Auditing compliance with a hippocratic database

• US 20060212491A1
• Filed: 03/21/2005
• Published: 09/21/2006
• Est. Priority Date: 03/21/2005
• Status: Active Grant

• Current Assignee: LinkedIn Corporation (Microsoft Corporation)
• Original Assignee: International Business Machines Corporation
• Inventors: Kiernan, Gerald George, Agrawal, Rakesh, Faloutsos, Christos, Rantzau, Ralf, Srikant, Ramakrishnan, Bayardo, Roberto
• Granted Patent: US 7,810,142 B2
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: G06F 21/6227 where protection concerns the structure of data, e.g. records, types, queries
• CPC Class Codes: G06F 21/6245 Protecting personal data, e.g. for financial or medical purposes
• CPC Class Codes: G06F 2221/2101 Auditing as a secondary aspect
• CPC Class Codes: G16H 10/60 for patient-specific data, e.g. for electronic patient records

Abstract

An auditing framework for determining whether a database disclosure of information adhered to its data disclosure policies. Users formulate audit expressions to specify the (sensitive) data subject to disclosure review. An audit component accepts audit expressions and returns all queries (deemed “suspicious”) that accessed the specified data during their execution.

Claims

1. A method to perform disclosure-based database auditing, said method comprising:

formulating one or more audit expressions specifying sensitive data to be subjected to an audit;

identifying a subset of logged queries which accessed said sensitive data with respect to said one or more audit expressions;

formulating an audit query by combining and transforming said subset of logged queries, and

running said audit query against a database to identify suspicious queries that accessed said sensitive data.

2. A method to perform disclosure-based database auditing, according to claim 1, wherein said database records updates made to base tables for recovering the state of said database at a past point in time.

3. A method to perform disclosure-based database auditing, according to claim 2, wherein said database is rolled back to restore said past point in time which may be when a query was run.

4. A method to perform disclosure-based database auditing, according to claim 2, wherein backlog tables, DB2 replica tables or Oracle flashback queries are used to recover said state of said database.

5. A method to perform disclosure-based database auditing, according to claim 1, wherein said logged queries are stored in a query log along with annotations comprising:

time when query was executed, user submitting query, and query'"'"'s purpose.

6. A method to perform disclosure-based database auditing, according to claim 1, wherein syntax of said audit expression essentially corresponds to a select-project-join (SPJ) SQL query.

7. A method to perform disclosure-based database auditing, according to claim 1, wherein said audit query is formulated by augmenting each query from said subsets of logged queries with information in said audit expressions.

8. A method to perform disclosure-based database auditing, according to claim 1, wherein said subset of logged queries is identified via four tests performed on queries in a query log:

first test for checking whether column names of each of said queries match column names in an audit list of said audit expression;

second test for checking if timestamp of each of said queries is out of range with respect to audit interval in the during clause of said audit expression;

third step for checking if a purpose-recipient pair of each of said queries matches any of purpose-recipient pairs specified in an other than clause of said audit expression; and

fourth step for checking contradictions between predicates of each of said queries and said audit expression.

9. A system to perform disclosure-based database auditing, said system comprising:

a query log storing one or more queries submitted to said system along with annotations;

a database capturing and recording updates to base tables;

an audit query generator processing one or more audit expressions specifying sensitive data to be subjected to audit, said audit query generator identifying a subset of logged queries from said query log which accessed said sensitive data with respect to said one or more audit expressions, formulating an audit query by combining and transforming said subset of logged queries, and running said audit query against said database to identify suspicious queries that accessed said sensitive data.

10. A system to perform disclosure-based database auditing, according to claim 9, wherein said database records said updates for recovering the state of said database at a past point in time.

11. A system to perform disclosure-based database auditing, according to claim 10, wherein said database is rolled back to restore said past point in time which may be when a query was run.

12. A system to perform disclosure-based database auditing, according to claim 10, wherein backlog tables, DB2 replica tables or Oracle flashback queries are used to recover said state of said database.

13. A system to perform disclosure-based database auditing, according to claim 9, wherein said annotations comprise, time when query was executed, user submitting query, and query'"'"'s purpose.

14. A system to perform disclosure-based database auditing, according to claim 9, wherein syntax of said audit expression essentially corresponds to a select-project-join (SPJ) SQL query.

15. A system to perform disclosure-based database auditing, according to claim 9, wherein said audit query is formulated by augmenting each query from said subset of logged queries with information in said audit expressions.

16. A system to perform disclosure-based database auditing, according to claim 9, wherein said subset of logged queries is identified via four tests performed on queries in said query log:

first test for checking whether column names of each of said queries match column names in an audit list of said audit expression;

second test for checking if timestamp of each of said queries is out of range with respect to audit interval in the during clause of said audit expression;

third step for checking if a purpose-recipient pair of each of said queries matches any of purpose-recipient pairs specified in an other than clause of said audit expression; and

fourth step for checking contradictions between predicates of each of said queries and said audit expression.