Ingest Proxy and Query Rewriter for Secure Data

Abstract

A system for providing an ingest proxy and query rewriter for secure data is described. In an example implementation, the system may include a proxy configured to obfuscate data, generate maps of the obfuscated data to the original data, and send the obfuscated data to an analysis server. The analysis server may be configured to generate analysis data relevant to the obfuscated data and the original data by analyzing the obfuscated data. The analysis server may send the analysis data and an identification of the obfuscated data to a user device in response to a request from the user device. The user device may be configured to detect the identification of the obfuscated data in the signal received from the analysis server and retrieve the analysis data from a client device via the proxy.

What is claimed is: 
     
         1 . A computer-implemented method comprising:
 receiving, by a proxy, structured data;   obfuscating, by the proxy, the structured data to generate obfuscated data;   generating, by the proxy, a map of the obfuscated data to the structured data;   transmitting, by the proxy, the obfuscated data to an analysis server, the analysis server configured to perform analysis of the obfuscated data and to generate analysis data based on the analysis of the obfuscated data;   receiving, by the proxy, a signal from a user device, a signal including an identification of the obfuscated data and requesting that the proxy send the structured data to the user device;   determining, by the proxy, the structured data corresponding to the obfuscated data using the map and the signal received from the user device;   retrieving, by the proxy, the structured data from a database; and   transmitting, by the proxy, the structured data to the user device, the user device configured to replace the identification of the obfuscated data in the analysis data with the structured data.   
     
     
         2 . The computer-implemented method of  claim 1 , wherein:
 obfuscating, by the proxy, the structured data to generate the obfuscated data includes applying a secure hash algorithm to the structured data.   
     
     
         3 . The computer-implemented method of  claim 1 , wherein:
 the structured data includes columns, the columns having column names and values; and   obfuscating, by the proxy, the structured data includes obfuscating the column names and the values of the structured data.   
     
     
         4 . The computer-implemented method of  claim 1 , further comprising:
 assigning, by the proxy, one or more keys to the structured data with which to obfuscate the structured data;   retrieving, by the proxy, the one or more keys; and   de-obfuscating, by the proxy, the obfuscated data using the one or more keys to determine the structured data corresponding to the obfuscated data.   
     
     
         5 . The computer-implemented method of  claim 4 , further comprising:
 storing, by the proxy, the one or more keys in the map based on the assignment of the one or more keys to the structured data; and   determining, by the proxy, which of the one or more keys to use to de-obfuscate the obfuscated data using the map.   
     
     
         6 . The computer-implemented method of  claim 4 , further comprising:
 assigning, by the proxy, a timestamp to the one or more keys;   associating, by the proxy, the timestamp to the obfuscated data based on when the obfuscated data was generated; and   using, by the proxy, the timestamp to determine which of the one or more keys to use in de-obfuscating the obfuscated data.   
     
     
         7 . The computer-implemented method of  claim 1 , wherein:
 the obfuscated data includes a hash value of the structured data;   the user device is configured to detect the hash value received from the analysis server and to automatically send the hash value to the proxy; and   the user device is connected to the proxy via a virtual private network when the user device receives the structured data from the proxy.