WO2019236872A1 - Methods for data masking and devices thereof - Google Patents
Methods for data masking and devices thereof Download PDFInfo
- Publication number
- WO2019236872A1 WO2019236872A1 PCT/US2019/035825 US2019035825W WO2019236872A1 WO 2019236872 A1 WO2019236872 A1 WO 2019236872A1 US 2019035825 W US2019035825 W US 2019035825W WO 2019236872 A1 WO2019236872 A1 WO 2019236872A1
- Authority
- WO
- WIPO (PCT)
- Prior art keywords
- data masking
- database
- data
- set forth
- received request
- Prior art date
Links
Classifications
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
- G06F21/60—Protecting data
- G06F21/62—Protecting access to data via a platform, e.g. using keys or access control rules
- G06F21/6218—Protecting access to data via a platform, e.g. using keys or access control rules to a system of files or objects, e.g. local or distributed file system or database
- G06F21/6227—Protecting access to data via a platform, e.g. using keys or access control rules to a system of files or objects, e.g. local or distributed file system or database where protection concerns the structure of data, e.g. records, types, queries
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F16/00—Information retrieval; Database structures therefor; File system structures therefor
- G06F16/20—Information retrieval; Database structures therefor; File system structures therefor of structured data, e.g. relational data
- G06F16/24—Querying
- G06F16/245—Query processing
- G06F16/2455—Query execution
- G06F16/24564—Applying rules; Deductive queries
- G06F16/24565—Triggers; Constraints
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F16/00—Information retrieval; Database structures therefor; File system structures therefor
- G06F16/20—Information retrieval; Database structures therefor; File system structures therefor of structured data, e.g. relational data
- G06F16/24—Querying
- G06F16/242—Query formulation
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F16/00—Information retrieval; Database structures therefor; File system structures therefor
- G06F16/90—Details of database functions independent of the retrieved data types
- G06F16/907—Retrieval characterised by using metadata, e.g. metadata not derived from the content or metadata generated manually
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
- G06F21/60—Protecting data
- G06F21/62—Protecting access to data via a platform, e.g. using keys or access control rules
- G06F21/6218—Protecting access to data via a platform, e.g. using keys or access control rules to a system of files or objects, e.g. local or distributed file system or database
- G06F21/6245—Protecting personal data, e.g. for financial or medical purposes
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
- G06F21/60—Protecting data
- G06F21/62—Protecting access to data via a platform, e.g. using keys or access control rules
- G06F21/6218—Protecting access to data via a platform, e.g. using keys or access control rules to a system of files or objects, e.g. local or distributed file system or database
- G06F21/6245—Protecting personal data, e.g. for financial or medical purposes
- G06F21/6254—Protecting personal data, e.g. for financial or medical purposes by anonymising data, e.g. decorrelating personal data from the owner's identification
Definitions
- This technology generally relates to methods and devices for data security and, more particularly, to methods for data masking and devices thereof.
- Dynamic data masking refers to securing data in real time by masking sensitive data as it is accessed, such that sensitive information is not provided to unauthorized recipients.
- dynamic data masking may be employed to mask some or all of the data so that sensitive data is not exposed to the requestor.
- data masking some prior approaches, have analyzed and modified data queries to cause resulting data that is retrieved to be masked.
- Other prior approaches have defined rules implemented at the database level that specify specific tables and columns to be masked in anticipation of queries. Unfortunately, these prior approaches are not effective because they do not adapt to new type of data attributes and also requires regular maintenance to adapt to the ever changing requirements for data masking.
- a method for data masking includes obtaining a database and metadata associated with the database in response to a request for data masking. Next, the obtained metadata is compared with the received request to determine when the obtained metadata validates the received request. A data masking operation is performed on the obtained database at a column level when the determination indicates the received request is validated. A record of the performance of the data masking operation on the obtained database at the column level is stored.
- a non-transitory computer readable medium having stored thereon instructions for data masking comprising machine executable code which when executed by at least one processor, causes the processor to perform steps including obtaining a database and metadata associated with the database in response to a request for data masking. Next, the obtained metadata is compared with the received request to determine when the obtained metadata validates the received request. A data masking operation is performed on the obtained database at a column level when the determination indicates the received request is validated. A record of the performance of the data masking operation on the obtained database at the column level is stored.
- a data masking apparatus including at least one of configurable hardware logic configured to be capable of implementing or a processor coupled to a memory and configured to execute programmed instructions stored in the memory to obtain a database and metadata associated with the database in response to a request for data masking.
- the obtained metadata is compared with the received request to determine when the obtained metadata validates the received request.
- a data masking operation is performed on the obtained database at a column level when the determination indicates the received request is validated.
- a record of the performance of the data masking operation on the obtained database at the column level is stored.
- This technology provides a number of advantages including providing a method, non-transitory computer readable medium, apparatus, and system that provides more effective and accurate data masking. Additionally, with the disclosed technology the masked data can easily be recoverable from any point of failure during the masking process. Furthermore, the disclosed technology secures the data while the data masking process is performed.
- FIG. 1 is an example of a block diagram of a data masking apparatus for data masking
- FIG. 2 is an example of a block diagram of a data masking apparatus
- FIG. 3 is an exemplary flowchart of a method for data masking
- FIG. 4 is an exemplary illustration of a database divided into a plurality of tables
- FIG. 5 is an exemplary illustration of data masking at a column level
- FIG. 6 is an exemplary illustration of disabling constraints
- FIG. 7 is an exemplary illustration of the masked data
- FIG. 8 is an exemplary illustration of enabling the disabled constraints.
- FIGS. 1-2 A network environment 10 with an example of a data masking apparatus 14 is illustrated in FIGS. 1-2.
- the environment 10 includes the data masking apparatus 14, client computing devices 12(1)-12(h), plurality of server databases 16(1)-16(h) coupled via one or more communication networks 30, although the environment could include other types and numbers of systems, devices, components, and/or other elements as is generally known in the art and will not be illustrated or described herein.
- This technology provides a number of advantages including providing methods, non-transitory computer readable medium, and apparatuses that system that provides more effective and accurate data masking.
- the data masking apparatus 14 is programmed to perform a number of data management operations including data masking, although the apparatus can perform other types and/or numbers of functions and/or other operations.
- the data masking apparatus 14 includes a processor 18, a memory 20, and a communication system 24 which are coupled together by a bus 26, although the data masking apparatus 14 may comprise other types and/or numbers of physical and/or virtual systems, devices, components, and/or other elements in other configurations.
- the processor 18 in the data masking apparatus 14 may execute one or more programmed instructions stored in the memory 20 for data masking as illustrated and described in the examples herein, although other types and numbers of functions and/or other operations can be performed.
- the processor 18 in the data masking apparatus 14 may include one or more central processing units and/or general purpose processors with one or more processing cores, for example.
- the memory 20 in the data masking apparatus 14 stores the programmed instructions and other data for one or more aspects of the present technology as described and illustrated herein, although some or all of the programmed instructions could be stored and executed elsewhere.
- a variety of different types of memory storage devices such as a random access memory (RAM) or a read only memory (ROM) in the system or a floppy disk, hard disk, CD ROM, DVD ROM, or other computer readable medium which is read from and written to by a magnetic, optical, or other reading and writing system that is coupled to the processor 18, can be used for the memory 20.
- the communication system 24 in the data masking apparatus 14 operatively couples and communicates between one or more of the client computing devices 12(1)- l2(n) and one or more of the plurality of server databases 16(1)-16(h), which are all coupled together by one or more of the communication networks 30, although other types and numbers of communication networks or systems with other types and numbers of connections and configurations to other devices and elements.
- the communication networks 30 can use TCP/IP over Ethernet and industry-standard protocols, including NFS, CIFS, SOAP, XMF, FDAP, SCSI, and SNMP, although other types and numbers of communication networks, can be used.
- the communication networks 30 in this example may employ any suitable interface mechanisms and network communication technologies, including, for example, any local area network, any wide area network (e.g., Internet), teletraffic in any suitable form (e.g., voice, modem, and the like), Public Switched Telephone Network (PSTNs), Ethernet-based Packet Data Networks (PDNs), and any combinations thereof and the like.
- PSTNs Public Switched Telephone Network
- PDNs Packet Data Networks
- each of the client computing devices 12(1)-12(h) may interact with applications executing on the data masking apparatus 14 and/or the plurality of server databases 16(1)-16(h), although the plurality of client computing devices 12(1)-12(h) can interact with the data masking apparatus 14 or the plurality of server databases 16(1)-16(h).
- Each of the client computing devices 12(1)-12(h) may include a processor, a memory, user input device, such as a keyboard, mouse, and/or interactive display screen by way of example only, a display device, and a
- the plurality of server databases 16(1)-16(h) may store and provide data files, by way of example only, to the data masking apparatus 14 via one or more of the communication networks 30, for example, although other types and/or numbers of storage media in other configurations could be used. Additionally, the plurality of server databases 16(1)-16(h) hosts a plurality data tables that the plurality of client computing devices 12(1)-12(h) can access via the data masking apparatus 14. In this particular example, each of the plurality of server databases 16(1)-16(h) may comprise various combinations and types of storage hardware and/or software and represent a system with multiple network server devices in a data storage pool, which may include internal or external networks.
- Various network processing applications such as CIFS applications, NFS applications, HTTP Web Network server device applications, and/or FTP applications, may be operating on the plurality of server databases 16(1)-16(h) and may transmit data in response to requests from the data masking apparatus 14.
- Each the plurality of server databases 16(1)-16(h) may include a processor, a memory, and a communication interface, which are coupled together by a bus or other link, although each may have other types and/or numbers of other systems, devices, components, and/or other elements.
- two or more computing systems or devices can be substituted for any one of the systems or devices in any example. Accordingly, principles and advantages of distributed processing, such as redundancy and replication also can be implemented, as desired, to increase the robustness and performance of the devices, apparatuses, and systems of the examples.
- the examples may also be implemented on computer system(s) that extend across any suitable network using any suitable interface mechanisms and traffic technologies, including by way of example only teletraffic in any suitable form (e.g., voice and modem), wireless traffic media, wireless traffic networks, cellular traffic networks, G3 traffic networks, Public Switched Telephone Network (PSTNs), Packet Data Networks (PDNs), the Internet, intranets, and combinations thereof.
- PSTNs Public Switched Telephone Network
- PDNs Packet Data Networks
- the Internet intranets, and combinations thereof.
- the examples also may be embodied as a non-transitory computer readable medium having instmctions stored thereon for one or more aspects of the present technology as described and illustrated by way of the examples herein, as described herein, which when executed by the processor, cause the processor to carry out the steps necessary to implement the methods of this technology as described and illustrated with the examples herein.
- the data masking apparatus 14 receives a request for data masking of one or more databases from one of the plurality of client computing devices 12(1)-12(h), although the data masking apparatus 14 can receive request to perform data masking on other data, such as a specific table or a schema of a specific database, by way of example.
- the data in the one or more databases can include financial data associated with one or more customers, although the database can include other types or amounts of information.
- step 310 the data masking apparatus 14 obtains the database for which the data masking has been requested from one of the plurality of server databases 16(1)- l6(n), although the data masking apparatus 14 can obtain the database from other locations.
- the data masking apparatus 14 obtains the metadata associated with the obtained database.
- the metadata of the database includes data associated with the rows and columns of the obtained database, although the metadata can include other types or amounts of information.
- An example of the metadata associated with the database is illustrated in FIG. 4.
- step 320 the data masking apparatus 14 performs validation of the metadata.
- the data masking apparatus 14 compares the received request with the obtained metadata to determine if the received request has the data necessary to perform the data masking. In this example, if the data masking apparatus 14 determines that the received request does not include the data necessary to perform data masking, then the No branch is taken to step 360 where the data masking apparatus 14 rejects the received request and the exemplary method ends. However, if the data masking apparatus 14 determines that the received request does include the data necessary to perform data masking, then the Yes branch is taken to step 325.
- step 325 the data masking apparatus 14 divides the obtained database into a plurality of tables.
- An example of the data masking apparatus 14 dividing the obtained database into a plurality of tables is illustrated in FIG. 4.
- the disclosed technology is able to achieve parallelism to perform data masking more efficiently and quickly when compared to the existing technologies.
- each of the divided tables can be converted into a trigger file that would assist with the data masking of the database.
- step 330 the data masking apparatus 14 disables constraints associated with the database table.
- constraints relates to the relationship of the data present in one cell of the database table to the data present in other cells, although the constraints can include other types or amounts of rules present in the database tables.
- FIG. 6 illustrates an example of the data masking apparatus 14 disabling the constraints.
- step 335 the data masking apparatus 14 performs data masking at a column level in the database table, although the data masking apparatus 14 can perform data masking using other techniques.
- An illustration of the column level data masking is illustrated in FIG. 5.
- step 340 the data masking apparatus 14 generates one or more update statements about the data masking into a stmctured query language (SQL) file, although the data masking apparatus 14 can generate the update statement in other formats.
- the update statements are generated based on the output of the data masking, although the update statements can be generated based on other types or numbers of parameters.
- FIG. 7 each record that has all its confidential data masked with the preconfigured algorithm is converted into a single row SQL update statement for performance.
- SQLs are generated to update columns (BO_NAME, ADDRESS 1, ADDRESS2, etc.) in table PS_PT_CIS_TMNT_AUD with masked values using a single SQL statement.
- step 345 the data masking apparatus 14 executes the SQL file on the database table.
- the disclosed technology is able to covert the obtained database into a data masked database to encrypt or protect the integrity of the data.
- step 350 the data masking apparatus 14 enables the constraints that were disabled in step 330.
- the disclosed technology is able to maintain the relationship and mles that were present in the database that was obtained back in step 310.
- an exemplary illustration of the data masking apparatus 14 enabling the constraints is illustrated in LIG. 8.
- step 355 the data masking apparatus 14 updates the log status with the time, date and the corresponding request for which the data masking was performed in the log table and the exemplary method ends at step 360.
- this technology provides more effective and accurate data masking. Additionally, this technology enables masked data to easily be recovered from any point of failure during the masking process.
Landscapes
- Engineering & Computer Science (AREA)
- Theoretical Computer Science (AREA)
- Databases & Information Systems (AREA)
- Physics & Mathematics (AREA)
- General Physics & Mathematics (AREA)
- General Engineering & Computer Science (AREA)
- Health & Medical Sciences (AREA)
- Bioethics (AREA)
- General Health & Medical Sciences (AREA)
- Data Mining & Analysis (AREA)
- Computer Hardware Design (AREA)
- Computer Security & Cryptography (AREA)
- Software Systems (AREA)
- Computational Linguistics (AREA)
- Medical Informatics (AREA)
- Library & Information Science (AREA)
- Mathematical Physics (AREA)
- Information Retrieval, Db Structures And Fs Structures Therefor (AREA)
Abstract
Methods, non-transitory computer readable media, and an apparatus that includes obtaining a database and metadata associated with the database in response to a request for data masking. Next, the obtained metadata is compared with the received request to determine when the obtained metadata validates the received request. A data masking operation is performed on the obtained database at a column level when the determination indicates the received request is validated. A record of the performance of the data masking operation on the obtained database at the column level is stored.
Description
METHODS FOR DATA MASKING AND DEVICES THEREOF
DETAILED DESCRIPTION
[0001] This application claims priority from US Patent Application Serial No.
16/145,713, filed September 28, 2018, which claims the benefit of U.S. Provisional Patent Application Serial No. 62/681,921 , filed June 7, 2018, the contents of each of which are hereby incorporated by reference in their respective entireties.
FIELD
[0002] This technology generally relates to methods and devices for data security and, more particularly, to methods for data masking and devices thereof.
BACKGROUND
[0003] Dynamic data masking refers to securing data in real time by masking sensitive data as it is accessed, such that sensitive information is not provided to unauthorized recipients. Thus, for example, when a database query is received from an unauthorized or restricted user or application, dynamic data masking may be employed to mask some or all of the data so that sensitive data is not exposed to the requestor. To implement data masking, some prior approaches, have analyzed and modified data queries to cause resulting data that is retrieved to be masked. Other prior approaches have defined rules implemented at the database level that specify specific tables and columns to be masked in anticipation of queries. Unfortunately, these prior approaches are not effective because they do not adapt to new type of data attributes and also requires regular maintenance to adapt to the ever changing requirements for data masking.
SUMMARY
[0004] A method for data masking includes obtaining a database and metadata associated with the database in response to a request for data masking. Next, the obtained metadata is compared with the received request to determine when the obtained metadata validates the received request. A data masking operation is performed on the obtained database at a column level when the determination indicates the received request is
validated. A record of the performance of the data masking operation on the obtained database at the column level is stored.
[0005] A non-transitory computer readable medium having stored thereon instructions for data masking comprising machine executable code which when executed by at least one processor, causes the processor to perform steps including obtaining a database and metadata associated with the database in response to a request for data masking. Next, the obtained metadata is compared with the received request to determine when the obtained metadata validates the received request. A data masking operation is performed on the obtained database at a column level when the determination indicates the received request is validated. A record of the performance of the data masking operation on the obtained database at the column level is stored.
[0006] A data masking apparatus including at least one of configurable hardware logic configured to be capable of implementing or a processor coupled to a memory and configured to execute programmed instructions stored in the memory to obtain a database and metadata associated with the database in response to a request for data masking.
Next, the obtained metadata is compared with the received request to determine when the obtained metadata validates the received request. A data masking operation is performed on the obtained database at a column level when the determination indicates the received request is validated. A record of the performance of the data masking operation on the obtained database at the column level is stored.
[0007] This technology provides a number of advantages including providing a method, non-transitory computer readable medium, apparatus, and system that provides more effective and accurate data masking. Additionally, with the disclosed technology the masked data can easily be recoverable from any point of failure during the masking process. Furthermore, the disclosed technology secures the data while the data masking process is performed.
BRIEF DESCRIPTION OF THE DRAWINGS
[0008] FIG. 1 is an example of a block diagram of a data masking apparatus for data masking;
[0009] FIG. 2 is an example of a block diagram of a data masking apparatus;
[0010] FIG. 3 is an exemplary flowchart of a method for data masking; and
[0011] FIG. 4 is an exemplary illustration of a database divided into a plurality of tables;
[0012] FIG. 5 is an exemplary illustration of data masking at a column level;
[0013] FIG. 6 is an exemplary illustration of disabling constraints;
[0014] FIG. 7 is an exemplary illustration of the masked data; and
[0015] FIG. 8 is an exemplary illustration of enabling the disabled constraints.
DETAILED DESCRIPTION
[0016] A network environment 10 with an example of a data masking apparatus 14 is illustrated in FIGS. 1-2. In this particular example, the environment 10 includes the data masking apparatus 14, client computing devices 12(1)-12(h), plurality of server databases 16(1)-16(h) coupled via one or more communication networks 30, although the environment could include other types and numbers of systems, devices, components, and/or other elements as is generally known in the art and will not be illustrated or described herein. This technology provides a number of advantages including providing methods, non-transitory computer readable medium, and apparatuses that system that provides more effective and accurate data masking.
[0017] Referring more specifically to FIGS. 1-2, the data masking apparatus 14 is programmed to perform a number of data management operations including data masking, although the apparatus can perform other types and/or numbers of functions and/or other operations. In this particular example, the data masking apparatus 14 includes a processor 18, a memory 20, and a communication system 24 which are coupled together by a bus 26, although the data masking apparatus 14 may comprise other types and/or numbers of physical and/or virtual systems, devices, components, and/or other elements in other configurations.
[0018] The processor 18 in the data masking apparatus 14 may execute one or more programmed instructions stored in the memory 20 for data masking as illustrated and described in the examples herein, although other types and numbers of functions and/or other operations can be performed. The processor 18 in the data masking apparatus 14
may include one or more central processing units and/or general purpose processors with one or more processing cores, for example.
[0019] The memory 20 in the data masking apparatus 14 stores the programmed instructions and other data for one or more aspects of the present technology as described and illustrated herein, although some or all of the programmed instructions could be stored and executed elsewhere. A variety of different types of memory storage devices, such as a random access memory (RAM) or a read only memory (ROM) in the system or a floppy disk, hard disk, CD ROM, DVD ROM, or other computer readable medium which is read from and written to by a magnetic, optical, or other reading and writing system that is coupled to the processor 18, can be used for the memory 20.
[0020] The communication system 24 in the data masking apparatus 14 operatively couples and communicates between one or more of the client computing devices 12(1)- l2(n) and one or more of the plurality of server databases 16(1)-16(h), which are all coupled together by one or more of the communication networks 30, although other types and numbers of communication networks or systems with other types and numbers of connections and configurations to other devices and elements. By way of example only, the communication networks 30 can use TCP/IP over Ethernet and industry-standard protocols, including NFS, CIFS, SOAP, XMF, FDAP, SCSI, and SNMP, although other types and numbers of communication networks, can be used. The communication networks 30 in this example may employ any suitable interface mechanisms and network communication technologies, including, for example, any local area network, any wide area network (e.g., Internet), teletraffic in any suitable form (e.g., voice, modem, and the like), Public Switched Telephone Network (PSTNs), Ethernet-based Packet Data Networks (PDNs), and any combinations thereof and the like.
[0021] In this particular example, each of the client computing devices 12(1)-12(h) may interact with applications executing on the data masking apparatus 14 and/or the plurality of server databases 16(1)-16(h), although the plurality of client computing devices 12(1)-12(h) can interact with the data masking apparatus 14 or the plurality of server databases 16(1)-16(h). Each of the client computing devices 12(1)-12(h) may include a processor, a memory, user input device, such as a keyboard, mouse, and/or interactive display screen by way of example only, a display device, and a
communication interface, which are coupled together by a bus or other link, although
each may have other types and/or numbers of other systems, devices, components, and/or other elements.
[0022] The plurality of server databases 16(1)-16(h) may store and provide data files, by way of example only, to the data masking apparatus 14 via one or more of the communication networks 30, for example, although other types and/or numbers of storage media in other configurations could be used. Additionally, the plurality of server databases 16(1)-16(h) hosts a plurality data tables that the plurality of client computing devices 12(1)-12(h) can access via the data masking apparatus 14. In this particular example, each of the plurality of server databases 16(1)-16(h) may comprise various combinations and types of storage hardware and/or software and represent a system with multiple network server devices in a data storage pool, which may include internal or external networks. Various network processing applications, such as CIFS applications, NFS applications, HTTP Web Network server device applications, and/or FTP applications, may be operating on the plurality of server databases 16(1)-16(h) and may transmit data in response to requests from the data masking apparatus 14. Each the plurality of server databases 16(1)-16(h) may include a processor, a memory, and a communication interface, which are coupled together by a bus or other link, although each may have other types and/or numbers of other systems, devices, components, and/or other elements.
[0023] Although the exemplary network environment 10 with the data masking apparatus 14, the plurality of client computing devices 12(1)-12(h), the plurality of server databases 16(1)-16(h), and the communication networks 30 are described and illustrated herein, other types and numbers of systems, devices, components, and/or elements in other topologies can be used. It is to be understood that the systems of the examples described herein are for exemplary purposes, as many variations of the specific hardware and software used to implement the examples are possible, as will be appreciated by those skilled in the relevant art(s).
[0024] In addition, two or more computing systems or devices can be substituted for any one of the systems or devices in any example. Accordingly, principles and advantages of distributed processing, such as redundancy and replication also can be implemented, as desired, to increase the robustness and performance of the devices, apparatuses, and systems of the examples. The examples may also be implemented on
computer system(s) that extend across any suitable network using any suitable interface mechanisms and traffic technologies, including by way of example only teletraffic in any suitable form (e.g., voice and modem), wireless traffic media, wireless traffic networks, cellular traffic networks, G3 traffic networks, Public Switched Telephone Network (PSTNs), Packet Data Networks (PDNs), the Internet, intranets, and combinations thereof.
[0025] The examples also may be embodied as a non-transitory computer readable medium having instmctions stored thereon for one or more aspects of the present technology as described and illustrated by way of the examples herein, as described herein, which when executed by the processor, cause the processor to carry out the steps necessary to implement the methods of this technology as described and illustrated with the examples herein.
[0026] An example of a method for data masking will now be described with reference to FIGS. 1-8. In step 305, the data masking apparatus 14 receives a request for data masking of one or more databases from one of the plurality of client computing devices 12(1)-12(h), although the data masking apparatus 14 can receive request to perform data masking on other data, such as a specific table or a schema of a specific database, by way of example. In this example, the data in the one or more databases can include financial data associated with one or more customers, although the database can include other types or amounts of information.
[0027] In step 310, the data masking apparatus 14 obtains the database for which the data masking has been requested from one of the plurality of server databases 16(1)- l6(n), although the data masking apparatus 14 can obtain the database from other locations.
[0028] Next in step 315, the data masking apparatus 14 obtains the metadata associated with the obtained database. In this example, the metadata of the database includes data associated with the rows and columns of the obtained database, although the metadata can include other types or amounts of information. An example of the metadata associated with the database is illustrated in FIG. 4.
[0029] In step 320, the data masking apparatus 14 performs validation of the metadata. In this example for the metadata validation, the data masking apparatus 14
compares the received request with the obtained metadata to determine if the received request has the data necessary to perform the data masking. In this example, if the data masking apparatus 14 determines that the received request does not include the data necessary to perform data masking, then the No branch is taken to step 360 where the data masking apparatus 14 rejects the received request and the exemplary method ends. However, if the data masking apparatus 14 determines that the received request does include the data necessary to perform data masking, then the Yes branch is taken to step 325.
[0030] In step 325, the data masking apparatus 14 divides the obtained database into a plurality of tables. An example of the data masking apparatus 14 dividing the obtained database into a plurality of tables is illustrated in FIG. 4. By dividing the database into a plurality of tables, the disclosed technology is able to achieve parallelism to perform data masking more efficiently and quickly when compared to the existing technologies.
Additionally in this example, each of the divided tables can be converted into a trigger file that would assist with the data masking of the database.
[0031] In step 330, the data masking apparatus 14 disables constraints associated with the database table. By way of example, constraints relates to the relationship of the data present in one cell of the database table to the data present in other cells, although the constraints can include other types or amounts of rules present in the database tables. In this example, FIG. 6 illustrates an example of the data masking apparatus 14 disabling the constraints.
[0032] In step 335, the data masking apparatus 14 performs data masking at a column level in the database table, although the data masking apparatus 14 can perform data masking using other techniques. An illustration of the column level data masking is illustrated in FIG. 5.
[0033] In step 340, the data masking apparatus 14 generates one or more update statements about the data masking into a stmctured query language (SQL) file, although the data masking apparatus 14 can generate the update statement in other formats. In this example, the update statements are generated based on the output of the data masking, although the update statements can be generated based on other types or numbers of parameters. By way of example, as illustrated in FIG. 7, each record that has all its
confidential data masked with the preconfigured algorithm is converted into a single row SQL update statement for performance. In FIG. 6, SQLs are generated to update columns (BO_NAME, ADDRESS 1, ADDRESS2, etc.) in table PS_PT_CIS_TMNT_AUD with masked values using a single SQL statement.
[0034] Next in step 345, the data masking apparatus 14 executes the SQL file on the database table. By executing the SQL file, the disclosed technology is able to covert the obtained database into a data masked database to encrypt or protect the integrity of the data.
[0035] In step 350, the data masking apparatus 14 enables the constraints that were disabled in step 330. By enabling the constraints, the disclosed technology is able to maintain the relationship and mles that were present in the database that was obtained back in step 310. By way of example, an exemplary illustration of the data masking apparatus 14 enabling the constraints is illustrated in LIG. 8.
[0036] In step 355, the data masking apparatus 14 updates the log status with the time, date and the corresponding request for which the data masking was performed in the log table and the exemplary method ends at step 360.
[0037] Accordingly, as illustrated by way of the examples herein this technology provides more effective and accurate data masking. Additionally, this technology enables masked data to easily be recovered from any point of failure during the masking process.
[0038] Having thus described the basic concept of the invention, it will be rather apparent to those skilled in the art that the foregoing detailed disclosure is intended to be presented by way of example only, and is not limiting. Various alterations,
improvements, and modifications will occur and are intended to those skilled in the art, though not expressly stated herein. These alterations, improvements, and modifications are intended to be suggested hereby, and are within the spirit and scope of the invention. Additionally, the recited order of processing elements or sequences, or the use of numbers, letters, or other designations therefore, is not intended to limit the claimed processes to any order except as may be specified in the claims. Accordingly, the invention is limited only by the following claims and equivalents thereto.
Claims
1. A method for data masking comprising:
obtaining, by a data masking apparatus, a database and metadata associated with the database in response to a received request for data masking;
comparing, by the data masking apparatus, the obtained metadata with the received request to determine when the obtained metadata validates the received request;
performing, by the data masking apparatus, a data masking operation on the obtained database at a column level when the determination indicates the received request is validated; and
storing, by the data masking apparatus, a record of the performance of the data masking operation on the obtained database at the column level.
2. The method as set forth in claim 1 further comprising, dividing, by the data masking apparatus, the obtained database into a plurality of database tables prior to performing the data masking operation.
3. The method as set forth in claim 1 further comprising, disabling, by the data masking apparatus, one or more constraints in the obtained database prior to performing the data masking operation.
4. The method as set forth in claim 2 wherein the data masking operation is performed on one or more columns of the divided plurality of database tables.
5. The method as set forth in claim 4 further comprising, generating, by the data masking apparatus, one or more stmctured query language files from the data masked plurality of database tables.
6. The method as set forth in claim 1 further comprising, enabling, by the data masking apparatus, the one or more constraints after performing the data masking.
7. A non-transitory computer readable medium having stored thereon instructions for data masking comprising executable code, which when executed by at least one processor, cause the processor to:
obtain a database and metadata associated with the database in response to a received request for data masking;
compare the obtained metadata with the received request to determine when the obtained metadata validates the received request;
perform a data masking operation on the obtained database at a column level when the determination indicates the received request is validated; and store a record of the performance of the data masking operation on the obtained database at the column level.
8. The medium as set forth in claim 7 further comprising, divide the obtained database into a plurality of database tables prior to performing the data masking operation.
9. The medium as set forth in claim 7 further comprising, disabling one or more constraints in the obtained database prior to performing the data masking operation.
10. The medium as set forth in claim 8 wherein the data masking operation is performed on one or more columns of the divided plurality of database tables.
11. The medium as set forth in claim 10 further comprising, generating one or more structured query language files from the data masked plurality of database tables.
12. The medium as set forth in claim 7 further comprising enabling the one or more constraints after performing the data masking.
13. A data masking apparatus comprising:
a processor; and
a memory coupled to the processor which is configured to be capable of executing programmed instmctions comprising and stored in the memory to: obtain a database and metadata associated with the database in response to a received request for data masking;
compare the obtained metadata with the received request to determine when the obtained metadata validates the received request;
perform a data masking operation on the obtained database at a column level when the determination indicates the received request is validated; and store a record of the performance of the data masking operation on the obtained database at the column level.
14. The apparatus as set forth in claim 13 wherein the processor is further configured to be capable of executing the stored programmed instmctions to divide the obtained database into a plurality of database tables prior to performing the data masking operation.
15. The apparatus as set forth in claim 13 wherein the processor is further configured to be capable of executing the stored programmed instmctions to disable one or more constraints in the obtained database prior to performing the data masking operation.
16. The apparatus as set forth in claim 14 wherein the data masking operation is performed on one or more columns of the divided plurality of database tables.
17. The apparatus as set forth in claim 16 wherein the processor is further configured to be capable of executing the stored programmed instmctions to generate one or more structured query language files from the data masked plurality of database tables.
18. The apparatus as set forth in claim 13 wherein the processor is further configured to be capable of executing the stored programmed instmctions to enable the one or more constraints after performing the data masking.
Priority Applications (1)
Application Number | Priority Date | Filing Date | Title |
---|---|---|---|
EP19816170.5A EP3803669A4 (en) | 2018-06-07 | 2019-06-06 | Methods for data masking and devices thereof |
Applications Claiming Priority (4)
Application Number | Priority Date | Filing Date | Title |
---|---|---|---|
US201862681921P | 2018-06-07 | 2018-06-07 | |
US62/681,921 | 2018-06-07 | ||
US16/145,713 | 2018-09-28 | ||
US16/145,713 US10909260B2 (en) | 2018-06-07 | 2018-09-28 | Methods for data masking and devices thereof |
Publications (1)
Publication Number | Publication Date |
---|---|
WO2019236872A1 true WO2019236872A1 (en) | 2019-12-12 |
Family
ID=68765122
Family Applications (1)
Application Number | Title | Priority Date | Filing Date |
---|---|---|---|
PCT/US2019/035825 WO2019236872A1 (en) | 2018-06-07 | 2019-06-06 | Methods for data masking and devices thereof |
Country Status (3)
Country | Link |
---|---|
US (1) | US10909260B2 (en) |
EP (1) | EP3803669A4 (en) |
WO (1) | WO2019236872A1 (en) |
Families Citing this family (6)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US11157645B2 (en) * | 2018-11-01 | 2021-10-26 | International Business Machines Corporation | Data masking with isomorphic functions |
US11227065B2 (en) * | 2018-11-06 | 2022-01-18 | Microsoft Technology Licensing, Llc | Static data masking |
US11507699B2 (en) * | 2019-09-27 | 2022-11-22 | Intel Corporation | Processor with private pipeline |
US11451371B2 (en) * | 2019-10-30 | 2022-09-20 | Dell Products L.P. | Data masking framework for information processing system |
US20220035939A1 (en) * | 2020-08-03 | 2022-02-03 | Jpmorgan Chase Bank, N.A. | Method and system for dynamic data masking |
CN114117511A (en) * | 2020-09-01 | 2022-03-01 | 华为技术有限公司 | Data desensitization method, data desensitization device and storage equipment |
Citations (6)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US20080065665A1 (en) * | 2006-09-08 | 2008-03-13 | Plato Group Inc. | Data masking system and method |
US20090100527A1 (en) * | 2007-10-10 | 2009-04-16 | Adrian Michael Booth | Real-time enterprise data masking |
US20100030795A1 (en) * | 2008-07-30 | 2010-02-04 | Oracle International Corp. | Maintaining referential integrity while masking |
US20100205189A1 (en) * | 2009-02-11 | 2010-08-12 | Verizon Patent And Licensing Inc. | Data masking and unmasking of sensitive data |
US20130144901A1 (en) * | 2011-12-01 | 2013-06-06 | Oracle International Corporation | Real-time data redaction in a database management system |
US20170323119A1 (en) * | 2016-05-06 | 2017-11-09 | Idera, Inc. | Systems and methods for dynamic masking of data |
Family Cites Families (1)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
WO2012127322A1 (en) * | 2011-03-22 | 2012-09-27 | Active-Base Ltd. | System and method for data masking |
-
2018
- 2018-09-28 US US16/145,713 patent/US10909260B2/en active Active
-
2019
- 2019-06-06 WO PCT/US2019/035825 patent/WO2019236872A1/en unknown
- 2019-06-06 EP EP19816170.5A patent/EP3803669A4/en active Pending
Patent Citations (6)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US20080065665A1 (en) * | 2006-09-08 | 2008-03-13 | Plato Group Inc. | Data masking system and method |
US20090100527A1 (en) * | 2007-10-10 | 2009-04-16 | Adrian Michael Booth | Real-time enterprise data masking |
US20100030795A1 (en) * | 2008-07-30 | 2010-02-04 | Oracle International Corp. | Maintaining referential integrity while masking |
US20100205189A1 (en) * | 2009-02-11 | 2010-08-12 | Verizon Patent And Licensing Inc. | Data masking and unmasking of sensitive data |
US20130144901A1 (en) * | 2011-12-01 | 2013-06-06 | Oracle International Corporation | Real-time data redaction in a database management system |
US20170323119A1 (en) * | 2016-05-06 | 2017-11-09 | Idera, Inc. | Systems and methods for dynamic masking of data |
Non-Patent Citations (1)
Title |
---|
See also references of EP3803669A4 * |
Also Published As
Publication number | Publication date |
---|---|
US20190377895A1 (en) | 2019-12-12 |
EP3803669A4 (en) | 2022-03-02 |
EP3803669A1 (en) | 2021-04-14 |
US10909260B2 (en) | 2021-02-02 |
Similar Documents
Publication | Publication Date | Title |
---|---|---|
US10909260B2 (en) | Methods for data masking and devices thereof | |
JP7130600B2 (en) | Implementing semi-structured data as first-class database elements | |
Harris et al. | 4store: The design and implementation of a clustered RDF store | |
EP3243305B1 (en) | Distributed storage and distributed processing query statement reconstruction in accordance with a policy | |
EP2282449B1 (en) | Message descriptions | |
US10628492B2 (en) | Distributed graph database writes | |
US9418094B2 (en) | Method and apparatus for performing multi-stage table updates | |
WO2014140941A1 (en) | Secure matching supporting fuzzy data | |
KR20090079248A (en) | Pattern-based filtering of query input | |
US11372569B2 (en) | De-duplication in master data management | |
JP6763830B2 (en) | Platform-based data isolation | |
US11669505B2 (en) | Partitioning, processing, and protecting data | |
CN109543089A (en) | Classification method, system and related device of network security information data | |
CN110909087A (en) | Method and device for modifying table structure of online DDL (distributed data storage) of relational database | |
CN114969819A (en) | Data asset risk discovery method and device | |
EP3107010B1 (en) | Data integration pipeline | |
US20240232420A9 (en) | System and method of dynamic search result permission checking | |
CN116204534B (en) | Data archiving method, device, equipment and storage medium | |
KR20160050930A (en) | Apparatus for Processing Transaction with Modification of Data in Large-Scale Distributed File System and Computer-Readable Recording Medium with Program | |
CN108256019A (en) | Database key generation method, device, equipment and its storage medium | |
JP2017537398A (en) | Generating unstructured search queries from a set of structured data terms | |
US11720563B1 (en) | Data storage and retrieval system for a cloud-based, multi-tenant application | |
US20230418825A1 (en) | Database system, database structure, and associated methods | |
Ren et al. | Partition-based data cube storage and parallel queries for cloud computing | |
US11632380B2 (en) | Identifying large database transactions |
Legal Events
Date | Code | Title | Description |
---|---|---|---|
121 | Ep: the epo has been informed by wipo that ep was designated in this application |
Ref document number: 19816170 Country of ref document: EP Kind code of ref document: A1 |
|
NENP | Non-entry into the national phase |
Ref country code: DE |
|
ENP | Entry into the national phase |
Ref document number: 2019816170 Country of ref document: EP Effective date: 20210111 |