US 7,599,937 B2Granted

Systems and methods for fine grained access control of data stored in relational databases

AssigneeMicrosoft Corporation

InventorsTanmoy Dutta, Conor Cunningham, Stefano Stefani, Girish Chander, Eric N. Hanson

Life of this patent

Estimating the term…

Loading patent…

Abstract

A system and method for facilitating secure access to database(s) is provided. The system relates to authorizing discriminatory access to relational database data. More particularly, the invention provides for an innovative technique of defining secured access to rows in relational database tables in a way that cannot be spoofed while preserving various optimization techniques. The invention affords a persistent scheme via providing for a security architecture whereby discriminatory access policies on persistent entities can be defined and enforced while preserving set based associative query capabilities. A particular aspect of the invention relates to the specification of such policies and the technique by which those policies are enforced. With respect to one particular implementation of the invention, creation, modification and deletion of access control lists called security descriptors is provided. The security descriptors can be provisioned independent of rows in tables of the database and can be shared and embody the policy on what permissions are granted to whom when associated with a row.

Claims12

Dependent claims

A system for facilitating a secure database, the system comprising:

a memory having stored therein computer executable components;
a first component that creates a table with a security descriptor column;
a second component that creates a security descriptor store associated with the table, wherein the security descriptor store comprises at least one security descriptor that includes access information, permission that identifies a kind of access associated with the at least one security descriptor, and one or more principals to whom the at least one security descriptor applies, wherein the one or more principals include at least one of one or more user names, one or more groups of users, one or more user identifiers, or one or more types of users;
a third component that populates at least one row of the table with a security descriptor identifier;
a fourth component that receives a query and user context information;
a fifth component that associates a row of the table with security information, wherein the table comprises at least one row and at least two columns, wherein one of the at least two columns stores a security descriptor associated with the row of the table, wherein the security descriptor associated with the row of the table identifies the security information stored in the security descriptor store, wherein the security descriptor associated with the row of the table is included in all access paths to the table, and wherein access paths to the table include at least one of following:
an access path to the table stored as an un-ordered collection;
an access path to a clustered index on the table;
an access path to a non-clustered index on the table;
or an access path to materialized views defined on the table;
a sixth database engine component that provides a response to the query, wherein the response comprises rows, if any, that satisfy the query, and wherein the security information associated with the row of the table is satisfied by the user context information;
a seventh query component that determines an optimal way to answer the query based on a cost-based optimization strategy, wherein the query is optimized prior to providing the response;
and
a processor that executes the computer executable components.

11 more elements

A computer-implemented method for facilitating a secure database, the method comprising:

creating a table with a security descriptor column;
storing the table in a memory utilizing a processor;
creating a security descriptor store associated with the table, wherein the security descriptor store comprises at least one security descriptor that includes access information, permission that identifies a kind of access associated with the at least one security descriptor, and one or more principals to whom the at least one security descriptor applies, wherein the one or more principals includes at least one of one or more user names, one or more groups of users, one or more user identifiers, or one or more types of users;
populating at least one row of the table with a security descriptor identifier;
receiving a query and user context information;
associating the at least one row of the table with security information, wherein the table comprises one or more rows and at least two columns, wherein one of the at least two columns stores a security descriptor associated with the at least one row of the table, wherein the security descriptor associated with the at least one row of the table identifies the security information stored in the security descriptor store, wherein the security descriptor associated with the at least one row of the table is included in all access paths to the table, and wherein an access path to the table includes at least one of following:
an access path to the table stored as an un-ordered collection;
an access path to a clustered index on the table;
an access path to a non-clustered index on the table;
or an access path to materialized views defined on the table;
providing a response to the query, wherein the response comprises rows, if any, that satisfy the query, and wherein the security information associated with the at least one row of the table is satisfied by the user context information;
and
providing a query optimizer that determines an optimal way to answer the query, wherein the query is optimized prior to providing the response, and wherein the query optimizer employs a cost-based optimization strategy.

10 more elements

Dependencies are inferred from the claim text.

Facts

Application: 11/696,024Filed 3 Apr 2007 · continuation
Priority: 28 Jun 2004
Published: US 2007/0174285 A126 Jul 2007
Granted: 6 Oct 2009
Term ends: Not estimatedThe source records don’t support an estimate.

Classification2 codes

G06F 21/6227
To a system of files or objects, e.g. local or distributed file system or database: where protection concerns the structure of data, e.g. records,…
G06F
Computing and data processing

Family

Application10/878,152Parent of this continuation · filed 28 Jun 2004
US 2007/0174285 A1Pre-grant publication · published 26 Jul 2007
US 7,200,595 B2Parent of this continuation
US 2005/0216465 A1Published application
US 7,599,937 B2This patent

From the US filing history. Foreign family members aren’t listed.