Identification, notification, and control of data access quantity and patterns

• US 7,885,976 B2
• Filed: 02/23/2007
• Issued: 02/08/2011
• Est. Priority Date: 02/23/2007
• Status: Expired due to Fees

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Bhattacharjee, Bishwaranjan, Dan, Asit
• Primary Examiner(s): Jalil; Neveen Abel
• Assistant Examiner(s): KINSAUL, DANIEL W
• Application Number:
  US11/678,167
• Publication Number:
  US 20080208866A1
• Time in Patent Office: 1,446 Days
• Field of Search: 707/9, 726 26- 30
• US Class Current: 707/787
• CPC Class Codes: G06F 16/217 Database tuning G06F16/2282 takes precedence; database performance monitoring G06F11/3409
• CPC Class Codes: G06F 21/554 involving event detection and direct action
• CPC Class Codes: G06F 21/6227 where protection concerns the structure of data, e.g. records, types, queries

Abstract

A device for limiting access to data in a database includes an input for receiving a request to access data in a database and a processor that is communicatively coupled to the input and allows access to the data in the database. A data counter for counting an instantaneous rate of data flow and/or a volume of data accessed and a comparator for determining if the data flow and/or the volume of data accessed in the database exceeds a previously specified value is also included, wherein the processor disallows access to the data in the database in response to the instantaneous rate and/or the volume of data exceeding the previously specified value.

Claims

1. A method for limiting access to data in a database, the method comprising:

receiving at least one new query for data from at least one user;

rewriting the at least one new query to form a rewritten query including a Fetch First n Rows Only (FFnRO) clause with a value n representing a number of rows to be returned from the rewritten query against data in the database

running the rewritten query against the data to return only results located in the number of rows specified by at least one of

a maximum instantaneous rate of a data flow, the value n set is based on one or more access rights associated with the user when accessing data in the database, and

a maximum cumulative volume of data associated with the user when accessing data in the database, the value of n is based on one or more access rights associated with the user, and a maximum cumulative volume value less any number of row previously fetched over a specified period of time.

2. The method according to claim 1, wherein the instantaneous rate is associated with a particular data type.

3. The method according to claim 1, further comprising:

sending a notification alert indicating that the specified value was exceeded.

4. The method according to claim 1, wherein the maximum volume of data is one of a total amount of data and cumulative amount of time over a specified period of time.

5. The method according to claim 4, wherein the cumulative amount of time is measured over different time periods.

6. The method according to claim 4, wherein the maximum volume of data is measured by at least one of a number of unique rows being accessed and number of unique items being accessed.

7. The method according to claim 1, wherein the specified value of at least one of the instantaneous rate of data flow and the volume of data accessed varies over time.

8. The method according to claim 1, wherein the instantaneous rate is one of a bit rate and a rate of accessing records.

9. The method according to claim 8, wherein the instantaneous rate is measured over different time periods.

10. The method according to claim 1, wherein the method is performed at query compilation level which is inside the database.

11. The method according to claim 1, further comprising:

sending a notification alert indicating that the-specified value is approaching.

12. A computer program product for limiting access to data in a database, the computer program product comprising:

a storage medium readable by a processing circuit and storing instructions for execution by the processing circuit for performing a method comprising;

receiving at least one new query for data from at least one user;

rewriting the at least one new query to form a rewritten query including a Fetch First n Rows Only (FFnRO) clause with a value n representing a number of rows to be returned from the rewritten query against data in the database

running the rewritten query against the data to return only results located in the number of rows specified by at least one of

a maximum instantaneous rate of a data flow, the value n set is based on one or more access rights associated with the user when accessing data in the database, and

a maximum cumulative volume of data associated with the user when accessing data in the database, the value of n is based on one or more access rights associated with the user, and a maximum cumulative volume value less any number of row previously fetched over a specified period of time.

13. The computer program product according to claim 12, further comprising:

sending a notification alert indicating that the specified value was exceeded.

14. The computer program product according to claim 12, wherein the maximum volume of data is one of a total amount of data and cumulative over a specified period of time.

15. The computer program product according to claim 12, wherein the specified value of at least one of the instantaneous rate of data flow and the volume of data accessed is time dependent.

16. The computer program product according to claim 12, wherein the instantaneous rate is one of a rate of accessing raw data and a rate of accessing records.

17. An information processing system for limiting access to data in a database, the information processing system comprising:

a memory; and

a processor, wherein the processor is configured to perform a method comprising;

receiving at least one new query for data from at least one user;

rewriting the at least one new query to form a rewritten query including a Fetch First n Rows Only (FFnRO) clause with a value n representing a number of rows to be returned from the rewritten query against data in the database running the rewritten query against the data to return only results located in the number of rows specified by at least one of

a maximum instantaneous rate of a data flow, the value n set is based on one or more access rights associated with the user when accessing data in the database, and

a maximum cumulative volume of data associated with the user when accessing data in the database, the value of n is based on one or more access rights associated with the user, and a maximum cumulative volume value less any number of row previously fetched over a specified period of time.

18. The system according to claim 17, wherein the method further comprises:

determining if the user is an authorized user based on a policy associated with the data requested from the query;

determining, in response to the user being an authorized user, that at least one of an instantaneous rate of a data flow and a volume of data accessed by the query in the database exceeds a specified value in the at least one query that has been rewritten; and

disallowing access to the data in the database in response to the at least one of an instantaneous rate and a volume of data exceeding the specified value.

19. The system according to claim 18, wherein the method further comprises:

sending a notification alert indicating that the-specified value is approaching.

20. The system according to claim 18, wherein the determining if the user is the authorized user based on the policy associated with the data requested from the query includes a policy containing at least three parts consisting of

an identification of who can access the data;

an identification of data that can be accessed; and

a maximum rate to which the data is accessible.