System and method for dynamic data redaction

• US 20060259954A1
• Filed: 09/08/2005
• Published: 11/16/2006
• Est. Priority Date: 05/11/2005
• Status: Active Grant

• Current Assignee: Oracle International Corporation (Oracle Corporation)
• Original Assignee: BEA Systems Incorporated (Oracle Corporation)
• Inventors: Patrick, Paul B.
• Granted Patent: US 7,748,027 B2
• Time in Patent Office: Days
• US Class Current: 726/2
• CPC Class Codes: G06F 21/62 Protecting access to data via a platform, e.g. using keys or access control rules
• CPC Class Codes: G06F 21/6209 to a single file or object, e.g. in a secure envelope, encrypted and accessed using a key, or with access control rules appended to the object itself
• CPC Class Codes: G06F 21/6227 where protection concerns the structure of data, e.g. records, types, queries
• CPC Class Codes: G06F 2221/2141 Access rights, e.g. capability lists, access control lists, access tables, access matrices

Abstract

A system, method and media for dynamically redacting data based on the evaluation of one or more policies. This abstract is not intended to be a complete description of, or limit the scope of, the invention. Other features, aspects and objects of the invention can be obtained from a review of the specification, the figures and the claims.

Claims

1. A computer-implemented method for securing access to data, comprising:

accessing at least one resource on behalf of a requestor;

receiving a result set provided by the at least one resource wherein the result set includes at least one part;

redacting from the result set a part that the requestor is not permitted to receive to create a redacted result set; and

providing the redacted result set to the requester.

2. The method of claim 1 wherein redacting further comprises:

deleting the part from the result set that the requestor is not permitted to receive.

3. The method of claim 1 wherein redacting further comprises:

encrypting the part in the result set that the requestor is not permitted to receive.

4. The method of claim 1 wherein the redacting further comprises:

evaluating at least one policy to determine if the requestor is permitted to receive the part.

5. The method of claim 1, further comprising:

receiving from the requestor a request to access the at least one resource.

6. The method of claim 1, further comprising:

accessing the at least one resource according to the request.

7. The method of claim 1, further comprising:

denying access to the at least one resource if the request and/or the requestor is not authorized to access the service.

8. The method of claim 1 wherein:

a resource is at least one of;

data, a service, a web service, a database, information in a database, a file, information in a file, an object, a method on an object, an XML document, and a representation of at least one source of information.

9. The method of claim 1 wherein:

the result set is an XML document.

10. The method of claim 9 wherein:

a part is an XML element.

11. A machine readable medium having instructions stored thereon to cause a system to:

access at least one resource on behalf of a requestor;

receive a result set provided by the at least one resource wherein the result set includes at least one part;

redact from the result set a part that the requestor is not permitted to receive to create a redacted result set; and

provide the redacted result set to the requestor.

12. The machine readable medium of claim 11, further comprising instructions that when used cause the system to:

delete the part from the result set that the requestor is not permitted to receive.

13. The machine readable medium of claim 11, further comprising instructions that when used cause the system to:

encrypt the part in the result set that the requestor is not permitted to receive.

14. The machine readable medium of claim 11, further comprising instructions that when used cause the system to:

evaluate at least one policy to determine if the requestor is permitted to receive the part.

15. The machine readable medium of claim 11, further comprising instructions that when used cause the system to:

receive from the requestor a request to access the at least one resource.

16. The machine readable medium of claim 11, further comprising instructions that when used cause the system to:

access the at least one resource according to the request.

17. The machine readable medium of claim 11, further comprising instructions that when used cause the system to:

deny access to the at least one resource if the request and/or the requestor is not authorized to access the service.

18. The machine readable medium of claim 11 wherein:

a resource is at least one of;

data, a service, a web service, a database, information in a database, a file, information in a file, an object, a method on an object, an XML document, and a representation of at least one source of information.

19. The machine readable medium of claim 11 wherein:

the result set is an XML document.

20. A system for securing access to data, said system comprising at least one component capable of performing the following steps:

accessing at least one resource on behalf of a requester;

receiving a result set provided by the at least one resource wherein the result set includes at least one part;

redacting from the result set a part that the requestor is not permitted to receive to create a redacted result set; and

providing the redacted result set to the requestor.