Controlling access to protected information

A computer program product for controlling access to protected information stored in a database, the computer program product comprising:

• a machine readable storage device;
• and
• computer code stored on the machine readable storage device, with the computer code including instructions and data to cause a processor(s) set to perform operations including the following:
• identifying a set of databased records in a data table as master records, with each master record having an associated set of authorization rule(s),
• storing, in each database record of the database, one or more ownership data fields comprising owner identification information for identifying a master record associated with the database record,
• retrieving the database record of the database,
• analyzing the owner identification information of the one or more ownership data fields of the retrieved database record to identify the master record associated with the retrieved database record, with the identification of the master records in the database including:
• extending the Data Definition Language (DDL) to allow a database designer to define data ownership rules,
• extending the DDL language processor to allow the set of authorization rule(s) to be stored in the ownership meta-data table for the database, and
• extending the Data Base Management System to process the ownership meta-data table so as to identify the master records in the database;
• controlling access to the retrieved database record using the set of authorization rule(s) of the master record associated with the retrieved database record by:
• adding a capability to automatically attribute row-based permissions to the retrieved database record for a set of user(s) with permission to access the retrieved database record;
• and
• creating an ownership inheritance structure to graphically represent the data ownership rules, with the ownership inheritance structure being a tree structure that includes one root node and at least one leaf node;
• wherein:
• the root node of the tree structure represents the master record and the at least one leaf node represents an updated database record;
• and
• the at least one leaf node automatically inherits the row-based authorization rule(s) that are applied to the master record.

A computer system (CS) for controlling access to protected information stored in a database, the CS comprising:

• a processor(s) set;
• a machine readable storage device;
• and
• computer code stored on the machine readable storage device, with the computer code including instructions and data for causing the processor(s) set to perform operations including the following:
• identifying a set of databased records in a data table as master records, with each master record having an associated set of authorization rule(s),
• storing, in each database record of the database, one or more ownership data fields comprising owner identification information for identifying a master record associated with the database record,
• retrieving the database record of the database,
• analyzing the owner identification information of the one or more ownership data fields of the retrieved database record to identify the master record associated with the retrieved database record, with the identification of the master records in the database including:
• extending the Data Definition Language (DDL) to allow a database designer to define data ownership rules,
• extending the DDL language processor to allow the set of authorization rule(s) to be stored in the ownership meta-data table for the database, and
• extending the Data Base Management System to process the ownership meta-data table so as to identify the master records in the database,
• controlling access to the retrieved database record using the set of authorization rule(s) of the master record associated with the retrieved database record by:
• adding a capability to automatically attribute row-based permissions to the retrieved database record for a set of user(s) with permission to access the retrieved database record;
• and
• creating an ownership inheritance structure to graphically represent the data ownership rules, with the ownership inheritance structure being a tree structure that includes one root node and at least one leaf node;
• wherein:
• the root node of the tree structure represents the master record and the at least one leaf node represents an updated database record;
• and
• the at least one leaf node automatically inherits the row-based authorization rule(s) that are applied to the master record.