Partitioned access control to a database

• US 6,578,037 B1
• Filed: 06/07/2000
• Issued: 06/10/2003
• Est. Priority Date: 10/05/1998
• Status: Expired due to Term

• Current Assignee: Oracle International Corporation (Oracle Corporation)
• Original Assignee: Oracle Corporation
• Inventors: Lei, Chon Hei, Wong, Daniel Manhung
• Primary Examiner(s): Mizrahi, Diane D.
• Assistant Examiner(s): Wu, Yicun
• Application Number:
  US09/589,602
• Time in Patent Office: 1,098 Days
• Field of Search: 709/202, 709/203, 707/1, 707/5, 707/9, 707/10, 707/100, 340/5.54, 235/382
• US Class Current: 707/694
• CPC Class Codes: G06F 16/24547 Optimisations to support specific applications; Extensibility of optimisers
• CPC Class Codes: G06F 16/24575 using context
• CPC Class Codes: G06F 21/6227 where protection concerns the structure of data, e.g. records, types, queries
• CPC Class Codes: G06F 2221/2141 Access rights, e.g. capability lists, access control lists, access tables, access matrices
• CPC Class Codes: Y10S 707/99939 Privileged access

Abstract

Described is a technique for controlling access to data in a database system. Groups of security policies are established for a database schema object, such as a table or a view. A security policy reflects access rules for accessing the database schema object. Access to the database schema object is restricted based on security policy groups selected for the user. The security policy groups are selected based on information associated with a user that is maintained or accessed by the database system. A default security policy is established and used to restrict access of users accessing the database schema object. The information associated with the user contains an attribute that identifies a policy group. The database management system uses the attribute to select policy groups that restrict the user'"'"'s access to the database scheme object. When the attribute does not identify any security policy group established for the database schema object, all security policies established for the database schema object are used to restrict access to the database schema object.

Claims

1. A method of controlling access to data in a database system, the method comprising the steps of:

establishing a plurality of security policy groups for a database schema object in said database system, wherein each security policy group of said plurality of security policy groups includes at least one policy, wherein said at least one policy is a rule that governs access to said database schema object;

selecting a first set of one or more security policy groups of said plurality of security policy groups for a first user based on first context information associated with said first user;

selecting a second set of one or more security policy groups of said plurality of security policy groups for a second user based on second context information associated with said second user;

wherein said second set of one or more security policy groups contains a security policy group that is not a member of said first set of one or more security policy groups;

receiving a query associated with said first user that requires data that resides in said database schema object, wherein said query does not specify any security policy group in said first set of one or more security policy groups and said second set of one or more policy groups;

restricting access of said query to said database schema object based on policies reflected in said first set of selected one or more security policy groups; and

restricting access of said second user to said database schema object based on policies reflected in said second set of selected one or more security policy groups.

2. The method of claim 1, wherein:

the step of establishing a plurality of security policy groups includes establishing a default security policy group; and

wherein the step of restricting access of said query includes restricting access of said query to said database schema object based on policies reflected in both said selected one or more security policy groups and said default security policy group.

3. The method of claim 1, wherein:

said first context information contains an attribute used to identify a particular security policy group; and

the step of selecting a first set of one or more security policy groups includes selecting one or more security policy groups based on said attribute.

4. The method of claim 3, wherein the step of selecting a first set of one or more security policy groups based on said attribute includes:

determining whether said attribute identifies any particular security policy group; and

if said attribute does not identify any particular security policy group, then selecting all of said plurality of security policy groups.

5. The method of claim 2, further including the step of setting said attribute using an attribute mechanism that selectively restricts access to attributes of said first context information.

6. The method of claim 5, wherein said attribute mechanism sets said attribute in response to messages from a client of the database system.

7. The method of claim 3, wherein:

the method further includes the step of generating metadata specifying that said attribute indicates said particular security policy for said database schema object; and

the step of selecting a first set of one or more security policy groups includes;

inspecting said metadata to determine that said attribute indicates a particular security policy for said database schema object, and

in response to determining that said attribute indicates a particular security policy for said database schema object, selecting one or more security policy groups based on said attribute.

8. The method of claim 1, wherein the step of restricting access of said query includes said database system rewriting said query to append one or more predicates to a query, said one or more predicates reflecting said policies.

9. The method of claim 1, wherein the step of establishing a plurality of security policy groups includes establishing a set of one or more policy functions that belong to said security policy groups.

10. The method of claim 9, wherein the step of restricting access of said query includes appending one or more predicates to a query, said one or more predicates reflecting said policies, wherein said one or more predicates are generated by one or more policy functions belonging to said selected one or more security policy groups.

11. The method of claim 1, further including the steps of:

selecting another one or more security policy groups of said plurality of security policy groups for another user based on context information associated with said other user;

restricting access of said other user to said database schema object based on policies reflected in said selected other one or more security policy groups; and

wherein said other one or more security policy groups and said first set of one or more security policy groups selected for said first user are not identical.

12. A computer-readable medium carrying one or more sequences of instructions for controlling access to data in a database system, wherein execution of the one or more sequences of instructions by one or more processors causes the one or more processors to perform the steps of:

establishing a plurality of security policy groups for a database schema object in said database system, wherein each security policy group of said plurality of security policy groups includes at least one policy, wherein said at least one policy is a rule that governs access to said database schema object;

selecting a first set of one or more security policy groups of said plurality of security policy groups for a first user based on first context information associated with said first user;

selecting a second set of one or more security policy groups of said plurality of security policy groups for a second user based on second context information associated with said second user;

wherein said second set of one or more security policy groups contains a security policy group that is not a member of said first set of one or more security policy groups;

receiving a query associated with said first user that requires data that resides in said database schema object, wherein said query does not specify any security policy group in said first set of one or more security policy groups and said second set of one or more policy groups;

restricting access of said query to said database schema object based on policies reflected in said first set of selected one or more security policy groups; and

restricting access of said second user to said database schema object based on policies reflected in said second set of selected one or more security policy groups.

13. The computer-readable medium of claim 12, wherein:

the step of establishing a plurality of security policy groups includes establishing a default security policy group; and

wherein the step of restricting access of said query includes restricting access of said query to said database schema object based on policies reflected in both said selected one or more security policy groups and said default security policy group.

14. The computer-readable medium of claim 12, wherein:

said first context information contains an attribute used to identify a particular security policy group; and

the step of selecting a first set of one or more security policy groups includes selecting one or more security policy groups based on said attribute.

15. The computer-readable medium of claim 14, wherein the step of selecting a first set of one or more security policy groups based on said attribute includes:

determining whether said attribute identifies any particular security policy group; and

if said attribute does not identify any particular security policy group, then selecting all of said plurality of security policy groups.

16. The computer-readable medium of claim 13, further including one or more sequences of instructions for performing the step of setting said attribute using an attribute mechanism that selectively restricts access to attributes of said first context information.

17. The computer-readable medium of claim 16, wherein said attribute mechanism sets said attribute in response to messages from a client of the database system.

18. The computer-readable medium of claim 14, wherein:

the computer-readable medium further includes one or more sequences of instructions for performing the step of generating metadata specifying that said attribute indicates said particular security policy for said database schema object; and

the step of selecting one or more security policy groups includes;

inspecting said metadata to determine that said attribute indicates a particular security policy for said database schema object, and

in response to determining that said attribute indicates a particular security policy for said database schema object, selecting one or more security policy groups based on said attribute.

19. The computer-readable medium of claim 12, wherein the step of restricting access of said query includes said database system rewriting said query to append one or more predicates to a query, said one or more predicates reflecting said policies.

20. The computer-readable medium of claim 12, wherein the step of establishing a plurality of security policy groups includes establishing a set of one or more policy functions that belong to said security policy groups.

21. The computer-readable medium of claim 20, wherein the step of restricting access of said query includes appending one or more predicates to a query, said one or more predicates reflecting said policies, wherein said one or more predicates are generated by one or more policy functions belonging to said selected one or more security policy groups.

22. The computer-readable medium of claim 12, further including one or more sequences of instructions for performing the steps of:

selecting another one or more security policy groups of said plurality of security policy groups for another user based on context information associated with said other user;

restricting access of said other user to said database schema object based on policies reflected in said selected other one or more security policy groups; and

wherein said other one or more security policy groups and said first set of one or more security policy groups selected for said first user are not identical.