as comprising a first option to mask sensitive content within the selected portion and a second option to mask sensitive content within the selected portion and additional pieces of user content, containing additional sensitive content that has the same data schema as the selected part.

[0096] Example 3: The method according to Examples 1-2, further comprising presenting the obfuscation options as indicating at least an exemplary obfuscated version of the target user content within the selected portion.

[0097] Example 4: The method according to Examples 1-3, where the graphical guidelines that annotate one or more pieces of user-generated content contain markers located near one or more pieces that are selectable in the user interface to present obfuscation options .

[0098] Example 5: The method according to Examples 1-4, wherein the obfuscated content that maintains the associated user content data schema contains characters selected in part based on the data schema of the associated user content to prevent identification of the associated user content during schema maintenance. associated user content data.

[0099] Example 6: The method according to Examples 1-5, further comprising, in response to replacing associated user content with obfuscated content, providing the obfuscated content to a classification service to confirm that the obfuscated content does not contain additional sensitive content.

[0100] Example 7: The method according to Examples 1-6, where one or more predefined data patterns are defined by one or more regular expressions used to parse user content to identify parts as indicating one or more predefined content patterns or one or more predefined content types.

[0101] Example 8: The method according to Examples 1-7, where one or more predefined data schemas each contain first parts to be obfuscated and second parts to be left unfussed, the first parts to be obfuscated correspond to locations, having more than one allowed character, and the second parts, which must remain unfussed, have only one allowed character containing the delimiter character. The method further comprises identifying whether a part of the first parts is assigned to remain distinct for uniqueness after obfuscation, and assigning a part to remain unfussed.

[0102] Example 9: A data obfuscation framework for a user application, comprising one or more computer-readable storage media, a processing system operatively associated with one or more computer-readable storage media, and program instructions stored on one or more computer-readable storage media. Based on at least reading and execution by the processing system, program instructions direct the processing system to at least provide the user content to a classification service configured to process the user content to classify portions of the user content as containing sensitive content corresponding to one or more predefined data schemas, and receive indications from the classification service of one or more pieces of user content that contain sensitive content. Based on at least reading and execution by the processing system, the program instructions further direct the processing system to at least present graphical indications in the user interface to the user application that annotate one or more pieces of user content as containing sensitive content, present obfuscation options in the user an interface for masking sensitive content within at least a selected portion among one or more pieces of user content, and in response to a user selecting at least one of the obfuscation options, replace the associated user content with obfuscated content that supports the data schema of the associated user content.

[0103] Example 10: The data obfuscation infrastructure according to Example 9, comprising additional program instructions that, based on at least reading and execution by the processing system, direct the processing system to at least present obfuscation options as containing a first option so that mask sensitive content within the selected part, and a second option to mask sensitive content within the selected part and additional user-generated content parts containing additional sensitive content having a similar data schema as the selected part.

[0104] Example 11: A data obfuscation infrastructure according to Examples 9-10, comprising additional program instructions that, based on at least reading and execution by a processing system, direct the processing system to at least present obfuscation options as indicating at least at least an approximate obfuscated version of the target user-generated content within the selected part.

[0105] Example 12: The data obfuscation infrastructure in accordance with Examples 9-11, where graphic indications that annotate one or more pieces of user content contain pointers located near one or more pieces that are selectable in the user interface to represent obfuscation options.

[0106] Example 13: The data obfuscation framework according to Examples 9-12, where the obfuscated content that supports the associated user content data schema contains characters selected in part based on the associated user content data schema to prevent identification of the associated user content while maintaining associated user content data schemas.

[0107] Example 14: The data obfuscation infrastructure in accordance with Examples 9-13, comprising additional program instructions that, based on at least reading and execution by the processing system, direct the processing system to at least, in response to replacing the associated user obfuscated content, provide the obfuscated content to the classification service to confirm that the obfuscated content does not contain additional sensitive content.

[0108] Example 15: A data obfuscation framework according to Examples 9-14, where one or more predefined data patterns are defined by one or more regular expressions used to parse user content to identify parts as indicating one or more predefined patterns content or one or more predefined content types.

[0109] Example 16: Data obfuscation infrastructure according to Examples 9-15, where one or more predefined data schemas each contain first parts to be obfuscated and second parts to be left unfussed, the first parts to be obfuscated correspond to locations that have more than one allowed character, and the second parts, which must remain unfussed, have only one allowed character containing the delimiter character. The data obfuscation infrastructure contains additional program instructions that, based on at least reading and execution by the processing system, direct the processing system to at least identify whether a part of the first parts is assigned to remain distinguishable for uniqueness after obfuscation, and assign a part, to stay unfussified.

[0110] Example 17: A method for operating a user application, the method comprises providing user content of a user data file to a classification service configured to process user content to classify one or more pieces of user content as containing sensitive content corresponding to one or more data schemas, and presenting pointers in the user interface that mark one or more pieces of user content as containing sensitive content, where the pointers are located near the one or more pieces and are selectable in the user interface to present obfuscation options. In response to selecting the first of the indicators, the method includes presenting the first obfuscation options in the user interface to replace the associated confidential content within the first portion of the user content marked by the first of the indicators. In response to a user's selection of at least one of the first obfuscation options, the method includes replacing the associated confidential content with obfuscated content that supports the associated confidential content's data schema.

[0111] Example 18: The method of Example 17, further comprising presenting the first obfuscation options as comprising a first option to replace associated confidential content with obfuscated content and a second option to replace associated confidential content and additional confidential content of a user data file having the same data schema as the associated confidential content.

[0112] Example 19: The method according to Examples 17-18, where the obfuscated content that maintains the data schema of the associated private content contains one or more characters selected to prevent identification of the associated private content while maintaining the data schema of the associated user content, where one or more characters are selected based in part on the data schema of the associated confidential content.

[0113] Example 20: The method according to Examples 17-19, where one or more data schemas each contain first parts to be obfuscated and second parts to be left unfussed, the first parts to be obfuscated correspond to locations having more than one allowed character, and the second parts, which must remain unfussed, have only one allowed character containing the delimiter character. The method further comprises identifying whether a part of the first parts is assigned to remain distinct for uniqueness after obfuscation, and assigning a part to remain unfussed.

[0114] The functional block diagrams, operating scenarios, and sequences and flowcharts shown in the drawings are representations of exemplary systems, environments, and methodologies for performing novel aspects of the disclosure. Although, for the sake of simplicity of explanation, the methods included herein may be presented in the form of a function diagram, a functional scenario, or a sequence or flowchart, and may be described as a sequence of actions, it should be understood that the methods are not limited to the order of actions, since some actions may, accordingly, occur in a different order and/or simultaneously with other actions from those shown and described herein. For example, those skilled in the art will appreciate that a method can alternatively be represented as a series of interrelated states or events, such as in a state diagram. Moreover, not all of the steps illustrated in the methodology may be required for a new implementation.

[0115] The descriptions and drawings included herein depict specific implementations to show those skilled in the art how best practice should be implemented and used. In order to disclose the principles of the invention, some conventional aspects have been simplified or omitted. Those skilled in the art will appreciate variations on these implementations that are within the scope of the disclosure. Those skilled in the art will also appreciate that the features described above may be combined in various ways to form multiple implementations. As a result, the invention is not limited to the specific implementations described above, but only by the claims and their equivalents.

Claims (47)

1. A method for providing a data obfuscation infrastructure for a user application, the method comprising: providing the user content containing the user data file viewed in the user application to a classification service configured to process the user content to classify portions of the user content as containing sensitive content corresponding to one or more predefined data schemas; receiving from the classification service indications of locations in the user data file of one or more pieces of user content that contain confidential content; before masking sensitive content, presenting graphical annotations viewed on the user interface to the user application that annotate each of the one or more pieces of user content on the user interface as containing sensitive content; presenting in the user interface graphical selection elements that correspond to graphical annotations and indicate obfuscation options for masking sensitive content; and in response to a user selecting in the user interface at least one of the obfuscation options in the selection graphic element for the associated user content, replacing at least said associated user content with obfuscated content that supports the data schema of at least said associated user content. 2. The method according to p. 1, further comprising: presenting the obfuscation options as containing a first option to mask sensitive content within the selected part and a second option to mask sensitive content within the selected part and additional user-generated content parts containing additional sensitive content having a similar data schema as the selected part. 3. The method according to claim 1, further comprising: presenting the obfuscation options as indicating at least an exemplary obfuscated version of the target user content within the selected portion. 4. The method of claim 1, wherein the graphical annotations that annotate each of the one or more pieces of user-generated content include pointers located near each of the one or more pieces that are selectable in the user interface to represent obfuscation options. 5. The method of claim 1, wherein the obfuscated content that supports the associated user content data schema comprises symbols selected in part based on the associated user content data schema to prevent identification of the associated user content while maintaining the associated user content data schema. 6. The method according to p. 1, further comprising: in response to replacing the associated user content with obfuscated content, providing the obfuscated content to a classification service to confirm that the obfuscated content does not contain additional sensitive content. 7. The method of claim 1, wherein the one or more predefined data schemas are defined by one or more regular expressions used to parse the user content to identify parts as indicating one or more predefined content patterns or one or more predefined content types. 8. The method of claim 1, wherein the one or more predefined data schemas each comprise first parts to be obfuscated and second parts to be left unfussed, wherein the first parts to be obfuscated correspond to locations having more than one allowed character, and the second parts, which must remain unfussed, have only one allowed character containing the delimiter character; and the method further comprises: identifying whether some part of the first parts is assigned to remain distinguishable for uniqueness after obfuscation, and the assignment of this part to remain unfussed. 9. A data obfuscation infrastructure for a user application, the infrastructure comprising: one or more computer-readable storage media; a processing system operatively associated with one or more computer-readable storage media; and program instructions stored on one or more computer-readable storage media that, based on at least being read and executed by a processing system, direct the processing system to at least: provide the user content containing the user data file being viewed in the user application to a classification service configured to process the user content to classify portions of the user content as containing sensitive content corresponding to one or more predefined data schemas; receive from the classification service indications of locations in the user data file of one or more pieces of user content that contain confidential content; before masking sensitive content, present graphical annotations viewed in the user interface to the user application that annotate each of the one or more pieces of user content in the user interface as containing sensitive content; present in the user interface graphical selection elements that correspond to graphical annotations and indicate obfuscation options for masking sensitive content; and in response to a user selecting in the user interface at least one of the obfuscation options in the selection graphic element for associated user content, replace at least said associated user content with obfuscated content that supports the data schema of at least said associated user content. 10. The data obfuscation infrastructure of claim 9, comprising additional program instructions that, based at least on reading and execution by the processing system, direct the processing system to at least: present obfuscation options as containing a first option to mask sensitive content within the selected part and a second option to mask sensitive content within the selected part and additional user-generated content parts containing additional sensitive content having a similar data schema as the selected part. 11. The data obfuscation infrastructure of claim 9, comprising additional program instructions that, based at least on reading and execution by the processing system, direct the processing system to at least: present obfuscation options as indicating at least an exemplary obfuscated version of the target user content within the selected portion. 12. The data obfuscation infrastructure of claim 9, wherein the graphical annotations that annotate each of the one or more pieces of user-generated content contain pointers located near each of the one or more pieces that are selectable in the user interface to present obfuscation options. 13. The data obfuscation infrastructure of claim 9, wherein the obfuscated content that maintains the associated user content data schema contains characters selected in part based on the associated user content data schema to prevent identification of the associated user content while maintaining the associated user content data schema. 14. The data obfuscation infrastructure of claim 9, comprising additional program instructions that, based at least on reading and execution by the processing system, direct the processing system to at least: in response to replacing the associated user content with the obfuscated content, provide the obfuscated content to the classification service to confirm that the obfuscated content does not contain additional sensitive content. 15. The data obfuscation framework of claim 9, wherein one or more predefined data schemas are defined by one or more regular expressions used to parse user content to identify parts as indicating one or more predefined content patterns or one or more predefined types content. 16. The data obfuscation infrastructure of claim 9, wherein one or more predefined data schemas each contain first parts to be obfuscated and second parts to be left unfussed, said first parts to be obfuscated corresponding to locations having more than one permitted character, and said second parts, which must remain unfussed, have only one permitted character containing the delimiter character; and contains additional program instructions which, based at least on being read and executed by the processing system, direct the processing system to at least: identify if some part of the first parts is assigned to remain distinguishable for uniqueness after obfuscation, and assign this part to remain unfussed. 17. The method of operation of the user application, containing: providing the user content of the user data file to a classification service configured to process the user content to classify one or more pieces of the user content as containing confidential content corresponding to one or more data schemas; before masking sensitive content, presenting annotations in the user interface that mark each of one or more pieces of user content in the user interface as containing sensitive content, with the annotations located near each of the one or more pieces and being selectable in the user interface to present obfuscation options; in response to selecting the first of the annotations, presenting in the user interface selection graphical elements that correspond to the annotations and indicate the first obfuscation options for replacing the associated confidential content; and in response to a user selecting at least one of the first obfuscation options in the user interface, replacing at least said associated confidential content with obfuscated content that supports the data schema of at least said associated confidential content. 18. The method of claim 17, further comprising: presenting the first obfuscation options as comprising a first option to replace associated confidential content with obfuscated content and a second option to replace associated confidential content and additional confidential content of a user data file having a similar data schema as the associated confidential content. 19. The method of claim 17, wherein the obfuscated content that maintains the associated private content data scheme comprises one or more characters selected to prevent identification of the associated private content while maintaining the associated user content data scheme, wherein the one or more characters are selected in part based on the data schema of the associated confidential content. 20. The method of claim 17, wherein the one or more data schemas each comprise first parts to be obfuscated and second parts to be left unfussed, said first parts to be obfuscated corresponding to locations having more than one allowed character , and the said second parts, which must remain unfussed, have only one allowed character containing the delimiter character; and additionally containing: identifying whether some part of the first parts is assigned to remain distinguishable for uniqueness after obfuscation, and the assignment of this part to remain unfussed.

Images