Enforcing data access policies in a reverse proxy
A method and system of masking, redacting, filtering, and encrypting data retrieved from or stored into a database using policies in an information management system. The system comprises application, data protection, and database components. A data protection component is placed between an application component and a database component to provide protection to data in a database by applying data access policies to requests sent from the application component to the database component.
1 . A method comprising:
providing a database management server, wherein the database management server manages a relational database, wherein the relational database having a plurality of tables, wherein each table having a plurality of rows and columns;
providing an application program having access to data in the plurality of tables, wherein the application program retrieves data in the plurality of tables via a database query;
providing a policy engine having a plurality of data access policies, wherein the plurality of data access policies controls access to the data in the plurality of tables;
providing a data access enforcer capable of intercepting database queries before the database queries reach the database management server;
providing a policy context provider installed on the application component, where the policy context provider sends application user information to the data protection component;
at the application component, sending a first user information comprising an identity of the first user to the data protection component, where policy enforcement by the data protection component is based on the first user information;
at the application component, sending a second user information comprising an identity of the second user to the data protection component, where policy enforcement by the data protection component is based on the second user information;
at the application program, sending a first database query to the database management server to retrieve a first result set, wherein an identity of a user viewing the data in the first result set was provided by the policy context provider before the first database query is sent;
at the data access enforcer, intercepting the first database query before the first database query is processed by the database management server;
at the data access enforcer, collecting contextual information to support evaluation of the plurality of data access policies;
at the data access enforcer, obtaining a decision on whether the first database query is allowed from the policy engine, wherein the decision comprises a policy obligation;
at the data access enforcer, altering the first database query to produce a second database query to implement the decision;
at the data access enforcer, sending the second database query to the database management server to retrieve a second result set, wherein the first database query is not sent to the database management server; and
at the data access enforcer, passing the second result set to the application program in response to the first database query,
wherein for the first user information, the response to the first database query provides results comprises masked data in a first column, and
for the second user information, the response to the first database query provides results comprises unmasked data in the first column.
2 . The method of claim 1 wherein the database query is a Structure Query Language (SQL) statement.
3 . The method of claim 1 wherein the plurality of data access policies controls access to the data in the plurality of tables based on the identity of a user logged into the application program.
4 . The method of claim 1 wherein the plurality of data access policies controls access to the data in the plurality of tables based on the identity of a user connected to the database management server.
5 . The method of claim 1 wherein the plurality of data access policies controls access to the data in the plurality of tables comprises excluding a row in the first result set.
6 . The method of claim 1 wherein the plurality of data access policies controls access to the data in the plurality of tables comprises masking of data in a column in the first result set.
7 . The method of claim 1 wherein the plurality of data access policies is stored in a file.
8 . The method of claim 1 wherein the data access enforcer performs the function of a reverse proxy server for the database management server.
9 . The method of claim 1 wherein the application program and the data access enforcer run on separate computing devices.
10 . The method of claim 1 wherein the data access enforcer and the database management server run on the same computing device.
11 . The method of claim 1 wherein the data access enforcer and the database management server run on separate computing devices.
12 . The method of claim 1 wherein the application program and the database management server communicate using one of Tabular Data Stream (TDS) protocol, Hypertext Transfer Protocol (HTTP) or SOAP messaging protocol.
13 . The method of claim 1 wherein the application program and the database management server communicate using a representational state transfer (REST) style application programming interface.
14 . The method of claim 1 wherein the at the data access enforcer, intercepting the first database query before the first database query is processed by the database management server comprises:
instrumenting the database client interface handler of the database management server to intercept the first database query before the first database query is processed by the database management server.
15 . The method of claim 1 wherein the at the data access enforcer, obtaining a decision on whether the first database query is allowed from the policy engine comprises:
at the data access enforcer, sending the first database query and the contextual information to the policy engine;
at the policy engine, evaluating a subset of the plurality of data access policies with the first database query and the contextual information to produce a decision; and
at the policy engine, passing the decision to the data access enforcer.
16 . The method in claim 15 wherein the contextual information comprises the identity of a user logged into the application program.
17 . The method of claim 1 wherein the decision comprises allowed or deny.
18 . The method of claim 1 wherein the decision comprises allowed and additional instructions.
19 . The method of claim 1 wherein the at the data access enforcer, obtaining a decision on whether the first database query is allowed from the policy engine is replaced by
at the data access enforcer, obtaining a decision from the policy engine, wherein the decision comprises an instruction for altering the first database query.
20 . The method of claim 1 wherein the data access enforcer and the policy engine run on the same computing device.
21 . The method of claim 1 wherein the data access enforcer and the policy engine run on separate computing devices.
22 . The method of claim 1 wherein the at the data access enforcer, altering the first database query to produce a second database query to implement the decision comprises:
inserting a condition into the first database query, wherein the condition reduces the amount of data produced by the first database query.
23 . The method of claim 22 wherein the first database query comprises a SQL statement, wherein the inserting a condition into the first database query comprises:
altering the WHERE clause of the SQL statement.
24 . The method of claim 1 wherein the at the data access enforcer, altering the first database query to produce a second database query to implement the decision comprises:
if the decision is not allowed, the first database query is altered to produce a second database query, wherein executing the second database query at the database management server produces an empty result set.
25 . The method of claim 1 wherein the first database query and the second database query are different.
26 . The method of claim 1 wherein the second result set is a subset of the first result set.
27 . The method of claim 1 wherein the first result set and the second result set each comprises a plurality of rows and columns, wherein the number of rows in the second result set is less than or equal to the number of rows in the first result set.
28 . The method of claim 1 wherein the first result set and the second result set each comprises a plurality of rows and columns, wherein data in a column in the second result set is masked while data in a corresponding column in the first result set is not masked.