Access control for elements in a database object

• US 20070136291A1
• Filed: 12/12/2005
• Published: 06/14/2007
• Est. Priority Date: 12/12/2005
• Status: Active Grant

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Rjaibi, Walid, Bird, Paul
• Granted Patent: US 7,865,521 B2
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: G06F 21/6227 where protection concerns the structure of data, e.g. records, types, queries

Abstract

A method, computer program product, and system for controlling access to elements in a database object are provided. The method, computer program product, and system provide for receiving a request from a user to access the database object, determining whether an access restriction is imposed on the database object, and controlling access to the elements in the database object by the user based on the access restriction. The access restriction specifies one or more users to which the access restriction is applicable, defines a dynamic condition the one or more users must satisfy in order to access the database object, and identifies one or more of the elements in the database object accessible to the one or more users when the dynamic condition is satisfied.

Claims

1. A method of controlling access to elements in a database object, the method comprising:

receiving a request from a user to access the database object;

determining whether an access restriction is imposed on the database object, the access restriction specifying a first user group to which the access restriction is applicable, defining a first dynamic condition the first user group must satisfy in order to access the database object, and identifying a first element set in the database object accessible to the first user group when the first dynamic condition is satisfied; and

controlling access to the elements in the database object by the user based on the access restriction.

2. The method of claim 1, wherein the database object is a table or a view.

3. The method of claim 1, wherein at least one element in the first element set is a column.

4. The method of claim 1, wherein the first dynamic condition is a session context or a session purpose associated with a user in the first user group.

5. The method of claim 1, wherein controlling access to the elements in the database object comprises:

confirming whether the user is in the first user group when the access restriction is imposed on the database object;

verifying whether the user satisfies the first dynamic condition when the user is in the first user group; and

allowing the user to access the first element set when the user satisfies the first dynamic condition.

6. The method of claim 5, wherein verifying whether the user satisfies the first dynamic condition comprises:

obtaining one or more session variables associated with the user when the user is in the first user group; and

comparing the one or more session variables associated with the user to the first dynamic condition to determine whether the user satisfies the first dynamic condition.

7. The method of claim 5, wherein allowing the user to access the first element set comprises:

generating a dynamic pseudo-view of the database object comprising only the first element set when the user satisfies the first dynamic condition; and

responding to the request from the user using the dynamic pseudo-view of the database object.

8. The method of claim 1, wherein the access restriction further defines a second dynamic condition the first user group must alternatively satisfy in order to access the database object and further identifies a second element set in the database object accessible to the first user group when the second dynamic condition is satisfied.

9. The method of claim 8, wherein at least one element in the first element set is also an element in the second element set.

10. The method of claim 1, wherein the access restriction further defines an additional dynamic condition the first user group must satisfy in order to access the first element set.

11. The method of claim 1, further comprising:

determining whether another access restriction is imposed on the database object, the other access restriction specifying a second user group to which the other access restriction is applicable.

12. The method of claim 11, wherein the other access restriction further defines another dynamic condition the second user group must satisfy in order to access the database object and identifies another element set in the database object accessible to the second user group when the other dynamic condition is satisfied.

13. The method of claim 12, wherein the other element set is a subset of the first element set.

14. The method of claim 11, wherein at least one user in the first user group is also a user in the second user group.

15. The method of claim 1, further comprising:

deciding whether an exception to the access restriction is applicable to the user requesting access to the database object; and

permitting the user to access the elements in the database object when the exception to the access restriction is applicable to the user.

16. A system comprising:

a database operable to store a database object, the database object comprising elements; and

a server coupled to the database, the server being operable to;

receive a request from a user to access the database object;

determine whether an access restriction is imposed on the database object, the access restriction specifying a first user group to which the access restriction is applicable, defining a first dynamic condition the first user group must satisfy in order to access the database object, and identifying a first element set in the database object accessible to the first user group when the first dynamic condition is satisfied; and

control access to the elements in the database object by the user based on the access restriction.

17. The system of claim 16, wherein the database object is a table or a view.

18. The system of claim 16, wherein at least one element in the first element set is a column.

19. The system of claim 16, wherein the first dynamic condition is a session context or a session purpose associated with a user in the first user group.

20. The system of claim 16, wherein control access to the elements in the database object comprises:

confirm whether the user is in the first user group when the access restriction is imposed on the database object;

verify whether the user satisfies the first dynamic condition when the user is in the first user group; and

allow the user to access the first element set when the user satisfies the first dynamic condition.

21. The system of claim 20, wherein verify whether the user satisfies the first dynamic condition comprises:

obtain one or more session variables associated with the user when the user is in the first user group; and

compare the one or more session variables associated with the user to the first dynamic condition to determine whether the user satisfies the first dynamic condition.

22. The system of claim 20, wherein allow the user to access the first element set comprises:

generate a dynamic pseudo-view of the database object comprising only the first element set when the user satisfies the first dynamic condition; and

respond to the request from the user using the dynamic pseudo-view of the database object.

23. The system of claim 16, wherein the access restriction further defines a second dynamic condition the first user group must alternatively satisfy in order to access the database object and further identifies a second element set in the database object accessible to the first user group when the second dynamic condition is satisfied.

24. The system of claim 16, wherein the access restriction further defines an additional dynamic condition the first user group must satisfy in order to access the first element set.

25. The system of claim 16, wherein the server is further operable to:

decide whether an exception to the access restriction is applicable to the user requesting access to the database object; and

permit the user to access the elements in the database object when the exception to the access restriction is applicable to the user.

26. The system of claim 16, wherein the database is further operable to store the access restriction.

27. A computer program product comprising a computer readable medium, the computer readable medium including a computer readable program for controlling access to elements in a database object, wherein the computer readable program when executed on a computer causes the computer to:

receive a request from a user to access the database object;

determine whether an access restriction is imposed on the database object, the access restriction specifying a first user group to which the access restriction is applicable, defining a first dynamic condition the first user group must satisfy in order to access the database object, and identifying a first element set in the database object accessible to the first user group when the first dynamic condition is satisfied; and

control access to the elements in the database object by the user based on the access restriction.

28. The computer program product of claim 27, wherein the database object is a table or a view.

29. The computer program product of claim 27, wherein at least one element in the first element set is a column.

30. The computer program product of claim 27, wherein the first dynamic condition is a session context or a session purpose associated with a user in the first user group.

31. The computer program product of claim 27, wherein control access to the elements in the database object comprises:

confirm whether the user is in the first user group when the access restriction is imposed on the database object;

verify whether the user satisfies the first dynamic condition when the user is in the first user group; and

allow the user to access the first element set when the user satisfies the first dynamic condition.

32. The computer program product of claim 31, wherein verify whether the user satisfies the first dynamic condition comprises:

obtain one or more session variables associated with the user when the user is in the first user group; and

compare the one or more session variables associated with the user to the first dynamic condition to determine whether the user satisfies the first dynamic condition.

33. The computer program product of claim 31, wherein allow the user to access the first element set comprises:

generate a dynamic pseudo-view of the database object comprising only the first element set when the user satisfies the first dynamic condition; and

respond to the request from the user using the dynamic pseudo-view of the database object.

34. The computer program product of claim 27, wherein the access restriction further defines a second dynamic condition the first user group must alternatively satisfy in order to access the database object and further identifies a second element set in the database object accessible to the first user group when the second dynamic condition is satisfied.

35. The computer program product of claim 27, wherein the access restriction further defines an additional dynamic condition the first user group must satisfy in order to access the first element set.

36. The computer program product of claim 27, wherein the computer readable program when executed on the computer further causes the computer to:

decide whether an exception to the access restriction is applicable to the user requesting access to the database object; and

permit the user to access the elements in the database object when the exception to the access restriction is applicable to the user.

37. A method of controlling access to elements in a database object, the method comprising:

receiving a request from a user to access the database object; and

controlling access to the elements in the database object by the user based on an access restriction imposed on the database object, wherein the access restriction defines a dynamic condition that the user must satisfy in order to access the database object.

38. The method of claim 37, wherein the access restriction further identifies an element set in the database object accessible to the user when the user satisfies the dynamic condition.

39. The method of claim 38, wherein at least one element in the element set is a column.

40. The method of claim 37, wherein the dynamic condition is a session context or a session purpose associated with the user.