ON-THE-FLY DATA MASKING

• US 20110314278A1
• Filed: 06/18/2010
• Published: 12/22/2011
• Est. Priority Date: 06/18/2010
• Status: Active Grant

• Current Assignee: Axis Technology Software LLC
• Original Assignee: Axis Technology LLC (Perforce Software Incorporated)
• Inventors: Taskaya, Ilker, Nauda, Alex
• Granted Patent: US 8,522,016 B2
• Time in Patent Office: Days
• US Class Current: 713/167
• CPC Class Codes: H04L 2209/04 Masking or blinding
• CPC Class Codes: H04L 2209/16 Obfuscation or hiding, e.g. involving white box
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 9/0643 Hash functions, e.g. MD5, SHA, HMAC or f9 MAC
• CPC Class Codes: H04L 9/085 Secret sharing or secret splitting, e.g. threshold schemes
• CPC Class Codes: H04L 9/0894 Escrow, recovery or storing of secret information, e.g. secret key escrow or cryptographic key storage

Abstract

Described are methods, systems, and apparatus, including computer program products for securing data of a production server. The invention, in one implementation, includes reading a data value on the production server, obfuscating the data value in the memory of the server to create a masked value, transmitting the masked value to a non-production server, and storing the masked value on the non-production server.

Claims

1. A method, executed on a computer processor of a production server, for securing data of the production server comprising:

reading a data value on the production server;

obfuscating the data value in the memory of the server to create a masked value;

transmitting the masked value to a non-production server; and

storing the masked value on the non-production server.

2. The method of claim 1, wherein the obfuscating step comprises masking the data value using a segmented mapping technique.

3. The method of claim 1, wherein the obfuscating step comprises masking the data value using a secure lookup technique wherein the lookup table is stored on the non-production server.

4. The method of claim 1, further comprising generating a report of the obfuscation step.

5. The method of claim 1, further comprising emailing a user the status of the obfuscating step.

6. The method of claim 1, further comprising presenting a plurality of obfuscation techniques to the user and basing the obfuscating step on a selection made by the user.

7. A computer program product, tangibly embodied in a computer-readable storage medium, for securing data of a production server, the computer program product comprising instructions operable to cause a data processing apparatus to:

read a data value on the production server;

obfuscate the data value in the memory of the server to create a masked value;

transmit the masked value to a non-production server; and

store the masked value on the non-production server.

8. The computer program product of claim 7, wherein the obfuscating step comprises masking the data value using a segmented mapping technique.

9. The computer program product of claim 7, wherein the obfuscating step comprises masking the data value using a secure lookup technique wherein the lookup table is stored on the non-production server.

10. The computer program product of claim 7, further operable to cause the data processing apparatus to generate a report of the obfuscation step.

11. The computer program product of claim 7, further operable to cause the data processing apparatus to email a user the status of the obfuscating step.

12. The computer program product of claim 7, further operable to cause the data processing apparatus to present a plurality of obfuscation techniques to the user and base the obfuscating step on a selection made by the user.

13. A system for securing data used by a production server, the system comprising:

a target environment comprising a target database and a target application server, the target application server configured to store a masked value received from the production server; and

a production environment comprising a production database and the production server, the production server comprising a processor and a memory and configured to;

read a data value on the production server;

obfuscate the data value in the memory of the production server to create a masked value; and

transmit the masked value to the target application server.

14. The system of claim 13, wherein the production server is configured to obfuscate the data value using a segmented mapping technique.

15. The system of claim 13, wherein the production server is configured to obfuscate the data value using a secure lookup technique wherein the lookup table is stored on the target application server.

16. The system of claim 13, wherein the production server is configured to generate a report of the obfuscation step.

17. The system of claim 13, wherein the production server is configured to email a user the status of obfuscating the data value.

18. The system of claim 13, wherein the production server is further operable to present a plurality of obfuscation techniques to a user and base the obfuscating operation on a selection made by the user.