Patent ID: 8321387

Claim:
A computer-implemented method of managing access to sensitive data in a database, comprising: receiving, from a requesting entity, an abstract query having one or more result fields, each referencing a logical field of a data abstraction model abstractly describing data in a database, wherein the data abstraction model is configured to facilitate transforming the one or more result fields of the abstract query into a form consistent with a physical representation of the data in the database; and updating an object to reflect the one or more result fields in the abstract query, whereby the object is dynamically maintained to collectively reflect the fields referenced in the abstract query as well as the previously received queries from the requesting entity; applying a security rule to the updated object, the security rule defining: (i) one or more unauthorized result field combinations for queries from the requesting entity and (ii) a corresponding security action selected from: (i) a first security action comprising auditing the requesting entity; (ii) a second security action comprising notifying an administrative entity; and (iii) a third security action comprising modifying query results to remove at least a portion of sensitive data from the query results, wherein the modified query results are output to the requesting entity; and upon determining, by operation of one or more computer processors, that the updated object contains a combination of fields that matches an unauthorized result field combination of the applied security rule, performing the corresponding security action by an application configured to selectively perform each of at least two different security actions selected from: (i) the first security action; (ii) the second security action; and (iii) the third security action.