Cell-level data access control using user-defined functions

• US 20030014394A1
• Filed: 03/22/2001
• Published: 01/16/2003
• Est. Priority Date: 03/22/2001
• Status: Abandoned Application

• Current Assignee: Hitachi America Limited (Hitachi, Ltd.)
• Original Assignee: Hitachi America Limited (Hitachi, Ltd.)
• Inventors: Fujiwara, Shinji, Kehrer, Michelle L., Lochowitz, James
• Application Number:
  US09/816,640
• Publication Number:
  US 20030014394A1
• Time in Patent Office: Days
• US Class Current: 707/3
• CPC Class Codes: G06F 16/284 Relational databases
• CPC Class Codes: G06F 21/6227 where protection concerns the structure of data, e.g. records, types, queries

Abstract

Access control at the cell level is provided by the use of mask functions. Original queries are modified to contain mask functions for those cells which controlled access in accordance with an access policy is desired. In addition, filter functions are included to eliminate rows according to the access policy

Claims

1. A method for accessing information in an information store in accordance with an access policy, said method comprising:

receiving an access request comprising a request for a first type of information, wherein said request for a first type of information has associated therewith first information contained in said information store;

replacing said request for a first type of information with a modified request for a first type of information, said modified request being based on said access policy; and

accessing said information store to produce a result in response to said access request, wherein said modified request produces either a masked value or said first information, based on said access policy.

2. The method of claim 1 wherein said modified request includes a mask function.

3. The method of claim 2 wherein said accessing includes executing said mask function to produce either said masked value or said first information.

4. The method of claim 1 further including modifying said access request to include a filter function, said filter function effective for eliminating portions of said result in accordance with said access policy.

5. The method of claim 1 wherein said information store is a relational database and said request for a first type of information comprises a SELECT statement, said SELECT statement comprising one or more column references, said modified request comprising a replacement of at least one of said one or more column references with a mask function.

6. The method of claim 1 wherein said information store is a relational database and said access request includes a WHERE clause, said result comprising one or more rows of information, said method further including incorporating a filter function in said WHERE clause to remove certain rows contained in said result, based on said access policy.

7. In a relational database, a method for accessing information in accordance with an access policy, said method comprising:

providing at least one query comprising a SELECT statement, said SELECT statement comprising one or more column references;

replacing at least one of said one or more column references with a mask function to produce a modified query; and

producing a query result in response to said modified query comprising one or more rows of information;

wherein said query result includes, for said at least one of said one or more column references, either mask values or information from said relational database, based on said access policy.

8. The method of claim 7 wherein said at least one query further comprises a WHERE clause, said method further including modifying said WHERE clause to produce a modified WHERE clause which includes a filter function, said filter function producing one of two logical values, said modified WHERE clause effective for deleting a row from said query result based on a value produced by said filter function.

9. The method of claim 7 wherein said relational database in provided in a database server;

said step of providing includes receiving said at least one query at a client system; and

said step of producing includes transmitting said modified query to said database server.

10. The method of claim 9 wherein said step of replacing is performed at said client system.

11. The method of claim 9 wherein said step of replacing is performed at said database server.

13. The system of claim 12 further including fourth code configured to modify said access request to include a filter function, said filter function effective for eliminating portions of said result in accordance with said access policy.

14. The system of claim 12 further including a relational database and said request for a first type of information comprises a SELECT statement, said SELECT statement comprising one or more column references, said modified request comprising a replacement of at least one of said one or more column references with a mask function.

15. The system of claim 12 further including a relational database and said access request includes a WHERE clause, said result comprising one or more rows of information, said second code further configured to incorporate a filter function in said WHERE clause to remove certain rows contained in said result, based on said access policy.

16. The system of claim 12 further including a client computer system and a server computer system, said client computer system comprising a portion of said computer memory embodying said first and second codes, said server computer system comprising another portion of said computer memory embodying said third code.

17. The system of claim 12 wherein said database server is a relational database server, said request for a first type of information comprises a SELECT statement, said SELECT statement comprising one or more column references, said modified request comprising a replacement of at least one of said one or more column references with a mask function.

18. The system of claim 17 wherein said third code includes mask function.

19. The system of claim 16 wherein said database server is a relational database server, said access request includes a WHERE clause, said result comprising one or more rows of information, said second code further configured to incorporate a filter function in said WHERE clause to remove certain rows contained in said result, based on said access policy.

20. The system of claim 19 wherein said third code includes mask function.

12. A computer-based information retrieval system comprising:

computer memory having computer readable program code embodied therein for accessing an information store in accordance with an access policy, said computer readable program code comprising;

first code configured to receive an access request for a first type of information, wherein said request for a first type of information has associated therewith first information;

second code configured to replace said request for a first type of information with a modified request for a first type of information, said modified request being based on said access policy; and

third code configured to access said information store to produce a result in response to said access request, wherein said modified request produces either a masked value or said first information, based on said access policy.