DYNAMIC DATA MASKING METHOD AND DATABASE SYSTEM

• US 20140164405A1
• Filed: 02/03/2013
• Published: 06/12/2014
• Est. Priority Date: 12/12/2012
• Status: Abandoned Application

• Current Assignee: Institute For Information Industry
• Original Assignee: Institute For Information Industry
• Inventors: TSAI, Lin-Jiun, WU, Jain-Shing, CHONG, Song-Kong
• Application Number:
  US13/757,843
• Publication Number:
  US 20140164405A1
• Time in Patent Office: Days
• US Class Current: 707/754
• CPC Class Codes: G06F 21/6227 where protection concerns the structure of data, e.g. records, types, queries

Abstract

A dynamic data masking method, suitable for a database including plural data, is disclosed in this invention. Each of the data includes plural values and plural keys corresponding to the values. The dynamic data masking method includes steps of: determining whether values and keys of one data are sensitive contents when the data are requested to be written into the database; if one of the values/keys of the data is sensitive, setting a key corresponding to the sensitive value or the key itself as a sensitive key and dynamically establishing a filtering rule corresponding to the key; and then, saving the filtering rule and writing the data into the database. In addition, a database system is also disclosed herein.

Claims

1. A dynamic data masking method, suitable for a database for storing plural data, each data comprising plural values and plural keys corresponding to the values, the dynamic data masking method comprising:

determining whether values and keys of one data are sensitive or not when the data requests to be written into the database;

if one of the values or one of the keys in the data to be written is sensitive, setting a key corresponding to the sensitive value or the key itself as a sensitive key and dynamically establishing a filtering rule corresponding to the sensitive key; and

storing the filtering rule and writing the data into the database.

2. The dynamic data masking method as claimed in claim 1, wherein, during a procedure of writing data into the database, the dynamic data masking method further comprises:

obtaining a user confidentiality rule comprising a plurality of different levels of user identifications, wherein, during the step of dynamically establishing a filtering rule corresponding to the sensitive key, the dynamic data masking method further establishes a plurality of different filtering rules relative to one key for corresponding to the different levels of user identifications according to the user confidentiality rule.

3. The dynamic data masking method as claimed in claim 1, further comprising:

when there is a request to read the database, determining whether a key requested to be read is sensitive or not;

if the key requested to be read is sensitive, loading the filtering rule corresponding to the key requested to be read;

performing a masking treatment onto the value corresponding to the key requested to be read according to the filtering rule; and

replying with the value after the masking treatment.

4. The dynamic data masking method as claimed in claim 3, wherein, during a procedure of reading data from the database, the dynamic data masking method further comprises:

obtaining a level of user identification of current requesting, wherein, during the step of loading the filtering rule corresponding to the key requested to be read, the filtering rule is loaded according to the key requested to be read and the level of user identification of current requesting at the same time.

5. The dynamic data masking method as claimed in claim 1, wherein the dynamic data masking method determines whether the values and the keys are sensitive or not according to an algorithm or a lookup table, the algorithm is selected from at least one algorithm consisting of Regular Expression (regex) algorithm, Machine Learning algorithm and Signature algorithm.

6. A database system, comprising:

a database for storing a plurality of data, each data comprising plural values and plural keys corresponding to the values; and

a data processing unit communicatively connected with the database for processing a request to write in or read from the database,

wherein, when one data requests to be written into the database, the data processing unit determining whether values and keys of the data to be written are sensitive or not, if one of the values or one of the keys in the data to be written is sensitive, the data processing unit sets a key corresponding to the sensitive value or the key itself as a sensitive key and dynamically establishing a filtering rule corresponding to the sensitive key.

7. The database system as claimed in claim 6, wherein, when there is a request to read the database, the data processing unit determines whether a key requested to be read is sensitive or not, if the key requested to be read is sensitive, the data processing unit loads the filtering rule corresponding to the key requested to be read, the data processing unit performs a masking treatment onto the value corresponding to the key requested to be read according to the filtering rule, and the data processing unit replies with the value after the masking treatment.

8. The database system as claimed in claim 6, wherein the data processing unit is a network gateway, a controlling circuit integrated on a network gateway or a controlling circuit integrated on the database.

9. The database system as claimed in claim 6, wherein the data processing unit is a non-relational database or a relational database.

10. The database system as claimed in claim 6, wherein the data processing unit stores a user confidentiality rule comprising a plurality of different levels of user identifications, during the data processing unit dynamically establishing a filtering rule corresponding to the sensitive key, the data processing unit further establishes a plurality of different filtering rules relative to one key for corresponding to the different levels of user identifications according to the user confidentiality rule, and during the data processing unit reading data from the database, the data processing unit determines a level of user identification of current requesting, and the data processing unit loads the filtering rule according to the key requested to be read and the level of user identification of current requesting at the same time