# US 2015/0089357 A1 · Policy-aware configurable data redaction based on sensitivity and use factors > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2015/0089357 A1 - Document ID: US20150089357A1 - Status: Published application - Kind: A1 - Application number: 14/033,831 - Filed: 2013-09-23 - Published: 2015-03-26 - Earliest claimed: 2013-09-23 - Assignees: Xerox Corporation - Applicants: Xerox Corporation - Inventors: David R. Vandervort; Andrés Quiroz Hernandez; Yasmine Charif - Web page: https://patentgrep.com/patent/US20150089357A1 ## CPC - G06F 21/62: Protecting access to data via a platform, e.g. using keys or access control rules - G06F 40/166: Editing, e.g. inserting or deleting - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract The present invention generally relates to systems and methods for document redaction. The disclosed techniques adapt to the needs of different levels of data sensitivity and different needs for disclosure or analysis by using pre-defined templates related to use cases, and mapping those to the relative sensitivity of private data types both in their natural form and after redaction by various redaction types. In this way, data is given the appropriate level of protection within the needs of a given use case. ## Claims ### Claim 1 A computer-implemented method for redacting data, the method comprising: obtaining from a user, using an electronic interface, for each of a plurality of redaction types, a corresponding identification scope and a corresponding disclosure impact, whereby a plurality of triples are obtained, each triple comprising a redaction type, a corresponding identification scope, and a corresponding disclosure impact; generating an initial redaction matrix from the plurality of triples, wherein the initial redaction matrix is incomplete; obtaining from a user, using an electronic interface, a selection of a policy, wherein the policy specifies a technique for completing the initial redaction matrix; applying the policy to the initial redaction matrix using an electronic processor, whereby a completed redaction matrix is obtained; obtaining, from a user, using an electronic interface, an indication of a need to know a content for each of a plurality of data types used in an application; and applying the completed redaction matrix to a corresponding data type used in the application, whereby an application template is obtained, wherein the application template specifies a particular redaction type for each of the plurality of data types used in the application; and applying the application template to the application, whereby data used by the application is redacted. ### Claim 2 (depends on 1) The method of claim 1, wherein each identification scope is selected from the group consisting of: identify a person uniquely, identify a person uniquely in an application, identify a group uniquely, identify a group uniquely in an application, and not needed for identification. ### Claim 3 (depends on 1) The method of claim 1, wherein each disclosure impact comprises a level of trust required of a third party to which a value is disclosed. ### Claim 4 (depends on 1) The method of claim 1, wherein each redaction type is selected from the group consisting of: mask, tokenize, encrypt, categorize, randomize, and aggregate. ### Claim 5 (depends on 1) The method of claim 1, wherein the initial redaction matrix comprises at least one blank entry for at least one trust requirement and disclosure impact pair. ### Claim 6 (depends on 1) The method of claim 1, wherein the policy is defined to favor one of usefulness or protection. ### Claim 7 (depends on 1) The method of claim 1, wherein the completed redaction matrix comprises at least one redaction type for each disclosure impact and identification scope pair. ### Claim 8 (depends on 1) The method of claim 1, wherein the obtaining an indication of a need to know a content for each of a plurality of data types used in an application comprises obtaining a positive response for a specific data type, the method further comprising obtaining an indication of an identification scope and an indication of an intended audience for the specific data type. ### Claim 9 (depends on 1) The method of claim 1, further comprising notifying a user of a policy violation. ### Claim 10 (depends on 9) The method of claim 9, wherein the policy violation is one of a usefulness violation and a protection violation. ### Claim 11 A system for redacting data, the system comprising at least one processor configured to: obtain from a user, using an electronic interface, for each of a plurality of redaction types, a corresponding identification scope and a corresponding disclosure impact, whereby a plurality of triples are obtained, each triple comprising a redaction type, a corresponding identification scope, and a corresponding disclosure impact; generate an initial redaction matrix from the plurality of triples, wherein the initial redaction matrix is incomplete; obtain from a user, using an electronic interface, a selection of a policy, wherein the policy specifies a technique for completing the initial redaction matrix; apply the policy to the initial redaction matrix, whereby a completed redaction matrix is obtained; obtain, from a user, using an electronic interface, an indication of a need to know a content for each of a plurality of data types used in an application; and apply the completed redaction matrix to a corresponding data type used in the application, whereby an application template is obtained, wherein the application template specifies a particular redaction type for each of the plurality of data types used in the application; and apply the application template to the application, whereby data used by the application is redacted. ### Claim 12 (depends on 11) The system of claim 11, wherein each identification scope is selected from the group consisting of: identify a person uniquely, identify a person uniquely in an application, identify a group uniquely, identify a group uniquely in an application, and not needed for identification. ### Claim 13 (depends on 11) The system of claim 11, wherein each disclosure impact comprises a level of trust required of a third party to which a value is disclosed. ### Claim 14 (depends on 11) The system of claim 11, wherein each redaction type is selected from the group consisting of: mask, tokenize, encrypt, categorize, randomize, and aggregate. ### Claim 15 (depends on 11) The system of claim 11, wherein the initial redaction matrix comprises at least one blank entry for at least one trust requirement and disclosure impact pair. ### Claim 16 (depends on 11) The system of claim 11, wherein the policy is defined to favor one of usefulness or protection. ### Claim 17 (depends on 11) The system of claim 11, wherein the completed redaction matrix comprises at least one redaction type for each disclosure impact and identification scope pair. ### Claim 18 (depends on 11) The system of claim 11, wherein the at least one processor is further configured to, upon obtaining a positive indication of a need to know for a specific data type, further obtain an indication of an identification scope and an indication of an intended audience for the specific data type. ### Claim 19 (depends on 11) The system of claim 11, further configured to notify a user of a policy violation. ### Claim 20 (depends on 19) The system of claim 19, wherein the policy violation is one of a usefulness violation and a protection violation. ### Claim 21 Non-transitory computer readable media including instructions which, when executed by at least one electronic processor, cause the at least one processor to: obtain from a user, using an electronic interface, for each of a plurality of redaction types, a corresponding identification scope and a corresponding disclosure impact, whereby a plurality of triples are obtained, each triple comprising a redaction type, a corresponding identification scope, and a corresponding disclosure impact; generate an initial redaction matrix from the plurality of triples, wherein the initial redaction matrix is incomplete; obtain from a user, using an electronic interface, a selection of a policy, wherein the policy specifies a technique for completing the initial redaction matrix; apply the policy to the initial redaction matrix, whereby a completed redaction matrix is obtained; obtain, from a user, using an electronic interface, an indication of a need to know a content for each of a plurality of data types used in an application; and apply the completed redaction matrix to a corresponding data type used in the application, whereby an application template is obtained, wherein the application template specifies a particular redaction type for each of the plurality of data types used in the application; and apply the application template to the application, whereby data used by the application is redacted.