Method, system and program for providing conditional access to data

Abstract

A method for conditional access to a database system, the database system including records, each record including a set of attributes, and database views, each database view representing a subset of the set of attributes, data object objects indicating a subset of attributes of the set of attributes and a processing purpose are stored, each processing purpose is associated with one or more entities that have authorized access to the subset of attributes of the processing purpose, a request for data for a particular processing purpose and a selected view of the database views is received, and a data object object indicating the particular processing purpose is retrieved, the subset of attributes represented by the selected view is compared to the subset of attributes represented in the retrieved data object, and a value for the subset of attributes of the selected view is provided.

Description

[Technical field]

[0001] FIELD OF THE DISCLOSURE The present disclosure relates generally to the field of computing, and more particularly to conditional access to data. [Background technology]

[0002] Privacy and data protection regulations are frequently emerging around the world. These include the General Data Protection Regulation (GDPR) and the California Consumer Privacy Act (CCPA), among others. These regulations often address the concept of consent. Consent in this context can relate to whether an individual whose personal data is processed agrees that their data will be processed in a particular way. Summary of the Invention

[0003] An embodiment of the present disclosure is directed to a method for conditional access to data in a database system, the database system including records, each record including a set of attributes. The database system may further include database views, each database view representing a subset of the set of attributes. The method includes storing data object objects, each data object indicating a subset of attributes of the set of attributes and a processing purpose to process the subset of attributes. The method further includes associating each processing purpose with one or more entities that have authorized access to the subset of attributes of the processing purpose. The method further includes receiving a request for data for a particular processing purpose and a selected view of the database views. The method further includes retrieving a data object indicating the particular processing purpose. The method further includes comparing the subset of attributes represented by the selected view to the subset of attributes represented in the retrieved data object. The method further includes providing values ​​of the subset of attributes represented in the selected view for an entity associated with the particular processing purpose in response to determining that the subset of attributes represented by the selected view is a subset of the subset of attributes represented in the retrieved data object.

[0004] The above method advantageously allows only conditional access to data (based on the processing purpose and the selected view). For example, the above method ensures that the data object is retrieved based on the specific processing purpose of the data. The method further ensures that the subset of attributes represented by the selected view is a subset of the subset of attributes represented in the retrieved data object before providing values ​​of the subset of attributes. This ensures that the view requested by the third party is within the constraints defined in the data object (e.g., based on user consent).

[0005] An embodiment of the present disclosure also relates to a system including one or more processors and one or more computer-readable storage media collectively storing program instructions configured, when executed by the one or more processors, to cause the one or more processors to perform a method for conditional access to data in a database system, the database system including records, each record including a set of attributes. The database system may further include database views, each database view representing a subset of the set of attributes. The method includes storing data object objects, each data object indicating a subset of attributes of the set of attributes and a processing objective to process the subset of attributes. The method further includes associating each processing objective with one or more entities that have authorized access to the subset of attributes of the processing objective. The method further includes receiving a request for data for a particular processing objective and a selected view of the database view. The method further includes retrieving a data object indicating the particular processing objective. The method further includes comparing the subset of attributes represented by the selected view to the subset of attributes indicated in the retrieved data object. The method further includes, in response to determining that the subset of attributes represented by the selected view is a subset of the subset of attributes represented in the searched data object object, providing values ​​of the subset of attributes represented in the selected view for an entity associated with the particular processing object.

[0006] The above system advantageously allows only conditional access to data (based on the processing purpose and the selected view). For example, the above system ensures that the data object object is retrieved based on the specific processing purpose of the data. The system further ensures that the subset of attributes represented by the selected view is a subset of the subset of attributes represented in the retrieved data object before providing values ​​for the subset of attributes. This ensures that the view requested by a third party is within the constraints defined in the data object object (e.g., based on user consent).

[0007] An embodiment of the present disclosure also relates to a computer program product including one or more computer-readable storage media and program instructions collectively stored on the one or more computer-readable storage media, the program instructions including instructions configured to cause one or more processors to execute a method for conditional access to data in a database system, the database system including records, each record including a set of attributes. The database system may further include database views, each database view representing a subset of the set of attributes. The method includes storing data object objects, each data object indicating a subset of attributes of the set of attributes and a processing objective to process the subset of attributes. The method further includes associating each processing objective with one or more entities that have authorized access to the subset of attributes of the processing objective. The method further includes receiving a request for data for a particular processing objective and a selected view of the database views. The method further includes retrieving a data object indicating the particular processing objective. The method further includes comparing the subset of attributes represented by the selected view to the subset of attributes indicated in the retrieved data object. The method further includes, in response to determining that the subset of attributes represented by the selected view is a subset of the subset of attributes represented in the searched data object object, providing values ​​of the subset of attributes represented in the selected view for an entity associated with the particular processing object.

[0008] Said computer program product advantageously allows only conditional access to data (based on the processing purpose and the selected view). For example, said computer program product ensures that the data object object is retrieved based on the specific processing purpose of the data. The computer program product further ensures that the subset of attributes represented by the selected view is a subset of the subset of attributes represented in the retrieved data object before providing the values ​​of the subset of attributes. This ensures that the view requested by a third party is within the constraints defined in the data object object (for example based on user consent).

[0009] The above summary is not intended to describe each illustrated embodiment or every implementation of the present disclosure.

[0010] The drawings included in this disclosure are incorporated in and form a part of the specification. The drawings illustrate embodiments of the disclosure and, together with the description, serve to explain the principles of the disclosure. The drawings are merely illustrative of typical embodiments and are not intended to limit the disclosure. [Brief description of the drawings]

[0011] [Figure 1] FIG. 1 is a block diagram of a computer system according to an embodiment of the present disclosure. [Diagram 2] FIG. 2 is a flow diagram of an example method for conditional access to data, according to an embodiment of the present disclosure. [Diagram 3] FIG. 1 illustrates a collection of information regarding processing purpose and user agreement, according to an embodiment of the present disclosure. [Figure 4] FIG. 2 is a flow diagram of an example method for conditional access to data, according to an embodiment of the present disclosure. [Figure 5A] FIG. 2 is a flow diagram of an example method for conditional access to data, according to an embodiment of the present disclosure. [Figure 5B]FIG. 1 illustrates a database system and governance catalog according to an embodiment of the present disclosure. [Figure 6] FIG. 1 illustrates a high-level block diagram of an exemplary computer system for use in implementing one or more of the methods, tools, and modules described herein, and any associated functionality, in accordance with embodiments of the present disclosure. [Figure 7] FIG. 1 illustrates a cloud computing environment according to an embodiment of the present disclosure. [Figure 8] FIG. 2 illustrates an abstract model layer according to an embodiment of the present disclosure. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0012] While the embodiments described herein are amenable to various modifications and alternative forms, details of which have been shown by way of example in the drawings and will be described in detail. It is to be understood, however, that the particular embodiments described are not to be taken in a limiting sense. On the contrary, the intention is to cover all modifications, equivalents, and alternatives falling within the spirit and scope of the disclosure.

[0013] Aspects of the present disclosure relate generally to the field of computing, and more particularly to conditional access to data. The present disclosure is not necessarily limited to such applications, but various aspects of the present disclosure may be understood through a discussion of various examples using this context.

[0014] Access to data is necessary to perform an action on the data, such as correcting the data, deleting the data, or using the data for a certain processing purpose. There are benefits to sharing access to data (e.g., granting data access to one or more users). However, there are certain situations where data sharing can be problematic (e.g., with medical data). This can be addressed by incorporating conditional access to data. By applying conditional access to data, certain criteria may need to be met before access to the data is granted (e.g., access to data may be granted subject to considerations such as consent policies and geographical restrictions). An entity may or may not authorize (e.g., consent) access to its data depending on the processing purpose and the requesting party. As an example, access to data to perform fraud analysis may require different access criteria compared to access to data for marketing purposes. Setting criteria for conditional data access may vary based on the specific use and may be difficult to implement properly.

[0015] The present disclosure may enable sharing of data in a database system, such as a master data management (MDM) system. The database system may include a database of records, each record having values ​​for a set of attributes. The present disclosure may enable data subjects or entities to control certain uses of their data (e.g., by consent from a user). This may be implemented by preventing access to records to which the data entity has not consented. Consent may be enforced at the database system level. Aspects of the present disclosure are more resilient to methods that enforce consent only at the application level. Consent may be enforced at the database level with very limited performance impact since existing storage capabilities may be utilized. Many third-party systems with separate data access requirements may be supported. Third-party processing purposes may be defined, for example, in a governance catalog and captured in the database system.

[0016] The present disclosure may incorporate criteria for conditional data access based on the third party needing access to the data, the entity owning the data, and the available resources of the database system. This may enable automatic enforcement of conditional access to data in the database system. Information about the third parties and associated authorizations may be collected. The relevant information of the third parties may be stored as data object objects (e.g., in a business glossary or governance catalog). A data object may refer to a data structure such as a file, an array, a tree, etc. Each data object object may include information indicating the third party system, the data processing purpose of the third party system, and a subset of the set of attributes required for the data processing purpose. For example, a data object object may consist of the name of the processing purpose and a data structure such as a bitmap or list to represent the subset of attributes.

[0017] One or more data object objects may be associated with the third party system. For example, the data object object may reference the specific data to be accessed and the reason for the access by the third party system. Information regarding authorization may be provided as an array of pairs of entities and corresponding data processing purposes (e.g., an entry in the array may include a user identification (ID) and the processing purpose to which the user consented). An entity may have a separate and separate entity (e.g., a second entry in a database) and may have certain attributes to which values ​​are assigned. For example, an employee or a company may be an entity. Possible attributes for an employee include name, date of birth, employee ID, etc. An entity may be represented by a record, which may be a collection of attribute values.

[0018] Using database views and collected information, the database system may enable systematic conditional access to data in the database for different third parties based on the available resources of the database system. A database view may represent a result set of a stored query on data that a database user may query in the same way as in a persistent database collection object. Each database view in a database system may represent a respective subset of the data contained in the database. A database view may reference a subset of attributes in a set of attributes. For example, a view may externalize a person's social media handles.

[0019] In an embodiment, the data object includes a first bitmap that maps bits to a set of attributes according to an order (e.g., configured to indicate a subset of the attributes), the database view includes a second bitmap that maps bits to a set of attributes according to the order, the second bitmap configured to indicate a subset of the attributes of the database view, and the comparison is performed using the first bitmap and the second bitmap.

[0020] Each required attribute type may be mapped onto a bitmap, with each position in the bitmap corresponding to a type. The bitmap contains a number of bits equal to the number of sets of attributes, with each bit representing a respective attribute. Each bit in the bitmap may be set to indicate whether the associated attribute is considered or not (e.g., 0 may indicate that it is not considered and 1 may indicate that it is considered). For example, if the set of attributes includes address, date of birth, and name, the bitmap may contain three bits representing the three attributes in the order address->date of birth->name. Similarly, the database view bitmap may have the same number of bits following the same order as the attribute representation. If the subset of attributes of the data object includes name and address, the bits in the bitmap may be set to 101 (e.g., the bits associated with the subset of attributes are set to 1 and the remaining bits are set to 0). The database view bitmap may be similarly provided and set so that comparisons between the bitmaps may be completed. For example, if the subset of attributes in a database view includes names, the bitmap may be set to 001.

[0021] By comparing the bitmap of the destination object and the required database view, the method may determine whether the required view is contained in the destination. Following the above example, by comparing 101 with 001, it may be determined that the database view is contained in the destination (e.g., a subset of the destination's attributes, address and name, contain a subset of the database view's attributes, name). This may save computing resources because bitmaps take up less storage space compared to other structures and allow for comparisons at a bit level, which may be faster (e.g., than comparing strings). For example, a new view may be created by simply specifying the bitmap without mapping it to the destination. Agreements may be added / removed by adding / removing agreements to / from the agreement table.

[0022] In an embodiment, the data object further includes a public key. The received request further indicates a signature (e.g., an encrypted digital signature). The method further includes verifying the signature using the retrieved data object's public key, where the comparing occurs only if the signature is validated. Using the public key, a requesting third party may authenticate the object by providing a signature encrypted with its private key.

[0023] The signature may be a digital signature, such as a hash of a message. The signature may be encrypted with a third party's private key associated with the public key. To validate a digital signature, a hash of the same message may be calculated, the signature decrypted using the public key, and the two resulting hash values ​​may be compared such that if they are identical, the signature is validated.

[0024] In an embodiment, associating each processing objective of the processing objective with one or more entities that have authorized access to a subset of attributes of the processing objective includes generating an agreement table, where each entry in the agreement table includes an entity identifier (ID) of the entity and the associated processing objective, and providing values ​​of the subset of attributes includes joining the agreement table with the selected view such that the entry includes only values ​​of the subset of attributes for entities associated with the particular processing objective.

[0025] Following the above example, the consent table may contain two entries pointing to a data object having a subset of attributes, address and name. These two entries may be associated with two entity identities (IDs) (e.g., user IDs). That is, the two entities have authorized or consented to access their names and addresses for the purposes indicated in the data object. By joining the consent table and the selected view, the names of the two users with the above user IDs may be provided.

[0026] In an embodiment, the data object includes a first list including a subset of the attributes, and the database view includes a second list including a subset of the attributes of the database view, and the comparing is performed using the first list and the second list. For sparse data, a list may be advantageous compared to a bitmap.

[0027] In an embodiment, the method further includes providing a procedure configured to receive as input a particular processing purpose and a selected view, configured to perform the steps of searching, comparing, and providing, and configured to execute the procedure via an application programming interface (API), where the request is received by a function of the API that invokes the procedure. By using a stored procedure for access to the database system, consent may be enforced and third parties may only access an individual's data for a given purpose if the individual has consented to that purpose.

[0028] In an embodiment, the method further includes receiving a request from a third party system to register a processing object with the third party system, and generating data object objects, each data object further indicating a respective third party system. For example, each data object object includes a name of the third party system. The name of the third party system may be, for example, the message used to generate the signature. This may be advantageous because both the third party system and the database system have access to the same message used for signature validation.

[0029] 1 illustrates a computer system 100 according to an embodiment of the present disclosure. The computer system 100 includes a database system 101 and one or more client systems 102a-102n (also referred to as third party systems 102a-102n). The database system 101 may be configured to communicate with each of the client systems 102a-102n via one or more networks 103. Although only one network is shown for ease of illustration, the database system 101 may be connected to the client systems 102a-102n via more than one network (e.g., the database system 101 may be connected to each of the computer systems 102a-102n via a respective network). The network 103 may include, but is not limited to, a cable network, an optical fiber network, a hybrid fiber coaxial network, a wireless network (e.g., Wi-Fi or a cellular network or both), a satellite network, the Internet, an intranet, a local area network, any other suitable network, or any combination of these networks or combinations thereof.

[0030] The database system 101 may be remote to the client systems 102a-102n, accessible via a network 103. The database system 101 stores a set of attributes att1, att2...att k The database 120 may include a database 120 that contains values ​​of attributes att1, att2, ... att3, where the set of attributes represents an entity, such as a person or a company. The database 120 may be associated with database views 121a-121n. Each database view 121a-121n may contain a set of attributes att1, att2, ... att kFor simplicity of illustration, only one database view 121a is shown (although others may be similarly constructed). Database view 121a includes a bitmap or list 130 that indicates the subset of attributes for which data is provided by database view 121a.

[0031] The database system 101 may use criteria to provide conditional access by the client systems 102a-102n to the database 120. The criteria may be defined based on the data processing purpose and the authorization or consent provided by the entity accessing those data for that purpose.

[0032] The database system 101 may access a governance catalog 113. Although shown as separate components, in another example, the database system 101 may include the governance catalog 113. The governance catalog 113 may include data object objects 105a-105m. For simplicity of illustration, only one data object object 105a is shown (although other data object objects may be similarly constructed). The data object object 105a includes information 108 indicative of one of the third party systems 102a-102n. The data object object 105a includes the name of a processing purpose 107 (reason for access) for processing data in the database system 101. As shown in FIG. 1, the processing purpose 107 is defined as "marketing". The data object object 105a further includes a subset of attributes 109 used for the data processing purpose 107. The data object object 105a further includes a bitmap or list 110 indicative of the subset of attributes 109, and the public key 111 of the third party system. One or more data object objects (e.g., data object objects 105a-105m) may be stored for each third party system 102a-102n. Each object stored for a third party may use a bitmap for all types of data that the object requires. For example, a marketing object may require access to email addresses. The database system 101 includes a consent table 123. The consent table 123 stores the entity ID (e.g., user ID) that consented to the object and the name of the object.

[0033] The database system 101 may further include a procedure 125. The procedure 125 may, for example, allow the client systems 102a-102n to retrieve data if the entity associated with the data has consented to the access. To that end, the procedure 125 may retrieve the purpose from the governance catalog 113 and verify the signature using the public key 111. The procedure 125 may then allow access to the requested view if the data in the view is a subset of the data that is allowed to be accessed in the purpose. The stored procedure 125 may be implemented using existing functionality of the database, such as an application programming interface (API), or may be built into the database as a query function. The aspect may be advantageously used within the scope of database-as-a-service (DBaaS) cloud technology.

[0034] 2 is a flow diagram illustrating an example method 200 for conditional access to data, according to some embodiments of the present disclosure. For purposes of explanation, the method 200 may be described with respect to the system 100 shown in FIG. 1. However, the method 200 is not limited to the system 100 shown in FIG. 1. The method 200 may be performed by the database system 101, in an embodiment.

[0035] Method 200 begins at operation 201, where a request for data (e.g., of database 120) is received. The request for data may be for a particular processing objective (e.g., a data processing objective in data objective objects 105a-105m). The request may include a name of the particular processing objective. The request may further indicate a selected view of database views 121a-121n. The view may be selected, for example, by the requestor or may be randomly selected (e.g., by the database system). Thus, the request indicates which data to access as indicated in the selected view, and further indicates the purpose for which the data is to be accessed (e.g., the request includes the name of the objective). The request may be received, for example, as an API call of stored procedure 125. In this manner, stored procedure 125 may be executed, and execution of procedure 125 may include operations 203 through 211.

[0036] For ease of explanation, assume by way of example that a database contains data describing products. The database may contain a set of attributes such as product, client age, purchase date, number of units purchased, mass, size, etc. The database view may be, for example, two database views DV1 and DV2, where database view DV1 has a subset of attributes product, client age, and purchase date, and database view DV2 has a subset of attributes mass, client age, and purchase date. The received request for data may be used to perform statistical analysis to know which age groups are interested in which products. The received request may point to one of the two database views DV1 and DV2.

[0037] Upon receiving the request, the database system 101 may search for a data object object 105a-105m indicating the specific processing purpose in operation 203. The name of the specific processing purpose may be compared to entries for processing purpose 107 stored in the data processing objects 105a-105m, and a data processing object containing the name of the specific purpose may be searched for in the governance catalog 113. If the requested specific processing purpose is not stored (e.g., is not part of the data processing object 105a-105m), the request may be rejected and access to the data may be denied accordingly.

[0038] The database system 101 compares the subset of attributes represented by the selected view to the subset of attributes represented in the retrieved data object in operation 205. For example, the bitmap (list) 130 of the selected view may be compared to the bitmap (list) 110 of the retrieved data object to determine whether the subset of attributes represented by the selected view is a subset of the subset of attributes represented in the retrieved data object.

[0039] Following the simplified example above, the subset of attributes of the retrieved data processing object associated with the specific purpose of the request, client age, purchase date, number of units purchased, and product, may be compared with the subset of attributes of the database view DV1, product, client age, and purchase date (if the selected view is DV1), or with the subset of attributes of the database view DV2, mass, client age, and purchase date (if the selected view is DV2). For example, if the selected view is DV2, the check is unsuccessful because the subset of attributes, mass, age, and purchase date, are not part of the subset of attributes of the retrieved data processing object (they only overlap). For example, if the selected view is DV1, the check is successful because the subset of attributes, age, purchase date, and product, are part of the subset of attributes of the retrieved data processing object.

[0040] If a determination is made in operation 207 that the subset of attributes represented by the selected view is a subset of the subset of attributes represented in the retrieved data object object, then values ​​of the subset of attributes represented in the selected view for entities associated with the particular processing purpose are provided in operation 209. For example, each record in database 120 may be processed to determine the entity associated with the record, and the determined entity may be compared to entities listed in a consent table to check whether the determined entity has authorized or consented to use the data for the particular processing purpose received, and if so, values ​​of the subset of attributes 109 for each record may be provided.

[0041] If, in operation 207, the subset of attributes represented by the selected view is not a subset of the subset of attributes represented in the retrieved data target object, then, in operation 211, access to the data is denied (e.g., the request is rejected).

[0042] In an embodiment, operations 201 through 211 may be performed automatically for each request received.

[0043] The operations described above may be completed in any order and are not limited to the order described. Additionally, some, all, or none of the operations described above may be completed while still remaining within the spirit and scope of the present disclosure.

[0044] FIG. 3 is a diagram illustrating a collection of information regarding processing purposes and user agreements, according to an embodiment of the present disclosure.

[0045] One or more third party systems may request (310) new processing purposes. In response to the request, the requested processing purpose may be stored (312) in the governance catalog 113 (e.g., as a data purpose object). After storing the data purpose object, an entity (e.g., an individual or a company) may consent (314) to the given purpose of the stored data purpose object. The consenting entity may be added (316) to the consent table 123 for the given purpose. The entity may also revoke (318) consent from the purpose. To that end, the consenting entity ID may be removed (320) from the consent table 123 for the given purpose. Operations 310 to 320 may enable the transmission of information regarding the purpose and consent to be used by the database system 101 for conditional access to data. For example, a third party system may request (322) to access data for a given purpose. In response, a stored procedure 125 may be executed (324). Execution of the stored procedure may include identifying (326) a stored data object that corresponds to a given object.

[0046] 4 is a flow diagram of an example method 400 for conditional access to data, according to an embodiment of the present disclosure. For purposes of explanation, the method 400 may be described with respect to the system 100 shown in FIG. 1. However, the method 400 is not limited to the system 100 shown in FIG. 1. The method 400 may be performed by the database system 101, in an embodiment.

[0047] The method 400 begins at operation 401, where a data access request is received by a third party system. The request may include an object name, a database view 121a-121n, and a signature. The database system 101 searches the governance catalog 113 for a data object object 105a-105m for the input object name at operation 403.

[0048] The received signature is validated using the public key of the retrieved data object to ensure that the requesting third party is the owner of the data object in operation 405. If the signature is not validated in operation 407, access is denied in operation 409 because the third party does not own the retrieved data object.

[0049] If the signature is validated in operation 407, then a determination is made in operation 411 whether the requested view bitmap 130 is a subset of the destination bitmap 110, indicating that all data in the view is encompassed by the purpose. If it is determined in operation 413 that the requested view bitmap 130 is not a subset of the destination bitmap 110, then access is denied in operation 415 because the view contains data that is not covered by the agreement for this purpose.

[0050] If, in operation 413, it is determined that the requested view bitmap 130 is a subset of the purpose bitmap 110, then, in operation 417, a consent table is joined with the view to include only data for users who consented to the requested purpose. The joined data is then returned (e.g., presented on a graphical user interface (GUI)). This is shown in operation 419.

[0051] 5A is a flow diagram illustrating an example method 500 for conditional access to data according to an embodiment of the present disclosure. For illustrative purposes, the method 500 described in FIG. 5A may be implemented in the system shown in FIG. 5B.

[0052] 5B illustrates an example database system 501 and a governance catalog 513. The governance catalog 513 stores two data objective objects 505a and 505b. Data objective object 505a represents an objective named "Marketing" and data objective object 505b represents an objective named "Fraud Analysis." Each of data objective objects 505a and 505b may include information such as that described with respect to the data objective objects of FIG. 1.

[0053] Database system 501 includes database view 521, consent table 523, and stored procedure 525. At operation 531 of method 500, a request to access data is received by database system 501. The request includes a list of inputs required by stored procedure 525, which are an object name, a selected view, and a signature. In response, database system 501 executes stored procedure 525 using the inputs at operation 533 of method 500. Execution of procedure 525 may, for example, perform operations 203 through 211 of FIG. 2 to allow or deny access to the requested data. As illustrated by the example pseudo code of FIG. 5B, the procedure may look up the object from governance catalog 513 and verify the signature using the public key. The procedure may then grant access to the requested view if the data in the view is a subset of the data allowed for access in the object.

[0054] As an example, for marketing purposes, a credit company may request data from database system 101 to know what products "Jane Doe" with user ID "15" has purchased. Database system 101 may grant this request because the bitmap of the accessed view is a subset of the access granted by Jane to the credit company for a given purpose.

[0055] In another example, for marketing purposes, a fraudulent company may request data from database system 101 to know what products "Jane Doe" with user ID "15" has purchased. Because there is no "marketing" purpose for this company, database system 101 cannot grant this request.

[0056] In another example, for marketing purposes, a credit card company may request data from database system 101 to learn what products "John Doe" with user ID "16" has purchased. Database system 101 cannot grant this request because user 16 (John) has not consented to data access.

[0057] In another example, for fraud analysis purposes, a fraud company may request data from database system 101 to know what products "Jane Doe" with user ID "15" purchased. Database system 101 cannot grant this request because the product view bitmap is not a subset for "fraud analysis" purposes.

[0058] 6, there is shown a high-level block diagram of an exemplary computer system 601 that may be utilized in various devices described herein (e.g., database system 101 and client system 102a) and that may be used in implementing (e.g., with one or more processor circuits or computer processors of a computer) one or more of the methods, tools, and modules described herein, and any associated functions, in accordance with embodiments of the present disclosure. In some embodiments, the major components of computer system 601 may include one or more CPUs 602 (also referred to herein as processors), memory 604, terminal interface 612, storage interface 614, I / O (input / output) device interface 616, and network interface 618, all of which may be communicatively coupled, directly or indirectly, for inter-component communication via memory bus 603, I / O bus 608, and I / O bus interface unit 610.

[0059] Computer system 601 may include one or more general purpose programmable central processing units (CPUs) 602A, 602B, 602C, and 602D, generally referred to herein as CPUs 602. In some embodiments, computer system 601 may include multiple processors inherent to a relatively large system, while in other embodiments computer system 601 may alternatively be a single CPU system. Each CPU 602 may execute instructions stored in memory subsystem 604 and may include one or more levels of on-board cache.

[0060] Memory 604 may include computer system readable media in the form of volatile memory such as random access memory (RAM) 622 or cache memory 624. Computer system 601 may further include other removable / non-removable, volatile / non-volatile computer system storage media. By way of example only, storage system 626 may be provided for reading from and writing to a non-removable non-volatile magnetic medium such as a "hard drive." Although not shown, a magnetic disk drive may be provided for reading from and writing to a removable non-volatile magnetic disk (e.g., a "floppy disk"), or an optical disk drive may be provided for reading from or writing to a removable non-volatile optical disk such as a CD-ROM, DVD-ROM, or other optical media. In addition, memory 604 may include flash memory, such as a flash memory stick drive or flash drive. Memory devices may be connected to memory bus 603 by one or more data media interfaces. The memory 604 may include at least one program product having a set (eg, at least one) of program modules configured to perform functions of various embodiments.

[0061] One or more programs / utilities 628, each having at least one set of program modules 630, may be stored in memory 604. The programs / utilities 628 may include a hypervisor (also called a virtual machine monitor), one or more operating systems, one or more application programs, other program modules, and program data. Each of the operating system, one or more application programs, other program modules, and program data, or any combination thereof, may include an implementation of a networking environment. The programs / utilities 628 and / or program modules 630 generally perform the functions or methodologies of the various embodiments.

[0062] 6 as a single bus structure providing a direct communication path between CPU 602, memory 604, and I / O bus interface 610, memory bus 603 may, in some embodiments, include multiple different buses or communication paths, which may be arranged in any of a variety of configurations, such as hierarchical point-to-point links, star or web configurations, multiple hierarchical buses, parallel and redundant paths, or any other suitable type of configuration. Additionally, I / O bus interface 610 and I / O bus 608 are shown as single respective units, and computer system 601 may, in some embodiments, include multiple I / O bus interface units 610, multiple I / O buses 608, or both. Additionally, although multiple I / O interface units are shown isolating I / O bus 608 from the various communication paths passing to the various I / O devices, in other embodiments some or all of the I / O devices may be directly connected to one or more system I / O buses.

[0063] In some embodiments, computer system 601 may be a multi-user mainframe computer system, a single-user system, or a server computer or similar device that has little or no direct user interface but receives requests from other computer systems (clients). Further, in some embodiments, computer system 601 may be implemented as a desktop computer, a portable computer, a laptop or notebook computer, a tablet computer, a pocket computer, a telephone, a smartphone, a network switch or router, or any other suitable type of electronic device.

[0064] It should be noted that Figure 6 is intended to depict representative major components of an exemplary computer system 601. In some embodiments, however, the individual components may have greater or less complexity than depicted in Figure 6, there may be components other than or in addition to those depicted in Figure 6, and the number, type, and configuration of such components may vary.

[0065] Although this disclosure includes a detailed description of cloud computing, it should be understood that implementations of the teachings provided herein are not limited to cloud computing environments. Rather, embodiments of the present disclosure may be practiced in conjunction with any other type of computing environment now known or later developed.

[0066] Cloud computing is a model of service delivery for enabling convenient, on-demand network access to a shared pool of configurable computing resources (e.g., networks, network bandwidth, servers, processing, memory, storage, applications, virtual machines, and services) that are rapidly provisioned and released with minimal administrative effort or interaction with a service provider. This cloud model may include at least five characteristics, at least three service models, and at least four deployment models.

[0067] The characteristics are as follows:

[0068] On-Demand Self-Service: Cloud consumers can unilaterally provision computing capabilities such as server time and network storage automatically as needed, without the need for human interaction with the service provider.

[0069] Broad network access: Capabilities are available over the network and accessed through standard mechanisms that facilitate use by heterogeneous thin-client or thick-client platforms (e.g., cell phones, laptops, and PDAs).

[0070] Resource Sharing: A provider's computing resources are pooled to serve multiple consumers using a multi-tenant model, with different physical and virtual resources dynamically allocated and reallocated according to demand. Location independence is implied in that consumers generally do not have control or knowledge over the exact location of the resources provided, but may be able to specify location at a higher level of abstraction (e.g., country, state, or data center).

[0071] Rapid Scalability: Capabilities can be quickly and elastically provisioned, in some cases automatically, to instantly scale out, and quickly released to instantly scale in. To the consumer, the capabilities available for provisioning often appear unlimited and can be purchased in any quantity at any time.

[0072] Services are meterable: Cloud systems automatically control and optimize resource usage by leveraging metering capabilities at a level of abstraction appropriate to the type of service (e.g., storage, processing, bandwidth, and active user accounts). Resource usage can be monitored, controlled, and reported, providing transparency to both providers and consumers of the services being used.

[0073] The service model is as follows:

[0074] Software as a Service (SaaS): The capability provided to the consumer is the use of the provider's applications running on a cloud infrastructure. The applications are accessible from a variety of client devices through thin-client interfaces such as web browsers (e.g., web-based email). The consumer does not manage or control the underlying cloud infrastructure, including the network, servers, operating systems, storage, or even individual application capabilities, with the possible exception of limited user-specific application configuration settings.

[0075] Platform as a Service (PaaS): The capability provided to the consumer is to deploy consumer-created or consumer-acquired applications, written using programming languages ​​and tools supported by the provider, onto a cloud infrastructure. The consumer does not manage or control the underlying cloud infrastructure, including networks, servers, operating systems, or storage, but does have control over the deployed applications and, to the extent possible, the application hosting environment configuration.

[0076] Infrastructure as a Service (IaaS): The capability provided to the consumer is the supply of processing, storage, networking, and other basic computing resources on which the consumer can deploy and run any software, which may include operating systems and applications. The consumer does not manage or control the underlying cloud infrastructure, but does have control over the operating systems, storage, deployed applications, and possibly limited control over select networking components (e.g., host firewalls).

[0077] The deployment model is as follows:

[0078] Private Cloud: The cloud infrastructure is operated exclusively for an organization. It may be managed by that organization or a third party and may be on-premise or off-premise.

[0079] Community Cloud: The cloud infrastructure is shared by multiple organizations to support a specific community with shared concerns (e.g., mission, security requirements, policy, and compliance considerations). The cloud infrastructure may be managed by the organization or a third party and may reside on-premise or off-premise.

[0080] Public Cloud: The cloud infrastructure is made available to the general public or large industry organizations and is owned by an organization that sells cloud services.

[0081] Hybrid Cloud: The cloud infrastructure is a composite of two or more clouds (private, community, or public) that remain a unique entity but are joined by standardized or proprietary technologies that enable data and application portability (e.g., cloud bursting for load balancing between clouds).

[0082] A cloud computing environment is stateless, low-coupling, modular, and service-oriented with a focus on semantic interoperability. At the heart of cloud computing is an infrastructure that includes a network of interconnected nodes.

[0083] Referring now to FIG. 7, an exemplary cloud computing environment 50 is shown. As shown, the cloud computing environment 50 includes one or more cloud computing nodes 10 with which local computing devices used by cloud consumers, such as a personal digital assistant (PDA) or cell phone 54A (e.g., client system 102a), a desktop computer 54B, a laptop computer 54C, or an automobile computer system 54N, or combinations thereof, may communicate. The nodes 10 may communicate with each other. They may be physically or virtually grouped in one or more networks, such as a private cloud, a community cloud, a public cloud, or a hybrid cloud, or combinations thereof, as described above (not shown). This allows the cloud computing environment 50 to offer infrastructure, platform, and / or software as a service without the cloud consumer having to maintain resources on the local computing device. It should be understood that the types of computing devices 54A-54N shown in FIG. 7 are intended to be exemplary only, and that the computing node 10 and cloud computing environment 50 may communicate with any type of computerized device over any type of network and / or network-addressable connection (e.g., using a web browser).

[0084] Referring now to Figure 8, a set of functional abstraction layers provided by cloud computing environment 50 (Figure 7) is shown. It should be understood in advance that the components, layers, and functions shown in Figure 8 are intended to be merely exemplary, and embodiments of the present disclosure are not limited thereto. As shown, the following layers and corresponding functions are provided:

[0085] Hardware and software layer 60 includes hardware and software components. Examples of hardware components include mainframe 61, Reduced Instruction Set Computer (RISC) architecture based servers 62, servers 63, blade servers 64, storage devices 65, and networks and networking components 66. In some embodiments, software components include network application server software 67 and database software 68.

[0086] The virtualization layer 70 provides an abstraction layer at which the following examples of virtual entities are provided: virtual servers 71, virtual storage 72, virtual networks including virtual private networks 73, virtual applications and operating systems 74, and virtual clients 75.

[0087] In one example, management layer 80 may provide the functions described below. Resource provisioning 81 provides dynamic procurement of computing and other resources utilized to execute tasks within the cloud computing environment. Metering and pricing 82 provides cost tracking as resources are utilized within the cloud computing environment and billing or invoicing for the consumption of these resources. In one example, these resources may include application software licenses. Security provides protection for data and other resources as well as identity verification for cloud consumers and tasks. User portal 83 provides consumers and system administrators with access to the cloud computing environment. Service level management 84 provides cloud computing resource allocation and management so that requested service levels are met. Service level agreement (SLA) planning and fulfillment 85 provides pre-positioning and procurement of cloud computing resources where future requirements are anticipated according to SLAs.

[0088] The workload tier 90 provides examples of functions for which cloud computing environments are utilized. Examples of workloads and functions provided from this tier include mapping and navigation 91, software development and lifecycle management 92, virtual classroom instructional delivery 93, data analytics processing 94, transaction processing 95, and conditional data access management 96.

[0089] As described in more detail herein, it is contemplated that some or all of the operations of some of the method embodiments described herein may be performed in an alternative order, or not at all. Further, multiple operations may occur simultaneously or as an internal part of a larger process.

[0090] The present disclosure may be a system, method, or computer program product, or any combination thereof. The computer program product may include a computer-readable storage medium (or media) having computer-readable program instructions thereon for causing a processor to perform aspects of the present disclosure.

[0091] A computer readable storage medium may be a tangible device that can hold and store instructions for use by an instruction execution device. A computer readable storage medium may be, for example, but not limited to, an electronic storage device, a magnetic storage device, an optical storage device, an electromagnetic storage device, a semiconductor storage device, or any suitable combination of the foregoing. A non-exhaustive list of more specific examples of computer readable storage media includes portable computer diskettes, hard disks, random access memory (RAM), read only memory (ROM), erasable programmable read only memory (EPROM or flash memory), static random access memory (SRAM), portable compact disk read only memory (CD-ROM), digital versatile disk (DVD), memory sticks, floppy disks, mechanically encoded devices such as punch cards or ridge structures in grooves that allow instructions to be recorded thereon, and any suitable combination of the foregoing. As used herein, a computer-readable storage medium should not be construed as a transitory signal per se, such as radio waves or other freely propagating electromagnetic waves, electromagnetic waves propagating through a waveguide or other transmission medium (e.g., light pulses passing through a fiber optic cable), or electrical signals transmitted through an electrical wire.

[0092] The computer readable program instructions described herein may be downloaded from the computer readable storage medium to the respective computing / processing device or to an external computer or external storage device via a network, such as the Internet, a local area network, a wide area network, or a wireless network, or a combination thereof. The network may include copper transmission cables, optical transmission fiber, wireless transmission, routers, firewalls, switches, gateway computers, or edge servers, or a combination thereof. A network adapter card or network interface in each computing / processing device receives the computer readable program instructions from the network and transfers the computer readable program instructions for storage in the computer readable storage medium in the respective computing / processing device.

[0093] The computer readable program instructions for carrying out the operations of the present disclosure may be either source or object code written in any combination of one or more programming languages, including assembler instructions, instruction set architecture (ISA) instructions, machine instructions, machine-dependent instructions, microcode, firmware instructions, state setting data, or object-oriented programming languages ​​such as Smalltalk®, C++, and traditional procedural programming languages ​​such as the “C” programming language or similar programming languages. The computer readable program instructions may execute completely on the user's computer, partially on the user's computer, as a standalone software package, partially on the user's computer and partially on a remote computer, or completely on a remote computer or server. In the latter scenario, the remote computer may be connected to the user's computer through any type of network, including a local area network (LAN) or a wide area network (WAN), or the connection may be made to an external computer (e.g., through the Internet using an Internet Service Provider). In some embodiments, electronic circuitry including, for example, a programmable logic circuit, a field programmable gate array (FPGA), or a programmable logic array (PLA), may execute computer readable program instructions by individualizing the electronic circuitry with state information of the computer readable program instructions to perform aspects of the present disclosure.

[0094] Aspects of the present disclosure are described herein with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to the disclosed embodiments. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, are implemented by computer readable program instructions.

[0095] These computer readable program instructions may be provided to a processor of a general purpose computer, special purpose computer, or other programmable data processing apparatus to produce a machine, such that the instructions, executed by the processor of the computer or other programmable data processing apparatus, generate means for performing the functions / operations specified in one or more blocks of the flowcharts and / or block diagrams. These computer readable program instructions may also be stored in a computer readable storage medium such that the computer readable storage medium on which the instructions are stored comprises an article of manufacture including instructions for performing aspects of the functions / operations specified in one or more blocks of the flowcharts and / or block diagrams, and can direct a computer, programmable data processing apparatus, or other device, or combination thereof, to function in a particular manner.

[0096] The computer readable program instructions may also be loaded onto a computer, other programmable data processing apparatus, or other device to cause the computer, other programmable apparatus, or other device to perform a series of operational steps to create a computer-implemented process, such that the instructions executing on the computer, other programmable apparatus, or other device perform the functions / operations specified in one or more blocks of the flowcharts and / or block diagrams.

[0097] The flowcharts and block diagrams in the drawings illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments of the present disclosure. In this regard, each block in the flowcharts or block diagrams may represent a module, segment, or part of an instruction, including one or more executable instructions for implementing a specified logical function. In some alternative implementations, the functions described in the blocks may occur out of the order described in the drawings. For example, two blocks shown in succession may in fact be implemented as one step, executed simultaneously, substantially simultaneously, partially or fully overlapping in time, or the blocks may be executed in the reverse order depending on the functionality involved. It should also be noted that each block in the block diagrams and / or flowchart illustrations, and combinations of blocks in the block diagrams and / or flowchart illustrations, are implemented by a dedicated hardware-based system that performs the specified functions or operations or executes a combination of dedicated hardware and computer instructions.

[0098] The terminology used herein is for the purpose of describing particular embodiments only and is not intended to limit the various embodiments. As used herein, the singular forms "a", "an" and "the" are intended to include the plural forms as well, unless the context clearly indicates otherwise. It is further understood that the terms "comprise" and / or "comprising", as used herein, specify the presence of stated features, integers, steps, operations, elements, or components, or combinations thereof, and do not exclude the presence or addition of one or more other features, integers, steps, operations, elements, components, or sets thereof, or combinations thereof. In the preceding detailed description of exemplary embodiments of the various embodiments, reference has been made to the accompanying drawings, in which like numbers represent like elements. The accompanying drawings form a part of this specification, and in which are shown, by way of illustration, specific exemplary embodiments in which the various embodiments may be practiced. These embodiments have been described in sufficient detail to enable one skilled in the art to practice the embodiments, but other embodiments may be used, and logical, mechanical, electrical, and other changes may be made without departing from the scope of the various embodiments. In the foregoing description, numerous specific details have been set forth in order to provide a thorough understanding of the various embodiments. However, the various embodiments may be practiced without these specific details. In other instances, well-known circuits, structures and techniques have not been shown in detail in order not to obscure the embodiments.

[0099] Different examples of the word "embodiment" as used herein do not necessarily refer to the same embodiment, but may. Any data and data structures shown or described herein are merely examples, and different amounts of data, types of data, fields, numbers and types of fields, field names, numbers and types of rows, records, entries, or data organizations may be used in other embodiments. Additionally, any data may be combined with logic such that individual data structures may not be necessary. Thus, the foregoing detailed description should not be taken in a limiting sense.

[0100] The description of various embodiments of the present disclosure is presented for illustrative purposes, but is not intended to be exhaustive or limited to the disclosed embodiments. Many modifications and variations will be apparent to those skilled in the art without departing from the scope and spirit of the described embodiments. The terminology used herein has been selected to best explain the principles of the embodiments, practical applications, or technical improvements to the technology found in the market, or to enable others skilled in the art to understand the embodiments disclosed herein.

[0101] While the present disclosure has been described with respect to specific embodiments, it is anticipated that alterations and modifications thereof will become apparent to those skilled in the art, and it is therefore intended that the following claims be interpreted to cover all such alterations and modifications as are within the true spirit and scope of the present disclosure.

[0102] Some examples will now be provided to further clarify various aspects of the present disclosure.

[0103] Example 1: A computer-implemented method for conditional access to data in a database system, the database system including records, each record including a set of attributes, the database system further including database views, each database view representing a subset of the set of attributes, the method comprising: storing data object objects, each data object object indicating a subset of attributes of the set of attributes and a processing purpose for processing the subset of attributes; associating each data processing purpose with one or more entities that have authorized access to the subset of attributes of the data processing purpose; receiving a request for data for a particular processing purpose of the data processing purpose and a selected view of the database views; retrieving a data object indicating the particular processing purpose; comparing the subset of attributes represented by the selected view with the subset of attributes represented in the retrieved data object; and in response to determining that the subset of attributes represented by the selected view is a subset of the subset of attributes represented in the retrieved data object, providing values ​​of the subset of attributes represented in the selected view for the entity associated with the particular processing purpose.

[0104] Example 2: A limitation of Example 1, in which the data object includes a first bitmap that maps bits to a set of attributes according to an order, the first bitmap being configured to indicate a subset of the attributes, the database view includes a second bitmap that maps bits to a set of attributes according to the order, the second bitmap being configured to indicate a subset of the attributes of the database view, and the comparison is performed using the first bitmap and the second bitmap.

[0105] Example 3: A limitation of any of Examples 1 or 2, wherein the data object further includes a public key, the received request further indicates a signature, and the method further includes verifying the signature using the public key of the retrieved data object, where the comparing is performed only if the signature is validated.

[0106] Example 4. Any limitation of Examples 1-3, wherein associating each processing purpose of the data processing purpose with one or more entities that have authorized access to the subset of attributes of the processing purpose includes generating an agreement table, where each entry in the agreement table includes an entity identifier (ID) of the entity and the associated processing purpose, and providing values ​​of the subset of attributes includes combining the agreement table with the selected view such that the value of the subset of attributes includes only values ​​of the subset of attributes for entities associated with the particular processing purpose.

[0107] Example 5. Any of the limitations of Examples 1-4, wherein the data object includes a first list including a subset of the attributes, the database view includes a second list including a subset of the attributes of the database view, and the comparison is performed using the first list and the second list.

[0108] Example 6. Any of the limitations of Examples 1-5, further including providing a procedure, the procedure configured to receive as input a specific processing objective and a selected view, and configured to perform searching, comparing, and providing; and executing the procedure via an application programming interface (API), the receiving of the request being performed by a function of the API that invokes the procedure.

[0109] Example 7. Any of the limitations of Examples 1-6, further including receiving a request from a third party system to register a processing objective with the third party system, and generating data objective objects, each data objective object further indicating a respective third party system.

[0110] Example 8. A system comprising one or more processors and one or more computer-readable storage media collectively storing program instructions configured, when executed by the one or more processors, to cause the processors to perform a method according to any of Examples 1-7.

[0111] Example 9. A computer program product comprising one or more computer-readable storage media and program instructions collectively stored on the one or more computer-readable storage media, the program instructions comprising instructions configured to cause one or more processors to perform a method according to any one of Examples 1-7.

Claims

1. 1. A computer-implemented method for conditional access to data in a database system, the database system including records, each record including a set of attributes, the database system including database views, each database view representing a subset of the set of attributes, the method comprising: storing data object objects, each data object indicating a subset of attributes of the set of attributes and a processing objective for processing the subset of attributes; associating each processing purpose with one or more entities that have authorized access to a subset of the attributes of the processing purpose; receiving a request for data for a particular processing purpose and a selected one of the database views; retrieving a data object indicating said particular processing objective; comparing the subset of attributes represented by the selected view with the subset of attributes represented in the retrieved data target objects; in response to determining that the subset of attributes represented by the selected view is a subset of the subset of attributes represented in the retrieved data object object, providing values ​​of the subset of attributes represented in the selected view for entities associated with the particular processing object; 4. A computer-implemented method comprising:

2. 2. The method of claim 1, wherein the data destination object includes a first bitmap that maps bits to the set of attributes respectively according to an order, the first bitmap being configured to indicate a subset of the attributes, the database view includes a second bitmap that maps bits to the set of attributes according to the order, the second bitmap being configured to indicate a subset of the attributes of the database view, and the comparing is performed using the first and second bitmaps.

3. The data destination object further includes a public key, the received request further includes a signature, and the method further comprises:

3. The method of claim 1 or 2, further comprising verifying the signature using the public key of the retrieved data object, the comparing occurring only if the signature is validated.

4. 4. The method of claim 1, wherein associating each processing purpose with one or more entities that have authorized access to the subset of attributes of the processing purpose comprises generating an agreement table, each entry of the agreement table including an entity identifier (ID) of an entity and an associated processing purpose, and providing values ​​of the subset of attributes comprises combining the agreement table with the selected view such that the values ​​of only the subset of attributes for the entities associated with the particular processing purpose are included.

5. 5. The method of claim 1, wherein the data target object includes a first list containing a subset of the attributes, and the database view includes a second list containing a subset of the attributes of the database view, and the comparing is performed using the first list and the second list.

6. providing a procedure, the procedure configured to receive the particular processing objective and the selected view as input, and configured to perform the searching, the comparing, and the providing; 6. The method of claim 1, further comprising: executing the procedure via an application programming interface (API), wherein the receiving of the request is performed by a function of the API that invokes the procedure.

7. 1. A system comprising: one or more processors; 1. One or more computer-readable storage media collectively storing program instructions that, when executed by the one or more processors, cause the one or more processors to perform a method for conditional access to data in a database system, the database system including records, each record including a set of attributes, the database system including database views, each database view representing a subset of the set of attributes, the method comprising: storing data object objects, each data object indicating a subset of attributes of the set of attributes and a processing objective for processing the subset of attributes; associating each processing purpose with one or more entities that have authorized access to a subset of the attributes of the processing purpose; receiving a request for data for a particular processing purpose and a selected one of the database views; retrieving a data object indicating said particular processing objective; comparing the subset of attributes represented by the selected view with the subset of attributes represented in the retrieved data object; and in response to determining that the subset of attributes represented by the selected view is a subset of the subset of attributes represented in the retrieved data object objects, providing values ​​of the subset of attributes represented in the selected view for entities associated with the particular processing object; A system comprising:

8. 8. The system of claim 7, wherein the data destination object includes a first bitmap that maps bits to the set of attributes according to an order, the first bitmap configured to indicate a subset of the attributes, the database view includes a second bitmap that maps bits to the set of attributes according to the order, the second bitmap configured to indicate the subset of the attributes of the database view, and the comparing is performed using the first and second bitmaps.

9. The data destination object further includes a public key, the received request further includes a signature, and the method further comprises:

9. The system of claim 7 or 8, further comprising verifying the signature using the public key of the retrieved data object, the comparing occurring only if the signature is validated.

10. 10. The system of claim 7, wherein associating each processing objective with one or more entities that have authorized access to the subset of attributes of the processing objective comprises generating an agreement table, each entry of the agreement table including an entity identifier (ID) of an entity and an associated processing objective, and providing values ​​of the subset of attributes comprises combining the agreement table with the selected view such that the agreement table includes only the values ​​of the subset of attributes for the entities associated with the particular processing objective.

11. 11. The system of claim 7, wherein the data target object includes a first list including a subset of the attributes, and the database view includes a second list including a subset of the attributes of the database view, and the comparing is performed using the first list and the second list.

12. The method performed by the one or more processors comprises: providing a procedure, the procedure configured to receive the particular processing objective and the selected view as input, and configured to perform the searching, the comparing, and the providing; 12. The system of claim 7, further comprising: executing the procedure via an application programming interface (API), wherein the receiving of the request is performed by a function of the API that invokes the procedure.

13. 13. A system according to any one of claims 7 to 12, wherein the data object is stored remotely from the database system.

14. 1. A computer program product comprising: one or more computer readable storage media; and program instructions collectively stored on the one or more computer readable storage media, the program instructions comprising instructions configured to cause one or more processors to perform a method for conditional access to data in a database system, the database system comprising records, each record comprising a set of attributes, the database system comprising database views, each database view representing a subset of the set of attributes, the method comprising: storing data object objects, each data object indicating a subset of attributes of the set of attributes and a processing objective for processing the subset of attributes; associating each processing purpose with one or more entities that have authorized access to a subset of the attributes of the processing purpose; receiving a request for data for a particular processing purpose and a selected one of the database views; retrieving a data object indicating said particular processing objective; comparing the subset of attributes represented by the selected view with the subset of attributes represented in the retrieved data target objects; in response to determining that the subset of attributes represented by the selected view is a subset of the subset of attributes represented in the retrieved data object object, providing values ​​of the subset of attributes represented in the selected view for entities associated with the particular processing object; 2. A computer program product comprising:

15. 15. The computer program product of claim 14, wherein the data destination object includes a first bitmap mapping bits to the set of attributes respectively according to an order, the first bitmap configured to indicate a subset of the attributes, the database view includes a second bitmap mapping bits to the set of attributes according to the order, the second bitmap configured to indicate a subset of the attributes of the database view, and the comparing is performed using the first and second bitmaps.

16. The data destination object further includes a public key, the received request further includes a signature, and the method further comprises:

16. The computer program product of claim 14 or 15, further comprising verifying the signature using the public key of the retrieved data object, wherein the comparing occurs only if the signature is validated.

17. 17. The computer program product of claim 14, wherein associating each processing objective with one or more entities that have authorized access to the subset of attributes of the processing objective comprises generating an agreement table, each entry of the agreement table including an entity identifier (ID) of an entity and an associated processing objective, and providing values ​​of the subset of attributes comprises combining the agreement table with the selected view such that the agreement table includes only the values ​​of the subset of attributes for the entities associated with the particular processing objective.

18. 18. The computer program product of claim 14, wherein the data target object includes a first list including a subset of the attributes, and the database view includes a second list including a subset of the attributes of the database view, and the comparing is performed using the first list and the second list.

19. The method performed by the one or more processors comprises: providing a procedure, the procedure configured to receive the particular processing objective and the selected view as input, and configured to perform the searching, the comparing, and the providing; 19. The computer program product of claim 14, further comprising: executing the procedure via an application programming interface (API), wherein the receiving of the request is performed by a function of the API that invokes the procedure.

20. 20. A computer program product according to any one of claims 14 to 19, wherein the data object is stored remotely from the database system.

Images