International Business Machines Corporation

Walid Rjaibi

Paul Miller Bird

Curt Lee Cotner

Peter Haas

Gerald George Kiernan

Timothy Jon Vincent

Yao-Ching Stephen Chen

James Willis Pickel

Stefan G Hild

Rene Pawlitzek

Markus Stolze

Gayathiri R Chandran

Adrian B Lobo

Irene C Liu

Scott Ian Logan

David Louis Kaminsky

Rakesh Agrawal

Guy Maring Lohman

Calisto Paul Zuzarte

Sam Sampson Lightstone

Youngja Park

Thomas Abel Beavin

Aankur Bhatia

John Frederick Hornibrook

Tyrone W A Grandison

Claire Willey McFeely

Regina J Liu

Irene Ching-Hua Liu

Dengfeng Gao

Gregory R Stager

Stephen Yao Ching Chen

David J Kuang

John E Lumby

Xun Li

Liyan Zhou

Allen William Luniewski

Joyce A Taylor

Jeffery Crume

George Gerald Kiernan

Eric L Alton

Zheng (Alex) Zhang

Harley W Boughton

Yuping Ding

Mechanisms are provided for automatically detecting data leakages and generating data leakage detection rules for a rules engine. The rules engine is configured with rules for identifying first sensitive data patterns in input data, and a large language model (LLM) is trained to identify second sensitive data patterns in input data. New input data is processed via the rules engine to determine whether it comprises any of the first sensitive data patterns. In response to the rules engine making a negative determination, the LLM is executed on the new input data to determine whether the new input data comprises any of the second sensitive data patterns. Responsive to a positive determination by the LLM, the rules engine is updated with a new rule based on the at least one second data pattern.

Data leakage protection using generative large language models

Access to a data element stored within a database object is controlled. A request is received from a user to perform an operation in relation to the database object, the operation including retrieval of information from the data element of the database object. Prior to retrieving information from the data element, a determination is made whether at least a portion of the information from the data element is subject to masking in accordance with an access policy. In response to determining that information from the data element is subject to masking, the request is modified to require that information from the data element be retrieved in a masked condition.

Masking sensitive data of table columns retrieved from a database

According to one embodiment of the present invention, a system processes a database query, and comprises a computer system including at least one processor. The system identifies one or more expressions within the database query utilizing a database object with value masking. Masking requirements are determined for each identified expression and the database object utilized by that identified expression is replicated to provide masked and actual versions of that database object in response to the masking requirements for that expression including masked values and actual values of that database object. The value masking of the database object is applied to the identified expressions within the database query based on the determined masking requirements to produce search results with masked values for the database query. Embodiments of the present invention further include a method and computer program product for processing a database query in substantially the same manner described above.

Query transformation for masking data within database objects

Disclosed is a data processing-implemented method, a data processing system, and an article of manufacture for modifying a query during compilation of the query. The query includes a request for an element of data from a table in a database and parameters identifying the requested element. The data processing-implemented method includes determining available information from parameters for locating a classification of the requested element and a classification associated with the query, the requested data classification controlling access to the requested element according to the query associated classification, requesting a suggested action from an external system for obtaining a comparison of the requested data classification and the query associated classification based on the available information, receiving the suggested action from the external system responsive to the sent request, and incorporating the suggested action into the query, the suggested action effecting comparison of the requested data classification with the query associated classification.

Method for modifying a query by use of an external system for managing assignment of user and data classifications

Provided are techniques for creating one or more fine-grained access control rules that are associated with a base table. A materialized query table is created from the base table without applying the one or more fine-grained access control rules associated with the base table when obtaining data from the base table. A fine-grained access control protection indicator is turned on for the materialized query table. In response to receiving a direct access request to the materialized query table in a query referencing the materialized query table, access is provided to the data in the materialized query table by applying one or more fine-grained access control rules associated directly with the materialized query table to the data in the materialized query table before returning the data.

Managing materialized query tables (MQTS) over fine-grained access control (FGAC) protected tables

A method and system for controlling access to data stored in a table of a database are provided. The method includes marking the table of the database as being protected with fine-grained access control (FGAC), creating a system authorization class for the table of the database, the system authorization class having a default row authorization that prevents access to all rows in the table, the system authorization class being unmodifiable, creating a user authorization class for the table of the database, the user authorization class having a default row authorization that prevents access to all rows in the table, the user authorization class being modifiable, and associating the system authorization class and the user authorization class with the table of the database.

Method and system for using fine-grained access control (FGAC) to control access to data in a database

A system, an article, and a computer program product for estimating a cardinality value for a set of data values. In one embodiment, the system includes means for initializing a data structure for representing an array of counts; means for obtaining a data value from said set of data values; means for transforming said data value into a transformed string; means for modifying said data structure with said transformed string; means for obtaining a summary statistic value from said modified data structure, wherein the summary statistic value is based on the array of counts; and means for generating said estimated cardinality value using said summary statistic value.

Incremental cardinality estimation for a set of data values

The present invention discloses a method, request detector, inference engine, and system for consolidating data from distributed databases into a central database. The method comprises the steps of receiving access information comprising request information to the distributed databases, analyzing the received access information, and aggregating into the central database the data content of the distributed databases in dependence on the analyzed access information.

System for consolidating data from distributed databases

A method for controlling access to an XML document includes referencing a schema definition comprising a path security label definition associated with a sibling-to-sibling path of an XML document. An XML document may then be validated by comparing it with the schema definition. This validation may include verifying that the XML document has a path security label associated with a sibling-to-sibling path that is at least as restrictive as that specified by the path security label definition. An access security label may be assigned to a user seeking to access the sibling-to-sibling path. The path security label and the access security label may then be compared, using pre-determined access rules, to determine whether the user is authorized to access the sibling-to-sibling path. Access to the sibling-to-sibling path may then be granted or denied according to the access rules.

Fine-grained, label-based, XML access control model

A method, for controlling access to elements in a database object are provided. The method provide for receiving a request from a user to access the database object, determining whether an access restriction is imposed on the database object, and controlling access to the elements in the database object by the user based on the access restriction. The access restriction specifies one or more users to which the access restriction is applicable, defines a dynamic condition the one or more users must satisfy in order to access the database object, and identifies one or more of the elements in the database object accessible to the one or more users when the dynamic condition is satisfied.

Access control for elements in a database object

A method, system and apparatus for data leak prevention. An information system, such as a database system, which has been configured for data leak protection in accordance with the present invention can include an IDS coupled to the information system and a data leak protection system configured to apply a data leak protection policy for result sets produced by the information system in response to a database query. The data leak protection policy can include a listing of data shapes and corresponding remedial measures. The data leak protection policy further can include consideration for metrics produced by the IDS.

Data leak protection system, method and apparatus

A system for establishing a connection between a data server and a middleware server is disclosed. The system includes defining a plurality of trust attributes corresponding to a trusted context between the middleware server and the data server and validating the plurality of trust attributes against a plurality of attributes corresponding to the middleware server. The plurality of attributes provided in a connection request. The system also includes establishing the trusted context based on the validating the plurality of trust attributes.

System for providing and utilizing a network trusted context

A data server of a data processing system is operably coupled to a database and in communication with a middleware server. A connection between the data server and the middleware server is established and managed. A set of attributes identifying trusted middleware servers is instituted with the data server. The middleware server transmits a connection request to the data server. The connection request has request attributes including identifying the connection request as being for a new connection or reuse of an existing connection with different connection request attributes. A connection with the middleware server is established by the data server based on the connection request. A connection status message is received by the middleware server from the data server indicating a status of the connection request. A trust indicator for the connection is established at the data server according to a trust status identified by the set of attributes for the middleware server.

Method for establishing a trusted relationship between a data server and a middleware server

A method that controls user access to the stored data elements using security label components is disclosed. Each stored data element is associated with a set of data security label components, and each user is associated with a set of user security label components. The method receives a user request to access the stored data elements, compares the set of user security label components to the set of data security label components associated with the users, and based on the comparison result, determines whether or not to permit access to the stored data.

Controlling data access using security label components

Growing community of inventors

Markham, Canada

Walid Rjaibi