Security descriptors for record access queries

A method comprising:

• determining, with one or more hardware processing devices, that one or more users are provided access to one or more records at a certain access level in a computing environment;
• maintaining, with the one or more hardware processing devices, a security descriptor structure storing one or more security descriptors each of which is associated with one or more security descriptor members, wherein each descriptor member comprises at least a record that has been shared with one or more users, groups of users, or both;
• determining, with the one or more hardware processing devices, whether the security descriptor structure in a share table of an entity includes the one or more users at the certain access level;
• modifying the entry to include the one or more records with the one or more hardware processing devices if an entry in a share table of an entity includes an existing security descriptor for the one or more users at the certain access level;
• and
• generating, with the one or more hardware processing devices, a new security descriptor and modifying the share table to include the new security descriptor if the share table does not include an existing security descriptor for the one or more users, groups, or both at the certain access level.

A non-transitory computer-readable storage medium having stored thereon data representing sequences of instructions that, when executed by one or more hardware processing devices, cause the one or more hardware processing devices to perform operations comprising:

• maintaining, with the one or more hardware processing devices, a security descriptor structure storing one or more security descriptors each of which is associated with one or more security descriptor members, wherein each descriptor member comprises at least a record that has been shared with one or more users, groups of users, or both;
• receiving, with the one or more hardware processing devices, a record access query regarding records for one or more users all at a certain access level;
• searching, with the one or more hardware processing devices, the security descriptor structure for security descriptors, each security descriptor being associated with a set of one or more users having access to one or more records of a set of records at the certain access level;
• identifying, with the one or more hardware processing devices, any security descriptors in the security descriptor structure that relate to the one or more users with at least the certain access level;
• and
• searching, with the one or more hardware processing devices, the one or more records associated with each of the identified security descriptors according to the record access query.

A non-transitory computer-readable storage medium having stored thereon data representing sequences of instructions that, when executed by a processor, cause the processor to perform operations comprising:

• determining, with the one or more hardware processing devices, that one or more users are provided access to one or more records at a certain access level in a computing environment;
• determining, with the one or more hardware processing devices, whether an entry in a share table of an entity includes an existing security descriptor in a share table of an entity includes the one or more users at the certain access level;
• modifying the entry to include the one or more records, with the one or more hardware processing devices, if an entry in a share table of an entity includes an existing security descriptor for the one or more users, groups, or both at the certain access level;
• and
• generating a new security descriptor and modifying the share table to include the new security descriptor, with the one or more hardware processing devices, if the share table does not include an existing security descriptor for the one or more users, groups, or both at the certain access level.