# US 11,308,095 B1 · Systems and methods for tracking sensitive data in a big data environment

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 11,308,095 B1
- Document ID: US11308095B1
- Status: Granted
- Kind: B1
- Application number: 16/596,533
- Filed: 2019-10-08
- Granted: 2022-04-19
- Earliest claimed: 2015-11-18
- Assignees: American Express Travel Related Services Company, Inc.
- Applicants: American Express Travel Related Services Company, Inc.
- Inventors: Ravi Arasan; Sandeep Bose; Xiaoyang Chen; Debasish Das; Matthew Kent Meyer; Gurusamy Ramasamy; Jeremy D. Seideman
- Web page: https://patentgrep.com/patent/US11308095B1

## CPC

- G06F 16/2457: with adaptation to user needs
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)

## Abstract

A system may retrieve a pattern from a pattern database with the pattern identifying a type of sensitive data. The system may also retrieve data identified by a variable from a big data management system. The system may then match the data to the pattern to detect the type of sensitive data in the data. An output may be generated in response to the data matching the pattern. A variable access permission may be retrieved for the variable from a permissions repository, a sensitive data permission may be retrieved for the type of sensitive data from the permissions repository, and the variable access permission may be compared to the sensitive data permission to detect a discrepancy.

## Claims

### Claim 1

A method for automatically securing sensitive data stored by a data management system comprising at least one hardware processor, the method comprising:
retrieving a text pattern from a pattern database, the text pattern corresponding to a type of sensitive data;
comparing text in a data item stored by the data management system to the text pattern;
determining that the text in the data item matches the text pattern;
determining a restrictive data access permission associated with the type of sensitive data;
automatically changing a data access permission for the data item in the data management system to be the restrictive data access permission in response to determining that the data access permission differs from the restrictive data access permission; and
restricting access to the data item in the data management system based at least in part on the restricted data access permission.

### Claim 2 (depends on 1)

The method of claim 1, wherein the data access permission for the data item is automatically changed further in response to determining that a threshold number of a plurality of data items stored in the data management system have respective permissions conflicting with required sensitive data permissions.

### Claim 3 (depends on 1)

The method of claim 1, further comprising scanning a plurality of data items stored by the data management system to determine that the text in the data item matches the text pattern.

### Claim 4 (depends on 1)

The method of claim 1, wherein the pattern database stores a plurality of text patterns that correspond to a plurality of different types of sensitive data.

### Claim 5 (depends on 1)

The method of claim 1, wherein the text pattern comprises a regular expression.

### Claim 6 (depends on 1)

The method of claim 1, wherein the type of sensitive data corresponds to a type of personally identifying information of an individual.

### Claim 7 (depends on 6)

The method of claim 6, wherein the type of personally identifying information of the individual comprises at least one of: a name of the individual, an address of the individual, or a telephone number of the individual.

### Claim 8

A system for automatically securing sensitive data stored by a data management system, comprising:
a computing device comprising a hardware processor and a memory; and
machine-readable instructions stored in the memory that, when executed by the processor, cause the computing device to at least:
retrieve a text pattern from a pattern database, the text pattern corresponding to a type of sensitive data;
compare text in a data item stored by the data management system to the text pattern;
determine that the text in the data item matches the text pattern;
determine a restrictive data access permission associated with the type of sensitive data;
automatically change a data access permission for the data item in the data management system to be the restrictive data access permission in response to determining that the data access permission differs from the restrictive data access permission; and
restrict access to the data item in the data management system based at least in part on the restricted data access permission.

### Claim 9 (depends on 8)

The system of claim 8, wherein the data access permission for the data item is automatically changed further in response to determining that a threshold number of a plurality of data items stored in the data management system have respective permissions conflicting with required sensitive data permissions.

### Claim 10 (depends on 8)

The system of claim 8, wherein the machine-readable instructions further cause the computing device to at least scan a plurality of data items stored by the data management system to determine that the text in the data item matches the text pattern.

### Claim 11 (depends on 8)

The system of claim 8, wherein the pattern database stores a plurality of text patterns that correspond to a plurality of different types of sensitive data.

### Claim 12 (depends on 8)

The system of claim 8, wherein the text pattern comprises a regular expression.

### Claim 13 (depends on 8)

The system of claim 8, wherein the type of sensitive data corresponds to a type of personally identifying information of an individual.

### Claim 14 (depends on 13)

The system of claim 13, wherein the type of personally identifying information of the individual comprises at least one of: a name of the individual, an address of the individual, or a telephone number of the individual.

### Claim 15

A non-transitory, computer-readable medium comprising machine-readable instructions for automatically securing sensitive data stored by a data management system, wherein the machine-readable instructions, when executed in a hardware processor of a computing device, cause the computing device to at least:
retrieve a text pattern from a pattern database, the text pattern corresponding to a type of sensitive data;
compare text in a data item stored by the data management system to the text pattern;
determine that the text in the data item matches the text pattern;
determine a restrictive data access permission associated with the type of sensitive data;
automatically change a data access permission for the data item in the data management system to be the restrictive data access permission in response to determining that the data access permission differs from the restrictive data access permission; and
restrict access to the data item in the data management system based at least in part on the restricted data access permission.

### Claim 16 (depends on 15)

The non-transitory, computer-readable medium of claim 15, wherein the data access permission for the data item is automatically changed further in response to determining that a threshold number of a plurality of data items stored in the data management system have respective permissions conflicting with required sensitive data permissions.

### Claim 17 (depends on 15)

The non-transitory, computer-readable medium of claim 15, wherein the machine-readable instructions further cause the computing device to at least scan a plurality of data items stored by the data management system to determine that the text in the data item matches the text pattern.

### Claim 18 (depends on 15)

The non-transitory, computer-readable medium of claim 15, wherein the pattern database stores a plurality of text patterns that correspond to a plurality of different types of sensitive data.

### Claim 19 (depends on 15)

The non-transitory, computer-readable medium of claim 15, wherein the text pattern comprises a regular expression.

### Claim 20 (depends on 15)

The non-transitory, computer-readable medium of claim 15, wherein the type of sensitive data corresponds to a type of personally identifying information of an individual, and the type of personally identifying information of the individual comprises at least one of: a name of the individual, an address of the individual, or a telephone number of the individual.