Virtual keys for column dataset access management

A non-transitory computer readable medium storing instructions that, when executed by one or more processors of a computing system, cause the computing system to:

• store, in a tag repository, information associating policy tags with column datasets;
• receive, from a client device over one or more networks, a client request for an encrypted encryption key (EEK) to access a column dataset, the client request including a column name for the column dataset;
• based on the client request, perform a lookup in the tag repository to identify one or more tags associated with the column dataset and determine whether the client device is authorized to access the column dataset;
• based on determining that the client device is authorized to access the column dataset, (i) generate an original encryption key, and (ii) generate the EEK using a shared master key, the original encryption key, and at least the column name for the column dataset;
• and
• provide the EEK to the client device over the one or more networks.

A computer-implemented method of managing column-level access control, the method being performed by one or more processors and comprising:

• storing, in a tag repository, information associating policy tags with column datasets;
• receiving, from a client device over one or more networks, a client request for an encrypted encryption key (EEK) to access a column dataset, the client request including a column name for the column dataset;
• based on the client request, performing a lookup in the tag repository to identify one or more tags associated with the column dataset and determine whether the client device is authorized to access the column dataset;
• based on determining that the client device is authorized to access the column dataset, (i) generating an original encryption key, and (ii) generating the EEK using a shared master key, the original encryption key, and at least the column name for the column dataset;
• and
• providing the EEK to the client device over the one or more networks.