Field-Level Data Masking for Secure Access Control

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Users accessing data sets through utility programs may inadvertently view sensitive information by accessing combinations of data fields that form sensitive information, highlighting a need for secure access control mechanisms to mask unauthorized data fields.

Innovation Solution

A system and method that processes user requests by accessing layout information to determine field authorization, masking data from fields the user is not authorized to access, and presenting it in a formatted, unintelligible manner to prevent unauthorized data exposure.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Ease of operation

If users are granted access to data sets through utility programs, then data accessibility and utility are improved, but security and sensitivity of information deteriorate

Engineering Contradiction:

Improvedata accessibilityVSAvoidunauthorized information exposure

Core Design Contradiction:

Ease of operationVSObject-affected harmful factors

Solution Approach 1:

The data set is segmented into multiple fields, and access rights are assigned at the field level rather than providing uniform access to the entire data set. This allows users to access only the specific fields they are authorized for, maintaining utility while preventing unauthorized access to sensitive information.

Inventive Principle:

Principle #1Segmentation

Solution Approach 2:

Different access control policies are applied to different fields within the same data set. Each field has its own access control attributes that determine which users can view or modify the data, enabling fine-grained security control that balances accessibility with protection.

Inventive Principle:

Principle #3Local quality

2Object-affected harmful factors

If access control information is implemented to mask unauthorized fields, then security is improved, but device complexity and processing requirements worsen

Engineering Contradiction:

Improveunauthorized information exposureVSAvoidaccess control processing

Core Design Contradiction:

Object-affected harmful factorsVSDevice complexity

Solution Approach 1:

Access control information and masking rules are pre-configured for each field before data access is requested. When a user requests data, the system simply retrieves the pre-established access control attributes and applies the corresponding masking, avoiding complex real-time decision-making and reducing processing complexity.

Inventive Principle:

Principle #10Preliminary action

Solution Approach 2:

Access control information acts as an intermediary layer between the data storage system and the user interface. This intermediary contains pre-defined rules that translate user authorization status into appropriate data masking decisions, simplifying the overall system architecture by centralizing access control logic.

Inventive Principle:

Principle #24Intermediary (Mediator)

Data Source

PatentUS7693849B2Masking object data based on user authorization

Publication Date: 2010.04.06 X CORP

AI summary

Provided are a method, system, and program for processing a request for an object from a user. Layout information for the requested object is accessed, wherein the layout information delineates fields in the object. A determination is made from access control information as to whether the user is authorized to access the fields indicated in the layout information. The data from the object in one field which the user is not authorized to access is masked. The fields from the object are generated into a formatted object formatted according to the layout information, wherein the masked data is presented unintelligible to the user.