International Business Machines Corporation

James C Sun

Edward Gust Branish, Ii

Veerabhadra R Chinnam

George Richard Hughes, Jr

A mechanism is provided for secure data access in a data processing system. A database having two tables is provided. A subset of the tables' primary key attributes is considered sensitive. A first user is authorized to access the primary key's sensitive attribute in an unmasked format, while a second user is authorized to access same data in a masked format. Two security views are generated granting the second user access to the primary key's sensitive attribute values of both tables in the masked format. The masked format value is generated from an unmasked format value using a reversible function. A join operation between the two security views is performed by optimizing a query statement corresponding to the join operation.

Secure data access using SQL query rewrites

A mechanism is provided for secure data access in a parallel processing system. A database having two tables is provided. A subset of the tables' primary key attributes is considered sensitive. A first user is authorized to access the primary key's sensitive attribute in an unmasked format, while a second user is authorized to access same data in a masked format. Two security tables are generated having a plurality of entries mapping the values of the primary key attribute in the unmasked format to the values of the primary key attribute in the masked format. A security view is generated joining the two security tables. The security view grants the first user access to the values of the primary key's sensitive attribute in the unmasked format only and grants the second user access to the values of the primary key's sensitive attribute in the masked format only.

Growing community of inventors

Lewisville, TX, United States of America

James C Sun