Patent US5572673A successfully refreshed from Google Patents.
US5572673A
Expired / Lapsed
US
⏱️ 0.0 years remaining
Secure multi-level system for executing stored procedures
Assignee: Sybase Inc
•
Filing: 1993-12-01
•
Granted: 1996-11-05
•
Expires: 2013-12-01
Abstract
Abstract A database management system is provided for security of database objects. These objects may be passive elements such as tables, rows, views, the databases themselves, etc., or they may be executable items such as stored procedures or triggers. A mechanism is provided for "certifying" that certain types of objects such as stored procedures, triggers, and views can be safely used to access other, sensitive objects in the database. Certification indicates that (1) a security officer has evaluated and certified the object, and (2) the now certified object has not undergone a defined security-relevant change since certification. Certification is particularly important in the context of a "trusted" stored procedure or a "trusted" stored trigger. "Trusted" executable objects can be executed at sensitivity levels that exceed that of a user or subject. Thus, the subject may use a trusted stored procedure or trigger to access certain objects having higher sensitivity levels than his or her own. If the certified object changes in a security-relevant manner, its "certification state" changes from certified to "suspect" which causes the object to become unexecutable.
Inventors
- 👤 Scott A. Shurts
Bibliographic Details
Application Number
—
Jurisdiction
US
Data Source
google_patents
Last Synchronized
2026-10-25 19:10
CPC Classifications
G; G06; G06F; G06F21/00; G06F21/60; G06F21/62; G06F21/6218; G06F2221/00; G06F2221/21; G06F2221/2113
Claims Analysis
Total Claims: 30
Claim 1
Independent Claim
115 words
A method of improving the security of a database in a computer system, the database comprising a plurality of stored objects, at least some of which are executable objects, said executable objects referencing other objects and having certification states, the method comprising the steps of: if an executable object meets defined security criteria, certifying the executable object such that its certification state is certified; if one or more defined security-relevant changes occur to one or more of the objects referenced by a certified executable object, automatically changing the certification state of the certified executable object from certified to suspect; and preventing execution of the suspect executable object until its certification state is no longer suspect.
Claim 2
Independent Claim
115 words
A method of improving the security of a database in a computer system, the database comprising a plurality of stored objects, at least some of which are executable objects, said executable objects referencing other objects and having certification states, the method comprising the steps of: if an executable object meets defined security criteria, certifying the executable object such that its certification state is certified; if one or more defined security-relevant changes occur to one or more of the objects referenced by a certified executable object, automatically changing the certification state of the certified executable object from certified to suspect; and preventing execution of the suspect executable object until its certification state is no longer suspect.
Claim 3
Dependent Claim
26 words
The method of claim 1 wherein the step of certifying an executable object comprises the step of certifying one of a stored procedure, view, or trigger.
Claim 4
Dependent Claim
49 words
The method of claim 1 wherein the step of changing the certification state of the certified executable object from certified to suspect includes the step of identifying one or more views or tables referenced by the executable object as having undergone one or more of said defined security-relevant changes.
Claim 5
Dependent Claim
44 words
The method of claim 1 wherein the step of changing the certification state of the certified executable object from certified to suspect includes the step of identifying one or more views or tables referenced by the executable object as having been deleted and recreated.
Claim 6
Dependent Claim
26 words
The method of claim 1 wherein the step of certifying an executable object includes a step of having a database security officer certify said executable object.
Claim 7
Independent Claim
216 words
A method of permitting a subject having current read and write labels to access a database object in a computer system, the object having an access sensitivity label, the database including a procedure referencing the object, and the procedure having its own access sensitivity label and current read and write labels, the method comprising the following steps: certifying the procedure as meeting defined security criteria; initiating a task on behalf of the subject; applying the subject's current read and write labels to the task so that the procedure's current read and write labels constitute the task's current read and write labels; initiating execution of the certified procedure if the subject's current read label dominates the procedure's access sensitivity label; applying the procedure's current read and write labels to the task; comparing the task's current read and write labels to the object's access sensitivity label to determine whether the task has authorization to access the object; determining whether the procedure references any object that has undergone a security-relevant change after the procedure was certified; and if the task has mandatory access control authorization to access the object and the procedure does not reference an object that has undergone a security-relevant change as determined in the steps of comparing and determining, permitting the procedure to access the object.
Claim 8
Independent Claim
216 words
A method of permitting a subject having current read and write labels to access a database object in a computer system, the object having an access sensitivity label, the database including a procedure referencing the object, and the procedure having its own access sensitivity label and current read and write labels, the method comprising the following steps: certifying the procedure as meeting defined security criteria; initiating a task on behalf of the subject; applying the subject's current read and write labels to the task so that the procedure's current read and write labels constitute the task's current read and write labels; initiating execution of the certified procedure if the subject's current read label dominates the procedure's access sensitivity label; applying the procedure's current read and write labels to the task; comparing the task's current read and write labels to the object's access sensitivity label to determine whether the task has authorization to access the object; determining whether the procedure references any object that has undergone a security-relevant change after the procedure was certified; and if the task has mandatory access control authorization to access the object and the procedure does not reference an object that has undergone a security-relevant change as determined in the steps of comparing and determining, permitting the procedure to access the object.
Claim 9
Dependent Claim
30 words
The method of claim 6 further comprising the following steps: exiting execution of the procedure; and applying the subject's current read and write labels to the task after exiting execution.
Claim 10
Dependent Claim
40 words
The method of claim 6 wherein the step of determining whether the procedure references any object that has undergone a security-relevant change includes a step of determining whether a table or a view referenced by the procedure has been deleted.
Claim 11
Dependent Claim
64 words
The method of claim 6 further comprising a step of applying to the task maximum and minimum boundary labels defining upper and lower limits of the procedure's current read and write labels, said step of applying maximum and minimum boundary labels being performed after the step of initiating execution of the procedure and before the step of permitting the procedure to access the object.
Claim 12
Dependent Claim
26 words
The method of claim 9 further comprising a step of adjusting the procedure's current read or write labels within said upper and lower limits during execution.
Claim 13
Dependent Claim
34 words
The method of claim 6 further comprising the following steps: initiating execution of a nested procedure called by the procedure; and applying current read and write labels of the nested procedure to the task.
Claim 14
Dependent Claim
23 words
The method of claim 6 wherein the step of initiating execution of the procedure in the task comprises initiating execution of a trigger.
Claim 15
Dependent Claim
35 words
The method of claim 6 further comprising a step of determining, before the step of initiating execution of the certified procedure, whether the subject has a discretionary access control privilege to access the certified procedure.
Claim 16
Independent Claim
175 words
A method of improving the security of a database in a computer system, the database comprising a plurality of stored objects, at least some of which are executable objects, said executable objects having a certification state, an access sensitivity label, and current read and write labels, the method comprising the following steps: certifying an executable object such that its certification state is certified if the executable object meets defined security criteria; compiling the certified executable object; initiating a task on behalf of the subject; and if a read sensitivity label of the subject dominates the certified executable object's access sensitivity label, (i) applying the current read and write labels of the certified executable object to the subject's task, (ii) determining whether the certified executable object references any objects which have undergone one or more defined security-relevant changes after the executable object was compiled, and (iii) if the certified executable object does not reference any objects which have undergone one or more defined security-relevant changes after the executable object was compiled, executing the certified executable object.
Claim 17
Independent Claim
175 words
A method of improving the security of a database in a computer system, the database comprising a plurality of stored objects, at least some of which are executable objects, said executable objects having a certification state, an access sensitivity label, and current read and write labels, the method comprising the following steps: certifying an executable object such that its certification state is certified if the executable object meets defined security criteria; compiling the certified executable object; initiating a task on behalf of the subject; and if a read sensitivity label of the subject dominates the certified executable object's access sensitivity label, (i) applying the current read and write labels of the certified executable object to the subject's task, (ii) determining whether the certified executable object references any objects which have undergone one or more defined security-relevant changes after the executable object was compiled, and (iii) if the certified executable object does not reference any objects which have undergone one or more defined security-relevant changes after the executable object was compiled, executing the certified executable object.
Claim 18
Dependent Claim
68 words
The method of claim 14 wherein the step of executing the certified executable object includes the following steps: changing the certification state of the certified executable object from certified to suspect if said one or more defined security-relevant changes has occurred to any of the objects referenced by said certified executable object; and preventing re-execution of a suspect executable object until its certification state is no longer suspect.
Claim 19
Dependent Claim
46 words
The method of claim 15 wherein the step of changing the certification state of the certified executable object from certified to suspect includes a step of identifying a table or a view that has been deleted, the table or view being referenced by the executable object.
Claim 20
Dependent Claim
26 words
The method of claim 14 wherein the step of certifying an executable object comprises a step of certifying one of a stored procedure, view, or trigger.
Claim 21
Dependent Claim
26 words
The method of claim 14 wherein the step of certifying an executable object includes a step of having a database security officer certify said executable object.
Claim 22
Dependent Claim
30 words
The method of claim 14 further comprising the following steps: exiting execution of the procedure; and applying the subject's current read and write labels to the task after exiting execution.
Claim 23
Dependent Claim
66 words
The method of claim 14 further comprising a step of applying to the task maximum and minimum boundary labels defining upper and lower limits of the executable object's current read and write labels, said step of applying maximum and minimum boundary labels being performed after the step of initiating a task on behalf of the subject and before the step of executing the certified executable object.
Claim 24
Dependent Claim
27 words
The method of claim 20 further comprising a step of adjusting the executable object's current read or write labels within said upper and lower limits during execution.
Claim 25
Dependent Claim
126 words
A computer system comprising: a processor; a memory; a stored procedure capable of running on said processor, the stored procedure having a defined certification state and referencing one or more referenced objects stored in said memory; means for explicitly changing the certification state of the stored procedure in accordance with defined security criteria; means for implicitly changing the certification state of the stored procedure from a certified certification state to a suspect certification state if a defined security relevant change occurs to any of the one or more referenced objects; and means for preventing suspect stored procedures from re-executing until their certification state has been changed to a state that is not suspect by the means for explicitly changing the certification state of a stored procedure.
Claim 26
Dependent Claim
126 words
A computer system comprising: a processor; a memory; a stored procedure capable of running on said processor, the stored procedure having a defined certification state and referencing one or more referenced objects stored in said memory; means for explicitly changing the certification state of the stored procedure in accordance with defined security criteria; means for implicitly changing the certification state of the stored procedure from a certified certification state to a suspect certification state if a defined security relevant change occurs to any of the one or more referenced objects; and means for preventing suspect stored procedures from re-executing until their certification state has been changed to a state that is not suspect by the means for explicitly changing the certification state of a stored procedure.
Claim 27
Dependent Claim
27 words
The computer system of claim 22 further comprising a system catalog stored in said memory, the system catalog including an access sensitivity label for the stored procedure.
Claim 28
Dependent Claim
40 words
The computer system of claim 23 further comprising means for denying a subject having a current read label access to the stored procedure when the subject's current read label does not dominate an access sensitivity label of the stored procedure.
Claim 29
Dependent Claim
20 words
The computer system of claim 23 wherein the system catalog also includes read and write labels for the stored procedure.
Claim 30
Dependent Claim
40 words
The computer system of claim 25 further comprising means for replacing one or more read and write labels of a subject with the read and write labels of the stored procedure when the subject initiates execution of the stored procedure.
References Cited (Backward Citations)
US5265221A
Cited
US5193185A
Cited
US5126728A
Cited
US5408657A
Cited
US5355474A
Cited
US5283830A
Cited
US5371794A
Cited
US5511122A
Cited
USPTO Annuity & Maintenance Windows
| Annuity Stage | Window Opens | Payment Deadline | Surcharge Period Until | Estimated Fee | Status |
|---|---|---|---|---|---|
| 3.5 Years (Year 4) | 1999-11-05 | 2000-05-06 | 2000-11-05 | $2000.00 | Window Closed / Lapsed |
| 7.5 Years (Year 8) | 2003-11-05 | 2004-05-06 | 2004-11-05 | $3760.00 | Window Closed / Lapsed |
| 11.5 Years (Year 12) | 2007-11-05 | 2008-05-06 | 2008-11-05 | $7700.00 | Window Closed / Lapsed |