# US 11,113,417 B2 · Dynamic data anonymization using taint tracking

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 11,113,417 B2
- Document ID: US11113417B2
- Status: Granted
- Kind: B2
- Application number: 16/032,067
- Filed: 2018-07-10
- Published: 2020-01-16
- Granted: 2021-09-07
- Earliest claimed: 2018-07-10
- Assignees: Sap SE
- Applicants: Sap SE
- Inventors: Benny Rolle
- Web page: https://patentgrep.com/patent/US11113417B2

## CPC

- G06F 21/6254: {by anonymising data, e.g. decorrelating personal data from the owner's identification}
- G06F 11/3086: {where the reporting involves the use of self describing data formats, i.e. metadata, markup languages, human readable formats}
- G06F 16/2282: {Tablespace storage structures; Management thereof}
- G06F 21/56: Computer malware detection or handling, e.g. anti-virus arrangements
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)

## Abstract

Dynamic data anonymization utilizes the introduction, tracking, and checking of taint information. During taint introduction, taint information relevant to a source of input data is bound with that data, and the taint information stored as metadata. During taint tracking, the taint information is maintained with the original data over its lifespan, and is also propagated with any derivative data generated from the original data. An anonymization procedure considers the taint information as semantic content to covert the data into anonymous form. Taint checking during anonymization determines whether a data object or a variable is tainted, and identifies the relevant taint information to allow the output of data in anonymous form. Introduction, tracking, and checking of semantic taint information permits embodiments to dynamically calculate anonymization metrics (e.g., k-anonymization, l-diversity) on the basis of the semantics of taint metadata that is actually present. This imparts resilience against accidental disclosure of privacy data.

## Claims

### Claim 1

A computer-implemented method comprising:
receiving data from a database of a source;
introducing taint information based upon the source by bundling metadata associated with the data in the database, wherein the taint information comprises,
an attribute semantic, and
a data object identifier comprising a row identifier of the database;
storing the taint information;
generating derived data from the data and propagating the taint information with the derived data;
referencing the taint information to perform a security evaluation;
where the security evaluation reveals the source to be a trusted source, flowing the data to a sensitive sink; and
where the security evaluation reveals the source to be an untrusted source,
considering the taint information to generate an anonymized data set including at least part of the data, according to an anonymization metric;
storing the anonymized data set; and
communicating the anonymized data set as output, wherein the anonymized data set includes at least a portion of the derived data.

### Claim 2 (depends on 1)

A method as in claim 1 wherein the anonymization metric comprises a sensitive attribute and a quasi-identifier.

### Claim 3 (depends on 2)

A method as in claim 2 wherein the anonymization metric comprises k-anonymity.

### Claim 4 (depends on 2)

A method as in claim 2 wherein the anonymization metric comprises 1-diversity.

### Claim 5 (depends on 1)

A method as in claim 1 wherein the anonymization metric comprises t-closeness.

### Claim 6 (depends on 1)

A method as in claim 1 wherein:
the taint information is stored within an in-memory database; and
an in-memory database engine generates the anonymized data set.

### Claim 7

A non-transitory computer readable storage medium embodying a computer program for performing a method, said method comprising:
receiving data from a database of a source;
introducing taint information based upon the source by bundling metadata associated with the data in the database, wherein the taint information comprises,
an attribute semantic, and
a data object identifier comprising a row identifier of the database;
storing the taint information;
generating derived data from the data and propagating the taint information with the derived data;
referencing the taint information to perform a security evaluation;
where the security evaluation reveals the source to be a trusted source, flowing the data to a sensitive sink; and
where the security evaluation reveals the source to be an untrusted source,
considering the taint information to generate an anonymized data set including at least part of the data, according to an anonymization metric comprising a sensitive attribute and a quasi-identifier;
storing the anonymized data set; and
communicating the anonymized data set as output, wherein the anonymized data set includes at least a portion of the derived data.

### Claim 8 (depends on 7)

A non-transitory computer readable storage medium as in claim 7 wherein the anonymization metric comprises k-anonymity or l-diversity.

### Claim 9

A computer system comprising:
one or more processors;
a software program, executable on said computer system, the software program configured to cause an in-memory database engine to:
receive data from a database of a source;
introduce taint information based upon the source by bundling metadata associated with the data in the database, wherein the taint information comprises,
an attribute semantic, and
a data object identifier comprising a row identifier of the database;
store the taint information in an in-memory database;
generate derived data from the data and propagate the taint information with the derived data;
referencing the taint information to perform a security evaluation;
where the security evaluation reveals the source to be a trusted source, flow the data to a sensitive sink; and
where the security evaluation reveals the source to be an untrusted source,
consider the taint information to generate an anonymized data set including at least part of the data, according to an anonymization metric;
store the anonymous data set in the in-memory database; and
communicate the anonymized data set as output, wherein the anonymized data set includes at least a portion of the derived data.

### Claim 10 (depends on 9)

A computer system as in claim 9 wherein the anonymization metric comprises k-anonymity or l-diversity.