Method and apparatus for controlling access to personally identifiable information

• US 20060085443A1
• Filed: 10/19/2004
• Published: 04/20/2006
• Est. Priority Date: 10/19/2004
• Status: Active Grant

• Current Assignee: Oracle International Corporation (Oracle Corporation)
• Original Assignee: Oracle International Corporation (Oracle Corporation)
• Inventors: Singh, Rajesh C., Pae, Christine Y.
• Granted Patent: US 7,716,242 B2
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: G06F 21/6227 where protection concerns the structure of data, e.g. records, types, queries
• CPC Class Codes: G06F 21/6245 Protecting personal data, e.g. for financial or medical purposes

Abstract

One embodiment of the present invention provides a system that controls access to personally identifiable information (PII) in a database system. During operation, the system receives a request from an application to perform a function which involves accessing information in the database system. In response to the request, the system identifies a purpose that the application has in making request to perform the function. Next, the system uses the purpose to identify a set of attributes in the database system, which are associated with the purpose. The system then determines if any of the identified attributes contain PII. If so, the system enforces access controls while accessing the identified attributes containing PII.

Claims

1. A method for controlling access to personally identifiable information (PII) in a database system, comprising:

receiving a request from an application to perform a function which involves accessing information in the database system;

identifying a purpose that the application has in making request to perform the function;

using the purpose to identify a set of attributes in the database system which are associated with the purpose; and

determining if any of the identified attributes contain PII, and if so enforcing access controls while accessing the identified attributes containing PII.

2. The method of claim 1, wherein after identifying the purpose associated with the request, the method additionally comprises:

identifying a role associated with the application;

determining if the role is empowered to have the identified purpose; and

if so, identifying the set of attributes associated with the purpose.

3. The method of claim 1, wherein enforcing the access controls involves restricting access to specific attributes containing PII for users who have opted out of disclosing the specific attributes.

4. The method of claim 3,

wherein users can opt out of disclosing “

voluntary attributes”

containing PII; and

wherein users cannot opt out of disclosing other “

mandatory attributes”

containing PII.

5. The method of claim 1, further comprising enforcing policies for attributes containing PII in the database system.

6. The method of claim 1, further comprising restricting access to specific attributes in the database system containing PII regardless of the purpose.

7. The method of claim 1, further comprising restricting access to specific attributes in the database system which do not contain PII.

8. The method of claim 1, wherein the database system includes tables, which are organized into rows and columns, wherein the columns are associated with attributes.

9. The method of claim 1, wherein each attribute containing PII is associated with a sensitivity level which indicates whether the attribute is, public, private, confidential or sensitive.

10. A computer-readable storage medium storing instructions that when executed by a computer cause the computer to perform a method for controlling access to personally identifiable information (PII) in a database system, the method comprising:

receiving a request from an application to perform a function which involves accessing information in the database system;

identifying a purpose that the application has in making request to perform the function;

using the purpose to identify a set of attributes in the database system which are associated with the purpose; and

determining if any of the identified attributes contain PII, and if so enforcing access controls while accessing the identified attributes containing PII.

11. The computer-readable storage medium of claim 10, wherein after identifying the purpose associated with the request, the method additionally comprises:

identifying a role associated with the application;

determining if the role is empowered to have the identified purpose; and

if so, identifying the set of attributes associated with the purpose.

12. The computer-readable storage medium of claim 10, wherein enforcing the access controls involves restricting access to specific attributes containing PII for users who have opted out of disclosing the specific attributes.

13. The computer-readable storage medium of claim 12,

wherein users can opt out of disclosing “

voluntary attributes”

containing PII; and

wherein users cannot opt out of disclosing other “

mandatory attributes”

containing PII.

14. The computer-readable storage medium of claim 10, wherein the method further comprises enforcing policies for attributes containing PII in the database system.

15. The computer-readable storage medium of claim 10, wherein the method further comprises restricting access to specific attributes in the database system containing PII regardless of the purpose.

16. The computer-readable storage medium of claim 10, wherein the method further comprises restricting access to specific attributes in the database system which do not contain PII.

17. The computer-readable storage medium of claim 10, wherein the database system includes tables, which are organized into rows and columns, wherein the columns are associated with attributes.

18. The computer-readable storage medium of claim 10, wherein each attribute containing PII is associated with a sensitivity level which indicates whether the attribute is, public, private, confidential or sensitive.

19. An apparatus for controlling access to personally identifiable information (PII) in a database system, comprising:

a receiving mechanism configured to receive a request from an application to perform a function which involves accessing information in the database system;

an purpose identification mechanism configured to identify a purpose that the application has in making request to perform the function;

an attribute identification mechanism configured to use the purpose to identify a set of attributes in the database system which are associated with the purpose; and

an access control mechanism configured to determine if any of the identified attributes contain PII, and if so to enforce access controls while accessing the identified attributes containing PII.

20. The apparatus of claim 19, wherein the apparatus additionally comprises:

a role identification mechanism configured to identify a role associated with the application;

wherein the attribute identification mechanism is additionally configured to,

determine if the role is empowered to have the identified purpose; and

if so, to identify the set of attributes associated with the purpose.

21. The apparatus of claim 19, wherein the access control mechanism is configured to restrict access to specific attributes containing PII for users who have opted out of disclosing the specific attributes.

22. The apparatus of claim 21,

wherein users can opt out of disclosing “

voluntary attributes”

containing PII; and

wherein users cannot opt out of disclosing other “

mandatory attributes”

containing PII.

23. The apparatus of claim 19, wherein the access control mechanism is additionally configured to enforce policies for attributes containing PII in the database system.

24. The apparatus of claim 19, wherein the access control mechanism is additionally configured to restrict access to specific attributes in the database system containing PII regardless of the purpose.

25. The apparatus of claim 19, wherein the access control mechanism is additionally configured to restrict access to specific attributes in the database system which do not contain PII.

26. The apparatus of claim 19, wherein the database system includes tables, which are organized into rows and columns, wherein the columns are associated with attributes.

27. The apparatus of claim 19, wherein each attribute containing PII is associated with a sensitivity level which indicates whether the attribute is, public, private, confidential or sensitive.