Data access control method, data access control apparatus, and data access control program

A data access control apparatus comprising:

• a processor:
• a memory in communication with the processor, the memory storing instructions executable by the processor for causing the processor to perform operations comprising:
• receiving, by the processor, over a network from a client device associated with a user, a request for accessing first data stored in a first database associated with the computer;
• acquiring, by the processor, a rule for the request for accessing the first data stored in the first database, wherein, based on a preset access control policy, the rule defines which records included in the first data the user is authorized to access based on whether attribute information for a respective record in the first data indicates the user is authorized to access the record
• selecting, by the processor, whether to acquire attribute information about an attribute of a record of the first data from a second database outside of the first database in which the first data is stored, wherein the selecting includes referring to an attribute information management data structure that indicates a record in the second database that includes an entry containing the attribute information for the record of the first data that indicates whether the user is authorized to access the record of the first data based on the rule, the record in the second database being related to the record in the first data based on another entry in the record in the second database having a value that matches an entry in the record of the first data;
• acquiring, by the processor, the attribute information for the record of the first data when acquisition of the attribute information is selected for evaluating the rule, based on the attribute information acquired;
• causing, by the processor, the first database to execute the filtering when no acquisition of the attribute information is selected;
• and
• acquiring, by the processor, at least one record of the first data corresponding to the access request from the first database, based on an evaluation result of the rule or an execution result of the filtering in the first database, and sending the at least one record to the client device.

A non-transitory computer storage medium storing a data access control program executable by a computer for causing the computer to execute operations comprising:

• receiving, by the computer, over a network from a client device associated with a user, a request for accessing first data stored in a first database associated with the computer;
• acquiring, by the computer, a rule for the request for accessing the first data stored in the first database, wherein, based on a preset access control policy, the rule defines which records included in the first data the user is authorized to access based on whether attribute information for a respective record in the first data indicates the user is authorized to access the record;
• selecting, by the computer, whether to acquire attribute information about an attribute of a record of the first data from a second database outside of the first database in which the first data is stored, wherein the selecting includes referring to an attribute information management data structure that indicates a record in the second database that includes an entry containing the attribute information for the record of the first data that indicates whether the user is authorized to access the record of the first data based on the rule, the record in the second database being related to the record in the first data based on another entry in the record in the second database having a value that matches an entry in the record of the first data;
• when selecting acquisition of the attribute information, acquiring, by the computer, the attribute information and evaluating the rule based on the attribute information;
• when selecting no acquisition of the attribute information, instructing, by the computer, the first database to execute filtering of the first data based on the rule;
• and
• acquiring, by the computer, a record of the first data corresponding to the access request from the first database, based on an evaluation result of the rule or an execution result of the filtering, sending the at least one record to the client device.