Auditing of sql queries using select triggers

A system for auditing data during execution of a SQL search query via a query execution plan to detect and report access to sensitive data, comprising:

• a computing device;
• and
• a computer program having program modules executable by the computing device, said program modules comprising,
• a database engine module,
• a SELECT trigger module, wherein the computing device is directed by the SELECT trigger module to receive a SELECT trigger which, specifies the sensitive data resident in a relational database that is to be monitored for access to by a query submitted to the database engine module and an action to be taken once the query process is completed if the sensitive data has been accessed.

A computer-readable storage medium having computer-executable instructions stored thereon for auditing data during execution of a SQL search query via a query execution plan to detect and report access to sensitive data, said computer-executable instructions comprising:

• prior to executing the query execution plan,
• inputting an audit expression which specifies what data corresponds to said sensitive data,
• generating one or more audit operators, each of said audit operators being capable of searching records generated by the query execution plan during its execution that flow between two different relational operators of the plan for said sensitive data that is accessed to create said records, and
• inserting each of the generated audit operators into the query execution plan between a different pair of relational operators so as to inspect records flowing between them;
• and
• during execution of the query execution plan, for each audit operator,
• whenever the audit operator detects that said sensitive data was accessed to create a record that flowed between the pair of relational operators associated therewith, the audit operator reports the sensitive data access to an accessed internal state associated with the SQL search query.