# US 12,762,269 B2 · Sensitive data classification for micro-service applications > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 12,762,269 B2 - Document ID: US12762269B2 - Status: Granted - Kind: B2 - Application number: 18/151,746 - Filed: 2023-01-09 - Published: 2024-07-11 - Granted: 2026-10-13 - Earliest claimed: 2023-01-09 - Assignees: Concentric Software, Inc. - Applicants: Concentric Software, Inc. - Inventors: Advait Abhay Dixit; Udayakumar Srinivasan; Dhruv Hemchand Jain; Sarangan Rangachari; Abhishek Das - Web page: https://patentgrep.com/patent/US12762269B2 ## CPC - G06F 21/6227: {where protection concerns the structure of data, e.g. records, types, queries} - G06F 16/906: Clustering; Classification - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract A datastore layer service of a plurality of services that compose an application receives, from an upstream service of the plurality of services, a request, the request being associated with a transaction submitted to the application, the request including a transaction identifier that uniquely identifies the transaction. The datastore layer service, in response to the request, initiates a query against a datastore to obtain a data item based on information included in the request. A sensitive data classifier analyzes query information associated with the query. The sensitive data classifier determines that the query requests a data item that has been classified as a sensitive data item. The sensitive data classifier causes the transaction identifier and classification information that indicates the query requested the data item that has been classified as a sensitive data item to be sent to a collector service. ## Claims ### Claim 1 A method comprising: receiving, by a datastore layer service of a plurality of services that compose an application from an upstream service of the plurality of services, a request, the request being associated with a transaction submitted to the application, the request including a transaction identifier that uniquely identifies the transaction; initiating, by the datastore layer service in response to the request, a query against a datastore to obtain a data item based on information included in the request; analyzing, by a sensitive data classifier, query information associated with the query; determining, by the sensitive data classifier, that the query requests a data item that has been classified as a sensitive data item; and in response to the determination that the query requests the data item that has been classified as a sensitive data item, cause, by the sensitive data classifier, the transaction identifier and classification information that indicates the query requested the data item that has been classified as a sensitive data item to be sent to a collector service, wherein the collector service receives the transaction identifier and the classification information, and stores the classification information in a datastore based on the transaction identifier, wherein the classification information is correlated with the transaction identifier and a security token in the datastore, the security token comprising an identity of an entity, associated with the transaction, that identifies and authorizes a transaction originator of the transaction prior to processing the transaction. ### Claim 2 (depends on 1) The method of claim 1 wherein the query information associated with the query comprises the query, and further comprising: determining, by the sensitive data classifier, that a data catalog that classifies data fields of the datastore exists; and determining, by the sensitive data classifier, based on the query and the data catalog, that the data item requested by the query is maintained in a data field that has been identified as a sensitive data field. ### Claim 3 (depends on 1) The method of claim 1 wherein the query information associated with the query comprises the data item obtained from the datastore, and further comprising: processing the data item with at least one regular expression; and determining, based on processing the data item with the at least one regular expression, to classify the data item as a sensitive data item. ### Claim 4 (depends on 1) The method of claim 1 wherein sending, by the sensitive data classifier to the collector service, the transaction identifier and the classification information that indicates the query requested the data item that has been identified as a sensitive data item further comprises sending, by the sensitive data classifier to the collector service, the transaction identifier and the classification information that indicates the query requested the data item that has been identified as a sensitive data item and refraining from sending the data item to the collector service. ### Claim 5 (depends on 1) The method of claim 1 wherein the query information associated with the query comprises a plurality of data items obtained from the datastore, and further comprising: determining, by the sensitive data classifier, that the plurality of data items has been classified as a plurality of sensitive data items; determining a quantity of the plurality of data items; and sending, by the sensitive data classifier to the collector service, the transaction identifier, classification information that indicates the query requested the plurality of data items that has been identified as a plurality of sensitive data items, and the quantity of the plurality of data items. ### Claim 6 (depends on 1) The method of claim 1 wherein the query information associated with the query comprises a plurality of data items obtained from the datastore, and further comprising: determining, by the sensitive data classifier, that the plurality of data items has been classified as a plurality of sensitive data items; storing the plurality of data items in a first probabilistic data structure; and sending, by the sensitive data classifier to the collector service, the first probabilistic data structure. ### Claim 7 (depends on 6) The method of claim 6 wherein the first probabilistic data structure comprises a Bloom filter. ### Claim 8 (depends on 6) The method of claim 6, further comprising: determining, by the sensitive data classifier, that the plurality of data items comprises a first plurality of data items that is associated with a first data field that is classified as a sensitive data field and a second plurality of data items that is associated with a second data field that is classified as a sensitive data field; storing the first plurality of data items in the first probabilistic data structure; storing the second plurality of data items in a second probabilistic data structure; and sending, by the sensitive data classifier to the collector service, the first probabilistic data structure and the second probabilistic data structure. ### Claim 9 (depends on 6) The method of claim 6 wherein the transaction is submitted to the application via a validating service by an entity, and further comprising: receiving, at the validating service, a response to be provided to the entity, the response comprising the plurality of data items; storing, by the validating service, the data items in a second probabilistic data structure; and sending, by the validating service to the collector service, the second probabilistic data structure. ### Claim 10 (depends on 9) The method of claim 9 further comprising: receiving, by the collector service, the second probabilistic data structure; and determining a quantity of data items, among the plurality of data items, stored in the first probabilistic data structure that are being provided to the entity, by performing an intersection between the first probabilistic data structure and the second probabilistic data structure. ### Claim 11 (depends on 6) The method of claim 6 wherein the first probabilistic data structure comprises one or more characteristics selected from the group of a bit size of the first probabilistic data structure and one or more hash functions utilized, and further comprising: returning, by the datastore layer service to the upstream service, information that identifies the one or more characteristics of the first probabilistic data structure. ### Claim 12 (depends on 1) The method of claim 1 wherein the classification information indicates that the data item is one of a driver's license identifier, a social security number, and a credit card number. ### Claim 13 (depends on 1) The method of claim 1 further comprising: returning, by the datastore layer service to the upstream service, information that identifies the data item that has been classified as a sensitive data item. ### Claim 14 (depends on 1) The method of claim 1 wherein the datastore layer service comprises a first container, the sensitive data classifier comprises a second container, and the first container and the second container execute in a same pod. ### Claim 15 A computing system comprising: one or more processor devices of one or more computing devices, wherein the one or more processor devices are configured to: receive, by a datastore layer service of a plurality of services that compose an application from an upstream service of the plurality of services, a request, the request being associated with a transaction submitted to the application, the request including a transaction identifier that uniquely identifies the transaction; initiate, by the datastore layer service in response to the request, a query against a datastore to obtain a data item based on information included in the request; analyze, by a sensitive data classifier, query information associated with the query; determine, by the sensitive data classifier, that the query requests a data item that has been classified as a sensitive data item; and in response to the determination that the query requests the data item that has been classified as a sensitive data item, cause, by the sensitive data classifier, the transaction identifier and classification information that indicates the query requested the data item that has been classified as a sensitive data item to be sent to a collector service, wherein the collector service receives the transaction identifier and the classification information, and stores the classification information in a datastore based on the transaction identifier, wherein the classification information is correlated with the transaction identifier and a security token in the datastore, the security token comprising an identity of an entity, associated with the transaction, that identifies and authorizes a transaction originator of the transaction prior to processing the transaction. ### Claim 16 (depends on 15) The computing system of claim 15 wherein the query information associated with the query comprises the query, and wherein the one or more processor devices are further configured to: determine, by the sensitive data classifier, that a data catalog that classifies data fields of the datastore exists; and determine, by the sensitive data classifier, based on the query and the data catalog, that the data item requested by the query is maintained in a data field that has been identified as a sensitive data field. ### Claim 17 (depends on 15) The computing system of claim 15 wherein the query information associated with the query comprises the data item obtained from the datastore, and wherein the one or more processor devices are further configured to: process the data item with at least one regular expression; and determine, based on processing the data item with the at least one regular expression, to classify the data item as a sensitive data item. ### Claim 18 (depends on 15) The computing system of claim 15 wherein the query information associated with the query comprises a plurality of data items obtained from the datastore, and wherein the one or more processor devices are further configured to: determine, by the sensitive data classifier, that the plurality of data items has been classified as a plurality of sensitive data items; store the plurality of data items in a first probabilistic data structure; and send, by the sensitive data classifier to the collector service, the first probabilistic data structure. ### Claim 19 A non-transitory computer-readable storage medium that includes executable instructions configured to cause one or more processor devices to: receive, by a datastore layer service of a plurality of services that compose an application from an upstream service of the plurality of services, a request, the request being associated with a transaction submitted to the application, the request including a transaction identifier that uniquely identifies the transaction; initiate, by the datastore layer service in response to the request, a query against a datastore to obtain a data item based on information included in the request; analyze, by a sensitive data classifier, query information associated with the query; determine, by the sensitive data classifier, that the query requests a data item that has been classified as a sensitive data item; and in response to the determination that the query requests the data item that has been classified as a sensitive data item, cause, by the sensitive data classifier, the transaction identifier and classification information that indicates the query requested the data item that has been classified as a sensitive data item to be sent to a collector service, wherein the collector service receives the transaction identifier and the classification information, and stores the classification information in a datastore based on the transaction identifier, wherein the classification information is correlated with the transaction identifier and a security token in the datastore, the security token comprising an identity of an entity, associated with the transaction, that identifies and authorizes a transaction originator of the transaction prior to processing the transaction. ### Claim 20 (depends on 19) The non-transitory computer-readable storage medium of claim 19 wherein the query information associated with the query comprises the query, and wherein the instructions are further configured to cause the one or more processor devices to: determine, by the sensitive data classifier, that a data catalog that classifies data fields of the datastore exists; and determine, by the sensitive data classifier, based on the query and the data catalog, that the data item requested by the query is maintained in a data field that has been identified as a sensitive data field. ### Claim 21 (depends on 19) The non-transitory computer-readable storage medium of claim 19 wherein the query information associated with the query comprises the data item obtained from the datastore, and wherein the instructions are further configured to cause the one or more processor devices to: process the data item with at least one regular expression; and determine, based on processing the data item with the at least one regular expression, to classify the data item as a sensitive data item.