Multilevel secure database

• US 20060206485A1
• Filed: 03/14/2005
• Published: 09/14/2006
• Est. Priority Date: 03/14/2005
• Status: Active Grant

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Corporation
• Inventors: Rubin, Donald B., Neumann, William C., Rask, Arthur T.
• Granted Patent: US 7,539,682 B2
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: G06F 16/20 of structured data, e.g. relational data
• CPC Class Codes: G06F 21/6227 where protection concerns the structure of data, e.g. records, types, queries
• CPC Class Codes: G06F 2221/2113 Multi-level security, e.g. mandatory access control
• CPC Class Codes: Y10S 707/99939 Privileged access

Abstract

Row level security (RLS) and cell level security (CLS) are implemented in a database to provide secure dynamic access to database data. Encryption keys are created based on either security classification meta-data tags associated with the individual fields of an incoming data stream or on the security classification of the source network. Without prior knowledge of the incoming data security classification, the present system may generate encryption keys and, if necessary, security classification meta-data on the fly.

Claims

1. A method for providing access to a database, comprising:

receiving a set of user access tokens;

retrieving permission information associated with each user access token; and

associating a selected portion of the permission information to selected data within a database; and

providing access to the data that is associated with the selected portion of the permission information.

2. The method of claim 1, wherein associating a selected portion includes:

matching a portion of the permission information to the set of user access tokens; and

selecting database data associated with the matched permission information.

3. The method of claim 1, wherein the set of user tokens is a set of security permission categories.

4. The method of claim 3, wherein each category has one or more markings.

5. The method of claim 3, wherein each category is associated with a set of attributes.

6. The method of claim 5, wherein each attribute is associated with an action.

7. The method of claim 4, wherein each database field is associated with a set of markings.

8. The method of claim 1, wherein providing access to the data includes:

decrypting the data associated with the selected portion of the permission information.

9. The method of claim 1, wherein the selected data within a database is selected at the cell level of the database.

10. A method for generating an encryption key for a database field, comprising:

accessing data;

assigning security information to the accessed data;

encrypting the data with an encryption key;

associating the encryption key with the security information

11. The method of claim 10, wherein accessing the data includes:

receiving the data, the security information derived from information embedded in the received data.

12. The method of claim 10, wherein accessing the data includes:

receiving the data, the security information is derived from a data source associated with the received data.

13. The method of claim 10, wherein assigning security information includes:

modifying a security information framework upon accessing data associated with unrecognized security information.

14. The method of claim 10, wherein modifying a security information framework includes modifying information within one or more tables to include the unrecognized security information

15. A method for managing meta-data, comprising:

receiving one or more sets of data tokens;

determining a category for each token;

generating a data label for each set of data tokens; and

associating each token in the set of data tokens with the associated category and data label.

16. The method of claim 15, wherein each data label includes tokens in the same category.

17. The method of claim 15, wherein associating each token includes:

maintaining the tokens, category and generated label in a table.

18. The method of claim 15, wherein each label is a unique label.

19. The method of claim 18, wherein associating each token includes:

maintaining each set of tokens and associated unique label in a table.

20. The method of claim 15, wherein determining a category for each token includes:

determining a valid digital signature associated with the sets of data tokens.