Priority-based masking policy selection in a database environment
Techniques for priority-based masking policy selection in a database environment are described. Masking policies are defined and attached to columns of relational data for particular users or roles. The attachment of a masking policy to a column includes a user-specified priority value. When multiple policies could apply to a particular query, the conflict can be easily resolved and understood by use of the priority values, for example, by selecting a candidate policy having a highest priority value.
1. A computer-implemented method comprising:
receiving, at a database service, a request to execute a query involving at least a column of a table of a database, wherein the request was issued on behalf of a user through a user account;
identifying, based on a data structure, one or more roles associated with the user account;
identifying multiple masking policies that are attached to the table, are associated with the column, and are applicable for all users or are applicable for the user account or are applicable for users associated with any of the one or more roles;
selecting a masking policy from among the multiple masking policies based on the one or more roles associated with the user account, and based on an analysis of user-configured priority values associated with the multiple masking policies, whereby the masking policy is selected due to it having a highest or lowest priority value from among the user-configured priority values; and
executing the query to generate a result, the executing comprising modifying values of the column based on the masking policy.
2. The computer-implemented method of claim 1 , wherein executing the query comprises:
rewriting the query to yield a rewritten query based on the masking policy;
providing the rewritten query to one or more compute nodes of the database service for use in generating one or more intermediate query results, wherein the one or more compute nodes apply a masking function, selected based on the rewritten query, to values of the column; and
generating the result based on the one or more intermediate query results.
3. The computer-implemented method of claim 1 , further comprising:
receiving, at the database service, a request to define the masking policy originated on behalf of a second user via a second user account; and
receiving, at the database service, a request to attach the masking policy to the column, wherein the request includes a priority value specified by the second user.
4. A computer-implemented method comprising:
receiving a request to execute a query involving at least a column of a relation of a database, wherein the request was issued through a user account;
identifying, based on a data structure, one or more roles associated with the user account;
identifying multiple masking policies that are attached to the relation, are associated with the column, and are applicable for all users or are applicable for the user account or are applicable for users associated with any of the one or more roles;
selecting a masking policy from among the multiple masking policies based on the one or more roles associated with the user account, and based on an analysis of priority values associated with the multiple masking policies, whereby the masking policy is selected due to it having a highest or lowest priority value from among the priority values; and
executing the query to generate a result, the executing comprising modifying values of the column based on the masking policy.
5. The computer-implemented method of claim 4 , wherein the priority values are user-configured priority values associated with attachments of the multiple masking policies to the relation.
6. The computer-implemented method of claim 4 , wherein executing the query comprises:
rewriting the query to yield a rewritten query based on the masking policy;
providing the rewritten query to one or more compute nodes of the database service for use in generating one or more intermediate query results, wherein the one or more compute nodes apply a masking function, selected based on the rewritten query, to values of the column; and
generating the result based on the one or more intermediate query results.
7. The computer-implemented method of claim 4 , wherein the query further involves a second column of the relation, and wherein the method further comprises:
selecting a second masking policy from a second set of multiple masking policies that are associated with the second column based on the one or more roles of the user account,
wherein executing the query further comprises modifying values of the second column based on the selected second masking policy.
8. The computer-implemented method of claim 4 , wherein selecting the masking policy from multiple masking policies comprises:
identifying, via a first data structure, a plurality of masking policies that have been attached to the relation and that output values for the column, and
selecting, for inclusion in the multiple masking policies, those of the plurality of masking policies that apply to any of the one or more roles or the user account.
9. The computer-implemented method of claim 8 , wherein selecting the masking policy from multiple masking policies further comprises selecting, for inclusion in the multiple masking policies, those of the plurality of masking policies that apply to all users or user roles.
10. The computer-implemented method of claim 4 , further comprising receiving a request to define the masking policy originated on behalf of a second user via a second user account.
11. The computer-implemented method of claim 10 , further comprising receiving a request to attach the masking policy to the relation.
12. The computer-implemented method of claim 11 , wherein the request to attach the masking policy to the column includes a priority value specified by the second user.
13. The computer-implemented method of claim 10 , wherein the masking policy indicates that values are to be modified based at least in part on a cryptographic function.
14. The computer-implemented method of claim 13 , wherein the masking policy indicates that the values are to be modified via:
an email address masking function;
a date masking function;
a national identification number masking function; or
a financial account number masking function.
15. A system comprising:
one or more electronic devices to implement a database service in a multi-tenant service provider network, the database service including one or more processors and memory storing instructions that upon execution by the one or more processors cause the database service to:
receive a request to execute a query involving at least a column of a relation of a database, wherein the request was issued through a user account;
identify, based on a data structure, one or more roles associated with the user account;
identify multiple masking policies that are attached to the relation, are associated with the column, and are applicable for all users or are applicable for the user account or are applicable for users associated with any of the one or more roles;
select a masking policy from among the multiple masking policies based on the one or more roles associated with the user account, and based on an analysis of priority values associated with the multiple masking policies, whereby the masking policy is selected due to it having a highest or lowest priority value from among the priority values; and
execute the query to generate a result, the executing comprising modifying values of the column based on the selected masking policy, wherein the values of the column were obtained previously or concurrently from data objects of a storage service in the multi-tenant service provider network.
16. The system of claim 15 , wherein the priority values are user-configured priority values associated with attachments of the multiple masking policies to the relation.
17. The system of claim 15 , wherein executing the query comprises:
rewriting the query to yield a rewritten query based on the masking policy;
providing the rewritten query to one or more compute nodes of the database service for use in generating one or more intermediate query results, wherein the one or more compute nodes apply a masking function, selected based on the rewritten query, to values of the column; and
generating the result based on the one or more intermediate query results.
18. The system of claim 15 , wherein the query further involves a second column of the relation, and wherein the database service further includes instructions that upon execution cause the database service to:
select a second masking policy from a second set of multiple masking policies that are associated with the second column and with the one or more roles or the user account,
wherein to execute the query the database service is further to modify values of the second column based on the selected second masking policy.
19. The system of claim 15 , wherein as part of the selection of the masking policy from multiple masking policies, the database service is to:
identify, via a first data structure, a plurality of masking policies that have been attached to the relation; and
select, for inclusion in the multiple masking policies, those of the plurality of masking policies that apply to any of the one or more roles or the user account.
20. The system of claim 19 , wherein as part of the selection of the masking policy from multiple masking policies, the database service is further to select, for inclusion in the multiple masking policies those of the plurality of masking policies that apply to all users or user roles.