Systems and methods for dynamic masking of data
Embodiments disclosed herein may be useful for controlling access to data, and particularly to data intended for restricted access. In at least one embodiment, a system and method for dynamic data masking intercepts input/output (I/O) read requests for data in external memory, determines if the data to be read should be masked, and appropriately, dynamically masks data before the requested data is written into system memory. The system and method for dynamic data masking provides a technical improvement to computing systems by, for example, avoiding the need to create an entirely separate database with scrubbed data and, thus, resource and costs associated with creating a separate, scrubbed database.
1. A method to dynamically enhance data security by masking selected data in transit from a database in a first memory to a second memory using a dynamic data masking system logically coupled between an input/output (I/O) system of a database system application and the database, the method comprising:
with the dynamic data masking system:
intercepting a request from the database system application to read data from the database in the first memory for writing to the second memory;
determining if a portion of requested data should be masked;
when a portion of the requested data is determined to be masked, masking the portion of the requested data determined to be masked; and
providing the requested data with masking to the I/O system; and
with the database system application:
copying the requested data with masking to the second memory.
2. The method of claim 1 wherein the second memory comprises main memory, the method further comprising:
with the dynamic data masking system:
when a portion of the requested data is determined to be masked, copying each page of data from a database to memory locations controlled by the dynamic data masking system;
when a portion of the requested data is determined to be masked, masking the portion of the requested data determined to be masked comprises:
masking the portion of the requested data in each page copied to the memory locations controlled by the dynamic data masking system; and
providing the requested data with masking to the I/O system comprises:
providing each page with the masked data to the I/O system, wherein the masking of data is transparent to the database system application.
3. The method of claim 1 wherein the dynamic data masking system preserves the data in the database so that masking the selected data is non-destructive of the data in the database.
4. The method of claim 1 wherein data stored in the database is organized into identifiable pages of data and each page of data includes at least one column of data, the method further comprising:
determining which portion of the requested data to mask, wherein determining which portion of the requested data to mask comprises:
comparing the data requested to be read with at least one metadata map of the database, wherein the metadata map includes (i) a mapping of each of the pages that allows each page to be uniquely identified, (ii) one or more data object names, (iii) each data column name of each column to have data masked, (iv) column type for each data column, and (v) a masking method for each column of data to be masked; and
determining from the comparison if the metadata map indicates that the data requested to be read has any column that should be masked.
5. The method of claim 1 wherein masking the portion of the requested data determined to be masked comprises:
masking the portion of the requested data in accordance with the masking method included in the metadata map.
6. The method of claim 1 wherein the first memory comprises computer system mass storage memory and the second memory comprises main memory of the computer system.
7. The method of claim 1 wherein the database is a member of a group consisting of a virtual database and a non-virtual database.
8. A system to dynamically enhance data security by masking selected data in transit from a database in a first memory to a second memory, the system comprising:
a processor;
a memory, coupled to the processor, having a dynamic data masking system encoded therein, executable by the processor, and logically coupled between an input/output (I/O) system of a database system application and the database to:
intercept a request from the database application system to read data from the database in the first memory for writing to the second memory;
determine if a portion of the requested data should be masked;
when a portion of requested data is determined to be masked, mask the portion of the requested data determined to be masked; and
provide the requested data with masking to the I/O system; and
the memory further having the database system application encoded therein and executable by the processor to:
copy the requested data with masking to the second memory.
9. The system of claim 8 wherein:
the second memory comprises main memory;
the dynamic data masking system is further executable to:
when a portion of the requested data is determined to be masked, copy each page of data from a database to memory locations controlled by the dynamic data masking system;
when a portion of the requested data is determined to be masked, to mask the portion of the requested data determined to be masked, comprises:
mask the portion of the requested data in each page copied to the memory locations controlled by the dynamic data masking system; and
the dynamic data masking system is further executable to:
provide each page with the masked data to the I/O system, wherein masking of data is transparent to the database system application.
10. The system of claim 8 wherein the dynamic data masking system preserves the data in the database so that masking the selected data is non-destructive of the data in the database.
11. The system of claim 8 wherein data stored in the database is organized into identifiable pages of data and each page of data includes at least one column of data, wherein the dynamic data masking system is further executable to:
determine which portion of the requested data to mask, and to determine which portion of the requested data to mask comprises:
compare the data requested to be read with at least one metadata map of the database, wherein the metadata map includes (i) a mapping of each of the pages that allows each page to be uniquely identified, (ii) one or more data object names, (iii) each data column name of each column to have data masked, (iv) column type for each data column, and (v) a masking method for each column of data to be masked; and
determine from the comparison if the metadata map indicates that the data requested to be read has any column that should be masked.
12. The system of claim 8 wherein to mask the portion of the requested data determined to be masked comprises:
mask the portion of data in accordance with the masking method included in the metadata map.
13. The system of claim 8 wherein the first memory comprises computer system mass storage memory and the second memory comprises main memory of the computer system.
14. The system of claim 8 wherein the database is a member of a group consisting of a virtual database and a non-virtual database.
15. A non-transitory, computer readable medium comprising a dynamic data masking system and database system application encoded therein, the dynamic data masking system is logically coupled between an input/output (I/O) system of a database system application and a database, to dynamically enhance data security by masking selected data in transit from the database in a first memory to a second memory, the non-transitory, computer readable medium, wherein:
the dynamic data masking system is executable to:
intercept a request from the database application system to read data from the database in the first memory for writing to the second memory;
determine if a portion of the requested data should be masked;
when a portion of the requested data is determined to be masked, mask the portion of the requested data determined to be masked; and
provide the requested data with masking to the I/O system; and
the database system application is executable to:
copy the requested data with masking to the second memory.
16. The non-transitory, computer readable medium of claim 8 wherein:
the second memory comprises main memory;
the dynamic data masking system is further executable to:
when a portion of the requested data is determined to be masked, copy each page of data from a database to memory locations controlled by the dynamic data masking system;
when a portion of the requested data is determined to be masked, to mask the portion of the requested data determined to be masked, comprises:
mask the portion of the requested data in each page copied to the memory locations controlled by the dynamic data masking system; and
the dynamic data masking system is further executable to:
provide each page with the masked data to the I/O system, wherein masking of data is transparent to the database system application.
17. The non-transitory, computer readable medium of claim 8 wherein the dynamic data masking system preserves the data in the database so that masking the selected data is non-destructive of the data in the database.
18. The non-transitory, computer readable medium of claim 8 wherein data stored in the database is organized into identifiable pages of data and each page of data includes at least one column of data, and the dynamic data masking system is further executable to:
determine which portion of the requested data to mask, and to determine which portion of the requested data to mask comprises:
compare the data requested to be read with at least one metadata map of the database, wherein the metadata map includes (i) a mapping of each of the pages that allows each page to be uniquely identified, (ii) one or more data object names, (iii) each data column name of each column to have data masked, (iv) column type for each data column, and (v) a masking method for each column of data to be masked; and
determine from the comparison if the metadata map indicates that the data requested to be read has any column that should be masked.
19. The non-transitory, computer readable medium of claim 8 wherein to mask the portion of the requested data determined to be masked comprises:
mask the portion of data in accordance with the masking method included in the metadata map.
20. The non-transitory, computer readable medium of claim 8 wherein the first memory comprises computer system mass storage memory and the second memory comprises main memory of the computer system.
21. The non-transitory, computer readable medium of claim 8 wherein the database is a member of a group consisting of a virtual database and a non-virtual database.