US 9,792,454 B2Granted

Record level data security

AssigneeProtegrity Corporation

InventorsYigal Rozenberg, David Clyde Williamson

Life of this patent

Estimating the term…

Loading patent…

Abstract

A database security system protects a data table at both the column level and the individual data record level. Access to data records within the data table is governed by categories assigned to data records, by user roles assigned to users, and by a set of security access tables. A first access table maps data record identifiers to data record categories, data record protection schemes, and corresponding scheme keys. A second access table maps user roles to data record categories. A third access table maps column identifiers to column protection schemes and corresponding scheme keys. A fourth access table maps user roles to column identifiers. If a user requests access to a data record, the security access tables are queried using the data record identifier, the associated column identifier, and the user roles associated with the user to determine if the user can access the requested data record.

Claims21

Dependent claims

A database security system, comprising:

a database table comprising encoded data records organized into columns, each data record associated with a data record identifier, a column identifier, and one or more data record categories;
a column identifier table mapping each column identifier to one or more column protection schemes used to encode the corresponding data column and to one or more corresponding keys used by the one or more column protection schemes;
a column role table mapping user roles to one or more column identifiers;
a record identifier table mapping each data record identifier to one or more data record categories, one or more data record protection schemes used to encode the corresponding data record, and one or more corresponding keys used by the data record protection schemes to encode the data record;
a record role table mapping user roles to one or more data record categories;
an input configured to receive a request from a user associated with one or more user roles for access to a data record;
a data protection engine comprising one or more hardware processors and configured to:
in response to a determination that at least one of the one or more user roles are mapped by the column role table to the column identifier associated with the requested data record, query the column identifier table to access the column protection schemes and corresponding keys, and decode the requested data record using the accessed column protection schemes and corresponding keys to produce an intermediate encoded data record;
and
in response to a determination that each of the one or more data record categories mapped to the data record identifier associated with the requested data record by the record identifier table are also mapped to one of the one or more user roles, query the record identifier table to access the data record protection schemes and corresponding keys and decode the intermediate encoded data record using the accessed data record protection schemes and corresponding keys to produce a decoded data record;
and
an output configured to provide the decoded data record to the user.

9 more elements

A method for database security, comprising:

receiving, by a database security system, a request from a user associated with one or more user roles for access to a data record stored in a database table, the database table comprising encoded data records organized into columns, each data record associated with a data record identifier, a column identifier, and one or more data record categories;
querying, by the database security system, a column role table mapping user roles to one or more column identifiers with the column identifier corresponding to the requested data record to identify a first subset of user roles mapped to the column identifier;
in response to a determination that the first subset of user roles includes at least one of the user roles associated with the user, querying, by the database security system, a column identifier table mapping each column identifier to one or more column protection schemes used to encode the corresponding data column and to one or more corresponding keys used by the one or more column protection schemes with the column identifier corresponding to the requested data record to access the column protection schemes and corresponding keys used to encode the requested data record;
decoding, by the database security system, the requested data record using the accessed column protection schemes and corresponding keys to produce an intermediate encoded data record;
querying, by the database security system, a record role table mapping user roles to one or more data record categories with the data record identifier corresponding to the requested data record to identify a second subset of user roles mapped to the data record identifier;
in response to a determination that each of the user roles in the second subset of user roles is also included in the user roles associated with the user, querying, by the database security system, a record identifier table mapping each data record identifier to one or more data record categories, one or more data record protection schemes used to encode the corresponding data record, and one or more corresponding keys used by the data record protection schemes to encode the data record with the data record identifier corresponding to the requested data record to access the data record protection schemes and corresponding keys used to encode the requested data record;
decoding, by the database security system, the intermediate encoded data record using the accessed data record protection schemes and corresponding keys to produce a decoded data record;
and
outputting the decoded data record to the user.

6 more elements

A non-transitory computer-readable storage medium storing executable computer instructions that, when executed by a processor, perform steps comprising:

receiving, by a database security system, a request from a user associated with one or more user roles for access to a data record stored in a database table, the database table comprising encoded data records organized into columns, each data record associated with a data record identifier, a column identifier, and one or more data record categories;
querying, by the database security system, a column role table mapping user roles to one or more column identifiers with the column identifier corresponding to the requested data record to identify a first subset of user roles mapped to the column identifier;
in response to a determination that the first subset of user roles includes at least one of the user roles associated with the user, querying, by the database security system, a column identifier table mapping each column identifier to one or more column protection schemes used to encode the corresponding data column and to one or more corresponding keys used by the one or more column protection schemes with the column identifier corresponding to the requested data record to access the column protection schemes and corresponding keys used to encode the requested data record;
decoding, by the database security system, the requested data record using the accessed column protection schemes and corresponding keys to produce an intermediate encoded data record;
querying, by the database security system, a record role table mapping user roles to one or more data record categories with the data record identifier corresponding to the requested data record to identify a second subset of user roles mapped to the data record identifier;
in response to a determination that each of the user roles in the second subset of user roles is also included in the user roles associated with the user, querying, by the database security system, a record identifier table mapping each data record identifier to one or more data record categories, one or more data record protection schemes used to encode the corresponding data record, and one or more corresponding keys used by the data record protection schemes to encode the data record with the data record identifier corresponding to the requested data record to access the data record protection schemes and corresponding keys used to encode the requested data record;
decoding, by the database security system, the intermediate encoded data record using the accessed data record protection schemes and corresponding keys to produce a decoded data record;
and
outputting the decoded data record to the user.

6 more elements

Dependencies are inferred from the claim text.

Facts

Application: 14/993,949Filed 12 Jan 2016 · us provisional application
Priority: 16 Jan 2015
Published: US 2016/0210470 A121 Jul 2016
Granted: 17 Oct 2017
Term ends: Not estimatedThe source records don’t support an estimate.

Classification12 codes

G06F 21/6218
Protecting access to data via a platform, e.g. using keys or access control rules: to a system of files or objects, e.g. local or distributed file…
G06F 16/22
Of structured data, e.g. relational data: indexing; Data structures therefor; Storage structures
G06F 16/221
Indexing; Data structures therefor; Storage structures: column-oriented storage; Management thereof
G06F 16/2425
Query formulation: iterative querying; Query formulation based on the results of a preceding query