International Business Machines Corporation

Spyridon Antonatos

Stefano Braghin

Naoise Holohan

Aris Gkoulalas-Divanis

Olivier Verscheure

Pol MacAonghusa

Sameep Mehta

Elizabeth Daly

Akshar Kaul

Manish Kesarwani

Martin Stephenson

Pol Mac Aonghusa

Marco Luca Sbodio

Rahul Nair

Killian Levacher

Derek Wayne Botti

Andrea Reale

Konstantinos Katrinis

Ioannis Gkoufas

Systems, computer-implemented methods, and computer program products that can facilitate sensitive data policy recommendation are provided. According to an embodiment, a system can comprise a memory that stores computer executable components and a processor that executes the computer executable components stored in the memory. The computer executable components can comprise an extraction component that can employ an artificial intelligence model to extract compliance data from a data source. The computer executable components can further comprise a recommendation component that can recommend a sensitive data policy based on the compliance data. In some embodiments, the recommendation component can further identify one or more sensitive data entities of a sensitive data dataset that are affected by actionable obligation data of the data source.

Sensitive data policy recommendation based on compliance obligations of a data source

Various embodiments are provided for providing intelligent data utility constraint information in a computing environment are provided. One or more utility constraints may be extracted from a dataset and a set of queries and applications to infer one or more data transformations to apply to selected data.

Extracting data utility requirements

Embodiments for performing consistent data masking in a distributed computing environment by a processor. A dictionary based data masking operation is performed on one or more datasets with causal ordering of the one or more datasets to enable reconstruction of a state of the one or more dictionaries for the one or more datasets.

Providing consistent data masking using causal ordering

Various embodiments are provided for providing data security in a computing environment are provided. Data may be inspected during a write operation or a read operation and selected data from the data may be filtered according to one or more data security policies or rules prior to sending the plurality of data to or receiving the plurality of data from a shared computing file system.

Preserving data security in a shared computing file system

Various embodiments are provided for authenticating an entity in non-secure communication channels via secure out-of-bands channels. An operator may be authenticated to have access to a secured location associated with an entity upon determining the operator retrieved and communicated a unique token, provided by the user and stored at the secured location, back to the user.

Authentication in non-secure communication channels via secure out-of-bands channels

Various embodiments are provided for linking of anonymized datasets in a computing environment are provided. A number of linking records may be identified between an anonymized dataset and one or more non-anonymized datasets of a knowledge base according to one or more equivalence classes and a generalization level.

Fast linking of anonymized datasets

To improve the security performance of a computer system, a retrieval component executing on at least one hardware processor obtains a list of known compromised passwords. A validation component executing on the at least one hardware processor obtains a specification of a putative password and risk-scores the putative password based at least in part on presence of the putative password in the list of known compromised passwords. The system obtains a specification of an actual password chosen in accordance with the risk score of the putative password. Access to at least one aspect of the computer system is controlled based on the actual chosen password.

Augmenting password generation and validation

A method, system and computer program product for providing privacy protection to data streams in a distributed computing environment. The method includes concurrently processing, by a plurality of computer machines, data streams of attributes containing data values received by each of the plurality of local computer machines; indexing the data values for each attribute of the plurality of data streams received by each of the plurality of local computer machines; providing the indexed data values to a main computer machine; integrating, by the main computer machine, the local computer machine indexed data values into a global index data structure for the plurality of data streams; and identifying privacy vulnerabilities of the attributes that are direct identifiers and quasi-identifiers based on the global index.

Method/system for the online identification and blocking of privacy vulnerabilities in data streams

Embodiments for watermarking anonymized datasets using decoys in a computing environment are provided. One or more decoy records may be embedded in an anonymized dataset such that a re-identification attack on the anonymized dataset targets the one or more decoy records.

Watermarking anonymized datasets by adding decoys

Embodiments for data anonymity by a processor. A dataset may be transformed into an anonymous dataset by applying a differential privacy operation and a clustering operation to the dataset.

Applying a differential privacy operation on a cluster of data

Techniques facilitating autonomously rendering an encrypted data anonymous in a non-trusted environment are provided. In one example, a computer-implemented method can comprise generating, by a system operatively coupled to a processor, a plurality of clusters of encrypted data from an encrypted dataset using a machine learning algorithm. The computer-implemented method can also comprise modifying, by the system, the plurality of clusters based on a defined criterion that can facilitate anonymity of the encrypted data.

Anonymous encrypted data

Embodiments for performing self-contained, consistent data masking in a distributed computing environment by a processor. A data masking operation is performed on one or more datasets in one of a plurality of data formats such that a key of each value of each key-value pair representing a common set of columns or paths for the one or more datasets is masked.

Self-contained consistent data masking

Distributed, consistent utility-preserving data masking is provided by retrieving an original value from a data table; initiating a communication with a mapping service to ascertain whether or not a masking table of the mapping service includes a fictionalized value associated with the original value; when the masking table does not include a fictionalized value associated with the original value, producing a fictionalized value for the original value wherein the fictionalized value preserves at least one utility function of the original value, updating the mapping service to include the fictionalized value in the masking table, and applying a first masking operation by replacing the retrieved original value with the fictionalized value.

Consistent utility-preserving masking of a dataset in a distributed environment

A method and system for automatically identifying and protecting privacy vulnerabilities in data streams includes indexing data values for each attribute of the data stream received by local virtual machines based on a schema of each data stream, classifying the data attributes of the plurality of data streams into known data types, integrating the local virtual machine indexes into a global index data structure for the data streams including single attribute data values, identifying privacy vulnerabilities in the data as attributes that are direct identifiers based on the attribute data values stored in the global index and combinations of attributes that are quasi-identifiers based on the low frequency of certain combinations of attribute data value pairs by computing the frequency based on the single attribute data values stored in the global index and providing privacy protection to the data streams by applying data transformations on the discovered direct identifiers and the quasi-identifiers.

Growing community of inventors

Dublin, Ireland

Spyridon Antonatos