METHOD FOR IMPLEMENTING FINE-GRAINED ACCESS CONTROL USING ACCESS RESTRICTIONS

• US 20110208780A1
• Filed: 04/29/2011
• Published: 08/25/2011
• Est. Priority Date: 04/30/2004
• Status: Active Grant

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: BIRD, Paul Miller
• Granted Patent: US 8,775,470 B2
• Time in Patent Office: Days
• US Class Current: 707/784
• CPC Class Codes: G06F 16/24534 Query rewriting; Transformation
• CPC Class Codes: G06F 16/24539 using cached or materialised query results
• CPC Class Codes: G06F 16/90335 Query processing
• CPC Class Codes: G06F 21/6227 where protection concerns the structure of data, e.g. records, types, queries

Abstract

Disclosed is a data processing system-implemented method, a data processing system and an article of manufacture for controlling access to data stored on a database having relational objects for which access restrictions are defined for elements of the relational objects The data processing system-implemented method includes receiving a user request to access one or more relational objects of the database, identifying any access restrictions defined for the one or more relational objects, determining whether any identified access restrictions are applicable to the user request, determining whether any determined applicable access restrictions are to be enforced for the user request, and allowing access to the one or more relational objects based on the determined enforceable access restrictions.

Claims

1. A data processing method for controlling access to data stored on a database, the method comprising:

receiving and parsing a user request containing a reference to a relational object;

determining column and row access restrictions based on the user'"'"'s identity and the parsed request;

constructing a pseudo-view of the relational object based on the determined column and row access restrictions;

replacing the reference to the relational object in the request with the pseudo-view to create a modified request, and

compiling the modified request.

2. The data processing method of claim 1, wherein the request is an SQL statement.