Processing database statements for a relational database

A database system comprising:

• a database engine comprising a processor and a memory, wherein the database engine is arranged to receive database statements from a client device;
• at least one database in communication with the database engine, the at least one database comprising one or more database tables, each table comprising one or more data rows;
• wherein the processor and memory in the database engine are arranged, on receiving a database statement from the client device, to:
• determine a set of predicates from the database statement to use to generate the result of the database statement;
• determine a set of data rows from the one or more tables to use to generate the result of the database statement;
• obtain a set of interdiction statements, wherein each interdiction statement defines one or more types of database statements to which the interdiction statement applies and defines at least one column of a database table to which the interdiction statement applies, and wherein at least one interdiction statement in the set of interdiction statements defines fewer than all types of database statements;
• for each predicate of the set of predicates:
• obtain a set of masks applicable to one or more data rows of the set of data rows, wherein for each mask of the set of masks, at least a portion of the data used by the predicate is masked;
• determine whether a data row of the set of data rows has an applicable interdiction statement, by examining whether the data row contains a column and a type of database statement that are both defined in one of the interdiction statements in the set of interdiction statements;
• determine whether the data row contains data masked by a mask of the set of masks;
• and
• in the case that the data has an applicable interdiction statement, and contains data masked by a mask of the set of masks, determine the result of the database statement without using the result of applying the predicate to the data row;
• and
• return the determined result to the client device.

A computer program product for processing a database statement for a relational database, wherein the database comprises one or more tables, each table comprising one or more data rows, the computer program product comprising a computer-readable storage medium having computer-readable program code embodied therewith, the computer-readable program code configured to perform the steps of:

• receiving a database statement;
• determining a set of predicates from the database statement to use to generate the result of the database statement;
• determining a set of data rows from the one or more tables to use to generate the result of the database statement;
• obtaining a set of interdiction statements, wherein each interdiction statement defines one or more types of database statements to which the interdiction statement applies and defines at least one column of a database table to which the interdiction statement applies, and wherein at least one interdiction statement in the set of interdiction statements defines fewer than all types of database statements;
• for each predicate of the set of predicates:
• obtaining a set of masks applicable to one or more data rows of the set of data rows, wherein for each mask of the set of masks, at least a portion of the data used by the predicate is masked;
• determining whether a data row of the set of data rows has an applicable interdiction statement, by examining whether the data row contains a column and a type of database statement that are both defined in one of the interdiction statements in the set of interdiction statements;
• determining whether the data row contains data masked by a mask of the set of masks;
• and
• in the case that the data row has an applicable interdiction statement, and contains data masked by a mask of the set of masks, determining the result of the database statement without using the result of applying the predicate to the data row.

A database system comprising:

• a database engine arranged to receive database statements from a client device;
• at least one database in communication with the database engine, the at least one database comprising one or more database tables, each table comprising one or more data rows;
• wherein the database engine is arranged, on receiving a database statement from the client device, to:
• determine a set of predicates from the database statement to use to generate the result of the database statement;
• determine a set of data rows from the one or more tables to use to generate the result of the database statement;
• obtain a set of interdiction statements, wherein each interdiction statement defines one or more types of database statements to which the interdiction statement applies and defines at least one column of a database table to which the interdiction statement applies, and wherein at least one interdiction statement in the set of interdiction statements defines fewer than all types of database statements;
• for each predicate of the set of predicates:
• obtain a set of masks applicable to one or more data rows of the set of data rows, wherein for each mask of the set of masks, at least a portion of the data used by the predicate is masked;
• determine whether a data row of the set of data rows has an applicable interdiction statement, by examining whether the data row contains a column and a type of database statement that are both defined in one of the interdiction statements in the set of interdiction statements;
• determine whether the data row contains data masked by a mask of the set of masks;
• and
• in the case that the data row has an applicable interdiction statement, and contains data masked by a mask of the set of masks, determine the result of the database statement without using the result of applying the predicate to the data row;
• and
• return the determined result to the client device.