Purging Compliance from Database
Backups by Encryption (pp149-168)
Nick Scope, Alexander
Rasin,
Ben Lenard, James Wagner, and Karen Heart
doi:
https://doi.org/10.26421/JDI3.1-4
Abstracts:
Data compliance laws
establish rules intended to protect privacy. These define both
retention durations (how long data must be kept) and purging
deadlines (when the data must be destroyed in storage). To comply
with the laws and to minimize liability, companies must destroy data
that must be purged or is no longer needed. However, database
backups generally cannot be edited to purge ``expired'' data and
erasing the entire backup is impractical. To maintain compliance,
data curators need a mechanism to support targeted destruction of
data in backups. In this paper, we present a cryptographic erasure
framework that can purge data from across database backups. We
demonstrate how different purge policies can be defined through
views and enforced without violating database constraints.
Key words: Purging
Compliance Databases Privacy Encryption