Consistent data masking

摘要

According to one embodiment of the present invention, a system masks data objects across a plurality of different data resources. The system comprises a processor configured to include a plurality of service providers to mask the data objects, wherein each service provider corresponds to a different type of data masking for the data objects. An interface provides access to the plurality of service providers from different data-consumers to mask the data objects according to the corresponding types of data masking, wherein resulting masked data maintains relational integrity across the different data resources. Embodiments of the present invention further include a method and computer program product for masking data objects across a plurality of different data resources in substantially the same manners described above.

主权项

1. A system for masking data objects across a plurality of different data resources comprising:
a masking module having a public application programming interface (API), a service manager, a service provider API, and a plurality of masking service providers;an application making an initial call to the masking module via the public API for applying masking to data extracted from a data source, the public API supporting a masking provider grammar that allows various computer languages to gain access to services provided by the masking module; the masking module is initialized to provide data masking services to any of said plurality of service providers to mask the data objects residing on said masking module, wherein each service provider corresponds to a different type of data masking for the data objects, whereby the public API provides access to the plurality of service providers from different data-consumers to mask the data objects according to the corresponding types of data masking such that resulting masked data maintains relational integrity across the different data resources; and
a data structure prepared by said application that identifies a specific one of said plurality of masking service providers along with control parameters to drive execution of said specific one of said plurality of masking service providers; a token identifier that has been passed from the masking module to the application identifying said specific one of said plurality of masking service providers; one or more input buffers for the data to be masked along with said token identifier input from the application to the masking module; at least one processor of the masking module configured to:
receive a request via the public API from a data-consumer to access to a selected one of the services providers;receive data via the public API from the data-consumer for masking by the selected service provider, said data including said token identifier and said one or more input buffers;interprete said token identifier and said one or more input buffers at the masking module to mask the received data using the selected service provider;return the masked data to the data-consumer via the public API; anddetermine whether additional data remains to be masked, and if so, masking said additional data.