DATA MASKING

• US 20130282697A1
• Filed: 02/26/2013
• Published: 10/24/2013
• Est. Priority Date: 04/18/2012
• Status: Active Grant

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Clifford, Austin, Barbas, Pedro, Jenkins, Gareth, McKeown, Brian
• Granted Patent: US 9,135,315 B2
• Time in Patent Office: Days
• US Class Current: 707/722
• CPC Class Codes: G06F 16/24553 of query operations
• CPC Class Codes: G06F 16/248 Presentation of query results

Abstract

Aspects include data masking in database operations including intercepting a database query and identifying masked data in the query. The masked data in the query is unmasked by substituting the masked data with equivalent real values. The unmasked query is sent to the database engine, and a result provided by the database engine in response to the unmasked query is intercepted. The values in the result that correspond to sensitive information are identified. The result is masked by substituting the values in the result corresponding to sensitive information with masked equivalents. The masked result is returned to a user.

Claims

1. A method for data masking in database operations, the method comprising:

intercepting a database query;

identifying at least one field in the query that includes masked data;

unmasking the query, the unmasking on a processor and comprising substituting the masked data with equivalent real values;

sending the unmasked query to a database engine;

intercepting a result provided by the database engine in response to the unmasked query;

identifying values in the result corresponding to sensitive information;

masking the result, the masking on a processor and comprising substituting the values in the result corresponding to sensitive information with masked data equivalents; and

returning the masked result to a user.

2. The method according to claim 1, wherein each masked data equivalent is a unique mask.

3. The method according to claim 2, wherein each unique mask is chosen from a non-repeating sequence.

4. The method according to claim 1, wherein all fields in the query are masked.

5. The method according to claim 1, wherein the masked data is deleted at a completion of a user session.

6. The method according to claim 1, wherein a list of types of sensitive information for masking and unmasking is maintained.

7. The method according to claim 1, wherein the masked and associated data is associated with a user account and is selected for the user when the user is logged into the user account.

8. The method according to claim 1, wherein a length of the masked result is the same as the length of the result provided by the database engine.

9. The method according to claim 8, wherein a length of a masked data equivalent is shortened if a data type of the masked data equivalent is a fixed length and the fixed length exceeds a maximum length policy.

10. The method according to claim 1, wherein the masked data equivalent is stored with its associated real value in a catalog.

11. A system configured to perform data masking in database operations, the system comprising:

a memory having computer readable computer instructions; and

a processor for executing the computer readable instructions, the instructions including;

intercepting a database query;

identifying at least one field in the query that includes masked data;

unmasking the query, the unmasking comprising substituting the masked data with equivalent real values;

sending the unmasked query to a database engine;

intercepting a result provided by the database engine in response to the unmasked query;

identifying values in the result corresponding to sensitive information;

masking the result, the masking comprising substituting the values in the result corresponding to sensitive information with masked data equivalents; and

returning the masked result to a user.

12. The system according to claim 11, wherein each masked data equivalent is a unique mask.

13. The system according to claim 12, wherein each unique mask is chosen from a non-repeating sequence.

14. The system according to claim 11, where all fields in the query are masked.

15. The system according to claim 11, wherein the masked data is deleted at a completion of a user session.

16. The system according to claim 11, wherein a list of types of sensitive information for masking and unmasking is maintained.

17. The system according to claim 11, wherein the masked and associated data is associated with a user account and is selected for the user when the user is logged into the user account.

18. The system according to claim 11, wherein a length of the masked result in the same as the length of the result provided by the database engine.

19. A computer program product for data masking in database operations, the computer program product comprising:

a computer readable storage medium having computer readable program code embodied therewith, the computer readable program code executable by a processor to;

intercept a database query;

identify at least one field in the query that includes masked data;

unmask the query, the unmasking comprising substituting the masked data with equivalent real values;

send the unmasked query to a database engine;

intercept a result provided by the database engine in response to the unmasked query;

identify values in the result corresponding to sensitive information;

mask the result, the masking comprising substituting the values in the result corresponding to sensitive information with masked data equivalents; and

return the masked result to a user.

20. The computer program product of claim 19, wherein each masked data equivalent is a unique mask chosen from a non-repeating sequence.