Database Masking Module for Transparent SQL Security
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing database security systems are inadequate in providing transparent privacy controls for Relational Database Management Systems (RDBMS), often requiring significant source code changes and failing to differentiate between requests for masked and unmasked data, leading to potential data breaches and compliance issues due to insufficient access restrictions.
Innovation Solution
A system and method utilizing a masking module as an in-line proxy that analyzes and applies security rules to SQL requests in real-time, masking sensitive data without altering source code or database structures, ensuring that only necessary information is accessed and transmitted, using a customizable rule engine to manage access based on user need-to-know principles.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If existing database security systems are used, then data access control is provided, but source code changes are required and data differentiation between masked and unmasked requests is not achieved
Solution Approach 1:
The patent introduces a database masking module as an intermediary component between the application and the database. This module intercepts SQL requests, applies masking rules to sensitive data columns, and returns masked data without requiring changes to existing application source code or database structures, thus resolving the contradiction between security reliability and system complexity
Solution Approach 2:
The database masking module segments the data access control function from the existing database system. It independently handles SQL request analysis, masking rule application, and data transformation, allowing security controls to be added without complicating the overall system architecture or requiring source code modifications
2Ease of operation
If transparent privacy controls are implemented, then data masking is achieved, but existing systems require client installations or database modifications
Solution Approach 1:
The masking module serves as a transparent intermediary that sits between applications and databases, providing privacy controls without requiring modifications to client applications or database structures. It intercepts and processes SQL requests transparently, maintaining ease of operation while avoiding implementation complexity
Solution Approach 2:
The database masking module is designed as a universal solution that can be deployed independently of specific applications or database configurations. It handles multiple types of SQL requests and applies masking rules across different data columns, providing broad privacy protection without requiring separate implementations for different clients or databases
3Reliability
If data masking is applied, then sensitive information protection is improved, but real-time processing capability may be reduced
Solution Approach 1:
The masking module performs preliminary actions by analyzing SQL requests and applying masking rules in real-time before data is returned to applications. It maintains processing efficiency by implementing optimized masking algorithms and caching mechanisms that minimize the performance overhead of real-time data transformation
Data Source
Figure 1
Figure 2
Figure 3
AI summary
A system and computer-implemented method for providing security rules to an existing enterprise database system. The disclosed system and computer- implemented method intercepts database connection requests provided by third-party applications and end-users and determines what, if any, security rules to be applied to the request, including masking, scrambling and unmasking the data, as well as whether the requesting user has a need to know the requested data. Accordingly, personally identifiable and other sensitive information is not provided to an unauthorized requesting application and/or end-user.