[0001] Automated Document Redaction.

FIELD OF THE INVENTION

[0002] The invention relates to computer data access control and privacy in general.

BACKGROUND OF THE INVENTION

[0003] Many organizations maintain documents that include information, such as of a medical or financial nature, that is deemed sensitive and whose exposure to individuals is restricted by company policy, or even by law. Such organizations may employ document redaction software that removes sensitive information from documents before they are shown to individuals requesting access to such documents. Document redaction software typically removes sensitive information from documents automatically according to a set of predefined rules, such as where a rule dictates that a number that appears to be a credit card number be redacted from a document before it is provided to a recipient. Such rules may be further adapted based on the role of the recipient, such where a rule dictates that a credit card number be left in a document that is provided to an accounts receivable clerk and redacted from the document before the document is provided to recipients in other roles.

SUMMARY OF THE INVENTION

[0004] In one aspect of the invention a document redaction method is provided where the method includes identifying within a computer-based document stored on a non-transitory computer-readable medium, a candidate redaction element that is of a predefined redaction element type, identifying an evaluation element that is of a predefined evaluation element type and that is associated with the candidate redaction element, identifying a predefined logic expression that is associated with the redaction element type and that operates on the evaluation element type, evaluating the logic expression, thereby resulting in a value, identifying a predefined permission expression that is associated with the logic expression, that operates on the value, and that is associated with a recipient role, evaluating the permission expression, thereby identifying a redaction directive, and applying the redaction directive to the candidate redaction element within the computer-based document prior to the computer-based document being provided to a recipient having the recipient role.

[0005] Systems and computer-program products embodying the invention are also provided.

[0006] The term "document" as used herein refers to any data file that may be stored on a computer-readable data storage device, such as word processing files, database files, image files, audio files, etc. BRIEF DESCRIPTION OF THE DRAWINGS

[0007] The invention will be understood and appreciated more fully from the following detailed description taken in conjunction with the appended drawings in which:

[0008] Fig. 1 is a simplified conceptual illustration of a document redaction system, constructed and operative in accordance with an embodiment of the invention;

[0009] Fig. 2 is a simplified flowchart illustration of an exemplary method of operation of the system of Fig. 1, operative in accordance with an embodiment of the invention;

[0010] Figs. 3 A and 3B show exemplary pseudocode illustrating the system of Fig. 1 and method of Fig. 2; and

[0011] Fig. 4 is a simplified block diagram illustration of an exemplary hardware implementation of a computing system, constructed and operative in accordance with an embodiment of the invention. DETAILED DESCRIPTION OF THE INVENTION

[0012] The invention is now described within the context of one or more embodiments, although the description is intended to be illustrative of the invention as a whole, and is not to be construed as limiting the invention to the embodiments shown. It is appreciated that various modifications may occur to those skilled in the art that, while not specifically shown herein, are nevertheless within the true spirit and scope of the invention. [0013] As will be appreciated by one skilled in the art, aspects of the present invention may be embodied as a system, method or computer program product. Accordingly, aspects of the present invention may take the form of an entirely hardware embodiment, an entirely software embodiment (including firmware, resident software, micro-code, etc.) or an embodiment combining software and hardware aspects that may all generally be referred to herein as a "circuit," "module" or "system." Furthermore, aspects of the present invention may take the form of a computer program product embodied in one or more computer readable medium(s) having computer readable program code embodied thereon.

[0014] Any combination of one or more computer readable medium(s) may be utilized. The computer readable medium may be a computer readable signal medium or a computer readable storage medium. A computer readable storage medium may be, for example, but not limited to, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any suitable combination of the foregoing. More specific examples (a non-exhaustive list) of the computer readable storage medium would include the following: an electrical connection having one or more wires, a portable computer diskette, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or Flash memory), an optical fiber, a portable compact disc read-only memory (CD-ROM), an optical data storage device, a magnetic data storage device, or any suitable combination of the foregoing. In the context of this document, a computer readable storage medium may be any tangible medium that can contain, or store a program for use by or in connection with an instruction execution system, apparatus, or device.

[0015] A computer readable signal medium may include a propagated data signal with computer readable program code embodied therein, for example, in baseband or as part of a carrier wave. Such a propagated signal may take any of a variety of forms, including, but not limited to, electro-magnetic, optical, or any suitable combination thereof. A computer readable signal medium may be any computer readable medium that is not a computer readable storage medium and that can communicate, propagate, or transport a program for use by or in connection with an instruction execution system, apparatus, or device. [0016] Program code embodied on a computer readable medium may be transmitted using any appropriate medium, including but not limited to wireless, wireline, optical fiber cable, RF, etc., or any suitable combination of the foregoing.

[0017] Computer program code for carrying out operations for aspects of the present invention may be written in any combination of one or more programming languages, including an object oriented programming language such as Java, Smalltalk, C++ or the like and conventional procedural programming languages, such as the "C" programming language or similar programming languages. The program code may execute entirely on the user's computer, partly on the user's computer, as a stand-alone software package, partly on the user's computer and partly on a remote computer or entirely on the remote computer or server. In the latter scenario, the remote computer may be connected to the user's computer through any type of network, including a local area network (LAN) or a wide area network (WAN), or the connection may be made to an external computer (for example, through the Internet using an Internet Service Provider).

[0018] Aspects of the present invention are described below with reference to flowchart illustrations and/or block diagrams of methods, apparatus (systems) and computer program products according to embodiments of the invention. It will be understood that each block of the flowchart illustrations and/or block diagrams, and combinations of blocks in the flowchart illustrations and/or block diagrams, can be implemented by computer program instructions. These computer program instructions may be provided to a processor of a general purpose computer, special purpose computer, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, create means for implementing the functions/acts specified in the flowchart and/or block diagram block or blocks.

[0019] These computer program instructions may also be stored in a computer readable medium that can direct a computer, other programmable data processing apparatus, or other devices to function in a particular manner, such that the instructions stored in the computer readable medium produce an article of manufacture including instructions which implement the function/act specified in the flowchart and/or block diagram block or blocks. [0020] The computer program instructions may also be loaded onto a computer, other programmable data processing apparatus, or other devices to cause a series of operational steps to be performed on the computer, other programmable apparatus or other devices to produce a computer implemented process such that the instructions which execute on the computer or other programmable apparatus provide processes for implementing the functions/acts specified in the flowchart and/or block diagram block or blocks.

[0021] Reference is now made to Fig. 1, which is a simplified conceptual illustration of a document redaction system, constructed and operative in accordance with an embodiment of the invention. In the system of Fig. 1, a redaction candidate identifier 100 is configured to process computer-readable documents, such as may reside in a document repository 102 stored on a computer-readable data storage device, to identify one or more elements with a document, such as words or numbers, in accordance with conventional techniques. For example, identifier 100 may identify textual elements in accordance with predefined textual extraction rules using information-extraction software for unstructured text, such as System T™. Alternatively, identifier 100 may find text at a given Cartesian coordinate in a form- based document using OCR software like OmniPage as implemented in IBM InfoSphere Guardium Data Redaction™, the latter commercially available from International Business Machines Corporation, Armonk, NY. Redaction candidate identifier 100 is also preferably configured to determine, in accordance with conventional techniques, whether an element identified within a document is of a predefined redaction element type, and therefore a candidate for redaction. For example, redaction candidate identifier 100 may be configured to identify the character string "Bob Smith" as a redaction candidate within a document, and determine that the character string is the name of a person by virtue of being in a predefined list of common names.

[0022] An evaluation element identifier 104 is configured to identify one or more evaluation elements that are associated with the candidate redaction element identified by redaction candidate identifier 100, where an evaluation element is of a predefined evaluation element type. Continuing with the previous example, evaluation element identifier 104 may be configured to identify a date that is associated with "Bob Smith," such as his birth date, as an evaluation element. Evaluation element identifier 104 may identify evaluation elements within the same computer-readable document where a candidate redaction element is found. Additionally or alternatively, evaluation element identifier 104 may identify evaluation elements from other sources. For example, evaluation element identifier 104 may lookup Bob Smith's birth date from a database responsive to redaction candidate identifier 100 finding the name "Bob Smith" in a computer-readable document. Or evaluation element identifier 104 may lookup Bob Smith's birth date from the database responsive to finding another element associated with Bob Smith, such as a Social Security Number for Bob Smith, on the same computer-readable document where redaction candidate identifier 100 found "Bob Smith." That is, for example, in one embodiment evaluation element identifier 104 associates a social security number to an adjacent (or at least proximate) personal name in a free text document. In another embodiment, there may be an external mapping (e.g., in a database between names and social security numbers, so that evaluation elements identifier 104 retrieves, for a name in a document, a social security number associated with the name according to that map.

[0023] An expression selector 106 is configured to identify one or more predefined logic expressions that are associated with redaction elements of the type identified by redaction candidate identifier 100 and that operate on evaluation elements of the type identified by evaluation element identifier 104. The predefined logic expressions may reside in a logic repository 108 stored on a computer-readable data storage device, and may include Boolean logic or other known logic. Continuing with the previous example, a logic expression may have been derived from a company policy or legal regulation that dictates that the name of an individual may or may not require redaction from a computer-based document based at least partly on the individual's age. As such, the logic expression is associated with redaction elements that are names and operates on dates that are birth dates. Expression selector 106 may thus identify the logic expression based on the candidate redaction element "Bob Smith" and his identified birth date as the evaluation element. Expression selector 106 is also preferably configured to evaluate the identified logic expression, where the evaluation results in (i.e., generates) one or more values. For example, where the logic expression defines a criteria concerning whether the age identified by evaluation element identifier 104 of the individual "Bob Smith" identified by candidate identifier 100 is less than 18 years old, the value generated by expression selector 106 may be "true" or "false." In another example, where candidate identifier 100 indicates that a candidate redaction element type is a person's name and an associated logic expression indicates that the person has a birth date identified by evaluation element identifier 104, the value generated by expression selector 106 may be a name in the computer readable document of a person having that birth date, e.g., "Bob Smith." In this case, expression selector 106 generates the specific candidate redaction element itself.

[0024] A permission selector 110 is configured to identify one or more predefined permission expressions responsive to a recipient role and the value resulting from the expression selector 106 evaluation of the logic expression. The predefined permission expressions may reside in a permission repository 112 stored on a computer- readable data storage device. Continuing with the previous example, permission selector 110 may be configured to identify a permission expression that is associated with the logic expression identified by expression selector 106, that operates on the value resulting from the evaluation of the logic expression, and that is associated with the recipient role "visiting nurse." Permission selector 110 is also preferably configured to evaluate the permission expression, where the evaluation results in a redaction directive that determines whether or not the candidate redaction element is redacted from the computer-readable document. For example, the redaction directive may indicate that the candidate redaction element is to be allowed to remain unaltered within the document where the document recipient is a visiting nurse and the individual is 18 years old or older, or may indicate that the candidate redaction element is to be redacted from the document in accordance with conventional techniques where the individual is less than 18 years old.

[0025] A document processor 114 is configured to apply the redaction directive identified by permission selector 110 to the candidate redaction element within the computer-based document, whereupon the computer-based document may be provided to a recipient having the recipient role, such as to a visiting nurse as in the previous example. Document processor 114 may be configured to provide a redaction profile for human review, where the redaction profile for a candidate redaction element includes information regarding any of the elements, types, logic expressions, permission expressions, evaluation result values, redaction directives, roles, and recipients described hereinabove, enabling the reviewer to approve or disapprove of the application of the redaction directive to the computer-based document.

[0026] Any of the elements shown in Fig. 1 are preferably executed by, or are otherwise accessible to, a computer 116, such as by implementing any of the elements in computer hardware and/or in computer software embodied in a physically-tangible, computer-readable storage medium in accordance with conventional techniques.

[0027] Reference is now made to Fig. 2, which is a simplified flowchart illustration of an exemplary method of operation of the system of Fig. 1, operative in accordance with an embodiment of the invention. In the method of Fig. 2, a candidate redaction element is identified within a computer-based document, where the candidate redaction element is of a predefined redaction element type (step 200). One or more evaluation elements associated with the candidate redaction element are identified, where each evaluation element is of a predefined evaluation element type (step 202). One or more predefined logic expressions are identified, where each logic expression is associated with the redaction element type and operates on one or more of the identified evaluation element types (step 204). The logic expression is evaluated, resulting in a value (step 206). A predefined permission expression is identified that is associated with the logic expression, that operates on the value, and that is associated with a recipient role (step 208). The permission expression is evaluated to identify a redaction directive (step 210). A redaction profile for the candidate redaction element is optionally provided for human review and approval or disapproval of the redaction directive (step 212). The redaction directive is applied to the candidate redaction element within the computer-based document (step 214), whereupon the computer- based document may be provided to a recipient having the recipient role (step 216).

[0028] The system of Fig. 1 and method of Fig. 2 may be illustrated with reference to exemplary pseudocode as shown in Figs. 3A and 3B as follows. Fig. 3A shows a pseudocode logic expression labeled "E" which relates to a candidate redaction element labeled "p" of candidate redaction element type "PersonName" and operates on an evaluation element labeled "d" of evaluation element type "DateOfBirth" that have been identified in a computer-based document. Expression "E" returns the object "p" if and only if the DateOfBirth "d" is less than 18 years in the past, and returns a value of fal se otherwise. Where "p" is returned from Expression "E", the permission expression shown in Fig. 3B is identified as relating to Expression "E" for the recipient role "Visiting Nurse". The evaluation of the permission expression shown in Fig. 3B given the result of the evaluation of Expression "E" results in a redaction directive that states that "p" is to be redacted as Expression "E" is satisfied.

[0029] Referring now to Fig. 4, block diagram 400 illustrates an exemplary hardware implementation of a computing system in accordance with which one or more components/methodologies of the invention (e.g., components/methodologies described in the context of Figs. 1 - 2) may be implemented, according to an embodiment of the invention.

[0030] As shown, the techniques for controlling access to at least one resource may be implemented in accordance with a processor 410, a memory 412, I/O devices 414, and a network interface 416, coupled via a computer bus 418 or alternate connection arrangement.

[0031] It is to be appreciated that the term "processor" as used herein is intended to include any processing device, such as, for example, one that includes a CPU (central processing unit) and/or other processing circuitry. It is also to be understood that the term "processor" may refer to more than one processing device and that various elements associated with a processing device may be shared by other processing devices.

[0032] The term "memory" as used herein is intended to include memory associated with a processor or CPU, such as, for example, RAM, ROM, a fixed memory device (e.g., hard drive), a removable memory device (e.g., diskette), flash memory, etc. Such memory may be considered a computer readable storage medium.

[0033] In addition, the phrase "input/output devices" or "I/O devices" as used herein is intended to include, for example, one or more input devices (e.g., keyboard, mouse, scanner, etc.) for entering data to the processing unit, and/or one or more output devices (e.g., speaker, display, printer, etc.) for presenting results associated with the processing unit.

[0034] The flowchart and block diagrams in the Figures illustrate the architecture, functionality, and operation of possible implementations of systems, methods and computer program products according to various embodiments of the invention. In this regard, each block in the flowchart or block diagrams may represent a module, segment, or portion of code, which comprises one or more executable instructions for implementing the specified logical function(s). It should also be noted that, in some alternative implementations, the functions noted in the block may occur out of the order noted in the figures. For example, two blocks shown in succession may, in fact, be executed substantially concurrently, or the blocks may sometimes be executed in the reverse order, depending upon the functionality involved. It will also be noted that each block of the block diagrams and/or flowchart illustration, and combinations of blocks in the block diagrams and/or flowchart illustration, can be implemented by special purpose hardware-based systems that perform the specified functions or acts, or combinations of special purpose hardware and computer instructions.

[0035] It will be appreciated that any of the elements described hereinabove may be implemented as a computer program product embodied in a computer-readable medium, such as in the form of computer program instructions stored on magnetic or optical storage media or embedded within computer hardware, and may be executed by or otherwise accessible to a computer (not shown).

[0036] While the methods and apparatus herein may or may not have been described with reference to specific computer hardware or software, it is appreciated that the methods and apparatus described herein may be readily implemented in computer hardware or software using conventional techniques.

[0037] While the invention has been described with reference to one or more specific embodiments, the description is intended to be illustrative of the invention as a whole and is not to be construed as limiting the invention to the embodiments shown. It is appreciated that various modifications may occur to those skilled in the art that, while not specifically shown herein, are nevertheless within the true spirit and scope of the invention.