Consistent data masking

Patent metadata

Field	Value
Publication number	US-9621680-B2
Application number	US-201314058556-A
Country	US
Kind code	B2
Filing date	Oct 21, 2013
Priority date	Oct 21, 2013
Publication date	Apr 11, 2017
Grant date	Apr 11, 2017

Abstract

According to one embodiment of the present invention, a system masks data objects across a plurality of different data resources. The system comprises a processor configured to include a plurality of service providers to mask the data objects, wherein each service provider corresponds to a different type of data masking for the data objects. An interface provides access to the plurality of service providers from different data-consumers to mask the data objects according to the corresponding types of data masking, wherein resulting masked data maintains relational integrity across the different data resources. Embodiments of the present invention further include a method and computer program product for masking data objects across a plurality of different data resources in substantially the same manners described above.

First claim

What is claimed is:

1. A system for masking data objects across a plurality of different data resources comprising:
a masking module having a public application programming interface (API), a service manager, a service provider API, and a plurality of masking service providers;

an application making an initial call to the masking module via the public API for applying masking to data extracted from a data source, the public API supporting a masking provider grammar that allows various computer languages to gain access to services provided by the masking module; the masking module is initialized to provide data masking services to any of said plurality of service providers to mask the data objects residing on said masking module, wherein each service provider corresponds to a different type of data masking for the data objects, whereby the public API provides access to the plurality of service providers from different data-consumers to mask the data objects according to the corresponding types of data masking such that resulting masked data maintains relational integrity across the different data resources; and
a data structure prepared by said application that identifies a specific one of said plurality of masking service providers along with control parameters to drive execution of said specific one of said plurality of masking service providers;
a token identifier that has been passed from the masking module to the application identifying said specific one of said plurality of masking service providers;
one or more input buffers for the data to be masked along with said token identifier input from the application to the masking module;
at least one processor of the masking module configured to:
receive a request via the public API from a data-consumer to access to a selected one of the services providers;
receive data via the public API from the data-consumer for masking by the selected service provider, said data including said token identifier and said one or more input buffers;
interprete said token identifier and said one or more input buffers at the masking module to mask the received data using the selected service provider;
return the masked data to the data-consumer via the public API; and
determine whether additional data remains to be masked, and if so, masking said additional data.

2. The system of claim 1 , wherein the data-consumers include at least one of user generated applications and user defined functions.

3. The system of claim 1 , wherein the request received via the public API includes a data structure identifying the selected service provider and control parameters for the selected service provider.

4. The system of claim 1 , wherein the at least one processor is further configured to add a new service provider performing a corresponding type of data masking to the plurality of service providers and provide access to the new service provider via the interface, wherein the new service provider comprises a new software module.

5. A computer program product for masking data objects across a plurality of different data resources comprising:
a computer readable storage medium having computer readable program code embodied therewith for execution on a processing system, the computer readable program code comprising computer readable program code configured to:
provide a masking module having a public application programming interface (API), a service manager, a service provider API, and a plurality of masking service providers;
provide an application making an initial call to the masking module via the public API for applying masking to data extracted from a data source, the public API supporting a masking provider grammar that allows various computer languages to gain access to services provided by the masking module;
the masking module is initialized to provide data masking services to any of said a plurality of service providers to mask the data objects residing on said masking module, wherein each service provider corresponds to a different type of data masking for the data objects, whereby the public API provides provide access to the plurality of service providers from different data-consumers to mask the data objects according to the corresponding types of data masking, wherein resulting masked data maintains relational integrity across the different data resources; provide a data structure prepared by said application that identifies a specific one of said plurality of masking service providers along with control parameters to drive execution of said specific one of said plurality of masking service providers;
provide a token identifier that has been passed from the masking module to the application identifying said specific one of said plurality of masking service providers;
provide one or more input buffers for the data to be masked along with said token identifier input from the application to the masking module;
receive a request via the public API from a data-consumer to access to a selected one of the services providers;
receive data via the public API from the data-consumer for masking by the selected service provider, said data including said token identifier and said one or more input buffers;
interprete said token identifier and said one or more input buffers at the masking module to mask the received data using the selected service provider;
return the masked data to the data-consumer via the public API; and
determine whether additional data remains to be masked, and if so, masking said additional data.

6. The computer program product of claim 5 , wherein the data-consumers include at least one of user generated applications and user defined functions.

7. The computer program product of claim 5 , wherein the request received via the public API includes a data structure identifying the selected service provider and control parameters for the selected service provider.

8. The computer program product of claim 5 , wherein the computer readable program code is further configured to add a new service provider performing a corresponding type of data masking to the plurality of service providers and provide access to the new service provider via the interface, wherein the new service provider comprises a new software module.

9. The system of claim 1 , further including:
generating a token identifier at the masking module that identifies the specific one of said plurality of masking service providers;
transferring the token identifier from the masking module to the application;
in subsequent service calls, passing the token identifier from the application to the masking module to identify the specific one of said plurality of masking service providers and the initialized masking service provider instance from others of said plurality of masking service providers.

10. The system of claim 1 , wherein the public API is independent from the data source to support structured and unstructured data sources.

11. The system of claim 1 , wherein the masking module processes masking tasks as single task.

12. The system of claim 1 , wherein the masking module processes masking tasks in user-defined batches.

13. The system of claim 1 , further including a plurality of masking utilities of the masking module.

14. The system of claim 1 , wherein the extracted data includes input and output data structures represented as rows and column fields within the rows.

15. The system of claim 14 , wherein the extracted data further include standard data types selected from the group consisting of an integer, char, null terminated strings, date, and time.

16. The s

Assignees

• Globalfoundries Inc

Inventors

• D'Costa Noel H E
• Hagelund Peter
• Henderson David J
• Oakley Robert J
• Tandon Ritesh

Classifications

• G06F21/6254 Primary

  by anonymising data, e.g. decorrelating personal data from the owner's identification · CPC title

• G06F17/30557

  Physics · mapped topic

• G06F21/60

  Protecting data · CPC title

• G06F17/30

  Physics · mapped topic

• G06F17/30424

  Physics · mapped topic