Database fine-grained access control
First Claim
1. A method for executing a query, the method comprising the steps of:
- a database server creating a modified query by adding one or more predicates to said query; and
in response to a request to execute the query, executing said modified query instead of said query.
0 Assignments
0 Petitions
Accused Products
Abstract
A method and mechanism are provided for accessing data. Values are stored for a set of context attributes associated with a session between a database user and a database server. The database system includes an attribute setting mechanism that selectively restricts access to the set of context attributes based on a policy. During the session, the database server executes a query that contains a reference to one or more of the context attributes. For example, the query may contain a predicate that requires a comparison between a context attribute value and a constant. The database server processes the query based on current values of the one or more of the context attributes referenced in the query. A mechanism is also provided for dynamically attaching predicates to queries, where the predicates are attached based on a policy. For example, the database system detects that a query is issued against a database object. Prior to executing the query, a policy function associated with the database object is invoked. The policy function creates a modified query by selectively adding zero or more predicates to the query based on a policy associated with the database object. The modified query is then executed.
-
Citations
34 Claims
-
1. A method for executing a query, the method comprising the steps of:
-
a database server creating a modified query by adding one or more predicates to said query; and
in response to a request to execute the query, executing said modified query instead of said query. - View Dependent Claims (2, 3, 4, 5, 6, 18, 19, 20, 21, 22, 23)
-
-
7. A method for executing a query, the method comprising the steps of:
-
a database server creating a modified query based on the query, wherein the modified query selects a subset of the data that is selected by said query; and
executing, within said database server, said modified query instead of said query. - View Dependent Claims (8, 9, 10, 11, 12, 13, 14, 15, 16, 17, 24, 25, 26, 27, 28, 29, 30, 31, 32, 33, 34)
-
Specification