# US 12,118,122 B2 · Masking sensitive information in records of filtered accesses to unstructured data > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 12,118,122 B2 - Document ID: US12118122B2 - Status: Granted - Kind: B2 - Application number: 18/297,320 - Filed: 2023-04-07 - Published: 2023-09-28 - Granted: 2024-10-15 - Earliest claimed: 2018-04-13 - Assignees: Amazon Technologies, Inc. - Applicants: Amazon Technologies, Inc. - Inventors: Ning Liao; Josef Schiefer; Karishma Chawla; Ruiwen Zhao; Michael Banfield; Fusheng Yuan; Kaiwen Qu - Web page: https://patentgrep.com/patent/US12118122B2 ## CPC - G06F 21/6245: {Protecting personal data, e.g. for financial or medical purposes} - G06F 21/604: {Tools and structures for managing or administering access control systems} - G06F 16/334: Query execution (filtering based on additional data G06F16/335) - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract Unstructured data items are stored at an object storage service. A filtering requirement to be used to generate a result set for an access request is determined. Using a transformed representation of the filtering requirement, a target set of tokens of the filtering requirement which are to be obfuscated within a log record is identified. A log record that comprises substitute tokens for the target set of tokens is generated and stored. ## Claims ### Claim 1 A computer-implemented method, comprising: storing one or more data objects in a bucket of an object storage service of a cloud computing environment, wherein an individual data object of the one or more data objects comprises a plurality of fields separated from one another using a first delimiter; receiving, via one or more programmatic interfaces, a data access request directed to the one or more data objects, wherein the data access request indicates (a) a bucket identifier of the bucket, (b) the first delimiter, and (c) a filtering criterion expressed at least in part using Structured Query Language (SQL); and transferring a subset of contents of the one or more data objects to a destination, wherein the subset of contents is selected from the bucket using the first delimiter and the filtering criterion. ### Claim 2 (depends on 1) The computer-implemented method as recited in claim 1, further comprising: receiving, via the one or more programmatic interfaces, another data access request directed to the one or more data objects, wherein the other data access request comprises another filtering criterion and a transformation specification; and selecting another subset of contents of the one or more data objects using the other filtering criterion; generating a transformed version of the other subset of contents in accordance with the transformation specification; and transferring the transformed version to another destination. ### Claim 3 (depends on 1) The computer-implemented method as recited in claim 1, wherein the bucket is stored at a first set of storage devices, the computer-implemented method further comprising: storing the subset of contents in a cache at a second set of storage devices; and providing, using the cache, a response to another data access request directed to the one or more data objects, without accessing the first set of storage devices. ### Claim 4 (depends on 1) The computer-implemented method as recited in claim 1, wherein the one or more programmatic interfaces include a Representational State Transfer (REST) application programming interface (API), and wherein the data access request is received via an invocation of the REST API. ### Claim 5 (depends on 1) The computer-implemented method as recited in claim 1, further comprising: identifying, based at least in part on analysis of a plurality of data access requests directed to the one or more data objects, a predicted filtering criterion of a future data access request; storing a result of applying the predicted filtering criterion to the one or more data objects in a cache; and providing, using the cache, a response to another data access request directed to the one or more data objects. ### Claim 6 (depends on 1) The computer-implemented method as recited in claim 1, wherein the one or more data objects comprise at least one log record. ### Claim 7 (depends on 1) The computer-implemented method as recited in claim 1, further comprising: obtaining, via the one or more programmatic interfaces, an indication of a policy to be used to detect sensitive data within the bucket; determining, using the policy, that a particular data object of the one or more data objects comprises sensitive data; and applying a masking methodology to at least a portion of the particular data object prior to providing a response to another data access request directed to the one or more data objects. ### Claim 8 A system, comprising: one or more computing devices; wherein the one or more computing devices include instructions that upon execution on or across the one or more computing devices: store one or more data objects in a bucket of an object storage service of a cloud computing environment, wherein an individual data object of the one or more data objects comprises a plurality of fields separated from one another using a first delimiter; receive, via one or more programmatic interfaces, a data access request directed to the one or more data objects, wherein the data access request indicates (a) a bucket identifier of the bucket, (b) the first delimiter, and (c) a filtering criterion expressed at least in part using Structured Query Language (SQL); and transfer a subset of contents of the one or more data objects to a destination, wherein the subset of contents is selected from the bucket using the first delimiter and the filtering criterion. ### Claim 9 (depends on 8) The system as recited in claim 8, wherein the one or more computing devices include further instructions that upon execution on or across the one or more computing devices: receive, via the one or more programmatic interfaces, another data access request directed to the one or more data objects, wherein the other data access request comprises another filtering criterion and a transformation specification; and select another subset of contents of the one or more data objects using the other filtering criterion; generate a transformed version of the other subset of contents in accordance with the transformation specification; and transfer the transformed version to another destination. ### Claim 10 (depends on 8) The system as recited in claim 8, wherein the bucket is stored at a first set of storage devices, and wherein the one or more computing devices include further instructions that upon execution on or across the one or more computing devices: store the subset of contents in a cache at a second set of storage devices; and provide, using the cache, a response to another data access request directed to the one or more data objects, without accessing the first set of storage devices. ### Claim 11 (depends on 8) The system as recited in claim 8, wherein the one or more programmatic interfaces include a Representational State Transfer (REST) application programming interface (API), and wherein the data access request is received via an invocation of the REST API. ### Claim 12 (depends on 8) The system as recited in claim 8, wherein the one or more computing devices include further instructions that upon execution on or across the one or more computing devices: identify, based at least in part on analysis of a plurality of data access requests directed to the one or more data objects, a predicted filtering criterion of a future data access request; store a result of applying the predicted filtering criterion to the one or more data objects in a cache; and provide, using the cache, a response to another data access request directed to the one or more data objects. ### Claim 13 (depends on 8) The system as recited in claim 8, wherein the one or more data objects comprise at least one log record. ### Claim 14 (depends on 8) The system as recited in claim 8, wherein the one or more computing devices include further instructions that upon execution on or across the one or more computing devices: obtain, via the one or more programmatic interfaces, an indication of a policy to be used to detect sensitive data within the bucket; determine, using the policy, that a particular data object of the one or more data objects comprises sensitive data; and apply a masking methodology to at least a portion of the particular data object prior to providing a response to another data access request directed to the one or more data objects. ### Claim 15 One or more non-transitory computer-accessible storage media storing program instructions that when executed on or across one or more processors: store one or more data objects in a bucket of an object storage service of a cloud computing environment, wherein an individual data object of the one or more data objects comprises a plurality of fields separated from one another using a first delimiter; receive, via one or more programmatic interfaces, a data access request directed to the one or more data objects, wherein the data access request indicates (a) a bucket identifier of the bucket, (b) the first delimiter, and (c) a filtering criterion expressed at least in part using Structured Query Language (SQL); and transfer a subset of contents of the one or more data objects to a destination, wherein the subset of contents is selected from the bucket using the first delimiter and the filtering criterion. ### Claim 16 (depends on 15) The one or more non-transitory computer-accessible storage media as recited in claim 15, storing further program instructions that when executed on or across the one or more processors: receive, via the one or more programmatic interfaces, another data access request directed to the one or more data objects, wherein the other data access request comprises another filtering criterion and a transformation specification; and select another subset of contents of the one or more data objects using the other filtering criterion; generate a transformed version of the other subset of contents in accordance with the transformation specification; and transfer the transformed version to another destination. ### Claim 17 (depends on 15) The one or more non-transitory computer-accessible storage media as recited in claim 15, wherein the bucket is stored at a first set of storage devices, and wherein the one or more non-transitory computer-accessible storage media store further program instructions that when executed on or across the one or more processors: store the subset of contents in a cache at a second set of storage devices; and provide, using the cache, a response to another data access request directed to the one or more data objects, without accessing the first set of storage devices. ### Claim 18 (depends on 15) The one or more non-transitory computer-accessible storage media as recited in claim 15, wherein the one or more programmatic interfaces include a Representational State Transfer (REST) application programming interface (API), and wherein the data access request is received via an invocation of the REST API. ### Claim 19 (depends on 15) The one or more non-transitory computer-accessible storage media as recited in claim 15, storing further program instructions that when executed on or across the one or more processors: identify, based at least in part on analysis of a plurality of data access requests directed to the one or more data objects, a predicted filtering criterion of a future data access request; store a result of applying the predicted filtering criterion to the one or more data objects in a cache; and provide, using the cache, a response to another data access request directed to the one or more data objects. ### Claim 20 (depends on 15) The one or more non-transitory computer-accessible storage media as recited in claim 15, wherein the one or more data objects comprise at least one log record.