Amazon Technologies, Inc.

Dmytro Bogatov

Gaurav Saxena

Kiran Kumar Chinta

Abhishek Sharma

Todd Jeffrey Green

James Claiborne Moore

Yanzhu Ji

Techniques for priority-based masking policy selection in a database environment are described. Masking policies are defined and attached to columns of relational data for particular users or roles. The attachment of a masking policy to a column includes a user-specified priority value. When multiple policies could apply to a particular query, the conflict can be easily resolved and understood by use of the priority values, for example, by selecting a candidate policy having a highest priority value.

Priority-based masking policy selection in a database environment

Techniques for dynamic database redaction using protected encryption secret material are described. A masking policy is defined that includes a reference to a secret material stored by a secrets manager service. The masking policy further identifies a pseudonymous redaction function that utilizes a cryptographic function requiring such a secret material. The secrets manager service is configured to grant access to the secret material by an entity of the database service that executes queries, such as a leader node of a cluster. For a particular query, the cluster obtains the secret material from the secrets manager service in a secure manner, uses the secret material for applying the cryptographic function to values for redaction purposes, and deletes any copies of secret material thereafter.

Dynamic database redaction using protected secret material

Growing community of inventors

Boston, MA, United States of America

Dmytro Bogatov