Database Management Engine for Database Management Systems

Abstract

The method, system, and computer storage medium provide a privacy compliance notice indicating a database's level of compliance with a privacy policy after restoring the database to a backup copy of the database. The database is associated with a database management engine. The database supports a first type of privacy-based data entity. The first type of privacy-based data entity is a database entity having privacy system level metadata properties associated with data operations in a database language syntax. The privacy compliance notice can be generated based on determining whether a database journal and a privacy database operation associated with the privacy journal have been performed for the database since the database was restored to the backup copy of the database. The database transaction journal includes a transaction log of database operations performed on the database, and the privacy journal includes database operations recorded as privacy database operations associated with a plurality of the first type of privacy-based data entities.

Description

[Background technology]

[0001] Users rely on applications and services to facilitate control of data stored in various data repositories (e.g., databases). A distributed computing system (e.g., a cloud computing platform) hosts a database management system that supports network access to the data. A database management system (DBMS) can be part of an information management system in a distributed computing system that provides various types of data control tools that allow for create, read, update, and / or delete (CRUD) operations. A DBMS can operate as part of an information management system to provide data storage, management, migration, organization, and manipulation services. Specifically, a DBMS performs computing tasks to facilitate database compliance with various corporate, departmental, or government regulatory privacy policies. For example, a DBMS supports database operations including user-initiated delete operations and requests to remove privacy data requested to be removed by the user.

[0002] Traditionally, database management systems are not configured with computing infrastructure and logic to support maintaining database compliance when a backup copy of a database is restored. For example, DBMSs are typically implemented to operationally restore the state of a database to a backup copy without reflecting privacy data removal requests that delay the time the backup was performed. The operational backup restore model cannot guarantee privacy compliance because privacy data is restored and not systematically identified and deleted when a backup copy of a database is restored. Therefore, a more comprehensive database management system with an alternative basis for implementing operations to facilitate privacy compliance may improve computing operations and interfaces in the database management system. Summary of the Invention

[0003] Various aspects of the technology described herein are generally directed to systems, methods, and computer storage media for providing, among other things, privacy compliance notices. A privacy compliance notice is an indication of database-level compliance with a privacy policy. A privacy compliance notice may be generated specifically after restoring a database to a backup copy of the database. A privacy compliance notice may be a message associated with software or hardware means and components for delivering messages. A privacy compliance notice may be generated based on determining whether privacy database operations associated with the database journal and privacy journal have been performed (i.e., re-performed) with respect to the database since the database was restored to the backup copy of the database. Privacy database operations that have not been performed with respect to the database since the database was restored to the backup copy of the database may be identified using the database transaction journal and privacy journal.

[0004] Operatively, the database transaction journal includes a transaction log of database operations performed on or against the database. The privacy journal is separate from and smaller in size than the database transaction journal, and thus the privacy journal may include a subset of the information contained within the database transaction journal. The database supports a plurality of privacy-based first type data entities (i.e., first type citizens in computing) corresponding to database entities having privacy system level metadata properties associated with data operations in a database language syntax. Aspects of the present disclosure enable ensuring privacy compliance through backup restore operations in a computationally efficient manner by generating and sending a privacy compliance notice to a database administrator based on identifying that a privacy database operation in the privacy journal has not been performed with respect to the database since the database was restored to a backup copy of the database. Specifically, aspects of the present disclosure include leveraging the privacy system level metadata to identify privacy database operations that have not been performed with respect to a backup copy of the database based on a comparison of the database transaction journal and the privacy journal of the restored backup copy.

[0005] Traditionally, database management systems are not configured with computing infrastructure and logic to support maintaining database compliance when a backup copy of a database is restored. A technical solution to the limitations of traditional database management systems provides a privacy compliance notice. The privacy compliance notice may be generated and include information based on identifying that a privacy database operation in a privacy journal has not been performed on a database since the database was restored to a backup copy of the database. Thus, aspects of the present disclosure enable ensuring privacy compliance through backup restore operations in a computationally efficient manner.

[0006] During operation, the computing device may access, with a database management engine, a database supporting a plurality of privacy-based first type data entities having privacy system level metadata properties associated with data operations in a database language syntax. The computing device may perform database operations associated with the privacy-based first type data entities and the privacy system level metadata properties with respect to the database. The computing device may record the database operations in a privacy journal based on performing the database operations. For example, the privacy journal is configured to record the database operations as privacy database operations associated with the privacy-based first type data entities and the privacy system level metadata. The computing device restores the database to a backup copy of the database and, based on the restoration, identifies in the privacy journal privacy database operations that have not been performed (i.e., re-performed) with respect to the database since the restoration. Based on identifying privacy database operations that have not been performed with respect to the database since the restoration, the computing device generates a privacy compliance notice associated with the database.

[0007] The database management system is further operative to access, with a database management engine, a database supporting a plurality of privacy-based first type data entities, the privacy-based first type data entities being database entities having privacy system level metadata properties associated with data operations in a data definition language syntax, the database management system is operative to generate a backup copy of the database associated with a database transaction journal configured to record the database operations and a privacy journal configured to record the database operations as privacy database operations.

[0008] The database management system is operative to perform database operations associated with the privacy-based first type data entities and privacy system level metadata properties with respect to the database. The database management system is operative to record the database operations in a database transaction journal and a privacy journal based on performing the database operations. The database operations are recorded in the privacy journal as privacy database operations. The database management system is also operative to detect errors in the database and to restore the database to a backup copy of the database based on detecting the errors in the database. The database management system is further operative to determine, based on restoring the database to the backup copy, whether any privacy database operations have not been performed with respect to the database since the restore. The database management system determines that no privacy database operations have been performed and generates a privacy compliance notice associated with the database based on determining that no privacy database operations have been performed with respect to the database since the restore.

[0009] This Summary is provided to introduce a selection of concepts in a simplified form that are further described below in the Detailed Description. This Summary is not intended to identify key features or essential features of the claimed subject matter, nor is it intended to be used as an aid in determining the scope of the claimed subject matter.

[0010] The techniques described herein are explained in detail below with reference to the accompanying drawings. [Brief description of the drawings]

[0011] [Figure 1A]FIG. 1 is a block diagram of an example database management system for generating a privacy compliance notice used to determine compliance with a privacy policy using a database management engine of the database management system, in accordance with aspects of the technology described herein. [Figure 1B] FIG. 1 is a block diagram of an exemplary schematic for generating a privacy compliance notice used to determine compliance with a privacy policy using a database management engine in a database management system, in accordance with aspects of the technology described herein. [Figure 1C] 1 is an example database management system configured to generate a privacy compliance notice within the database management system, in accordance with aspects of the technology described herein. [Figure 2A] An exemplary database management system for storing database transactions in a database transaction journal and storing privacy database transactions in a privacy journal using a database management engine in the database management system according to aspects of the technology described herein. [Figure 2B] 1 is an exemplary database management system for generating a privacy compliance notice used to determine compliance with a privacy policy using a database management engine within the database management system, in accordance with aspects of the technology described herein. [Diagram 3] 1 provides a first example method for generating a privacy compliance notice using a database management engine in a database management system, according to aspects of the technology described herein. [Figure 4] FIG. 13 provides a second example method for generating a privacy compliance notice using a database management engine in a database management system, according to aspects of the technology described herein. [Diagram 5]FIG. 13 provides a third example method for generating a privacy compliance notice using a database management engine in a database management system, according to aspects of the technology described herein. [Figure 6] FIG. 1 illustrates a block diagram of an exemplary distributed computing environment suitable for use in implementing aspects of the technologies described herein. [Figure 7] FIG. 1 illustrates a block diagram of an exemplary computing environment suitable for use in implementing aspects of the technologies described herein. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0012] Summary of technical problems, technical solutions, and technical improvements Database management systems operate within information management systems to provide data storage, management, migration, organization, and manipulation services. In particular, database management systems perform computing tasks to facilitate database compliance with various corporate, departmental, or government regulatory privacy policies. For example, database management systems support database operations including processing user-initiated delete operations to remove privacy data requested to be removed by the user. Traditionally, database management systems are not configured with computing logic to handle facilitating ongoing maintenance of database compliance when backups are performed and when removal of some privacy data is later requested.

[0013] As used herein, a "privacy policy" may refer to a set of rules or regulations for managing data. Privacy policies may be data-specific, user-specific, enterprise-specific, and the like. For example, the California Consumer Privacy Act (CCPA) and the General Data Protection Regulation (GDPR) provide rules and regulations specific to certain areas of the world regarding the regulation and control of certain types of data. Privacy policies may include, by way of example, computing logic that satisfies rules or regulations related to pseudonymization and encryption of personal data, the ability to ensure ongoing confidentiality, integrity, availability, and resilience of processing systems and services, the ability to restore availability and access to personal data in a timely manner in the event of a physical or technical event, and processes for periodically testing, assessing, and evaluating the effectiveness of technical and organizational measures to ensure the security of processing. Ensuring compliance has become important in recent years to comply with customer demands regarding control of data and to avoid fees or sanctions associated with failing to comply with privacy policies. Complying with privacy policies through backup restoration involves additional challenges as discussed herein.

[0014] As used herein, "backup," "performing a backup," "initiating a database backup store operation," or "saving a backup copy of a database" may interchangeably refer to the process of creating a backup copy of a database by copying data records from a database (e.g., a Structured Query Language (SQL) server database) or log records from a corresponding database transaction journal of a transaction log (referred to herein as a "database transaction journal"). In response to initiating a backup, a backup copy of the database may be created at a particular moment in time from when the backup was initiated. The backup copy may be used to restore and recover the data and associated database transaction journal, for example, when a user wishes to restore the database to a previous copy. A "database transaction journal" may refer to a transaction log that contains database operations that were performed with respect to the database resulting in a corresponding copy or version of the database. In this manner, performing a "backup restore operation" may restore the database as well as the corresponding database transaction journal to the backup copy that was associated with when the backup was performed.

[0015] Some conventional database management systems may initiate a full database backup, a partial database backup, or a file backup. Furthermore, conventional database management systems may initiate a differential backup restore operation based on a recent complete backup of (1) the full or partial database, or (2) a set of data files or file groups (a "differential base"), such that the differential backup restore operation only includes modifications related to data that has changed since the differential base. Although a differential backup restore operation is more efficient than a full backup in that only data modified since a previous backup restore is replaced, even database management systems that utilize a differential backup restore operation do not provide computing logic or a computational model for addressing privacy policy compliance issues associated with a backup restore operation that restores privacy data that a user previously requested to be removed.

[0016] In fact, conventional database management systems are typically implemented to blindly restore the state of data structures to the state they were in when the backup was completed, without reflecting database operations related to privacy data communicated and / or performed after the time the backup was completed. The blind backup restore model cannot ensure privacy policy compliance (e.g., by addressing or removing data restored as part of the backup restore operation that renders the database in violation of the privacy policy). To complete the backup, the blind backup model causes data stored as part of the backup to be restored, including privacy data that was previously requested to be removed after the date of the backup.

[0017] One approach to facilitate database compliance with privacy policies may include dedicating information technology (IT) professionals to the task of ensuring database compliance with privacy policies. These dedicated IT professionals may be burdened with manually analyzing data structures and databases to identify privacy policy violations. However, this manual process of identifying privacy policy violations is cumbersome and inefficient, and may result in data structures that fail to comply with privacy policies being overlooked. In contrast to existing approaches, aspects of the present disclosure may improve the efficiency of achieving database compliance with privacy policies, reduce CPU cycles by automating the identification of privacy database operations, and reduce network bandwidth.

[0018] Another existing approach to ensuring database compliance with privacy policies may include giving customers (e.g., customers of distributed computing system database solutions) the freedom to manually tag data structures, such as fields and records in a relational database. However, giving customers the freedom to participate in the complexities of privacy tagging management may result in inefficiencies, inconsistencies, and incorrectly tagged data, especially in light of the growing lack of IT professionals capable of meeting the growing demands of IT professionals. Furthermore, IT professionals leaving or retiring from an enterprise may continually rotate privacy tagging management tasks to newer IT professionals who may not be aware of the organizational approach used by the previous IT professionals, resulting in inconsistencies in the approach to attempting to maintain compliance with privacy policies. Thus, a more comprehensive database management system with an alternative basis for implementing privacy management operations may improve computing operations and interfaces with the database management system.

[0019] An embodiment of the present disclosure provides a privacy compliance notice. The privacy compliance notice is an indication of database-level compliance with a privacy policy. The privacy compliance notice may be generated specifically after restoring a database to a backup copy of the database. The privacy compliance notice may be a message related to software or hardware means and components for delivering messages. The privacy compliance notice may be generated based on determining whether privacy database operations associated with the database journal and privacy journal have been performed (i.e., re-performed) with respect to the database since the database was restored to the backup copy of the database. Privacy database operations that have not been performed with respect to the database since the database was restored to the backup copy of the database may be identified using the database transaction journal and privacy journal.

[0020] In operation, privacy is operatively integrated into a database platform (e.g., a Structured Query Language database) as a first level data entity. As used herein, a "first level data entity" refers to an entity that supports operations that facilitate other entities in the database. A privacy first level data entity may refer to a privacy entity that is generated and integrated into the database platform to support privacy database operations in a manner similar to the predefined entities and data operations of the database platform. Thus, in the privacy context, exemplary first level data entities include objects, functions, operations, and auxiliary relational database entities. In some contexts, the first level data entities may be specific to a programming language, such as, but not limited to, the Python, SQL, and C programming language suites. Operations available to a first level data entity include the ability to be passed as an argument, returned as a function, modified, and assigned to a variable.

[0021] In one embodiment, system level metadata is assigned to data structures such as tables, columns (e.g., fields), or corresponding rows (e.g., records) using a data definition language (DDL), for example, enabled by the first level data entity specification. In this manner, standard database DDL operations may be utilized to assign certain data structures with privacy system level metadata, simplifying the process for assigning privacy system level metadata to target data structures. As used herein, "privacy system level metadata" or "privacy system level metadata properties" may refer to any tag or metadata assigned to any suitable data structure that indicates that the corresponding data structure is associated with information controlled by a privacy policy. For example, a column that contains a "social security number" may be associated with privacy system level metadata, indicating that entries in the column correspond to privacy data. Thus, "privacy data" refers to any data that includes "privacy system level metadata" or otherwise, or that is tagged with metadata that indicates that the corresponding data structure contains privacy data. Control of privacy data may be regulated by a privacy policy.

[0022] As a non-limiting example, a DDL operation for assigning privacy system-level metadata may be: ”ALTER TABLE table_name MODIFY column_name privacy=true” which causes privacy system level metadata to be assigned to a column defined in the MODIFY entry, and the column defined in the MODIFY entry is associated with a table defined in the ALTER TABLE entry. Specifically, as given in this example, "privacy=true" may be a computer readable script configured to assign privacy system level metadata to a column (e.g., column_name) of a table (e.g., table_name) defined in this line of exemplary code. In this manner, a computing system may identify that a database operation performed with respect to any entry in this column of this table pertains to privacy data since privacy system level metadata has been assigned to the column. While this example involves assigning privacy system level metadata to a column by written code, it should be understood that privacy system level metadata may be assigned by any suitable input or selection, including a selection made via a drop down menu, text written in a data field, etc.

[0023] Further, aspects of the present disclosure are directed to, among other things, providing a privacy compliance notification indicating a level of compliance with a privacy policy associated with a database. In this specification, a "level of compliance" indicates a degree of compliance achieved with a privacy policy. The level of compliance may be associated with a computing logic for evaluating data (e.g., a privacy database operation or a privacy journal) and determining a level of compliance with the privacy policy. For example, a binary level 0-compliant and 1-non-compliant based on whether privacy data to be deleted is not present (compliant) or is present (non-compliant) in the database. Other variations and combinations of the level of compliance indicated by the degree to the existence of privacy data that violates the privacy policy are contemplated with embodiments of the present disclosure.

[0024] As discussed herein, the privacy compliance notification may include an indication of the level of compliance of the database with the privacy policy after a backup restore that restores a backup copy of the database, such that the backup copy of the database may have restored privacy data previously requested to be removed by the user. The privacy compliance notification may include any suitable indication in any suitable format, such as an email, an instant message, a browser notification, an integrated calendar notification, etc. A privacy compliance notification may be generated and sent to any suitable personnel (or associated device), including a database administrator.

[0025] A privacy compliance notice may be generated based on identifying in the privacy journal privacy database operations that have not been performed with respect to the restored backup copy. A "privacy database operation" may refer to a database operation performed with respect to data structures, such as fields / columns, records / rows, and tables, that are associated with privacy system level metadata. A "privacy journal" may refer to a transaction log or journal that includes a listing of privacy database operations. A privacy journal may include a subset of the information in a database transaction journal. As an example, a privacy journal may include pointers that point to entries in a database transaction journal that correspond to database operations performed with respect to data structures associated with privacy system level metadata. For example, the pointers may correspond to low-bit data structures, such as transaction identifiers ("IDs"). In this manner, compliance with privacy policies is maintained in the privacy journal, since structures of entries in the privacy journal, such as pointers, may omit any additional privacy data. Additionally, low-bit structures of the privacy journal, such as pointers, may improve the speed of performing calculations, such as identifying from the privacy journal privacy database operations that have not been performed with respect to a copy of a database since restoration, as discussed below.

[0026] Furthermore, since the privacy compliance notice may provide more specific instructions regarding the level of compliance, the computational resources associated with database administrators performing operations on backup copies of the database to manually ensure compliance are reduced. For example, the privacy compliance notice may indicate which privacy database operations in the privacy journal were performed after the backup copy was generated as part of the backup operation. Additionally or alternatively, the privacy compliance notice may indicate that the backup copy complies with the privacy policy based on the privacy journal not including any privacy database operations that were not performed on the copy of the database after the backup was restored.

[0027] To illustrate one example of providing privacy compliance notification, a database management engine of a database management system may perform a backup operation on a database (or file). At a first instant in time, the backup operation may store a backup copy of the database at the first instant in time and a corresponding database transaction journal. At a second instant in time (after the first instant in time), a user may communicate a request to remove privacy data from the database. The database management engine may access the request to remove the user's privacy data and execute a delete statement to remove the privacy data from the database. The database management engine may store a transaction associated with the delete statement in the database transaction journal.

[0028] At a third moment (after the second moment), the database management engine may receive a request to initiate a backup restore operation. The backup restore operation may be received in response to detecting some targeted event, such as an error in the database. As a result, at the third moment, the database management system may restore the database to the backup copy of the database. Restoring the database to the backup copy of the database includes replacing the database and associated database transaction journal from the third moment with the database and associated database transaction journal of the first copy of the database (i.e., associated with the first moment).

[0029] In some embodiments, a database transaction journal from a third moment (prior to the backup restore operation) may be stored in the storage device to facilitate a determination as to which privacy database operations have not been performed. To verify compliance with the privacy policy, the database management engine may compare (i) the database transaction journal associated with the backup copy to (ii) the privacy journal. The database management engine may determine a database operation to attempt to remove the privacy data in response to determining, based on the comparison, that the backup operation restored the previously deleted user's privacy data. Additionally or alternatively, the database management engine may determine and generate a privacy compliance notice indicating the level of compliance of the database after the backup restore.

[0030] Thus, machine operations are more efficient when using the same, uniform, underlying privacy-based database infrastructure, as opposed to giving customers (e.g., customers of distributed computing system database solutions) the freedom to manually, independently, and variably tag data structures such as fields and records in a relational database. Indeed, the additional computational operations associated with transforming inconsistently tagged data structures are reduced by utilizing the disclosed privacy-based database infrastructure.

[0031] Aspects of the technical solution may be described, by way of example, with reference to Figures 1A, 1B, and 1C. Figure 1A shows a database management system 100 having a database management engine 110, a privacy client device 120, a database administrator device 126, and a network 180. The database management engine includes a data source 130, a transaction engine 140, a database operation engine 150, and a privacy notice engine 170.

[0032] Referring to FIG. 1B, FIG. 1B includes an exemplary database management system 100 for providing privacy compliance notification using a database management engine in the database management system according to aspects of the technology described herein. FIG. 1B includes components corresponding to those described with reference to FIG. 1A. The database management system 100 further includes a privacy client device 120 having privacy client interface data 122, a database administrator device 126 having database administrator interface data, a data source 130 having database transaction log data 132, privacy transaction log data 134, privacy data 136, and backup data 138, a transaction engine 140 having a client request processing engine 142, a database transaction engine 144, a privacy transaction engine 146, and a comparison engine 148, a database operation engine 150 having a backup engine 152, a database error detection engine 154, a restoration engine 156, a privacy data removal engine 158, and a privacy notification engine 170 having privacy violation event data 172.

[0033] The database management system 100 is configured to provide privacy compliance notices within the database management system. The database management system 100 includes a database management engine 110 that operates with management engine clients (such as management engines of the privacy client device 120 and the database administrator device 126) to manage privacy compliance notices and provide the functionality described herein. The privacy client device 120 and / or the database administrator device 126 include client-side computing logic and instructions that complement and supplement the server-side computing logic and instructions of the database management engine 110 for providing privacy compliance notices. For example, the database management system 110 may provide interfaces to (1) perform operations based on privacy-based first type data entities and / or privacy system level metadata properties, and (2) access, communicate, and generate interfaces related to privacy compliance notices, as described herein.

[0034] Database transaction log data 132, privacy transaction log data 134, privacy data 136, and backup data 138 may be stored and retrieved via data sources (e.g., data source 130) of database management system 100 and may include data supporting the provision of services associated with database management system 100. For example, the database management system may support recording database operations (performed with respect to a database) as database transaction log data 132 and recording database operations (performed with respect to a data structure of the database having privacy system level metadata) as privacy transaction log data 134, and database management system 100 is operable to manage database transaction log data 132 and privacy transaction log data 134. Additional data (e.g., metadata) related to database transaction log data 132 and privacy transaction log data 134 may be tracked and stored.

[0035] Referring to Figure 1C, an exemplary database management system 100 for providing privacy compliance notification using a database management engine 110 therein, in accordance with aspects of the technology described herein, is illustrated. Figure 1C includes components corresponding to those described with reference to Figure 1B. Figure 1C includes a privacy client 120 and a database management engine 110 having a data source 130, a transaction engine 140, a database operation engine 150, and a privacy notification engine 170.

[0036] Operatively, at block 12, the database operation engine 150 stores a backup copy of the database based on the backup operation. At block 14, the privacy client 120 communicates the database operation associated with the privacy system level metadata. At block 16, the database management engine 110 accesses a database supporting the first type of privacy-based data entity, and at block 18, performs the database operation on the database supporting the first type of privacy-based data entity. The first type of privacy-based data entity may include a privacy type associated with a privacy management operation defined in a privacy policy. Alternatively or additionally, the first type of privacy-based data entity tracks privacy metadata associated with the database operation, whereby the privacy metadata is stored in a privacy journal along with the corresponding database operation.

[0037] At block 20, the transaction engine 140 records a first entry related to the database operation in the database transaction journal, and at block 22, the transaction engine 140 determines privacy system level metadata related to the data structure to which the database operation applies. At block 24, the database management engine 110 records a second entry related to the database operation in the privacy journal as a privacy database operation. At block 26, the transaction engine records an entry related to the privacy database operation in the privacy journal.

[0038] At block 28, database operations engine 150 receives a request to initiate a backup restore, at block 30, restores the database to the backup copy of the database, and at block 32, compares the database transaction journal of the backup copy of the database to the privacy journal. At block 34, database management engine 110 identifies privacy database operations that have not been performed on or against the copy of the database since the restore. At block 36, transaction engine 140 generates additional database operations related to remediating (e.g., performing) the privacy database operations that have not been performed. At block 38, privacy notice engine 170 generates a privacy compliance notice indicating a level of compliance with the privacy policy associated with the database.

[0039] Overview of an exemplary environment for providing privacy compliance notices using a database management engine within a database management system Aspects of the technical solution may be described, by way of example, with reference to Figures 2A and 2B. Figure 2A is a block diagram of an exemplary technical solution environment based on the exemplary environment described with reference to Figures 6 and 7 used in implementing an embodiment of the technical solution. In general, the technical solution environment includes a technical solution system suitable for providing an exemplary database management system 100 in which the method of the present disclosure may be utilized. In particular, Figure 2A illustrates a high-level architecture of a database management system 100 according to an implementation of the present disclosure.

[0040] Among other engines, managers, generators, selectors, or components (collectively referred to herein as "components") not shown, the technical solution environment of the database management system 100 includes a database management engine 110. As shown, the database management engine 110 may include a database 210 including a database disk 210A, a database transaction journal 220 including a database transaction journal log disk 220A, a privacy journal 230 including a database transaction journal log disk 240, and a privacy notice data 240 including privacy violation event logical data. As discussed below in connection with the database transaction log data 132 and the privacy transaction log data 134 of FIG. 2B, the database transaction journal 220 may record database operations in the database transaction journal log disk 220A. Similarly, the privacy journal 230 may record database operations as privacy database operations in the privacy journal log disk 230A, and the privacy notice data 240 may be generated based on the privacy violation event logical data 240A. Thus, database management engine 110 may record transactions in database transaction journal 220 and in privacy journal 230. For example, recording a database operation in privacy journal 230 may include recording a pointer in privacy journal 230, where the pointer points to an entry in database transaction journal 220 that corresponds to the database operation. Additionally, database 210 may store any data, such as privacy data 136 (of FIG. 2B) of privacy client 120.Although database 210 is shown as being contained within a data disk, while database transaction journal 220 and privacy journal 230 are shown as being contained within respective log disks, it should be understood that the database, database transaction journal 220, and privacy journal 230 may be stored within any suitable storage or memory device, including but not limited to the features discussed in connection with Figures 6 and 7.

[0041] Database 210 may process database operations (e.g., requests to make changes to data stored in database disk 210A). In some embodiments, the changes may include computer-readable scripts in any suitable database language syntax, such as, for example, SQL. Taking SQL as an exemplary database language syntax, the changes to the database may occur as a result of any suitable command, including, but not limited to, database operations containing DDL, DML, Data Control Language (DCL), Transition Control Language (TCL), privacy data, and the like. As discussed in more detail below in connection with transaction engine 140, database transaction journal 220 may include entries including database transaction log data 132, and privacy journal 230 may include entries including privacy transaction log data 134. In operation, the privacy journal may include indications of privacy database operations performed with respect to data structures of database 210. The privacy database operations may correspond to database operations performed with respect to data structures (of database 210) having privacy system level metadata, as discussed herein. In some embodiments, making changes to privacy system level metadata may be classified as database operations related to the privacy system level metadata, and therefore making changes to privacy system level metadata may cause corresponding entries to be recorded in privacy journal 230 (and database transaction journal 220). As discussed in more detail herein, privacy notification data 240 and privacy violation event log data 240A are associated with privacy notification engine 170 and privacy violation event logic 172 of FIG. 1B.The privacy notification data 240 and the privacy violation event logic data 240A are associated with determining whether a privacy database operation has not been performed with respect to the database since restoration and generating a privacy compliance notice associated with the database based on determining whether a privacy database operation has not been performed with respect to the database since restoration.

[0042] Referring to Figure 2B, an exemplary database management system 100 for providing privacy compliance notification using a database management engine within the database management system according to aspects of the technology described herein is shown. Figure 2B corresponds to components described with reference to Figure 1B, but includes components discussed in more detail herein. In some embodiments, the database management system 100 may be implemented based on the exemplary environment described with reference to Figures 6 and 7, which are used in implementing embodiments of the technical solution.

[0043] A privacy client device 120 is configured to communicatively couple to the database management engine 110. Privacy client interface data 122 may be configured to allow the privacy client 120 to interact with features or services provided by the database management engine 110. In one embodiment, the privacy client interface data 122 may include logic for presenting interactable graphical user interface (GUI) elements to control data associated with the privacy client 120. For example, the GUI elements may include selectable icons, drop-down menus, scripting interfaces, text blocks, tables, and the like. In the context of the privacy client interface data 122 supporting SQL, the privacy client 120 may communicate data definition language (DDL) commands. As discussed below, because the database management engine 110 may support privacy-based first type data entities, the privacy client 120 may submit user input, such as DDL commands, to associate a particular data structure with privacy system level metadata. Alternatively, in some embodiments, the privacy client 120 may access data structures configured with privacy system-level metadata by the database management engine 110, and thus the privacy client 120 may access and use tables pre-configured with the privacy system-level metadata.

[0044] In some embodiments, the privacy client 120 may interact with a data structure that includes any appropriate data, such as privacy data. Privacy data may include personally identifiable information ("PII"), medical records, media such as photographs, communications, financial information, and / or any other data associated with privacy system level metadata, as discussed herein. As one example of a privacy client 120 interacting with a data structure, the privacy client 120 may communicate a request to remove certain privacy data 136 from the data source 130. A request to remove privacy data 136 may include a data manipulation language (DML) command, such as DELETE, a selection from a drop-down menu indicating a request to delete, or any other appropriate request communicated to the database management engine 110 to have the database management engine 110 delete the corresponding privacy data 136. Although communications from the privacy client 120 are discussed in the context of a delete or remove operation, it should be understood that the database management engine 110 may receive any appropriate database operation, including a database operation to be performed on a data structure (e.g., a field or record) associated with privacy system level metadata.

[0045] Continuing with FIG. 2B, transaction engine 140 is configured to process requests from privacy clients 120 and database administrators 126. Transaction engine 140 may process requests to modify data, such as privacy data 136, by generating data manipulation commands, such as the DML or DDL commands described above. In some embodiments, transactions and / or operations associated with requests performed on data structures of a database are recorded in data source 130 as database transaction log data 132. Database transaction log data 132 may correspond to a database transaction log implemented as a separate file or set of files within or separate from the database. For example, database transaction log data 132 may include a log cache that is managed separately from the database. In one embodiment, database management engine 110 is configured to truncate database transaction log data 132 such that space in the database transaction log is freed for reuse based on any number of factors, such as the occurrence of a checkpoint, a backup, etc.

[0046] The database transaction log data 132 may include a log sequence number (LSN) that includes a unique ID for the log record. In one embodiment, the LSNs are assigned in a monotonically increasing order that facilitates maintaining a chronological listing of transactions in the database transaction log. Additionally, the database transaction log data 132 may include a Prev LSN that links a corresponding transaction log to the last transaction log. In this manner, the transaction logs may be temporally related to one another as well. Additionally or alternatively, the database transaction log data 132 may include a transaction ID number that may correspond to a reference to the associated database operation that generated the log record. The database transaction log data 132 may include an indication of the type of transaction log, such as an indication of whether the corresponding database operation included DDL, DML, DCL, TCL, privacy data, etc.

[0047] In some embodiments, when a database operation is performed on a data structure associated with privacy system level metadata, information associated with the database operation may be stored as privacy transaction log data 134 and database transaction log data 132. In one embodiment, privacy transaction log data 134 may include pointers that reference entries in the transaction log. For example, the pointers may include a transaction ID, pointing to a particular (and unique) entry in the database transaction log. By using the pointers, the privacy transaction engine 146 may be able to efficiently record and access entries in the privacy transaction journal for future processing, as discussed below.

[0048] The client request processing engine 142 of the transaction engine 140 may receive a request from the privacy client device 120 or the database administrator device 126 to assign privacy system level metadata. As discussed herein, the database management engine 110 may create privacy first level first type data entities so that the privacy client 120 or the database administrator 126 may assign privacy system level metadata in a uniform manner. Thus, inconsistencies associated with contrasting approaches to assigning privacy system level metadata may be reduced or eliminated entirely. For example, a privacy client may wish to associate a column identified as "FirstName" located in a table identified as "Data" as a data structure that includes privacy data. The privacy client 120 may communicate the following lines of script to designate this column as a data structure that includes privacy data: ”ALTER TABLE FirstName MODIFY Data privacy=true” In this manner, any database operation performed on a record contained within the "FirstName" field may be identified as a privacy database operation (i.e., a database operation performed with respect to privacy data). It should be appreciated that instead of communicating a computer readable script, the privacy client device 120 may communicate any request or selection indicating a request to assign or modify privacy system level metadata associated with any accessible data structure. For example, the privacy client 120 may communicate an email requesting that the first name of the privacy client 120 be removed from the database management system 100.

[0049] The client request processing engine 142 of the transaction engine 140 is configured with computing logic to receive a database operation from the privacy client 120. As discussed above, the database operation or request communicated by the privacy client 120 may be formatted in any suitable manner. The client request engine 142 may receive a request or database operation from the privacy client 120. In some embodiments, the client request engine 142 (1) determines an operation to be performed and (2) determines a data structure in the database on which the operation is to be performed. Additionally, the client request engine 142 may determine whether the determined data structure is associated with privacy system level metadata. Determining whether the data structure is associated with privacy system level metadata may include accessing metadata associated with the data structure and determining whether the metadata corresponds to the privacy system level metadata. In response to determining that the data structure on which the database operation is to be performed is associated with privacy system level metadata (and thus the privacy database operation), the client request processing engine 142 may communicate the privacy database operation to the database transaction engine 144 and the privacy transaction engine 146.

[0050] On the other hand, in response to determining that the data structure on which the database operation is to be performed is not associated with privacy system level metadata, the client request processing engine 142 may communicate the database operation to the database transaction engine 144 and not to the privacy transaction engine 146. Thus, in one embodiment, the privacy transaction engine 146 may only receive an indication of a database operation when the database operation is associated with privacy system level metadata and thus corresponds to a privacy database operation to be performed with respect to the privacy data.

[0051] In some embodiments, the database transaction engine 144 of the transaction engine 140 is configured with computing logic to perform database operations. Continuing with the above example, in response to a request to delete privacy data (in this example, the first name of the privacy client), the database transaction engine 144 may perform a delete database operation on the target data structure. Performing the delete database operation may include removing the target privacy data 136 (in this example, the first name) from the data source 310. In some embodiments, complying with a request from a privacy client 120, such as a request to remove the privacy data 136, may be part of a privacy policy. Failure to comply with such a request from a privacy client 120 may result in the database management system 100 violating the privacy policy. Although this example has been discussed in the context of a delete database operation, it should be understood that embodiments of the present disclosure are not limited to a delete database operation, as the database transaction engine 144 may perform any other suitable database operation.

[0052] Further, in some embodiments, the database transaction engine 144 is configured to record the corresponding database transaction as database transaction log data 132 in the database transaction journal 220. Continuing with the above example, in response to receiving a request to delete privacy data 136, the database transaction engine may record an entry in the database transaction journal 220 related to the delete operation performed with respect to the target data structure. As discussed above, the entry in the database transaction journal 220 may include the LSN, Prev LSN, transaction ID, type of transaction, etc.

[0053] Continuing with FIG. 2B, the privacy transaction engine 146 is configured with computing logic to record an entry in the privacy journal 230 (FIG. 2A) based on a determination of whether a database operation is performed on or for a data structure having or associated with privacy system level metadata. The privacy transaction engine 146 may record an entry associated with the privacy database operation. In one embodiment, the privacy transaction engine 146 copies information from a corresponding entry in the database transaction journal 220 and records the information in the privacy journal 230. For example, in response to a privacy database operation being performed, the privacy transaction engine 146 may copy from the database transaction journal 220 an entire entry associated with the corresponding database operation. Alternatively, in response to a privacy database operation being performed, the privacy transaction engine 146 may copy from the database transaction journal 220 a subset of information of the entry associated with the corresponding database operation.

[0054] The comparison engine 148 is configured with computing logic to identify privacy database operations that have not yet been performed on the restored backup copy of the database. In some embodiments, the comparison engine 148 determines the privacy database operations that have not yet been performed on the restored backup copy of the database based on a comparison of the privacy journal 230 and the database transaction journal 220. For example, the comparison engine 148 determines which entries in the privacy journal 230 that delay the backup copy are included in the backup copy. Alternatively, the comparison engine 148 may determine which entries in the privacy journal 230 are not included in the database transaction journal 220 associated with the backup copy of the database. In this manner, the comparison engine 148 can determine which privacy database operations should be performed on the restored backup copy of the database to maintain compliance with the privacy policy.

[0055] In one embodiment, the comparison engine 148 operates to replay database operations in the database transaction journal that were performed after the backup copy was generated. The comparison engine then detects an error in replaying the database operations that triggers a comparison of the unplayed database operations in the database transaction journal with the privacy journal. Based on the comparison of the unplayed database operations in the database transaction journal with the privacy journal, the comparison engine 148 identifies privacy database operations in the privacy journal based on the privacy database operations matching the unplayed database operations in the database transaction journal. Thus, privacy database operations that have not been performed since the database was restored are identified.

[0056] In some embodiments, the transaction engine 140 may cause a security transition operation to be performed. The security transition operation may correspond to any suitable computer operation that may bring the database into compliance with the privacy policy. In one embodiment, the transaction engine 140 may aggregate any data related to the privacy database operations that were determined to have not been performed with respect to the restored backup copy of the database (restored by the restoration engine 156, as discussed below). For example, the transaction engine 140 may aggregate commands related to the database operations, data structures on which the privacy database operations were performed, and any other suitable information related to the privacy database operations that were not performed with respect to the restored backup copy. The security transition operation may be performed based on the aggregated data related to the privacy database operations. Exemplary security transition operations include providing instructions to remediate the lack of compliance with the privacy policy, instructions to perform database operations, identification of data structures within the restored backup copy of the database, etc.

[0057] Continuing with FIG. 2B, database operation engine 150 is configured with computing logic to perform a backup and determine privacy database operations to perform after restoring the backup copy of the database. Backup engine 152 is configured to perform the backup operation. By performing the backup operation, backup engine 152 may store a copy of the database from the time the backup operation was performed. In some embodiments, performing the backup may include storing a copy of the database, as well as database transaction journal 220 (and corresponding entries) from the time the backup operation was performed. In this manner, a user (e.g., database administrator 126) seeking to make changes to a backup copy of the database may determine which database operations have been captured in and performed on the database based on the corresponding database transaction journal 220.

[0058] Backup engine 152 is configured with computing logic to perform backups based on any suitable schedule. For example, backup engine 152 may perform backups periodically (e.g., daily, weekly, monthly, yearly, etc.) or based on the occurrence of an event. For example, database error detection engine 154 may notify backup engine 152 of a possible security issue, and thus backup engine 152 performs a backup in response to receiving a notification from the database error detection engine.

[0059] Continuing with FIG. 2B, the database error detection engine 154 is configured with computing logic to detect errors in the database. An error in the database may include any operation that renders the database temporarily or permanently unavailable. The database error detection engine 154 may detect an error in response to a failure to perform an operation. For example, a database may have been created with insufficient column widths, causing entries to the database to be erroneous. As another example, an index for a table in the database may have been modified, causing other tables that rely on the original unmodified index to be unusable, causing the database to be unavailable. As another example, a power outage in one data center causes data to be deleted, resulting in an inability to perform database operations that are run through other data centers. Other exemplary errors include undergoing a volume overflow, ignoring a time period, overlooking an audit train, ignoring a match, and the like.

[0060] The restore engine 156 is configured with computing logic to initiate and perform a backup restore operation that restores the database to a backup copy of the database. In some embodiments, the restore engine 156 performs the backup restore operation based on the database error detection engine 154 detecting any errors. Alternatively or additionally, the restore engine 156 may perform the backup restore operation based on manual user input. As discussed herein, performing a backup restore operation may include replacing the current database with a backup copy of the database stored as part of the backup operation. In some embodiments, the restore engine 156 may replace only data structures in the database that have been changed or modified since the last backup restore. Alternatively, the restore engine 156 may replace the entire database with a backup copy of the database.

[0061] The privacy data removal engine 158 of the database operation engine 150 is configured with computing logic to perform the privacy database operations identified as not being performed on the restored backup copy of the database. The privacy data removal engine 158 may receive from the comparison engine 148 an indication of a privacy database transaction from the privacy journal 230 that has not been performed on the restored backup copy of the database. In some embodiments, the comparison engine 148 may communicate a pointer (e.g., transaction ID) corresponding to the privacy database operation to be performed. The privacy data removal engine 158 may translate the pointer into a corresponding database operation and perform the database operation on the restored backup copy of the database. For example, the pointer may point to a transaction ID corresponding to an entry in the database transaction journal 220 of the database before the backup restore operation was performed. Thus, the privacy data removal engine 158 may receive the pointer (e.g., transaction ID) and search for the corresponding database operation in the database transaction log data 132. In this manner, the privacy data removal engine 158 may attempt to perform privacy database operations on the restored backup copy of the database and maintain compliance with privacy policies that may require the database management system to comply with requests to remove privacy data, for example.

[0062] Based on the comparisons performed by the comparison engine 148 and the attempts to perform privacy database operations performed by the privacy data removal engine 158, the privacy notification engine 170 may generate and communicate a privacy compliance notice. The privacy notification engine 170 is configured with computing logic to generate a privacy compliance notice indicating a level of compliance with the privacy policy. In one embodiment, the privacy notification engine 170 may generate a privacy compliance notice indicating compliance with the privacy policy in response to the database transaction journal 220 including all of the entries of the privacy journal 230. This would indicate that all privacy database transactions have been performed with respect to the restored copy, as indicated by the entries in the database transaction journal 220.

[0063] In some embodiments, in response to privacy journal 230 including an entry that was not included in database transaction journal 220, privacy notification engine 170 may generate a privacy compliance notice indicating a lack of compliance with the privacy policy. Additionally, privacy notification engine 170 may generate the privacy compliance notice to include the entry in privacy journal 230, the corresponding privacy database operation to be performed, and a status indicating whether an attempt was made to perform the corresponding privacy database operation.

[0064] The privacy notification engine 172 may include privacy violation event logic 172 that defines conditions under which the database or a restored backup copy of the database does or does not comply with a privacy policy. For example, the privacy violation event logic 172 may define conditions for compliance with various privacy policies. For example, a first privacy policy may require that health records be encrypted based on government regulations, and a second privacy policy may require that first names be removed upon request by a corresponding privacy client 120. A privacy compliance notice generated by the privacy notification engine 170 may provide with which privacy policies the restored backup copy of the database may not comply.

[0065] The privacy notification engine 170 may communicate the privacy compliance notification to the database administrator device 126. The database administrator 126 may receive the privacy compliance notification via a GUI generated on the database administrator device 126 based on the database administrator interface data 128.

[0066] 3-5, flow diagrams are provided illustrating methods associated with generating a privacy compliance notice using a database management engine 110 (FIGS. 1-2) within a database management system 100 (e.g., FIGS. 1-2). In some embodiments, one or more components of the database management system 100, the privacy client 120 (FIGS. 1-2), and / or the database administrator 126 are configured to perform the methods illustrated in FIGS. 3-5. In some embodiments, one or more computer storage media having computer-executable or computer-usable instructions embodied thereon that, when executed by one or more processors, can cause one or more processors to perform a method (e.g., a computer-implemented method) within the database management system 100 (e.g., a computerized or computing system).

[0067] Referring to process 300 shown in FIG. 3, database management engine 110 may access a database supporting privacy-based first type data entities, which are database entities having privacy system level metadata associated with data operations in a data definition language syntax (block 302). Database management engine 110 may perform database operations associated with the privacy-based first type data entities and privacy system level metadata properties with respect to database 210 (FIG. 2A) (block 304). The privacy-based first type data entities may include privacy types associated with privacy management operations defined in a privacy policy and / or may track privacy metadata associated with database operations. The privacy metadata is stored in privacy journal 230 (FIG. 2A) along with the corresponding database operations.

[0068] Additionally, the database management engine 110 may record the database operation in a privacy journal 230 configured to record the database operation as a privacy database operation associated with the privacy-based first type data entity and the privacy system level metadata (block 306). The database management engine 110 may restore the database to a backup copy of the database (block 306). Based on restoring the database to the backup copy (block 306), the database management engine 110 may identify in the privacy journal 230 privacy database operations that have not been performed with respect to the database 210 since the restoration (block 310). Based on identifying privacy database operations that have not been performed with respect to the database 210 since the restoration (block 310), a privacy compliance notice associated with the database 210 may be generated (block 312). The privacy compliance notice may provide a level of compliance with the privacy policy. In some embodiments, the database administrator 126 (FIGS. 1-2) may manually remediate issues resulting in a lack of compliance based on the privacy compliance notice.

[0069] Referring to process 400 shown in FIG. 4, database management engine 110 may access a database supporting privacy-based first type data entities, which may correspond to database entities having privacy system level metadata properties associated with data operations in a data definition language syntax (block 402). Database management engine 110 may generate a backup copy of database 210 (FIG. 2A) (block 404), the backup copy associated with database transaction journal 220 (FIG. 2A) configured to record database operations and privacy journal 230 (FIG. 2A) configured to record privacy database operations associated with the privacy-based first type data entities and the privacy system level metadata. Database management engine 110 may perform database operations associated with the privacy-based first type data entities, privacy system level metadata properties, and / or privacy metadata with respect to database 210 (block 406).

[0070] Continuing with Figure 4, database management engine 110 may record the database operation as a privacy database operation in privacy journal 230 and in database transaction journal 220 (block 408). Database management engine 110 may detect an error in database 210 (block 410) and, based on detecting the error in the database (block 410), restore the database to a backup copy of database 210 (block 412).

[0071] The database management engine 110 may determine that no privacy database operations have been performed on the database since the restore (block 414). In one embodiment, determining that no privacy database operations have been performed on the database since the restore (block 412) is based on (1) replaying database operations in the database transaction journal 220 that were performed after the backup copy was generated, (2) detecting errors in replaying the database operations, (3) comparing the unreplayed database operations in the database transaction journal 220 to the privacy journal 230, and (4) identifying privacy database operations in the privacy journal 230 based on the privacy database operations matching the unreplayed database operations in the database transaction journal 220. Replaying the database operations may include attempting to perform the privacy database operations on the restored backup copy of the database in any suitable order. For example, the privacy database operations may be performed in order from most recently performed to least recently performed, or may be ordered from least recently performed to most recently performed.

[0072] The database management engine 110 may generate a privacy compliance notice associated with the database (block 416). Although the processes 300 and 400 of Figures 3 and 4 are discussed as being performed by the database management engine of Figures 1 and 2, it should be understood that any suitable component capable of processing computer-readable instructions may be configured to perform these processes.

[0073] Referring to FIG. 5, process 500 includes accessing a database administrator GUI (block 502). The database administrator GUI may be generated based on database administrator interface data 128 (FIG. 1B). Process 500 includes communicating a request to restore the database via the database administrator graphical user interface (block 502). In some embodiments, process 500 may be implemented by database administrator device 126 (FIGS. 1-2). A database administrator client associated with the database administrator graphical user interface causes a database management engine to determine that no privacy database operations have been performed with respect to the database since the restore and to generate a privacy compliance notice associated with the database (block 504). The database administrator client accesses the privacy compliance notice including data related to the privacy operations not performed with respect to the database (506).

[0074] Technical improvements and literal support for claims A method, system, and computer storage medium for providing a privacy compliance notice indicating a database's level of compliance with a privacy policy. In some embodiments, a computerized system is provided. The computerized system includes one or more computer processors and a computer memory that stores computer usable instructions that, when used by the one or more computer processors, cause the one or more computer processors to perform operations. The operations include accessing, with a database management engine, a database supporting a plurality of privacy-based first type data entities, the privacy-based first type data entities being database entities having privacy system level metadata properties associated with data operations in a database language syntax. The operations include performing a database operation on the database, the database operation being associated with the privacy-based first type data entities and the privacy system level metadata properties. The operations include recording the database operation in a privacy journal based on performing the database operation, such that the privacy journal is configured to record the database operation as a privacy database operation associated with the privacy-based first type data entities and the privacy system level metadata properties. The operations include restoring the database to a backup copy of the database. The operations include identifying, based on restoring the database to the backup copy, in the privacy journal, privacy database operations that have not been performed on the database since the restore, and generating a privacy compliance notice associated with the database based on identifying the privacy database operations that have not been performed on the database since the restore.Advantageously, these and other embodiments provide improved techniques for computer systems to improve the efficiency of achieving database compliance with privacy policies, as described herein, and may reduce CPU cycles and reduce network bandwidth by automating the identification of privacy database operations. For example, existing approaches may include facilitating database compliance with privacy policies by assigning specialized information technology (IT) professionals to the task of ensuring database compliance with privacy policies. These specialized IT professionals may be burdened with manually analyzing data structures and databases to identify privacy policy violations. However, this manual process of identifying privacy policy violations is cumbersome and inefficient, and may result in data structures that fail to comply with privacy policies being overlooked. Furthermore, low-bit structures of the privacy journal, such as pointers, may improve the speed in performing calculations, such as identifying privacy database operations from the privacy journal that have not been performed on a copy of the database since restoration, as discussed herein.

[0075] In any combination of the above embodiments, the database operations include data definition language (DDL) commands, relational database entities, and values ​​for privacy system level metadata properties.

[0076] In any combination of the above embodiments, the first privacy-based first type data entity is a privacy type associated with a privacy management operation defined in the privacy policy, and the second privacy-based first type data entity tracks privacy metadata associated with the database operation, such that the privacy metadata is stored in the privacy journal together with the corresponding database operation.

[0077] In any combination of the above embodiments, recording the database operation in the privacy journal includes recording a pointer in the privacy journal, the pointer pointing to an entry in the database transaction journal corresponding to the database operation.

[0078] In any combination of the above embodiments, identifying privacy database operations that have not been performed on the database since the restore is based on detecting errors in replaying database operations in a database transaction journal of the database, such that the privacy journal includes a subset of the database operations in the database transaction journal.

[0079] In any combination of the above embodiments, identifying privacy database operations that have not been performed on the database since the restore is based on (1) replaying database operations in the database transaction journal that were performed after the backup copy was generated, (2) detecting errors in replaying the database operations, (3) comparing the unreplayed database operations in the database transaction journal with the database operations in the privacy journal, and (4) identifying privacy database operations in the privacy journal based on the privacy database operations matching the unreplayed database operations in the database transaction journal.

[0080] In any combination of the above embodiments, the privacy compliance notification indicates that the database is not compliant because no privacy database operations have been performed on the database since the restore.

[0081] In some embodiments, one or more computer storage media having computer-executable instructions embodied thereon that, when executed by a computing system having a processor and a memory, cause the processor to access, with a database management engine, a database supporting a plurality of privacy-based first type data entities, the privacy-based first type data entities having privacy system level metadata properties associated with data operations in a data definition language syntax. The computer-executable instructions cause the processor to generate a backup copy of the database, the backup copy associated with a database transaction journal configured to record the database operations and a privacy journal configured to record privacy database operations associated with the privacy-based first type data entities and the privacy system level metadata properties. The computer-executable instructions cause the processor to perform a database operation on the database, the database operation associated with the privacy-based first type data entities and the privacy system level metadata properties. The computer-executable instructions cause the processor to record the database operation in the database transaction journal and the privacy journal based on performing the database operation, the database operation being recorded in the privacy journal as a privacy database operation. The computer-executable instructions cause the processor to detect errors in the database, restore the database to a backup copy of the database based on detecting the errors in the database, determine whether a privacy database operation has not been performed on the database since the restoration based on restoring the database to the backup copy, generate a privacy compliance notice associated with the database based on determining whether a privacy database operation has not been performed on the database since the restoration, and perform a security migration operation.Advantageously, these and other embodiments provide improved techniques for computer systems to improve the efficiency of achieving database compliance with privacy policies, as described herein, and may reduce CPU cycles and reduce network bandwidth by automating the identification of privacy database operations. For example, existing approaches may include facilitating database compliance with privacy policies by assigning specialized information technology (IT) professionals to the task of ensuring database compliance with privacy policies. These specialized IT professionals may be burdened with manually analyzing data structures and databases to identify privacy policy violations. However, this manual process of identifying privacy policy violations is cumbersome and inefficient, and may result in data structures that fail to comply with privacy policies being overlooked. Furthermore, low-bit structures of the privacy journal, such as pointers, may improve the speed in performing calculations, such as identifying privacy database operations from the privacy journal that have not been performed on a copy of the database since restoration, as discussed herein.

[0082] In any combination of the above embodiments, the database operations include data definition language (DDL) commands, relational database entities, and values ​​for privacy system level metadata properties.

[0083] In any combination of the above embodiments, the first privacy-based first type data entity is a privacy type associated with a privacy management operation defined in the privacy policy, and the second privacy-based first type data entity tracks privacy metadata associated with the database operation, such that the privacy metadata is stored in the privacy journal together with the corresponding database operation.

[0084] In any combination of the above embodiments, recording the database operation in the privacy journal includes recording a pointer in the privacy journal, the pointer pointing to an entry in the database transaction journal corresponding to the database operation.

[0085] In any combination of the above embodiments, determining that no privacy database operations have been performed on the database since the restore is based on (1) replaying database operations in the database transaction journal that were performed after the backup copy was generated, (2) detecting errors in replaying the database operations, (3) comparing the unreplayed database operations in the database transaction journal to the privacy journal, and (4) identifying privacy database operations in the privacy journal based on the privacy database operations matching the unreplayed database operations in the database transaction journal.

[0086] In any combination of the above embodiments, the instructions further cause the processor to determine that there are no privacy database operations in the privacy journal that have not been performed on the database since the restoration, and based on determining that there are no privacy database operations in the privacy journal that have not been performed on the database since the restoration, generate a compliance notification indicating that the database is compliant because it is not a privacy database operation that has not been performed on the database since the restoration.

[0087] In any combination of the above embodiments, the instructions further cause the processor to determine that a privacy database operation has not been performed on the database since the restoration, and based on determining that a privacy database operation has not been performed on the database since the restoration, generate the compliance notification indicating that the database is not compliant because a privacy database operation has not been performed on the database since the restoration.

[0088] In some embodiments, a computer-implemented method is provided that includes accessing, with a database management engine, a database supporting a plurality of privacy-based first type data entities, the privacy-based first type data entities being database entities having privacy system level metadata properties. The computer-implemented method includes identifying, in a privacy journal, privacy database operations that have not been performed with respect to the database since the restore based on a restore operation to a backup copy of the database that has been performed with respect to the database. The computer-implemented method includes causing a security migration operation to be performed based on identifying the privacy database operations that have not been performed with respect to the database since the restore. Advantageously, these and other embodiments provide improved techniques for computer systems for improving the efficiency of achieving database compliance with privacy policies as described herein, and may reduce CPU cycles and reduce network bandwidth by automating the identification of privacy database operations. For example, existing approaches may include facilitating database compliance with privacy policies by assigning specialized information technology (IT) professionals to the task of ensuring database compliance with privacy policies. These specialized IT professionals may be burdened with manually analyzing data structures and databases to identify violations of privacy policies. However, this manual process of identifying privacy policy violations is cumbersome, inefficient, and can result in data structures that fail to comply with privacy policies being overlooked. Additionally, low-bit structures in the privacy journal, such as pointers, can improve the speed at which computations are performed, such as identifying from the privacy journal privacy database operations that have not been performed on a copy of the database since a restore, as discussed herein.

[0089] In any combination of the above embodiments, the privacy system-level metadata properties are associated with data operations in Data Definition Language (DDL) syntax, such that the database operations include DDL commands, relational database entities, and values ​​for the privacy system-level metadata properties.

[0090] In any combination of the above embodiments, the first privacy-based first type data entity is a privacy type associated with a privacy management operation defined in a privacy policy, and the second privacy-based first type data entity tracks privacy metadata associated with the database operation such that the privacy metadata is stored in a privacy journal along with the corresponding database operation.

[0091] In any combination of the above embodiments, the privacy database operation in the privacy journal is a pointer in the privacy journal, the pointer pointing to an entry in the database transaction journal corresponding to the database operation performed on the database.

[0092] In any combination of the above embodiments, identifying privacy database operations that have not been performed on the database since the restore is based on detecting errors in replaying database operations in a database transaction journal of the database, wherein the privacy journal includes a subset of the database operations in the database transaction journal.

[0093] In any combination of the above embodiments, causing the security migration operation to be performed includes generating a privacy compliance notice associated with the database, such that the privacy compliance notice indicates that the database is not compliant because no privacy database operations have been performed on the database since the restore.

[0094] Further support for the detailed description of the invention Exemplary Distributed Computing System Environment Referring now to FIG. 6, FIG. 6 illustrates an exemplary distributed computing environment 600 in which implementations of the present disclosure may be utilized. Specifically, FIG. 6 illustrates a high-level architecture of an exemplary cloud computing platform 610 that may host the technology solution environment or a portion thereof (e.g., a data trustee environment). It should be understood that this and other configurations described herein are provided by way of example only. For example, as previously mentioned, many of the elements described herein may be implemented as separate or distributed components, or with other components, in any suitable combination and location. Other configurations and elements (e.g., machines, interfaces, functions, sequences, and groupings of functions) may be used in addition to or instead of those illustrated.

[0095] A data center may support a distributed computing environment 600 including a cloud computing platform 610, racks 620, and nodes 630 (e.g., computing devices, processing units, or blades) within the racks 620. The technical solution environment may be implemented with a cloud computing platform 610 that runs cloud services across different data centers and geographic regions. The cloud computing platform 610 may implement a fabric controller 640 component for provisioning and managing resource allocation, deployment, upgrades, and management of the cloud services. Typically, the cloud computing platform 610 operates to store data or run service applications in a distributed manner. The cloud computing infrastructure 610 in the data center may be configured to host and support the operation of endpoints of a particular service application. The cloud computing infrastructure 610 may be a public cloud, a private cloud, or a dedicated cloud.

[0096] A node 630 may be provisioned with a host 650 (e.g., an operating system or runtime environment) that executes a predefined software stack on the node 630. A node 630 may also be configured to perform a specialized function (e.g., a compute node or a storage node) within the cloud computing platform 610. A node 630 is allocated to execute one or more portions of a tenant's service application. A tenant may refer to a customer that utilizes the resources of the cloud computing platform 610. A service application component of the cloud computing platform 610 that supports a particular tenant may be referred to as a multi-tenant infrastructure or tenancy. The terms service application, application, or service are used interchangeably herein and broadly refer to any software, or portion of software, that runs on or accesses storage and compute device locations within a data center.

[0097] When multiple separate service applications are supported by the node 630, the node 630 may be partitioned into virtual machines (e.g., virtual machine 652 and virtual machine 654). A physical machine may also run separate service applications simultaneously. The virtual machines or physical machines may be configured as individualized computing environments supported by resources 660 (e.g., hardware and software resources) in the cloud computing platform 610. It is contemplated that resources may be configured for a particular service application. Furthermore, each service application may be divided into functional parts, whereby each functional part may run on a separate virtual machine. In the cloud computing platform 610, multiple servers may be used to run the service applications and perform data storage operations in a cluster. Specifically, the servers may independently perform data operations but be exposed as a single device called a cluster. Each server in the cluster may be implemented as a node.

[0098] The client device 680 may be linked to a service application within the cloud computing platform 610. The client device 680 may be any type of computing device, and the computing device may correspond to the computing device 600 described with reference to FIG. 6, for example, the client device 680 may be configured to issue commands to the cloud computing platform 610. In an embodiment, the client device 680 may communicate with the service application through a virtual Internet Protocol (IP) and load balancer or other means that directs communication requests to a specified endpoint within the cloud computing platform 610. The components of the cloud computing platform 610 may communicate with each other over a network (not shown), which may include, but is not limited to, one or more local area networks (LANs) and / or wide area networks (WANs).

[0099] Exemplary Distributed Computing Environment Having briefly described an overview of embodiments of the present invention, an exemplary operating environment in which embodiments of the present invention may be implemented is described below to provide a general context for various aspects of the present invention. Referring initially and specifically to FIG. 6, an exemplary operating environment for implementing embodiments of the present invention is illustrated and generally designated as computing device 600. Computing device 600 is only one example of a suitable computing environment and is not intended to suggest any limitation as to the scope of use or functionality of the invention. Neither should computing device 700 be interpreted as having any dependency or requirement relating to any one or combination of illustrated components.

[0100] The invention may be described in the general context of computer code or machine usable instructions, including computer-executable instructions, such as program modules, running on a computer or other machine, such as a personal digital assistant or other handheld device. Generally, program modules, including routines, programs, objects, components, data structures, etc., refer to code that performs particular tasks or implements particular abstract data types. The invention may be practiced in a variety of system configurations, including handheld devices, consumer electronics, general purpose computers, more specialized computing devices, and the like. The invention may also be practiced in distributed computing environments where tasks are performed by remote processing devices that are linked through a communications network.

[0101] Referring to FIG. 7, a computing device 700 includes a bus 710 that directly or indirectly couples the following devices: memory 712, one or more processors 714, one or more presentation components 716, input / output ports 718, input / output components 720, and an exemplary power supply 722. The bus 710 represents what may be one or more buses (such as an address bus, a data bus, or a combination thereof). The various blocks in FIG. 7 are shown with lines for conceptual clarity, and other configurations of the described components and / or component functions are contemplated. For example, a presentation component such as a display device may be considered an I / O component. Additionally, a processor has memory. The inventors acknowledge that such is the nature of the art and reiterate that the diagram in FIG. 7 is merely an example of an exemplary computing device that may be used with one or more embodiments of the present invention. No distinction is made between categories such as "workstation," "server," "laptop," "handheld device," etc., as all are contemplated within the scope of FIG. 7 and reference to a "computing device."

[0102] Computing device 700 typically includes a variety of computer readable media. Computer readable media can be any available media that can be accessed by computing device 700 and includes both volatile and nonvolatile media, removable and non-removable media. By way of example, and not limitation, computer readable media can include computer storage media and communication media.

[0103] Computer storage media includes volatile and nonvolatile, removable and non-removable media implemented in any method or technology for storage of information, such as computer readable instructions, data structures, program modules, and other data. Computer storage media includes, but is not limited to, RAM, ROM, EEPROM, flash memory, or other memory technology, CD-ROM, digital versatile disks (DVDs), or other optical disk storage, magnetic cassettes, magnetic tapes, magnetic disk storage, or other magnetic storage devices, or any other medium that can be used to store the desired information and that can be accessed by computing device 700. Computer storage media inherently excludes signals.

[0104] Communication media typically embodied computer readable instructions, data structures, program modules or other data in a modulated data signal, such as a carrier wave or other transport mechanism, and include any information delivery media. The term "modulated data signal" means a signal that has one or more of its characteristics set or changed in such a manner as to encode information in the signal. By way of example, and not limitation, communication media includes wired media, such as a wired network or direct-wired connection, and wireless media, such as acoustic, RF, infrared and other wireless media. Combinations of any of the above should also be included within the scope of computer readable media.

[0105] The memory 712 includes computer storage media in the form of volatile and / or non-volatile memory. The memory may be removable, non-removable, or a combination thereof. Exemplary hardware devices include solid state memory, hard drives, optical disk drives, and the like. The computing device 700 includes one or more processors that read data from various entities, such as the memory 712 and the I / O components 720. The presentation component 716 presents a display of the data to a user or other device. Exemplary presentation components include a display device, a speaker, a printing component, a vibrating component, and the like.

[0106] The I / O ports 718 allow the computing device 700 to be logically coupled to other devices, including I / O components 720, some of which may be built-in. Example components include microphones, joysticks, game pads, satellite dishes, scanners, printers, wireless devices, etc.

[0107] Additional structural and functional features of embodiments of the technical solution Although various components utilized herein have been identified, it should be understood that any number of components and configurations may be utilized to achieve the desired functionality within the scope of the present disclosure. For example, the components in the embodiments illustrated in the figures are shown with lines for conceptual clarity. Other configurations of these and other components may also be implemented. For example, while some components are shown as single components, many of the elements described herein may be implemented as separate or distributed components, or with other components, in any suitable combination and location. Some elements may be omitted entirely. Additionally, various functions described herein as being performed by one or more entities may be implemented by hardware, firmware, and / or software, as described below. For example, various functions may be performed by a processor executing instructions stored in a memory. Thus, other configurations and elements (e.g., machines, interfaces, functions, sequences, and groupings of functions) may be used in addition to or instead of those illustrated.

[0108] The embodiments described in the following paragraphs may be combined with one or more of the specifically described alternative embodiments. In particular, a claimed embodiment may include references to multiple other embodiments in alternative embodiments. A claimed embodiment may specify further limitations of the claimed subject matter.

[0109] The subject matter of the embodiments of the present invention is specifically described herein to meet statutory requirements. However, the description itself shall not limit the scope of this patent. Rather, the inventors contemplate that the claimed subject matter may be implemented in other ways, including different steps or combinations of steps similar to those described in this document, together with other current or future technologies. Furthermore, although the terms "step" and / or "block" may be used herein to imply different elements of the method utilized, the terms should not be construed to imply any particular order between the various steps of the disclosed specification unless and when the order of the individual steps is explicitly described.

[0110] In this disclosure, the word "including" has the same broad meaning as the word "comprising" and the word "accessing" includes "receiving," "referencing," or "retrieving." Additionally, the word "communicating" has the same broad meaning as the words "receiving" or "transmitting" facilitated by a software or hardware based bus, receiver, or transmitter using the communication medium described herein. Additionally, words such as "a" and "an" include the plural as well as the singular unless otherwise indicated. Thus, for example, if one or more features are present, the constraint for "a feature" is satisfied. Additionally, the term "or" includes conjunctions, disjunctions, and both (so a or b includes both a or b, and a and b).

[0111] In the above detailed discussion, embodiments of the present invention are described with reference to a distributed computing environment, however, the distributed computing environment depicted herein is merely exemplary. Components may be configured to perform novel aspects of the embodiments, and the term "configured for" may refer to being "programmed to" perform a particular task or implement a particular abstract data type using code. Furthermore, while embodiments of the present invention may generally refer to the technical solution environment and schematic diagrams described herein, it should be understood that the described techniques may be extended to other implementation contexts.

[0112] The present invention has been described in relation to particular embodiments which are intended in all respects to be illustrative and not restrictive, and alternative embodiments will become apparent to those skilled in the art to which the invention pertains without departing from the scope of the invention.

[0113] From the above, it will be seen that this invention is one well adapted to attain all the ends and objectives hereinabove set forth together with other advantages which are obvious and which are inherent in the structure.

[0114] It will be understood that certain features and subcombinations are of utility and may be utilized without reference to other features or subcombinations, which are contemplated by and within the scope of the claims.

Claims

1. A computerized system comprising: one or more computer processors; a computer memory storing computer usable instructions that, when used by the one or more computer processors, cause the one or more computer processors to perform operations; The operation is receiving a database restore indication that the database has been restored to a previous version of the database as of a first timestamp; accessing a privacy journal comprising at least one privacy operation indicator of a privacy operation associated with the restored database as of a second timestamp after the first timestamp; determining that the at least one privacy operation indicator is missing from a database transaction journal comprising at least one non-privacy operation indicator of a non-privacy operation associated with the restored database; performing a security migration operation based on determining that the at least one privacy operation indicator is missing from the database transaction journal; and computerized systems, including

2. A computerized system according to claim 1, the privacy operations are associated with a data structure having privacy system-level metadata properties; The privacy operation includes at least one of a Data Definition Language (DDL) command, a Data Control Language (DCL) command, a Transition Control Language (TCL) command, a command specifying a relational database entity, or a command specifying a value of the privacy system level metadata property of the at least one privacy operation indicator.

3. A computerized system according to claim 1, The privacy operation is missing from the database transaction journal because the privacy operation has not been performed on the restored database since the first timestamp.

4. A computerized system according to claim 1, The computerized system wherein performing the security migration operation includes generating a privacy compliance notice indicating that the database is not in compliance because the privacy operations have not been performed on the restored database.

5. The computerized system of claim 1, The computerized system wherein enforcing the security transition action includes generating a privacy compliance notice indicating that the database is non-compliant.

6. The computerized system of claim 1, The operation is receiving an indication of performing the privacy operation on the database at the first timestamp; recording the at least one privacy operation indicator in the privacy journal and the database transaction journal based on performing the privacy operation on the database; performing a backup operation on the database that restores the database to a backup copy of the database having the first timestamp that is earlier than the second timestamp; The computerized system further comprises:

7. The computerized system of claim 6, The computerized system wherein performing the backup operation restores the database transaction journal to a previous version corresponding to the state of the database transaction journal as of the first timestamp.

8. The computerized system of claim 1, The operations include determining that the privacy operations not performed on the restored database are non-compliant with a privacy policy; The computerized system, wherein the security transition action is performed based on non-compliance with the privacy policy.

9. One or more computer storage media having computer-executable instructions embodied thereon, the computer-executable instructions, when executed by a computing system having a processor and memory, causing the computing system to: receiving a database restore indication that the database has been restored to a previous version of the database as of a first timestamp; accessing a privacy journal at a second timestamp after the first timestamp, the privacy journal comprising at least one privacy operation indicator of a privacy operation associated with the restored database, the privacy operation being associated with a data structure having a privacy system level metadata property, the privacy operation comprising at least one of a Data Definition Language (DDL) command, a Data Control Language (DCL) command, a Transition Control Language (TCL) command, a command specifying a relational database entity, or a command specifying a value of the privacy system level metadata property of the at least one privacy operation indicator; determining that the at least one privacy operation indicator is missing from a database transaction journal comprising at least one non-privacy operation indicator of a non-privacy operation associated with the restored database; performing a security migration operation based on determining that the at least one privacy operation indicator is missing from the database transaction journal; and One or more computer storage media that cause the 10. One or more computer storage media according to claim 9, performing the security transition operation aggregating data associated with the privacy operations determined to be missing from the database transaction journal; generating instructions to perform said privacy operations on said database; or performing said privacy operations; [0023] One or more computer storage media, including at least one of:

11. One or more computer storage media according to claim 9, The data structure having the privacy system level metadata properties comprises: a first privacy-based first class data entity that is a privacy type associated with a privacy management action defined in the privacy policy; or a second privacy-based first-class data entity that tracks the privacy system-level metadata properties, the privacy system-level metadata properties being stored together with corresponding privacy operations in the privacy journal; [0023] One or more computer storage media, including at least one of:

12. One or more computer storage media according to claim 9, The data structure comprises: a first privacy-based first class of data entities having privacy types associated with privacy management actions defined in a privacy policy; a second privacy-based first-class data entity that tracks privacy metadata associated with privacy operations, the privacy metadata being stored together with corresponding privacy operations in the privacy journal; and [0023] one or more computer storage media, 13. One or more computer storage media according to claim 9, The computer-executable instructions cause the computing system to record the privacy operations in the privacy journal; recording the privacy operation in the privacy journal includes recording a pointer to the privacy journal; The one or more computer storage media, wherein the pointer points to an entry in the database transaction journal corresponding to the privacy operation.

14. One or more computer storage media according to claim 9, Determining that the at least one privacy operation indicator is missing from the database transaction journal includes: replaying privacy operations in a database transaction journal that were performed after the first timestamp; detecting errors in replaying the privacy operation; comparing unplayed privacy operations in the database transaction journal with a plurality of privacy operations in the privacy journal; identifying the privacy operations in the privacy journal based on the privacy operations that match unplayed privacy operations in the database transaction journal; [0023] one or more computer storage media, 15. A computer-implemented method comprising: receiving a database restore indication that the database has been restored to a previous version of the database as of a first timestamp; accessing a privacy journal comprising at least one privacy operation indicator of a privacy operation associated with the restored database as of a second timestamp after the first timestamp; determining that the at least one privacy operation indicator is missing from a database transaction journal comprising at least one non-privacy operation indicator of a non-privacy operation associated with the restored database; performing a security migration operation based on determining that the at least one privacy operation indicator is missing from the database transaction journal; and 11. A computer-implemented method comprising:

16. The computer-implemented method of claim 15, comprising: the privacy operations are associated with a data structure having privacy system-level metadata properties; the privacy operation includes at least one of a Data Definition Language (DDL) command, a Data Control Language (DCL) command, a Transition Control Language (TCL) command, a command specifying a relational database entity, or a command specifying a value of the privacy system level metadata property of the at least one privacy operation indicator; The computer-implemented method, wherein the privacy operations are Structured Query Language (SQL) operations formatted into a DDL.

17. The computer-implemented method of claim 15, comprising: The computer-implemented method, wherein the privacy journal comprises a subset of the database operations in the database transaction journal.

18. The computer-implemented method of claim 15, comprising: determining that there are no privacy operations in the privacy journal that have not been performed on the restored database since the first timestamp; based on determining that there are no privacy operations in the privacy journal that have not been performed on the restored database since the first timestamp, generating a compliance notice indicating that the database is in compliance because there are no privacy operations that have not been performed on the restored database since the first timestamp; The computer-implemented method further comprises:

19. The computer-implemented method of claim 15, comprising: determining that no privacy operations have been performed on the restored database since the first timestamp; based on determining that each privacy operation has not been performed on the restored database since the first timestamp, generating a compliance notice indicating that the database is not compliant because each privacy operation has not been performed on the restored database since the first timestamp; The computer-implemented method further comprises:

20. The computer-implemented method of claim 15, comprising: identifying the privacy operations that have not been performed on the database since the restoration was based on detecting an error during replay of privacy operations in a database transaction journal of the database; The computer-implemented method further comprises:

Images