Techniques for managing resources for multiple exclusive groups

• US 6,606,627 B1
• Filed: 08/27/2001
• Issued: 08/12/2003
• Est. Priority Date: 05/08/2001
• Status: Active Grant

• Current Assignee: Oracle International Corporation (Oracle Corporation)
• Original Assignee: Oracle Corporation
• Inventors: Andersen, Jesper, McMahon, Douglas James, Guthrie, Christine Pae
• Primary Examiner(s): Mizrahi, Diane D.
• Assistant Examiner(s): Wu, Yicun
• Application Number:
  US09/940,870
• Time in Patent Office: 715 Days
• Field of Search: 709/202, 709/203, 707/1, 707/5, 707/9, 707/10, 707/100, 340/5.54, 235/382
• US Class Current: 1/1
• CPC Class Codes: G06F 16/24547 Optimisations to support specific applications; Extensibility of optimisers
• CPC Class Codes: G06F 21/6227 where protection concerns the structure of data, e.g. records, types, queries
• CPC Class Codes: Y10S 707/99935 Query augmenting and refining, e.g. inexact access
• CPC Class Codes: Y10S 707/99939 Privileged access

Abstract

Techniques for allowing an application designed to store data for one group of users to store data for a plurality of groups of users include modifying the application to cause the application to indicate a routine to a database server that stores data for the application in a database. The routine provides modifications to queries of the database, which limit access based on the groups to which belong users that cause the queries to be submitted. In response to receiving a query involving the database and caused by a particular user, the database server locates the routine, and, prior to executing the query, modifies the query. Modifying the query includes invoking the routine. The modification to the query thereby limits access of the particular user to data that is associated with the group of users to which the particular user belongs.

Claims

1. A method for allowing an application designed to store data for one group of users to store data for a plurality of groups of users, the method comprising the steps of:

modifying the application to cause the application to indicate a routine to a database server that stores data for the application in a database;

wherein;

the application is distinct from the database server;

the routine provides modifications to queries of the database, the modifications limiting access based on the groups to which belong users that cause the queries to be submitted; and

in response to receiving a query issued against a database object of the database caused by a particular user, the database server performs the steps of locating the routine, and

prior to executing the query, modifying the query by invoking the routine to create a modified query issued against the same database object, thereby limiting access of the particular user to data that is associated with the group of users to which the particular user belongs.

2. The method of claim 1, wherein:

each user constitutes a distinct group; and

the routine provides modifications to queries based on a unique identity of the user that causes the queries to be submitted.

3. The method of claim 1, wherein:

before said step of modifying the application, the application is substantially specified by a first set of instructions; and

said step of modifying the application does not include modifying the first set of instructions.

4. The method of claim 1, said step of modifying the application comprising adding to the application instructions that call a database server routine with a parameter of the database server routine having a value of a reference to the routine.

5. The method of claim 1, wherein:

the particular user operates a client process that communicates with the application over a network;

the database server receives session data describing communication with the client process over the network; and

the routine further performs the steps of

determining the particular user based on the session data, and

determining the group to which the particular user belongs based on the particular user.

6. The method of claim 5, wherein the session data is based on data stored by an operating system in a secure socket layer.

7. The method of claim 1, said step of indicating the routine further comprising the step of invoking a first procedure of the database server, said step of invoking including passing as a parameter of the first procedure a reference to the routine.

8. The method of claim 7, said step of invoking the first procedure further comprising passing as a parameter of the first procedure data indicating a database object associated with the routine.

9. The method of claim 7, said step of invoking the first procedure further comprising passing as a parameter of the first procedure data indicating a query type associated with the routine.

10. The method of claim 1, further comprising:

providing instructions for the routine in a file, which instructions cause a predicate to be returned to a calling routine, the predicate for adding to the queries; and

said step of modifying the application comprises indicating a reference for the file to indicate the routine to the database server.

11. The method of claim 1, said step of modifying the application further comprises indicating a database server routine that limits access based on an enterprise to which the user belongs.

12. The method of claim 1, wherein:

the routine limits access based on an unique group identification for each group of the plurality of groups; and

the database includes database objects that associate all users of each group with the unique group identification of the group.

13. A method for allowing an application designed to store data for one group of users to store data for a plurality of groups of users, the method comprising the steps of:

modifying the application to cause the application to indicate data segregation criteria to a database server that stores data for the application; and

in response to receiving a query that inserts one or more data items into a database object of the database from the application, submitted by a particular user, the database server performs the step of automatically adding to each data item inserted into the same database object one or more values that indicate how the particular user satisfies the segregation criteria,

wherein the application is distinct from the database server.

14. The method of claim 13, wherein, in response to receiving from the application a query submitted for the particular user, which query does not insert a data item into the database but requests access to certain data items in the database, the database server performs the step of determining that the particular user satisfies the segregation criteria for each data item accessed.

15. The method of claim 13, wherein:

before said step of modifying the application, the application is substantially specified by a first set of instruction; and

said step of modifying the application does not include modifying the first set of instructions.

16. The method of claim 13, said step of modifying the application comprising adding a set of one or more additional instructions to indicate the data segregation criteria to the database server.

17. The method of claim 13, wherein:

the particular user operates a client process that communicates with the application over a network; and

the database server determines the particular user based on session data describing communication with the client process over the network.

18. The method of claim 17, wherein the session data is based on data stored by an operating system in a secure socket layer.

19. The method of claim 13, said step of modifying the application to indicate the data segregation criteria comprising:

indicating a segregation attribute; and

indicating a routine for setting a value for the segregation attribute for the particular user.

20. The method of claim 13, wherein:

the application uses a plurality of tables to store data for the plurality of groups of users; and

the method further comprises causing the database server to add a column to each table of the plurality of tables, the column for storing one or more values that indicate how a user satisfies the segregation criteria.

21. A computer-readable medium carrying one or more sequences of instructions for allowing an application designed to store data for one group of users to store data for a plurality of groups of users, wherein execution of the one or more sequences of instructions by one or more processors causes the one or more processors to perform the steps of:

modifying the application to cause the application to indicate a routine to a database server that stores data for the application in a database;

wherein;

the application is distinct from the database server;

the routine provides modifications to queries of the database, the modifications limiting access based on the groups to which belong users that cause the queries to be submitted; and

in response to receiving a query issued against a database object of the database caused by a particular user, the database server performs the steps of locating the routine, and

prior to executing the query, modifying the query by invoking the routine to create a modified query issued against the same database object, thereby limiting access of the particular user to data that is associated with the group of users to which the particular user belongs.

22. The computer-readable medium of claim 21, wherein:

each user constitutes a distinct group; and

the routine provides modifications to queries based on a unique identity of the user that causes the queries to be submitted.

23. The computer-readable medium of claim 21, wherein:

before said step of modifying the application, the application is substantially specified by a first set of instruction; and

said step of modifying the application does not include modifying the first set of instructions.

24. The computer-readable medium of claim 21, said step of modifying the application comprising adding to the application instructions that call a database server routine with a parameter of the database server routine having a value of a reference to the routine.

25. The computer-readable medium of claim 21, wherein:

the particular user operates a client process that communicates with the application over a network;

the database server receives session data describing communication with the client process over the network; and

the routine further performs the steps of

determining the particular user based on the session data, and

determining the group to which the particular user belongs based on the particular user.

26. The computer-readable medium of claim 25, wherein the session data is based on data stored by an operating system in a secure socket layer.

27. The computer-readable medium of claim 21, said step of indicating the routine further comprising the step of invoking a first procedure of the database server, said step of invoking including passing as a parameter of the first procedure a reference to the routine.

28. The computer-readable medium of claim 27, said step of invoking the first procedure further comprising passing as a parameter of the first procedure data indicating a database object associated with the routine.

29. The computer-readable medium of claim 27, said step of invoking the first procedure further comprising passing as a parameter of the first procedure data indicating a query type associated with the routine.

30. The computer-readable medium of claim 21, said step of modifying the application further comprises indicating a database server routine that limits access based on an enterprise to which the user belongs.

31. The computer-readable medium of claim 21, wherein:

the routine limits access based on an unique group identification for each group of the plurality of groups; and

the database includes database objects that associate all users of each group with the unique group identification of the group.

32. A computer-readable medium for allowing an application designed to store data for one group of users to store data for a plurality of groups of users, wherein execution of the one or more sequences of instructions by one or more processors causes the one or more processors to perform the steps of:

modifying the application to cause the application to indicate data segregation criteria to a database server that stores data for the application; and

in response to receiving a query that inserts one or more data items into a database object of the database from the application, submitted by a particular user, the database server performs the step of automatically adding to each data item inserted into the same database object_one or more values that indicate how the particular user satisfies the segregation criteria,

wherein the application is distinct from the database server.

33. The computer-readable medium of claim 32, wherein, in response to receiving from the application a query submitted for the particular user, which query does not insert a data item into the database but requests access to certain data items in the database, the database server performs the step of determining that the particular user satisfies the segregation criteria for each data item accessed.

34. The computer-readable medium of claim 32, wherein:

before said step of modifying the application, the application is substantially specified by a first set of instructions; and

said step of modifying the application does not include modifying the first set of instructions.

35. The computer-readable medium of claim 32, said step of modifying the application comprising adding a set of one or more additional instructions to indicate the data segregation criteria to the database server.

36. The computer-readable medium of claim 32, wherein:

the particular user operates a client process that communicates with the application over a network; and

the database server determines the particular user based on session data describing communication with the client process over the network.

37. The computer-readable medium of claim 36, wherein the session data is based on data stored by an operating system in a secure socket layer.

38. The computer-readable medium of claim 32, said step of modifying the application to indicate the data segregation criteria comprising:

indicating a segregation attribute; and

indicating a routine for setting a value for the segregation attribute for the particular user.

39. The computer-readable medium of claim 32, wherein:

the application uses a plurality of tables to store data for the plurality of groups of users; and

execution of the one or more sequences of instructions by the one or more processors further causes the one or more processors to perform the step of adding a column to each table of the plurality of tables, the column for storing one or more values that indicate how a user satisfies the segregation criteria.