Event-based database access execution

• US 20040117371A1
• Filed: 12/16/2002
• Published: 06/17/2004
• Est. Priority Date: 12/16/2002
• Status: Active Grant

• Current Assignee: LinkedIn Corporation (Microsoft Corporation)
• Original Assignee: International Business Machines Corporation
• Inventors: Mohania, Mukesh Kumar, Bhide, Manish Anand
• Granted Patent: US 7,120,635 B2
• Time in Patent Office: Days
• US Class Current: 707/9
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: G06F 2216/03 Data mining
• CPC Class Codes: G06F 2221/2101 Auditing as a secondary aspect
• CPC Class Codes: G06F 2221/2145 Inheriting rights or properties, e.g., propagation of permissions or restrictions within a hierarchy
• CPC Class Codes: Y10S 707/99932 Access augmentation or optimizing
• CPC Class Codes: Y10S 707/99936 Pattern matching access
• CPC Class Codes: Y10S 707/99939 Privileged access
• CPC Class Codes: Y10S 707/99942 Manipulating data structure, e.g. compression, compaction, compilation

Abstract

An authorisation privilege for an access request is inferred when no explicit privilege exists. The inference can be performed by way of mining occurrence patterns or derived from user hierarchy, profile, click history, transaction history or role. For any access request, the respective explicit privilege or inferred privilege is verified by the database or security administrator before the access request is permitted. Conditions expressed in an access policy are evaluated on the occurrence of predefined events. The events extend beyond user access requests, and include external events, composite events and access of a referential type. The access policy is framed in ‘event, condition, access enforcement’ terminology. The access control rules can be parameterised and can be instantiated by data obtained from inference rules associated with the conditions of the policy. The conditions have an evaluation component and an inference component. The access privileges supported are: read, write and indirect read. An indirect read operation typically allows a user qualified access to one or more portions of a database, but not the entire database.

Claims

1. A method of executing event-based database access requests comprising:

receiving a database access request;

determining whether said request includes an explicit authorisation privilege;

inferring an authorisation privilege in the case where there is no said authorisation privilege; and

executing said access request.

2. The method of claim 1, wherein said step of inferring an authorisation privilege includes algorithmically mining occurrence patterns from existing user records.

3. The method of claim 1, wherein the step of inferring an authorisation privilege includes a derivation from data associated with said requesting user.

4. The method of claim 3, wherein said requesting user data includes data selected from the group of:

place in a hierarchy, profile, click history, transaction history, and role.

5. The method of claim 1, wherein said step of inferring an authorisation privilege is performed within an access control policy comprising a set of events, and for each event, one or more condition evaluations and associated inference rules, and access enforcement actions.

6. The method of claim 5, wherein said access enforcement actions are parameterised.

7. The method of claim 1, further comprising:

verifying an inferred authorisation privilege before executing said access request.

8. A method of executing event-based database access requests within an access control policy having a set of events, and for each event, one or more condition evaluations and associated inference rules, and access enforcement actions, the method comprising:

receiving a database access request;

assessing which event applies;

for the applicable event, evaluating said conditions against said request;

determining whether said request includes a explicit authorisation privilege, and inferring an authorisation privilege in the case where there is none; and

executing a relevant said enforcement action.

9. The method of claim 8, wherein said step of inferring an authorisation privilege includes algorithmically mining occurrence patterns from existing user records.

10. The method of claim 8, wherein the step of inferring an authorisation privilege includes a derivation from data associated with said requesting user.

11. The method of claim 10, wherein said requesting user data includes data selected from the group of:

place in a hierarchy, profile, click history, transaction history, and role.

12. The method of claim 8, further comprising verifying an inferred authorisation privilege before executing said relevant enforcement action.

13. The method of claim 8, wherein said events include external events, composite events and referential events.

14. A database system having event-based access, the system comprising:

a user input interface by which user access requests are received;

a database; and

a processor controlling execution of user access requests to said database, and wherein, in response to a said access request, said processor determines whether said request includes an explicit authorisation privilege, infers an authorisation privilege in the case where there is none, and executes said access request.

15. The database system of claim 14, wherein said processor infers an authorisation privilege by algorithmically mining occurrence patterns from existing user records.

16. The database system of claim 15, wherein the processor infers an authorisation privilege derived from data associated with said requesting user.

17. The database system of claim 16, wherein the processor operates on data selected from the group of:

place in a hierarchy, profile, click history, transaction history, and role.

18. The database system of claim 14, further comprising a database administrator that verifies an inferred authorisation privilege before said processor executes said access request.

19. A database system having event-based access within an access control policy having a set of events, and for each event, one or more condition evaluations and associated inference rules, and access enforcement actions, comprising:

a user input interface by which user access requests are received;

a database; and

a processor controlling execution of user access requests to said database, and wherein, in response to an access request, the processor assesses which event applies, and for the applicable event, evaluates said conditions against said request, determines whether said request includes a explicit authorisation privilege, infers an authorisation privilege in the case where there is none, and executes a relevant said enforcement action.

20. The database system of claim 19, wherein said processor infers an authorisation privilege by algorithmically mining occurrence patterns from existing user records.

21. The database system of claim 19, wherein the processor infers an authorisation privilege derived from data associated with said requesting user.

22. The database system of claim 21, wherein the processor operates on data selected from the group of:

place in a hierarchy, profile, click history, transaction history, and role.

23. The database system of claim 19, further comprising a database administrator that verifies an inferred authorisation privilege before said processor executes said access request.

24. The database system of claim 19, wherein said events include external events, composite events and referential events.

25. Computer software for execution of event-based database requests, recorded on a medium and able to be executed by a computer system capable of interpreting the computer software, the computer software comprising:

software code means for receiving a database access request;

software code means for determining whether said request includes an explicit authorisation privilege, and for inferring an authorisation privilege in the case where there is none; and

software code means for executing said access request.

26. The computer software of claim 25, wherein the code means for inferring an authorisation privilege performs an algorithmically mining of occurrence patterns from existing user records.

27. The computer software of claim 25, wherein the code means for inferring an authorisation privilege performs a derivation from data associated with said requesting user.

28. The computer software of claim 27, wherein said requesting user data includes data selected from the group of:

place in a hierarchy, profile, click history, transaction history, and role.

29. The computer software of claim 25, further comprising software code means for verifying an inferred authorisation privilege before executing said access request.

30. Computer software for executing event-based database access requests within an access control policy having a set of events, and for each event, one or more condition evaluations and associated inference rules, and access enforcement actions, the software comprising:

software code means for receiving a database access request;

software code means for assessing which event applies, and for the applicable event, to evaluate said conditions against said request;

software code means for determining whether said request includes a explicit authorisation privilege and inferring an authorisation privilege in the case where there is none; and

software code means for executing a relevant said enforcement action.

31. The software of claim 30, wherein said code means for inferring an authorisation privilege performs an algorithmically mining of occurrence patterns from existing user records.

32. The software of claim 30, wherein the code means for inferring an authorisation privilege performs a derivation from data associated with said requesting user.

33. The software of claim 32, wherein said requesting user data includes data selected from the group of:

place in a hierarchy, profile, click history, transaction history, and role.

34. The software of claim 30, further comprising software code means for verifying an inferred authorisation privilege before executing said relevant enforcement action.

35. The software of claim 30, wherein said events include external events, composite events and referential events.