Logical log visibility control in enclave database

1 . A database management system (DBMS) in an enclave that comprises at least one memory and at least one processor, the DBMS comprising:

a system catalog table;

a logical log; and

a DBMS engine in the enclave configured to:

parse the logical log based on a request to retrieve the logical log to detect at least one predetermined identifier;

for each predetermined identifier being detected in the logical log:

determine an access control of the request with respect to a field of the system catalog table of a data privacy preservation database corresponding to a record in the system catalog table, and

retrieve secret data corresponding to the field when the access control indicating a first access control status or mask the secret data corresponding to the field when the access control indicating a second access control status; and

distribute the logical log having the retrieved or masked secret data based on the request,

wherein for each predetermined identifier in the logical log, the logical log includes an identification of the field, a length of the secret data corresponding to the field, and the secret data corresponding to the field.

2 . The DBMS of claim 1 , wherein for each predetermined identifier in the logical log, the DBMS engine is further configured to remove the predetermined identifier, the identification of the field, and the length of the secret data corresponding to the field from the logical log before the logical log is distributed.

3 . The DBMS of claim 1 , wherein the record in the system catalog table includes the identification of the field and one or more user identifications.

4 . The DBMS of claim 3 , wherein the DBMS engine is further configured to:

determine the access control of the request based on the one or more user identifications when the identification of the field in the record matches the identification of the field in the logical log.

5 . The DBMS of claim 4 , wherein the DBMS engine is further configured to:

when the request is from a first user corresponding to the one or more user identifications, configure the access control to the first access control status; and

when the request is from a second user that does not correspond to the one or more user identifications, configure the access control to the second access control status.

6 . The DBMS of claim 1 , wherein the first access control status is indicative of the field being visible to a user of the request, and the second access control status is indicative of the field being invisible to the user.

7 . The DBMS of claim 1 , wherein the DBMS is in the enclave for runtime execution.

8 . A method for data privacy control, the method comprising:

parsing, by a database management system (DBMS) in an enclave, a logical log based on a request to retrieve the logical log to detect at least one predetermined identifier;

for each predetermined identifier being detected in the logical log:

determining an access control of the request with respect to a field of a system catalog table of a data privacy preservation database corresponding to a record in the system catalog table, and

retrieving secret data corresponding to the field when the access control indicating a first access control status or masking the secret data corresponding to the field when the access control indicating a second access control status; and

distributing the logical log having the retrieved or masked secret data based on the request,

wherein for each predetermined identifier in the logical log, the logical log includes an identification of the field, a length of the secret data corresponding to the field, and the secret data corresponding to the field.

9 . The method of claim 8 , further comprising:

for each predetermined identifier in the logical log, removing the predetermined identifier, the identification of the field, and the length of the secret data corresponding to the field from the logical log before distributing the logical log.

10 . The method of claim 8 , wherein the record in the system catalog table includes the identification of the field and one or more user identifications.

11 . The method of claim 10 , further comprising:

determining the access control of the request based on the one or more user identifications when the identification of the field in the record matches the identification of the field in the logical log.

12 . The method of claim 11 , further comprising:

when the request is from a first user corresponding to the one or more user identifications, configuring the access control to the first access control status; and

when the request is from a second user that does not correspond to the one or more user identifications, configuring the access control to the second access control status.

13 . The method of claim 8 , wherein the first access control status is indicative of the field being visible to a user of the request, and the second access control status is indicative of the field being invisible to the user.

14 . A non-transitory computer-readable medium having computer-executable instructions stored thereon that, upon execution, cause one or more processors to perform operations comprising:

parsing, by a database management system (DBMS) in an enclave, a logical log based on a request to retrieve the logical log to detect at least one predetermined identifier;

for each predetermined identifier being detected in the logical log:

determining an access control of the request with respect to a field of a system catalog table of a data privacy preservation database corresponding to a record in the system catalog table, and

retrieving secret data corresponding to the field when the access control indicating a first access control status or masking the secret data corresponding to the field when the access control indicating a second access control status; and

distributing the logical log having the retrieved or masked secret data based on the request,

wherein for each predetermined identifier in the logical log, the logical log includes an identification of the field, a length of the secret data corresponding to the field, and the secret data corresponding to the field.

15 . The computer-readable medium of claim 14 , wherein the operations further comprise:

for each predetermined identifier in the logical log, removing the predetermined identifier, the identification of the field, and the length of the secret data corresponding to the field from the logical log before distributing the logical log.

16 . The computer-readable medium of claim 14 , wherein the record in the system catalog table includes the identification of the field and one or more user identifications.

17 . The computer-readable medium of claim 16 , wherein the operations further comprise:

determining the access control of the request based on the one or more user identifications when the identification of the field in the record matches the identification of the field in the logical log.