Data access policies

• US 10,476,911 B2
• Filed: 07/14/2017
• Issued: 11/12/2019
• Est. Priority Date: 11/27/2013
• Status: Active Grant

• Current Assignee: Workday Incorporated
• Original Assignee: AT&T Intellectual Property I LP (AT&T, Inc.)
• Inventors: Vahlis, Evgene, Giura, Paul
• Primary Examiner(s): Lewis, Lisa C
• Application Number:
  US15/649,692
• Publication Number:
  US 20170318058A1
• Time in Patent Office: 851 Days
• CPC Class Codes: G06F 16/122 using management policies backup systems G06F11/1446; file migration policies for HSM systems G06F16/185
• CPC Class Codes: G06F 16/245 Query processing
• CPC Class Codes: G06F 21/602 Providing cryptographic facilities or services
• CPC Class Codes: G06F 21/6227 where protection concerns the structure of data, e.g. records, types, queries
• CPC Class Codes: G06F 2221/2149 Restricted operating environment
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/105 Multiple levels of security
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04L 9/3226 using a predetermined code, e.g. password, passphrase or PIN network architectures or network communication protocols for supporting authentication of entities using passwords in a packet data network H04L63/083

Abstract

To verify compliance with a data access policy, a query result including data specified by a requesting entity and a representation of a data access policy is received from a database. Based on the representation of the data access policy included in the query result, it is verified whether the requesting entity is permitted to access the data included in the query result. Transmission of the data included in the query result to the requesting entity is controlled responsive to the verification. Related methods, systems, and computer program products are also discussed.

Claims

1. A method, comprising:

receiving, by a server, a query sent from a client device, the query requesting electronic data records associated with a database;

generating, by the server, a modified query in response to the receiving of the query, the modified query requesting the electronic data records and specifying a representation of a data access policy;

querying, by the server, the database for the representation of the data access policy specified by the modified query;

retrieving, by the server, the electronic data records associated by the database with the representation of the data access policy; and

forwarding, by the server, the electronic data records to an agent for a verification that the electronic data records comply with the data access policy specified by the modified query.

2. The method of claim 1, further comprising retrieving the representation of the data access policy.

3. The method of claim 1, further comprising comparing the electronic data records to the data access policy.

4. The method of claim 3, further comprising matching at least one of the electronic data records with the data access policy.

5. The method of claim 1, further comprising retrieving a cryptographic key that is associated by the database with the representation of the data access policy.

6. The method of claim 5, further comprising generating electronic values associated with the electronic data records using the cryptographic key.

7. A system, comprising:

a processor; and

a memory device, the memory device storing instructions, the instructions when executed causing the processor to perform operations, the operations comprising;

receiving a query sent from a client device, the query requesting electronic data records associated with a database;

generating a modified query in response to the receiving of the query, the modified query requesting the electronic data records and specifying a representation of a data access policy;

querying the database for the representation of the data access policy specified by the modified query;

retrieving the electronic data records associated by the database to the representation of the data access policy; and

forwarding the electronic data records to a checker agent for a verification that the electronic data records comply with the data access policy.

8. The system of claim 7, wherein the operations further comprise retrieving the representation of the data access policy.

9. The system of claim 7, wherein the operations further comprise comparing the electronic data records to the representation of the data access policy.

10. The system of claim 9, wherein the operations further comprise matching at least one of the electronic data records with the representation of the data access policy.

11. The system of claim 7, wherein the operations further comprise retrieving a cryptographic key that is associated by the database with the representation of the data access policy.

12. The system of claim 11, wherein the operations further comprise generating electronic values representing the electronic data records using the cryptographic key.