Data Masking Framework for High-Throughput Database Security
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing data masking solutions are inadequate in handling complex data relationships, scalability, and compatibility with various database types, leading to inefficiencies and increased complexity in masking data for production and non-production systems.
Innovation Solution
A data masking framework that supports flexible masking algorithm functions, enables granular masking, disables/reenables scheduled jobs and triggers, and handles encrypted and VPD policy-enabled data, allowing for high-throughput masking of large datasets across multiple tables and partitions, with support for various database configurations.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If data masking is applied to production data for non-production purposes, then data security and privacy are improved, but data usability and functionality deteriorate
Solution Approach 1:
The patent creates masked copies of production data that can be used in non-production environments. Instead of masking the original production data, the system generates replicated copies with masking algorithms applied, allowing the original data to remain secure while the copies provide usable masked data for testing and development purposes
Solution Approach 2:
The patent applies different masking algorithms to different data elements based on their specific requirements. Each data element can have a customized masking approach (e.g., substitution, encryption, nullification) tailored to its sensitivity and usage requirements, maintaining usability where appropriate while ensuring security where needed
2Reliability
If complex data relationships are masked, then data security is improved, but masking complexity and processing time increase
Solution Approach 1:
The patent performs preliminary actions by identifying and documenting complex data relationships before applying masking algorithms. The system analyzes referential integrity constraints, foreign key relationships, and data dependencies in advance, then uses this information to guide the masking process, ensuring that relationships are preserved while data is masked
Solution Approach 2:
The patent introduces an intermediary layer of masking algorithms that act as mediators between the original data and the masked output. This intermediary layer handles complex transformations while preserving data relationships, allowing the system to maintain security without directly exposing the complexity of the masking operations
3Adaptability or versatility
If data masking is applied across multiple database types, then versatility is improved, but system compatibility and configuration complexity worsen
Solution Approach 1:
The patent implements a universal masking framework that can operate across multiple database types (Oracle, SQL Server, DB2, etc.) through a common architecture. The system uses database-agnostic masking algorithms and configuration mechanisms that can be adapted to different database platforms without requiring completely separate implementations for each database type
4Productivity
If high-throughput masking is implemented for large datasets, then productivity is improved, but processing resource requirements worsen
Solution Approach 1:
The patent segments large datasets into smaller processing units or batches that can be masked in parallel. By dividing the data processing workload into manageable segments, the system can utilize multiple processing resources simultaneously, improving overall throughput while distributing the resource requirements across multiple units rather than concentrating them in a single overloaded processor
Data Source
AI summary
Techniques for improved masking data in an information processing system are provided. For example, a method comprises generating a data masking configuration file for use in an information processing system to mask at least a portion of a given data set, wherein the generation of the data masking configuration file further comprises attaching a masking algorithm function selected from a plurality of defined masking algorithm functions to each data element of the given data set to be masked.