Tag-based data governance auditing system
A method of implementing object tagging framework starts with the processor receiving a tag creation command including a tag name. In response to the tag creation command, the processor creates a current tag. The processor then receives an association command, the tag name and a source object identifier. The processor determines a source object associated with the source object identifier. The source object includes a tag value. The processor associates the current tag with the source object. The processor receives a replication command including the source object and a target object. The processor causes replication of the source object to the target object that comprises replicating the current tag with the tag name and the tag value in the source object to the target object. Other embodiments are also described herein.
1. A computer-implemented object tagging method for a database, comprising:
receiving from an administrator of the database, a tag creation command including a tag name;
in response to the tag creation command, creating a tag for classifying sensitive information in objects of the database;
granting an apply privilege of the tag to a data owner of an object of the database;
in response to a bind command from the data owner, generating a tagged object based on the tag and the object of the database, the tagged object containing sensitive information; and
in response to a request from the database administrator during an audit, performing operations comprising:
finding the tagged object of the database using the tag;
determining whether the tagged object of the database is associated with a masking policy set by the administrator; and
in response to determining the tagged object is unassociated with the masking policy, associating the tagged object with the masking policy to mask the sensitive information.
2. The computer-implemented object tagging method of claim 1 ,
wherein the data owner is associated with a consumer account of a first organization, and the administrator is associated with a provider account of a second organization, and
wherein the first organization and the second organization are not a same organization.
3. The computer-implemented object tagging method of claim 1 , wherein the mask comprises a personally identifiable information mask.
4. The computer-implemented object tagging method of claim 3 , wherein the personally identifiable information mask comprises a social security number mask.
5. The computer-implemented object tagging method of claim 1 , wherein the tag comprises a personally identifiable information tag.
6. The computer-implemented object tagging method of claim 1 , further comprising:
in response to receiving a query including the tag name,
generating an output based on the tag name.
7. The computer-implemented object tagging method of claim 1 , further comprising:
controlling access to the tag based on one or more user roles.
8. A system for implementing an object tagging framework for a database, comprising:
one or more processors; and
a memory storing instructions that, when executed by the one or more processors, cause the system to perform operations comprising:
receiving from an administrator of the database, a tag creation command including a tag name;
in response to the tag creation command, creating a tag for classifying sensitive information in objects of the database;
granting an apply privilege of the tag to a data owner of an object of the database;
in response to a bind command from the data owner, generating a tagged object based on the tag and the object of the database, the tagged object containing sensitive information; and
in response to a request from the database administrator during a periodic audit, performing operations comprising:
finding the tagged object of the database using the tag;
determining whether the tagged object of the database is associated with a masking policy set by the administrator; and
in response to determining the tagged object is unassociated with the masking policy, associating the tagged object with the masking policy to mask the sensitive information.
9. The system for implementing an object tagging framework for a database of claim 8 ,
wherein the data owner is associated with a consumer account of a first organization, and the administrator is associated with a provider account of a second organization, and
wherein the first organization and the second organization are not a same organization.
10. The system for implementing an object tagging framework for a database of claim 8 , wherein the mask comprises a personally identifiable information mask.
11. The system for implementing an object tagging framework for a database of claim 10 , wherein the personally identifiable information mask comprises a social security number mask.
12. The system for implementing an object tagging framework for a database off claim 8 , wherein the tag comprises a personally identifiable information tag.
13. The system for implementing an object tagging framework for a database of claim 8 , wherein the instructions when executed further cause the system to perform operations comprising:
in response to receiving a query include the tag name, generating an output based on the tag name.
14. The system for implementing an object tagging framework for a database of claim 8 , wherein the instructions when executed further cause the system to perform operations comprising:
controlling access to the tag based on one or more user roles.
15. A non-transitory computer-readable storage medium, the computer-readable storage medium including instructions that when executed by a computer, cause the computer to perform operations comprising:
receiving from an administrator of the database, a tag creation command including a tag name;
in response to the tag creation command, creating a tag for classifying sensitive information in objects of the database;
granting an apply privilege of the tag to a data owner of an object of the database;
in response to a bind command from the data owner, generating a tagged object based on the tag and the object of the database, the tagged object containing sensitive information; and
in response to a request from the database administrator during a periodic audit, performing operations comprising:
finding the tagged object of the database using the tag;
determining whether the tagged object of the database is associated with a masking policy set by the administrator; and
in response to determining the tagged object is unassociated with the masking policy, associating the tagged object with the masking policy to mask the sensitive information.
16. The non-transitory computer-readable storage medium of claim 15 ,
wherein the data owner is associated with a consumer account of a first organization, and the administrator is associated with a provider account of a second organization, and
wherein the first organization and the second organization are not a same organization.
17. The non-transitory computer-readable storage medium of claim 15 , wherein the mask comprises a personally identifiable information mask.
18. The non-transitory computer-readable storage medium of claim 17 , wherein the personally identifiable information mask comprises a social security number mask.
19. The non-transitory computer-readable storage medium of claim 15 , wherein the tag comprises a personally identifiable information tag.
20. The non-transitory computer-readable storage medium of claim 15 , wherein the instructions when executed further cause the computer to perform operations comprising:
controlling access to the tag based on one or more user roles.