Patent Description:
<CIT> discloses a system and method for data masking target data fields of a data record using an original database with data records having at least one target data field and a copied database including a copy of at least a portion of the original database.

<CIT> discloses a system that masks data objects across a plurality of different data resources.

<CIT> discloses a method for dynamic data masking (DDM) of sensitive data.

Implementations described herein disclose a system for static data masking. The static data masking system may perform one or more operations including unbinding tables in a database, evaluating masking operations on the tables to determine that at least one masking operation on a particular column of a candidate table is a complex masking operation that cannot be completed using a query, adding a temporary key column with unique values to the candidate table, generating a temporary table including the temporary key column and an empty masked column, generating masked values for the particular column at a client, and populating the masked values for the particular column in the empty masked column of the temporary table.

At the core of static data masking lies the concept of a masking function. A masking function is an algorithm that is used to generate data. It can be modeled as a function, e.g. a mathematical operation or series of mathematical operations that take a column (a set of N columns) as an input and returns a column (a set of N columns) as an output. Masking functions are responsible for implementing the three ideas mentioned earlier. Poorly combined, they can deprive the database of its structure or leave loopholes that can be exploited for the identification of masked records.

A static data masking system disclosed herein allows users to use one or more of such masking functions to mask data in one or more columns in a database while still preserving the relations between the various fields as well as keeping the constraints of the database. Specifically, an implementation of the static data masking system allows masking the data in the selected columns such that the statistical nature of the data in the database is still preserved.

<FIG> illustrates an implementation of a static data masking system <NUM> that allows users to request masking data in one or more fields of a database <NUM>. For example, the database <NUM> may be a patient database with tables storing information about the patients' names and other personally identifiable information (PII) and various non-PII. The database <NUM> may be stored on a cloud server, an on-premise server, a network-based server that is accessible over the Internet, etc..

The technology disclosed herein provides technical advantages to computers and computing technology. Specifically, the static data masking system <NUM> improves efficiency and functioning of database systems by allowing complex masking configurations to be applied to columns of data in an efficient manner. For example, determining that some of the masking configurations are implemented on server side and other masking configurations are implemented on the client side reduces the network traffic, thus making efficient use of computing networks, thus improving the technical operations of the database and the networks connecting such databases.

A client <NUM> may be configured to allow a user to use a data masking user interface (UI) <NUM> to request various masking operations. For example, a user may request masking one or more of the PII from the database <NUM>. Alternatively, a user may also use a command line instruction to request a masking operation. In one implementation, the client <NUM> may have access to the configuration and the shape of the data in the database <NUM>. The client <NUM> may include a masking configuration generator <NUM> that communicates with the data masking UI <NUM> to allow a user to generate masking configuration for various columns of the database <NUM>. A schema modeling module <NUM> may model and store the schema of the database <NUM>, whereas a schema validator <NUM> analyzes the masking configuration to ensure that any of the constraints as per the schema are not invalid.

The client <NUM> communicates the request for the masking operation to a data masking engine <NUM>. The data-masking engine <NUM> may be implemented on the server side where it can access the database <NUM> and work with the client <NUM> to affect the masking operations requested by the client <NUM>.

Upon receiving the request for the masking operation, the data-masking engine <NUM> creates a clone database <NUM> of the database <NUM> and stores the clone database <NUM>. This allows the client to preserve continuity of its operations that are accessing the data from the database <NUM>. If the database <NUM> is an on-premise database, a combination of backup and restore commands may be sued to generate the clone database <NUM>. If the database <NUM> is cloud based, a new database as a copy of the database <NUM> may be created. Once the clone database <NUM> is created, one or more of the masking operations by the data masking engine <NUM> may be performed on the clone database <NUM>. As a result, the client is able to continue using the database <NUM> in normal course of business.

Subsequently, the data masking engine <NUM> copies schema <NUM> of the database <NUM> and communicates it to the client <NUM>, where it may be stored. The schema <NUM> may include file system information about tables of the database <NUM>, columns of the table, relations between tables, constraints on various columns of the tables, etc. The schema <NUM> may be used to validate one or more masking operation requests from the client <NUM>. For example, if the schema identifies a column with a name SSN (SSN column <NUM>) as a primary key, which typically includes data that is unique for each record or row, if a masking operation requests the SSN column <NUM> to be filled with same value, such request will result in data in SSN column <NUM> that does not meet the constraint of the values being unique. In such as case, a schema validator <NUM> may reject that particular masking operation request.

Once the schema <NUM> is saved, the data masking engine <NUM> drops all the constraints on the clone database <NUM>. For example, the data masking engine <NUM> deletes the constraints of the clone database <NUM>. Thus, if the SSN column <NUM> was constrained to have values that are unique, after dropping the constraint, the values in the SSN column <NUM> may be non-unique. This allows manipulating data at one or more intermediate states to affect the masking operation on the clone database <NUM>.

Subsequently, the data masking engine <NUM> reviews the database table by table based on the masking operations requested by the client <NUM>. For example, the client <NUM> may have requested to set all values of the SSN column <NUM> to a NULL value. An alternate masking operation request from the client <NUM> may be to change the values of the SSN column <NUM> data to a random number. Alternatively, the client <NUM> may have requested to shuffle all values of a pName column <NUM> that has names of the patients stored therein.

The data masking engine <NUM> determines the type of masking operations requested by the client <NUM> for various columns. Specifically, the data masking engine <NUM> determines which of the masking operations can be performed on the server side with a simple query and which of the masking operations are more complex and therefore requires additional processing of the data on the client side.

For example, the data masking engine <NUM> may determine that the masking operation required on column A <NUM> merely requires each value of column A <NUM> to be changed to NULL. In this case, the data masking engine <NUM> may issue a command to make such change in all values of column A <NUM>. In one implementation, the command to make such a change may be a structured query language (SQL) command which may be used to query, insert, update, or modify data in tables of a relational database.

In one implementation, determining which masking operations can be implemented simply using an SQL command compared to the complex masking operations that require processing on the client side is determined based on the type of the masking operations. For example, in one implementation, each of various types of masking operations available to the client <NUM> may be categorized as being a simple masking operation or a complex masking operation.

On the other hand, the data masking engine <NUM> may determine that the masking operation on a column B <NUM> is a complex operation that requires additional processing on the client side. For example, the masking operation for column B <NUM> may be a random masking operation, which requires that pre-masking values of column B <NUM> are replaced with randomly generated values.

For a column with a complex masking operation, the data masking engine <NUM> generates a temporary column <NUM>. The temporary column is populated with unique values. For example, in one implementation, the unique values in the temporary column may be globally unique identifier (GUID) values that may have a <NUM>-byte value.

Subsequently, based on the instruction from the client <NUM>, the data masking engine <NUM> determines if the original value of the column B <NUM> is desired or not. If so, the values of the column B <NUM> is pulled to the client side. Once the data from the column B <NUM> is communicated to the client side, the desired masking operation is performed on each value of the column B <NUM>. In one implementation, as each value Bi <NUM>i of the column B <NUM> is received at the client side, its value is changed as per the masking operation. The changed value is communicated back to the server side and stored in a masked version of column B <NUM>, represented by a masked column Ba <NUM>a.

A copy of the temporary column <NUM>, represented by column tempa <NUM>a, is used to associate the values of the masked column Ba <NUM>a in a temporary table <NUM>. Subsequently an SQL command may be issued to insert the masked values from the masked column Ba <NUM>a into the column B <NUM>. Once the column B <NUM> is updated, table <NUM>, including the temporary column <NUM> and <NUM>a, is deleted. Subsequently, all the constraints on the table <NUM> are added back using the schema <NUM>.

<FIG> illustrates example data flow diagram <NUM> for the static data masking system disclosed herein. Specifically, the data flow diagram <NUM> illustrates the flow of information between a client <NUM>, a source database <NUM>, and a masked database <NUM>. The client <NUM> may be a computing device, such as the computing device disclosed in <FIG> below that may be used for hosting an application programming interface (API) to a data masking system. In one implementation, a user may access the data masking API via a GUI that allows the user to select various masking operations to be performed on one or more columns of the source database <NUM>. Thus, the API exposes the listing of the columns and one or more constraints on its masking to the user via such a GUI.

In one implementation, at <NUM> the client <NUM> may issue a transact-SQL (TSQL) command to back up the database <NUM>. In response at <NUM>, the source database <NUM> is backed up to a server drive <NUM>. Subsequently, an operation <NUM> retrieves the file system information of the source database at the client. An operation <NUM> sends a restore command to restore the backed up database as a new database. Together the backup command <NUM> and the restore command <NUM> are used to generate a clone of the source database <NUM>. In response to the restore command <NUM>, at <NUM> the masked database <NUM> is created and the backed up data from the server <NUM> is restored to the masked database <NUM> at an operation <NUM>.

An operation <NUM> sends a command to the masked database to get the schema of the masked database. In one implementation, the command may be a data-tier application (DAC) command and in return the schema is sent as a DAC pack (dacpac) at an operation <NUM> to the client <NUM>. Once the schema is received, at operation <NUM> the client may issue a command to the masked database <NUM> to drop all keys, constraints and indexes.

Subsequently, a set of masking operations <NUM> are performed on the masked database <NUM> without all keys, constraints and indexes. For all masking operations that may be performed by a simple SQL command, an operation <NUM> sends a TSQL update command to the masked database <NUM>. For example, if all values in a column in the masked database <NUM> is merely to be replaced by a NULL value, the operation <NUM> may initiate a TSQL update command to complete such an SQL capable masking operation.

For columns where complex masking operations are required, such as masking operations that may not be completed by an SQL command, an operation <NUM> sends a TSQL select command to retrieve data from that column. In one implementation, the data from the given column may be full, however, a set of columns chosen to have data retrieved therefrom may vary from none to all. In response, an operation <NUM> communicates such data to the client <NUM>. At an operation <NUM> the retrieved data is processed to compete the complex masking operation at the client <NUM>. Once the values for the column are updated with the complex masking operation, at an operation <NUM>, the masked data for the given column are inserted to a temporary table with unique identification values, such as GUIDs, that are also added to a table of the masked database <NUM>. Subsequently, a TSQL command is executed at an operation <NUM> to stitch or combine the masked values from the temporary table to the original table of the masked database <NUM>. Once all of the masking operations <NUM> are complete, an operation <NUM> recreates all the keys, constraints, and indexes of the masked database <NUM>. For example, the operation <NUM> may use dacpac to recreate all the keys, constraints, and indexes of the masked database <NUM>.

<FIG> illustrates operations <NUM> of the static data masking system disclosed herein. An operation <NUM> receives n masking operations for a database from a user. For example, the user may use a GUI to specify the n masking operations. In one implementation, an application used by the user may validate the masking operations to ensure that they do not violate any constraints of the database to be masked. An operation <NUM> clones the database to generate a masked database. For example, the cloning operation may be executed using a combination of backup/restore commands. An operation <NUM> saves the schema of the masked database. Once the masked database schema is saved, an operation <NUM> drops the constraints on the masked database.

Now the masked database is ready for performing various masking operations. An operation <NUM> evaluates a masking configuration to determine if it is an SQL capable masking operation that may be completed using an SQL command or not. If it determines that the masking operation can be completed using as SQL command, an operation <NUM> initiates an SQL command to complete such masking. Example of such SQL capable masking operation include a single value masking, a scramble masking, NULL masking, etc. On the other hand, examples of masking operations that are complex and therefore cannot be completed by an SQL command include a bag masking operation, an encryption masking operation, a random masking operation, a histogram masking operation, etc..

On the other hand, if the operation <NUM> determines that the masking operation on a column is complex in that it cannot be completed by an SQL command, an operation <NUM> fetches the data from the column to the client side for further processing. Such client side processing operation <NUM> is disclosed in further detail in <FIG> below. Operations <NUM> and <NUM> increase the index value and operations <NUM> and <NUM> determine if there are any additional of the n masking operations to be completed. Once all masking operations are completed, an operation <NUM> restores the keys, constraints, and indexes of the masked database.

<FIG> illustrates operations <NUM> of the static data masking system disclosed herein for complex masking on a column. An operation <NUM> adds a temporary key column to the table that includes the column requiring complex masking. The temporary key column may include unique key values such as GUID values and referred to as a GUID column. For example, for a candidate table with columns for SSN, pName, and pAddress, if the column SSN is to be masked using complex masking, the new GUID column with unique key values is added such that the candidate table now has four columns, namely SSN, pName, pAddress, and GUID. The GUID column includes values that are unique for each row.

An operation <NUM> creates a temporary table with a copy of the temporary key column and an empty column to store the masked values. The temporary keys may be GUIDs. Thus, the temporary table has two columns, namely the temporary key and maskedSSN. An operation <NUM> communicates the values of the column to be masked, in this example, column SSN, to the client. An operation <NUM> performs the complex masking operation on the values of the column SSN. The masked values are the column SSN are communicated back to the masked database at operation <NUM>. The masked values are added to the empty column, namely the maskedSSN column, of the temporary table at operation <NUM>. Subsequently an operation <NUM> performs an SQL operation to add the masked values from the maskedSSN column of the temporary table to the SSN column of the candidate table using the GUID from each of the temporary table and the candidate table as the key. An operation <NUM> deletes the temporary table and the GUID column from the candidate table.

<FIG> illustrates an example system <NUM> that may be useful in implementing the multi-modality video recognition system disclosed herein. The example hardware and operating environment of <FIG> for implementing the described technology includes a computing device, such as a general-purpose computing device in the form of a computer <NUM>, a mobile telephone, a personal data assistant (PDA), a tablet, smart watch, gaming remote, or other type of computing device. In the implementation of <FIG>, for example, the computer <NUM> includes a processing unit <NUM>, a system memory <NUM>, and a system bus <NUM> that operatively couples various system components including the system memory to the processing unit <NUM>. There may be only one or there may be more than one processing unit <NUM>, such that the processor of the computer <NUM> comprises a single central-processing unit (CPU), or a plurality of processing units, commonly referred to as a parallel processing environment. The computer <NUM> may be a conventional computer, a distributed computer, or any other type of computer; the implementations are not so limited.

The system bus <NUM> may be any of several types of bus structures including a memory bus or memory controller, a peripheral bus, a switched fabric, point-to-point connections, and a local bus using any of a variety of bus architectures. The system memory may also be referred to as simply the memory, and includes read only memory (ROM) <NUM> and random access memory (RAM) <NUM>. A basic input/output system (BIOS) <NUM>, containing the basic routines that help to transfer information between elements within the computer <NUM>, such as during start-up, is stored in ROM <NUM>. The computer <NUM> further includes a hard disk drive <NUM> for reading from and writing to a hard disk, not shown, a magnetic disk drive <NUM> for reading from or writing to a removable magnetic disk <NUM>, and an optical disk drive <NUM> for reading from or writing to a removable optical disk <NUM> such as a CD ROM, DVD, or other optical media.

The hard disk drive <NUM>, magnetic disk drive <NUM>, and optical disk drive <NUM> are connected to the system bus <NUM> by a hard disk drive interface <NUM>, a magnetic disk drive interface <NUM>, and an optical disk drive interface <NUM>, respectively. The drives and their associated tangible computer-readable media provide non-volatile storage of computer-readable instructions, data structures, program modules and other data for the computer <NUM>. It should be appreciated by those skilled in the art that any type of tangible computer-readable media may be used in the example operating environment.

A number of program modules may be stored on the hard disk drive <NUM>, magnetic disk <NUM>, optical disk <NUM>, ROM <NUM>, or RAM <NUM>, including an operating system <NUM>, one or more application programs <NUM>, other program modules <NUM>, and program data <NUM>. A user may generate reminders on the personal computer <NUM> through input devices such as a keyboard <NUM> and pointing device <NUM>. Other input devices (not shown) may include a microphone (e.g., for voice input), a camera (e.g., for a natural user interface (NUI)), a joystick, a game pad, a satellite dish, a scanner, or the like. These and other input devices are often connected to the processing unit <NUM> through a serial port interface <NUM> that is coupled to the system bus <NUM>, but may be connected by other interfaces, such as a parallel port, game port, or a universal serial bus (USB) (not shown). A monitor <NUM> or other type of display device is also connected to the system bus <NUM> via an interface, such as a video adapter <NUM>. In addition to the monitor, computers typically include other peripheral output devices (not shown), such as speakers and printers.

The computer <NUM> may operate in a networked environment using logical connections to one or more remote computers, such as remote computer <NUM>. These logical connections are achieved by a communication device coupled to or a part of the computer <NUM>; the implementations are not limited to a particular type of communications device. The remote computer <NUM> may be another computer, a server, a router, a network PC, a client, a peer device or other common network node, and typically includes many or all of the elements described above relative to the computer <NUM>. The logical connections depicted in FIG. <NUM> include a local-area network (LAN) <NUM> and a wide-area network (WAN) <NUM>. Such networking environments are commonplace in office networks, enterprise-wide computer networks, intranets and the Internet, which are all types of networks.

When used in a LAN-networking environment, the computer <NUM> is connected to the local network <NUM> through a network interface or adapter <NUM>, which is one type of communications device. When used in a WAN-networking environment, the computer <NUM> typically includes a modem <NUM>, a network adapter, a type of communications device, or any other type of communications device for establishing communications over the wide area network <NUM>. The modem <NUM>, which may be internal or external, is connected to the system bus <NUM> via the serial port interface <NUM>. In a networked environment, program engines depicted relative to the personal computer <NUM>, or portions thereof, may be stored in the remote memory storage device. It is appreciated that the network connections shown are examples and other means of communications devices for establishing a communications link between the computers may be used.

In an example implementation, software or firmware instructions for providing attestable and destructible device identity may be stored in memory <NUM> and/or storage devices <NUM> or <NUM> and processed by the processing unit <NUM>. One or more ML, NLP, or DLP models disclosed herein may be stored in memory <NUM> and/or storage devices <NUM> or <NUM> as persistent datastores. For example, a static data masking system <NUM> may be implemented on the computer <NUM> as an application program <NUM> (alternatively, the static data masking system <NUM> may be implemented on a server or in a cloud environment). The static data masking system <NUM> may utilize one of more of the processing unit <NUM>, the memory <NUM>, the system bus <NUM>, and other components of the personal computer <NUM>.

In contrast to tangible computer-readable storage media, intangible computer-readable communication signals may embody computer readable instructions, data structures, program modules or other data resident in a modulated data signal, such as a carrier wave or other signal transport mechanism. By way of example, and not limitation, intangible communication signals include wired media such as a wired network or direct-wired connection, and wireless media such as acoustic, RF, infrared and other wireless media.

An implementation disclosed herein provides a system for static data masking. The static data masking system may perform one or more operations including unbinding tables in a database, evaluating masking operations on the tables to determine that at least one masking operation on a particular column of a candidate table is a complex masking operation that cannot be completed using a query, adding a temporary key column with unique values to the candidate table, generating a temporary table including the temporary key column and an empty masked column, generating masked values for the particular column at a client, and populating the masked values for the particular column in the empty masked column of the temporary table. In an alternative implementation, the computer process further includes performing a query operation to restore masked values from the temporary table to the particular column of the candidate table.

Yet alternatively, the computer process further includes deleting the temporary table and the temporary key column from the candidate table. Alternatively, the computer process further includes restoring keys, constraints, and indexes of the database. Yet alternatively, the computer process includes determining that a masking operation on another column of the candidate table is a simple masking operation that can be completed using a query, the another column being different than the particular column and in response to the determination, performing a query operation to complete the simple masking operation.

In one implementation, the computer process further includes cloning the database using before unbinding the tables in the database. Alternatively, the computer process further includes saving schema of the database using before unbinding the tables in the database. In one implementation, the complex masking operation is at least one of a bag masking operation, an encryption masking operation, a random masking operation, a histogram masking operation.

A method of providing a static data masking includes evaluating masking operations on tables of a database to determine that at least one masking operation on a particular column of a candidate table is a complex masking operation that cannot be completed using a query, adding a temporary key column with unique values to the candidate table, generating a temporary table including the temporary key column and an empty masked column, generating masked values for the particular column at a client, and populating the masked values for the particular column in the empty masked column of the temporary table. Alternatively, the method further includes unbinding the tables before evaluating the masking operations.

An alternative implementation further includes performing a query operation to restore masked values from the temporary table to the particular column of the candidate table. Yet alternatively, the method further includes restoring keys, constraints, and indexes of the database. Alternatively, the method further includes determining that a masking operation on another column of the candidate table is a simple masking operation that can be completed using a query, the another column being different than the particular column and in response to the determination, performing a query operation to complete the simple masking operation.

In another implementation, the method further includes cloning the database using before unbinding the tables in the database using a backup operation and a restore operation. Yet alternatively, the complex masking operation is at least one of a bag masking operation, an encryption masking operation, a random masking operation, a histogram masking operation.

A system disclosed herein operates in a computing environment and includes a memory, one or more processor units, and a data masking system stored in the memory and executable by the one or more processor units, the static data masking system encoding computer-executable instructions on the memory for executing on the one or more processor units a computer process, the computer process including unbinding tables in a database, evaluating masking operations on the tables to determine that at least one masking operation on a particular column of a candidate table is a complex masking operation that cannot be completed using a query, adding a temporary key column with unique values to the candidate table, generating a temporary table including the temporary key column and an empty masked column, generating masked values for the particular column at a client, and populating the masked values for the particular column in the empty masked column of the temporary table.

In an alternative implementation, the computer process further includes performing a query operation to restore masked values from the temporary table to the particular column of the candidate table. Alternatively, the computer process further comprising deleting the temporary table and the temporary key column from the candidate table. Yet alternatively, the computer process further comprising restoring keys, constraints, and indexes of the database. In one implementation, the complex masking operation is at least one of a bag masking operation, an encryption masking operation, a random masking operation, a histogram masking operation.

The implementations described herein are implemented as logical steps in one or more computer systems. The logical operations may be implemented (<NUM>) as a sequence of processor-implemented steps executing in one or more computer systems and (<NUM>) as interconnected machine or circuit modules within one or more computer systems. The implementation is a matter of choice, dependent on the performance requirements of the computer system being utilized. Accordingly, the logical operations making up the implementations described herein are referred to variously as operations, steps, objects, or modules. Furthermore, it should be understood that logical operations may be performed in any order, unless explicitly claimed otherwise or a specific order is inherently necessitated by the claim language.

Claim 1:
A computer program comprising computer-executable instructions for executing on a computer system a computer process, the computer process comprising:
evaluating (<NUM>) masking operations on tables in a source database (<NUM>) to determine that at least one masking operation on a particular column of a candidate table is a complex masking operation, a complex masking operation being a masking operation that requires processing at a client;
responsive to determining that the at least one masking operation is a complex masking operation, executing the at least one masking operation by:
adding (<NUM>) a temporary key column with unique values to the candidate table of the masked database;
generating (<NUM>) a temporary table including the temporary key column and an empty masked column of the masked database;
sending, to the client, one or more data values from the particular column of the candidate table of the masked database to cause the client to generate (<NUM>) masked values for the particular column based on the one or more received data values; communicating back (<NUM>) the masked values to the source database (<NUM>); populating (<NUM>) the masked values for the particular column in the empty masked column of the temporary table of the masked database; and
performing a query operation to restore masked values from the temporary table to the particular column of the candidate table using the temporary key column of the candidate table and the temporary key column of the temporary table.