System and method for RDBMS to protect records in accordance with non-RDBMS access control rules

#The present invention relates to methods and systems for allowing applications to directly access a relational database while protecting records in the database.

#Information management systems (IMS) typically use a relational database management system (RDBMS) to manage data records in a database. As an example, an IMS might manage document data, with the desire that some documents can be read by all users but only written to by a few. Many other high-level access rules can be enforced by the IMS. In any case, when a user wants to access the records of a document in the RDBMS, the user is routed through the IMS to first check for access control.

#The documents themselves are broken down into records of various formats by the IMS and the records are stored in tabular form in the RDBMS, which can efficiently manage the records for querying using a language known as SQL. Only the IMS knows the high level access control rules. User applications must access the RDBMS indirectly, through the IMS, to ensure integrity and protection of data.

#FIG. 1 is a block diagram of the present system;

#FIG. 2 is a schematic representation of the data structure of an access control list (ACL);

#FIG. 3 is a flow chart of the logic for generating a global RDBMS view embodying access control rules;

#Referring initially to FIG. 1, a system is shown, generally designated 10, that includes at least one user computer 12 having a software-implemented application 14 that generates queries. Input to the user computer 12 is via one or more input devices 16, and query results can be output on an output device 18. The input device 16 can be any suitable device, such as a keyboard, keypad, mouse, joystick, trackball, voice-recognition software, and so on. The output device 18 can be a monitor, a speaker, another computer or computer network, a printer, and so on.

#As shown in FIG. 1, the user computer 12 communicates with an information management system (IMS) 20 via an IMS communication path 22 using high-level application programming interfaces (API). The IMS 20 communicates with a relational database system (RDBMS) 24, such as the present assignee's DB2, that stores records of documents managed by the IMS 20, with the IMS 20 enforcing high level access control rules pertaining to the application 14 vis-a-vis the records of the RDBMS 24. Each IMS document consists of a root record, which is a row in a root table, and optionally some number of dependent records, which are rows in certain dependent tables. The way the system 10 achieves this enforcement, which is the subject of the present invention, enables the application 14 to issue queries and otherwise to communicate, via a direct communication path 26, directly with the RDBMS 24 using SQL (or other DBMS query language) without the direct communication path 26 going through the IMS 20 while nevertheless maintaining access control. One or both of the IMS 20 and RDBMS 24 can be hosted on a server computer 28, or each can have its own associated computer.

#As intended herein, either or both of the user computer 12/server computer 28 can be a server computer made by International Business Machines Corporation (IBM) of Armonk, N.Y. Other digital processors, however, may be used, such as personal computers, laptop computers, mainframe computers, palmtop computers, personal assistants, or any other suitable processing apparatus can be used.