Database Masking Layout for Enterprise Data Privacy
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing data management systems fail to effectively segregate and protect sensitive data, leading to privacy issues as they often store sensitive information alongside non-sensitive data, and applications may inadvertently disclose sensitive information, violating data privacy regulations.
Innovation Solution
A database system that replaces restricted entities with masked attributes defined by a system administrator, using a mask layout to protect privacy, ensuring that only masked attributes are provided to users when accessing data, thereby maintaining compliance with data privacy policies.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If sensitive data is stored together with non-sensitive data in the same database, then data storage is simplified and access efficiency is improved, but data privacy protection deteriorates and compliance with privacy regulations worsens
Solution Approach 1:
The patent segments data into restricted entities (sensitive data) and unrestricted entities (non-sensitive data) within the database. This segmentation allows the system to apply different access control mechanisms to different data portions, maintaining both efficient access to non-sensitive data and strong protection for sensitive data through the masking mechanism.
Solution Approach 2:
The patent introduces a masking mechanism as an intermediary layer between the database and applications. This mediator automatically replaces restricted entities with masked attributes when data is retrieved, allowing applications to access data efficiently without directly exposing sensitive information, thus resolving the contradiction between access efficiency and privacy protection.
2Ease of operation
If applications access both restricted and unrestricted data without differentiation, then application development is simplified and operation ease is improved, but data disclosure risk increases and privacy compliance deteriorates
Solution Approach 1:
The masking mechanism operates autonomously without requiring application developers to manually implement privacy protection logic. The system automatically identifies restricted entities and applies masking based on pre-defined rules, allowing applications to access data with simplified code while the system self-manages the privacy protection, thus maintaining ease of operation while reducing disclosure risk.
Solution Approach 2:
The patent implements preliminary masking rule configuration before applications access data. System administrators pre-define which entities are restricted and what masked attributes should be applied. This preliminary action ensures that when applications retrieve data, the masking is already in place, preventing data disclosure risk without complicating application development or operation.
3Reliability
If sensitive data is masked for all users, then data privacy protection is improved and compliance is enhanced, but data utility deteriorates and legitimate access requirements are not met
Solution Approach 1:
The patent applies masking selectively rather than uniformly to all data. The system identifies specific restricted entities within the dataset and applies masking only to those portions, while leaving unrestricted entities (non-sensitive data) accessible in their original form. This local quality approach ensures privacy protection for sensitive data while maintaining full utility of non-sensitive data for legitimate business operations.
Solution Approach 2:
The masking mechanism applies partial action by selectively masking only the necessary restricted entities rather than masking all data. This allows the system to provide adequate privacy protection for sensitive information while preserving access to non-sensitive data that is needed for business operations, thus balancing privacy protection with data utility without excessive masking.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
Various embodiments of systems and methods for protection of data privacy in an enterprise system are described herein. A request to access data stored in an electronic database is received. The data comprises restricted and unrestricted entities. A restricted entity is replaced with one or more masked attributes that protect privacy of the restricted entity. A mask layout comprising the one or more masked attributes is defined for the restricted entity. The one or more masked attributes are then provided to a user in response to the request.