# US 7,613,711 B2 · Specification of a hierarchical authorization model for a DBMS—SQL language extensions

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 7,613,711 B2
- Document ID: US7613711B2
- Status: Granted
- Kind: B2
- Application number: 11/151,998
- Filed: 2005-06-14
- Published: 2006-12-14
- Granted: 2009-11-03
- Earliest claimed: 2005-06-14
- Assignees: Microsoft Corporation
- Inventors: Tanmoy Dutta; Girish Chander; Ziquan Li; Steven Richard Gott; Clifford T. Dibble
- Web page: https://patentgrep.com/patent/US7613711B2

## CPC

- G06F 21/6227: {where protection concerns the structure of data, e.g. records, types, queries}
- G06F 16/2448: {for particular applications; for extensibility, e.g. user defined types}
- G06F 21/6218: {to a system of files or objects, e.g. local or distributed file system or database}
- G06F 2221/2145: Inheriting rights or properties, e.g., propagation of permissions or restrictions within a hierarchy
- Y10S 707/99939: Privileged access
- Y10S 707/99952: Coherency, e.g. same view to multiple users
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)
- Y10S: TECHNICAL SUBJECTS COVERED BY FORMER USPC CROSS-REFERENCE ART COLLECTIONS [XRACs] AND DIGESTS

## Abstract

Provided are systems and methods that facilitate providing permission to entities of a database. A system includes a component that authorizes a principal of a containing entity to grant a permission to that entity, and a component that grants the permission to the containing entity, the grantee of the permission inherits a set of permissions to one or more entities contained by the containing entity. When a permission is granted to a parent in a hierarchy of a relational database, the permission is inherited by the child nodes. Also provided is a method for transferring ownership of entities in a relational database. The method includes a two-part handshake that can be audited to avoid repudiation issues.

## Claims

### Claim 1

A database management system that facilitates providing permission to entities of a database, comprising:
a processor operatively coupled to a computer readable medium having stored thereon the following computer executable components:
a component for authorizing a principal of a containing entity of a database to dynamically grant a permission to that entity by providing extended syntax grammar of a database query language that accommodates a hierarchical permissions model;
a component for dynamically granting the permission to the containing entity, the grantee of the permission inherits a set of permissions to one or more entities contained by the containing entity;
a component for performing a two-step authentication and authorization handshake for a grantee to transfer permission for an entity to a principal without a repudiation issue by authenticating a principal with an entity, receiving a call from the principal to relinquish ownership of the entity, and determining if a call to accept ownership of the entity is received from a potential owner, wherein the two-step authentication and authorization component is further for performing two-step handshakes to effect permissions for administrators who can claim ownership of the securable entity, owners who take ownership of any entity that they create, and users who are granted permission by the owners to perform operations on the entity that they own, and wherein the granting component holds a lock for a short period while performing the grant by computing dynamically a permission on a lower scope schema or table rather than explicitly materializing such that there is one physically persisted permission that covers a current sub-entity and a future sub-entity contained on the lower scopes; and
a component for creating a schema with a securable entity for which permissions can be granted, revoked, or denied, and with a grantable take ownership permission without regard to whether a particular user desires ownership.

### Claim 2 (depends on 1)

The database management system of claim 1, the permission to the containing entity is granted through a GRANT SELECT permission.

### Claim 3 (depends on 2)

The database management system of claim 2, the GRANT SELECT permission is applied to one or more entities presently contained by the containing entity.

### Claim 4 (depends on 2)

The database management system of claim 2, the GRANT SELECT permission is applied to one or more future entities contained by the containing entity.

### Claim 5 (depends on 1)

The database management system of claim 1, the principal grants permission to the entity through one of a GRANT, a DENY, and a REVOKE statement.

### Claim 6 (depends on 1)

The database management system of claim 1, the granted permission is based on a set of operations of the entity.

### Claim 7 (depends on 1)

The database management system of claim 1, the one or more entities are contained in a relational database system.

### Claim 8 (depends on 1)

The database management system of claim 1, the one or more entities contained by the containing entity are child nodes.

### Claim 9 (depends on 1)

The database management system of claim 1, wherein the authenticating and authorizing component is further for associating the potential owner with the entity if a call to accept ownership of the entity is received from the potential owner.

### Claim 10 (depends on 9)

The database management system of claim 9, wherein the authenticating and authorizing component is further for disassociating the principal from the entity.

### Claim 11 (depends on 1)

The database management system of claim 1, wherein the authenticating and authorizing component is further for receiving a call for the principal to relinquish ownership to the potential owner is in the form of a GRANT TAKE statement.

### Claim 12 (depends on 1)

The database management system of claim 1, wherein the authenticating and authorizing component is further for receiving a call from the potential owner to accept ownership of the entity is in the form of an ALTER AUTHORIZATION statement.

### Claim 13

The database management system of claim , wherein the authenticating and authorizing component is further for transferring ownership when the entity has a grantable take ownership permission.

### Claim 14 (depends on 1)

The database management system of claim 1, wherein the authenticating and authorizing component is further for auditing an ownership transfer to mitigate repudiation issues.

### Claim 15

A method for facilitating providing permission to entities of a database, comprising:
employing a processor executing computer executable instructions stored on a computer readable storage medium to implement the following acts:
authorizing a principal of a containing entity of a database to dynamically grant a permission to that entity by providing extended syntax grammar of a database query language that accommodates a hierarchical permissions model;
dynamically granting the permission to the containing entity, the grantee of the permission inherits a set of permissions to one or more entities contained by the containing entity;
performing a two-step authentication and authorization handshake for a grantee to transfer permission for an entity to a principal without a repudiation issue by authenticating a principal with an entity, receiving a call from the principal to relinquish ownership of the entity, and determining if a call to accept ownership of the entity is received from a potential owner, wherein two-step authenticating and authorizing is by performing two-step handshakes to effect permissions for administrators who can claim ownership of the securable entity, owners who take ownership of any entity that they create, and users who are granted permission by the owners to perform operations on the entity that they own, and wherein dynamically granting by holding a lock for a short period while performing the grant by computing dynamically a permission on a lower scope schema or table rather than explicitly materializing such that there is one physically persisted permission that covers a current sub-entity and a future sub-entity contained on the lower scopes; and
creating a schema with a securable entity for which permissions can be granted, revoked, or denied, and with a grantable take ownership permission without regard to whether a particular user desires ownership.

### Claim 16 (depends on 15)

The method of claim 15, granting the permission to the containing entity by granting a GRANT SELECT permission.

### Claim 17 (depends on 16)

The method of claim 16, granting the GRANT SELECT permission by applying to one or more entities presently contained by the containing entity.

### Claim 18 (depends on 16)

The method of claim 16, granting the GRANT SELECT permission by applying to one or more future entities contained by the containing entity.

### Claim 19 (depends on 15)

The method of claim 15, wherein the principal grants permission to the entity through one of a GRANT, a DENY, and a REVOKE statement.

### Claim 20 (depends on 15)

The method of claim 15, wherein the granted permission is based on a set of operations of the entity.

### Claim 21 (depends on 15)

The method of claim 15, wherein the one or more entities are contained in a relational database system.

### Claim 22 (depends on 15)

The method of claim 15, wherein the one or more entities contained by the containing entity are child nodes.

### Claim 23 (depends on 15)

The method of claim 15, further comprising authenticating and authorizing by associating the potential owner with the entity if a call to accept ownership of the entity is received from the potential owner.

### Claim 24 (depends on 23)

The method of claim 23, further comprising authenticating and authorizing by disassociating the principal from the entity.

### Claim 25 (depends on 15)

The method of claim 15, further comprising authenticating and authorizing by receiving a call for the principal to relinquish ownership to the potential owner is in the form of a GRANT TAKE statement.

### Claim 26 (depends on 15)

The method of claim 15, further comprising authenticating and authorizing by receiving a call from the potential owner to accept ownership of the entity is in the form of an ALTER AUTHORIZATION statement.

### Claim 27 (depends on 15)

The method of claim 15, further comprising authenticating and authorizing component by transferring ownership when the entity has a grantable take ownership permission.

### Claim 28 (depends on 15)

The method of claim 15, further comprising authenticating and authorizing by auditing an ownership transfer to mitigate repudiation issues.