Virtual keys for column dataset access management

1 . A key management system implementing column-level access control, comprising:

a tag repository storing information associating one or more policy tags with each column dataset of one or more column datasets;

a network communication interface to communicate over one or more networks;

one or more processors; and

a memory storing instructions that, when executed by the one or more processors, cause the key management system to:

receive, from a client device over the one or more networks, a client request for an encrypted encryption key (EEK) to access one or more column datasets, the client request including a column name for each of the one or more column datasets;

based in part on the column name for each of the one or more column datasets of the client request, perform a lookup in the tag repository to identify one or more policy tags associated with each column name of the client request;

based on the one or more identified policy tags, determine whether the client device is authorized to access each of the one or more column datasets corresponding to each column name of the client request;

based on determining that the client device is authorized to access the one or more column datasets, (i) generate or obtain an original encryption key, and (ii) generate the encrypted encryption key (EEK) by using each of (a) a master key shared between the key management system and the client device, (b) the original encryption key, and (c) the column name for each of the one or more column datasets; and

provide the EEK to the client device over the one or more networks.

2 . The key management system of claim 1 , wherein the client request further includes (i) a dataset name for a data table that includes the one or more column datasets and (ii) a timestamp for at least one of the one or more column datasets, and wherein the instructions, when executed, cause the key management system to perform the lookup in the tag repository using the dataset name and timestamp for at least one of the one or more column datasets.

3 . The key management system of claim 2 , wherein the instructions, when executed, cause the key management system to generate the EEK using at least the dataset name and the timestamp of at least one of the one or more column datasets.

4 . The key management system of claim 3 , wherein the instructions, when executed, further cause the key management system to:

subsequent to providing the EEK to the client device, receive, over the one or more networks, a decrypt EEK request from the client device, the decrypt EEK request including data corresponding to the dataset name, the column name, the timestamp, and the EEK;

query the tag repository to identify the one or more policy tags associated with the one or more column datasets and determine whether the client device is authorized to access the one or more column datasets; and

based on determining that the client device is authorized to access the one or more column datasets, decrypt the EEK using the shared master key and provide, over the one or more networks, the original encryption key to the client device to enable access to the one or more column datasets.

5 . The key management system of claim 2 , wherein the shared master key is a time-based physical key that is associated with a time-to-live (TTL) to facilitate data retention enforcement.

6 . The key management system of claim 5 , wherein the TTL of the shared master key corresponds to the timestamp of at least one of the one or more column datasets.

7 . The key management system of claim 1 , wherein the instructions, when executed, further cause the key management system to:

receive data corresponding to a tag change for the one or more column datasets; and

configure the one or more policy tags associated with the one or more column datasets in the tag repository to implement the tag change.

8 . The key management system of claim 7 , wherein the tag change does not require re-encryption or a rewrite of the one or more column datasets.

9 . A non-transitory computer readable medium storing instructions that, when executed by one or more processors of a computing system, cause the computing system to:

store, in a tag repository, information associating one or more policy tags with each column dataset of one or more column datasets;

receive, from a client device over one or more networks, a client request for an encrypted encryption key (EEK) to access one or more column datasets, the client request including a column name for each of the one or more column datasets;

based in part on the column name for each of the one or more column datasets of the client request, perform a lookup in the tag repository to identify one or more policy tags associated with each column name of the client request;

based on the one or more identified policy tags, determine whether the client device is authorized to access each of the one or more column datasets corresponding to each column name of the client request;

based on determining that the client device is authorized to access the one or more column datasets, (i) generate or obtain an original encryption key, and (ii) generate the encrypted encryption key (EEK) by using each of (a) a master key shared between a key management system and the client device, (b) the original encryption key, and (c) the column name for each of the one or more column datasets; and

provide the EEK to the client device over the one or more networks.

10 . The non-transitory computer readable medium of claim 9 , wherein the client request further includes (i) a dataset name for a data table that includes the one or more column datasets and (ii) a timestamp for at least one of the one or more column datasets, and wherein the instructions, when executed, cause the computing system to perform the lookup in the tag repository using the dataset name and timestamp of at least one of the one or more column datasets.

11 . The non-transitory computer readable medium of claim 10 , wherein the instructions, when executed, cause the computing system to generate the EEK using at least the dataset name and the timestamp of at least one of the one or more column datasets.

12 . The non-transitory computer readable medium of claim 11 , wherein the instructions, when executed, further cause the computing system to:

subsequent to providing the EEK to the client device, receive, over the one or more networks, a decrypt EEK request from the client device, the decrypt EEK request including data corresponding to the dataset name, the column name, the timestamp, and the EEK;

query the tag repository to identify the one or more policy tags associated with the one or more column datasets and determine whether the client device is authorized to access the one or more column datasets; and

based on determining that the client device is authorized to access the one or more column datasets, decrypt the EEK using the shared master key and provide, over the one or more networks, the original encryption key to the client device to enable access to the one or more column datasets.

13 . The non-transitory computer readable medium of claim 10 , wherein the shared master key is a time-based physical key that is associated with a time-to-live (TTL) to facilitate data retention enforcement.

14 . The non-transitory computer readable medium of claim 13 , wherein the TTL of the shared master key corresponds to the timestamp of the one or more column datasets.

15 . The non-transitory computer readable medium of claim 9 , wherein the instructions, when executed, further cause the computing system to:

receive data corresponding to a tag change for the one or more column datasets; and

configure the one or more policy tags associated with the one or more column datasets in the tag repository to implement the tag change.

16 . The non-transitory computer readable medium of claim 15 , wherein the tag change does not require re-encryption or a rewrite of the one or more column datasets.

17 . A computer-implemented method of managing column-level access control, the method being performed by one or more processors and comprising:

storing, in a tag repository, information associating one or more policy tags with each column dataset of one or more column datasets;

receiving, from a client device over one or more networks, a client request for an encrypted encryption key (EEK) to access one or more column datasets, the client request including a column name for each of the one or more column datasets;

based in part on the column name for each of the one or more column datasets of the client request, performing a lookup in the tag repository to identify one or more policy tags associated with each column name of the client request;

based on the one or more identified policy tags, determine whether the client device is authorized to access each of the one or more column datasets corresponding to each column name of the client request;

based on determining that the client device is authorized to access the one or more column datasets, (i) generating or obtaining an original encryption key, and (ii) generating the encrypted encryption key (EEK) by using each of (a) a master key shared between a key management system and the client device, (b) the original encryption key, and (c) the column name for each of the one or more column datasets; and

providing the EEK to the client device over the one or more networks.

18 . The method of claim 17 , wherein the client request further includes (i) a dataset name for a data table that includes the one or more column datasets and (ii) a timestamp for at least one of the one or more column datasets, and wherein the instructions, when executed, cause the one or more processors to perform the lookup in the tag repository using the dataset name and timestamp of at least one of the one or more column datasets.

19 . The method of claim 18 , wherein the one or more processors generate the EEK using at least the dataset name and the timestamp of at least one of the one or more column datasets.

20 . The method of claim 19 , further comprising:

subsequent to providing the EEK to the client device, receiving, over the one or more networks, a decrypt EEK request from the client device, the decrypt EEK request including data corresponding to the dataset name, the column name, the timestamp, and the EEK;

querying the tag repository to identify the one or more policy tags associated with the one or more column datasets and determine whether the client device is authorized to access the one or more column datasets; and

based on determining that the client device is authorized to access the one or more column datasets, decrypting the EEK using the shared master key and provide, over the one or more networks, the original encryption key to the client device to enable access to the one or more column datasets.