Secure invocation of stored procedures in database management systems

A method for secure invocation of stored procedures, comprising:

• receiving, by a processor coupled to a memory, a request for performing a computational task from a client application, the request being a request of a first DB-user of a first DBMS;
• identifying, by the processor, in response to receiving the request for performing the computational task, one or more of a plurality of first tables to act as input or output tables for a first stored procedure;
• determining, by the processor, for each of the one or more of the plurality of first tables, if the first DB-user has read or write permissions for said one or more of the plurality of first tables for generating privilege information of the first DB-user;
• granting, by the processor, user privileges to a second DB-user with respect to respective ones of second tables mapped by a synchronization mapping to at least a portion of the plurality of first tables, the user privileges being granted in accordance with the privilege information of the first DB-user;
• and
• executing, by the processor, the at least one second stored procedure to prohibit access to any one of the second tables for which a second DB-user lacks privileges,
• wherein the processor is configured to:
• install a describe stored procedure in the second DBMS, the describe stored procedure being a non-trusted stored procedure;
• in response to receiving a request by the first DBMS, create a third DB-user in the second DBMS or using an existing DB-user as the third DB-user by withdrawing all permissions for accessing any one of the first tables from said existing DB-user, the third DB-user not having access to any one of the second tables:
• call the describe stored procedure to provide parameter values of the request as input for the describe stored procedure;
• parse, via the describe stored procedure, the provided parameter values;
• output a list of the identified first table names and corresponding roles as an input or output table in a generic syntax.

A computer program product, the computer program product comprising a computer readable storage medium having program instructions for secure invocation of stored procedures embodied therewith, the program instructions executable by a processor to cause the processor to perform:

• receiving a request for performing a computational task from a client application, the request being a request of a first DB-user of a first DBMS;
• identifying in response to receiving the request for performing the computational task, one or more of a plurality of first tables to act as input or output tables for a first stored procedure;
• determining for each of the one or more of the plurality of first tables, if the first DB-user has read or write permissions for said one or more of the plurality of first tables for generating privilege information of the first DB-user;
• granting, user privileges to a second DB-user with respect to respective ones of second tables mapped by a synchronization mapping to at least a portion of the plurality of first tables, the user privileges being granted in accordance with the privilege information of the first DB-user;
• and
• executing the at least one second stored procedure to prohibit access to any one of the second tables for which a second DB-user lacks privileges,
• wherein the processor is configured to:
• install a describe stored procedure in the second DBMS, the describe stored procedure being a non-trusted stored procedure;
• in response to receiving a request by the first DBMS, create a third DB-user in the second DBMS or using an existing DB-user as the third DB-user by withdrawing all permissions for accessing any one of the first tables from said existing DB-user, the third DB-user not having access to any one of the second tables;
• call the describe stored procedure to provide parameter values of the request as input for the describe stored procedure;
• parse, via the describe stored procedure, the provided parameter values;
• output a list of the identified first table names and corresponding roles as an input or output table in a generic syntax.