Back to results
US 9,870,483 B2Granted
Row-level security in a relational database management system
AssigneeInternational Business Machines Corporation
InventorsCurt Cotner, Roger Lee Miller
Life of this patent
Estimating the term…
Abstract
Access control methods provide multilevel and mandatory access control for a database management system. The access control techniques provide access control at the row level in a relational database table. The database table contains a security label column within which is recorded a security label that is defined within a hierarchical security scheme. A user's security label is encoded with security information concerning the user. When a user requests access to a row, a security mechanism compares the user's security information with the security information in the row. If the user's security dominates the row's security, the user is given access to the row.
Claims14
A computer-implemented method of controlling access to a relational database, comprising:
- receiving via a network from a user computer, by a server computer, a user request for data from the relational database, the user request including a user security label and a request to perform a database operation;
- determining, by a server computer, whether a security label column is included in a table of the relational database, the security label column storing, in each row of the table, a row security label, which indicates a security level required by a user of the user request to access the data contained in a respective row in the table;
- and
- automatically activating, by the server computer, a mandatory security enforcement mechanism, independent of the relational database operation to access the database, as a result of determination that the security label column is included in the table of the relational database;
- wherein the mandatory security enforcement mechanism is automatically activated independent of creating a view based on the database operation to access the relational database;
- the mandatory security enforcement mechanism comprising:
- determining user security information from the user security label;
- determining row security information for each row to be accessed by the database operation being performed by the request, from the security label column in the respective row;
- comparing the user security information and the row security information, the user security information and the row security information being unchanged during a period when the database operation is performed;
- retrieving one or more rows of data from the table in the relational database based on a result of the comparing the user security information and the row security information;
- and
- returning, to the user computer, only the one or more rows for which the user is determined to have authorization to access for performing the database operation on the rows.
9 more elements
A computer-implemented method of controlling access to data in at least one row of a relational database, wherein said at least one row is associated with row-level access control information, the method comprising:
- receiving via a network from a user computer, by a server computer, a user request to operate on the relational database, the user request including a user security label, which indicates a user security level and a request to perform a database operation;
- determining, by a server computer, whether a security label column is included in a table of the relational database, the security label column storing, in each row of the table, a row security label, which indicates a row security level required by a user of the request to access the data contained in a respective row in the table;
- and
- automatically applying, by a server computer, mandatory access control rules to rows of the database satisfying the request independent of creating a view based on the database operation to access the relational database when the security label column is included in the table of the relational database, by determining whether privileges associated with a first security level are included in the privileges associated with a second security level,
- the applying the mandatory access control rules comprising:
- determining row security information for each row to be accessed by the database operation being performed by the request, from the security label column in the respective row;
- comparing the user security level and the row security level, the user security level and the row security level being unchanged during a period when the database operation is performed;
- retrieving one or more rows of data from the table in the relational database based on a result of the comparing the user security level and the row security level;
- and returning data from one or more rows in the relational database to the user computer, if the row security level associated with one or more rows is at least a subset of the user security level, to perform the database operation on the one or more rows.
6 more elements
A computer-implemented method of controlling a user's access to data in rows of a relational database, the method comprising:
- receiving via a network, by using a server computer, a user request from a user computer to operate on the relational database, the user request including a user security label and a request to perform a database operation;
- determining, by the server computer, whether a security label column is included in a table of the relational database, the security label column storing, in each row of the table, a first access level, which indicates a row security level required by a user of the user request to access the data contained in a respective row in the table;
- and
- automatically activating, by the server computer, a mandatory security enforcement mechanism, independent of creating a view based on the relational database operation to access the database, when the security label column is included in the table of the relational database;
- the mandatory security enforcement mechanism including:
- determining whether the user is authorized to operate on a row of the relational database that satisfies the request by comparing the first access level stored in the security label column of the table and a second access level and determining whether privileges associated with the first access level are included in the privileges associated with the second access level included in the user security label, the first access level and the second access level being unchanged during a period when the database operation is performed;
- retrieving one or more rows of data from the table in the relational database based on a result of the comparing the first access level and the second access level;
- and
- returning data from the one or more rows only if the user is determined to be authorized to perform the database operation on the one or more rows.
6 more elements
Dependencies are inferred from the claim text.