Patent US4405948A successfully refreshed from Google Patents.
Patent US6487552B1 successfully refreshed from Google Patents.
US6487552B1
Expired / Lapsed
US
⏱️ 0.0 years remaining
Database fine-grained access control
Assignee: Oracle International Corp
•
Filing: 1998-10-05
•
Granted: 2002-11-26
•
Expires: 2018-10-05
Abstract
Abstract A method and mechanism are provided for accessing data. Values are stored for a set of context attributes associated with a session between a database user and a database server. The database system includes an attribute setting mechanism that selectively restricts access to the set of context attributes based on a policy. During the session, the database server executes a query that contains a reference to one or more of the context attributes. For example, the query may contain a predicate that requires a comparison between a context attribute value and a constant. The database server processes the query based on current values of the one or more of the context attributes referenced in the query. A mechanism is also provided for dynamically attaching predicates to queries, where the predicates are attached based on a policy. For example, the database system detects that a query is issued against a database object. Prior to executing the query, a policy function associated with the database object is invoked. The policy function creates a modified query by selectively adding zero or more predicates to the query based on a policy associated with the database object. The modified query is then executed.
Inventors
- 👤 Chon Hei Lei
- 👤 Douglas James McMahon
Bibliographic Details
Application Number
—
Jurisdiction
US
Data Source
google_patents
Last Synchronized
2026-11-04 09:27
CPC Classifications
G; G06; G06F; G06F21/00; G06F21/60; G06F21/62; G06F21/6218; G06F21/6227; G06F16/00; G06F16/20; G06F16/24; G06F16/245; G06F16/2457; G06F16/24575; Y; Y10; Y10S; Y10S707/00; Y10S707/953; Y10S707/955; Y10S707/964; Y10S707/966; Y10S707/99931; Y10S707/99932; Y10S707/99933; Y10S707/99934; Y10S707/99935; Y10S707/99939
Claims Analysis
Total Claims: 49
Claim 1
Independent Claim
94 words
A method for accessing data within a database system, the method comprising the steps of: storing values for a set of context attributes within the database system; providing, within said database system, an attribute setting mechanism that selectively restricts access to said set of context attributes based on a policy, accessing data managed by the database system by performing the steps of: executing a query that contains a reference to one or more of said context attributes; and processing said query based on current values of said one or more of said context attributes.
Claim 2
Independent Claim
94 words
A method for accessing data within a database system, the method comprising the steps of: storing values for a set of context attributes within the database system; providing, within said database system, an attribute setting mechanism that selectively restricts access to said set of context attributes based on a policy, accessing data managed by the database system by performing the steps of: executing a query that contains a reference to one or more of said context attributes; and processing said query based on current values of said one or more of said context attributes.
Claim 3
Dependent Claim
52 words
The method of claim 1 wherein: the step of storing values includes storing values for a set of context attributes associated with a session between a database client and a database server; and the step of executing a query includes the steps of said database server executing said query during said session.
Claim 4
Dependent Claim
35 words
The method of claim 2 wherein the step of storing values for a set of context attributes is performed by storing said values in a portion of server-side memory that is associated with said session.
Claim 5
Dependent Claim
36 words
The method of claim 1 further comprising the step of said attribute setting mechanism selectively setting values of context attributes that belong to said set of context attributes in response to messages from a database client.
Claim 6
Dependent Claim
21 words
The method of claim 1 wherein the step of providing an attribute setting mechanism includes providing a server-side attribute setting mechanism.
Claim 7
Dependent Claim
99 words
The method of claim 4 wherein the step of selectively setting values of context attributes includes: executing a stored procedure in response to a message from said database client, wherein said message requests that a particular context attribute be set to a particular value; said stored procedure determining whether said policy allows said database client to set said particular context attribute to said particular value; and if said policy allows said database client to set said particular context attribute to said particular value, then said stored procedure causing said particular context attribute to be set to said particular value.
Claim 8
Dependent Claim
33 words
The method of claim 6 wherein said stored procedure causes said particular context attribute to be set to a particular value by making a call to a routine provided by a database server.
Claim 9
Dependent Claim
22 words
The method of claim 7 wherein said routine verifies that said call is from said stored procedure prior to servicing said call.
Claim 10
Dependent Claim
24 words
The method of claim 8 wherein said routine verifies that said call is from said stored procedure by inspecting one or more call stacks.
Claim 11
Dependent Claim
40 words
The method of claim 1 wherein the step of executing a query that contains a reference to one or more of said context attributes includes executing a query that contains a predicate that contains a reference to a context attribute.
Claim 12
Dependent Claim
22 words
The method of claim 10 wherein said predicate requires a comparison between said context attribute and a value specified by an expression.
Claim 13
Dependent Claim
38 words
The method of claim 4 wherein the attribute setting mechanism selectively restricts access to said set of context attributes by preventing the database client from changing values associated with a first subset of said set of context attributes.
Claim 14
Dependent Claim
24 words
The method of claim 12 wherein a database server automatically sets the values associated with the context attributes that belong to said first subset.
Claim 15
Dependent Claim
34 words
The method of claim 4 wherein the attribute setting mechanism performs a database lookup to determine whether the database client is allowed to set a particular context attribute in said set of context attributes.
Claim 16
Dependent Claim
68 words
The method of claim 2 wherein the query requires a portion of work to be performed by a foreign database server, the method further comprising the steps of: said database server sending values for at least one of said context attributes to said foreign database server; and said foreign database server using said values of at least one of said context attributes to execute said portion of work.
Claim 17
Independent Claim
95 words
A method for executing a query sent to a database server by a database client, the method comprising the steps of: detecting, within the database server, that the query is issued against a database object; prior to the database server executing said query, invoking a policy function associated with said database object; said policy function creating a modified query by selectively adding zero or more predicates to said query based on a policy associated with said database object; and executing, within said database server, said modified query to access data managed by said database server.
Claim 18
Independent Claim
95 words
A method for executing a query sent to a database server by a database client, the method comprising the steps of: detecting, within the database server, that the query is issued against a database object; prior to the database server executing said query, invoking a policy function associated with said database object; said policy function creating a modified query by selectively adding zero or more predicates to said query based on a policy associated with said database object; and executing, within said database server, said modified query to access data managed by said database server.
Claim 19
Dependent Claim
47 words
The method of claim 16 wherein: the database server maintains values for a plurality of context attributes; and the policy function determines which predicates to add to said query based at least in part on current values of one or more of said plurality of context attributes.
Claim 20
Dependent Claim
43 words
The method of claim 16 wherein: the database server maintains values for a plurality of context attributes; and the step of adding zero or more predicates includes adding at least one predicate that references one or more of said plurality of context attributes.
Claim 21
Dependent Claim
33 words
The method of claim 16 wherein the policy function determines which predicates to add to said query based at least in part on whether the query modifies data associated with the database object.
Claim 22
Dependent Claim
18 words
The method of claim 16 further comprising the step of the policy function setting a context attribute value.
Claim 23
Dependent Claim
41 words
The method of claim 20 wherein: said database object is a view that accesses a particular table; and the context attribute value set by the policy function is set to indicate that the particular table is being accessed through the view.
Claim 24
Dependent Claim
68 words
The method of claim 17 wherein: the database object is a table; the query accesses the table through a view; a second policy function associated with said view sets a particular context attribute value to indicate that the table is being accessed through the view; and the policy function determines which predicates to add to said query based at least in part on said particular context attribute value.
Claim 25
Dependent Claim
57 words
The method of claim 17 further comprising the steps of: providing a server-side attribute setting mechanism that selectively restricts access to said plurality of context attributes based on a policy; said server-side attribute setting mechanism selectively setting values of context attributes that belong to said plurality of context attributes in response to messages from said database client.
Claim 26
Dependent Claim
62 words
The method of claim 16 wherein: the database object is a view that accesses a table; and the modified query is executed by: a second policy function associated with said table creating a second modified query by selectively adding zero or more predicates to said modified query based on a second policy associated with said table; and executing said second modified query.
Claim 27
Dependent Claim
122 words
A computer-readable medium carting one or more sequences of instructions for accessing data managed by a database system, wherein execution of the one or more sequences of instructions by one or more processors causes the one or more processors to perform the steps of: storing values for a set of context attributes within the database system; providing, within said database system, an attribute setting mechanism that selectively restricts access to said set of context attributes based on a policy, accessing data managed byte database system by performing the steps of: executing a query that contains a reference to one or more of said context attributes; and processing said query based on current values of said one or more of said context attributes.
Claim 28
Dependent Claim
122 words
A computer-readable medium carting one or more sequences of instructions for accessing data managed by a database system, wherein execution of the one or more sequences of instructions by one or more processors causes the one or more processors to perform the steps of: storing values for a set of context attributes within the database system; providing, within said database system, an attribute setting mechanism that selectively restricts access to said set of context attributes based on a policy, accessing data managed byte database system by performing the steps of: executing a query that contains a reference to one or more of said context attributes; and processing said query based on current values of said one or more of said context attributes.
Claim 29
Dependent Claim
60 words
The computer-readable medium of claim 25 wherein: the step of providing an attribute setting mechanism includes providing a server-side attribute setting mechanism; and the computer-readable medium includes instructions for performing the step of said server-side attribute setting mechanism selectively setting values of context attributes that belong to said set of context attributes in response to messages from said database client.
Claim 30
Dependent Claim
100 words
The computer-readable medium of claim 26 wherein the step of selectively setting values of context attributes includes: executing a stored procedure in response to a message from said database client, wherein said message requests that a particular context attribute be set to a particular value; said stored procedure determining whether said policy allows said database client to set said particular context attribute to said particular value; and if said policy allows said database client to set said particular context attribute to said particular value, then said stored procedure causing said particular context attribute to be set to said particular value.
Claim 31
Dependent Claim
34 words
The computer-readable medium of claim 27 wherein said stored procedure causes said particular context attribute to be set to a particular value by making a call to a routine provided by the database server.
Claim 32
Dependent Claim
23 words
The computer-readable medium of claim 28 wherein said routine verifies that said call is from said stored procedure prior to servicing said call.
Claim 33
Dependent Claim
25 words
The computer-readable medium of claim 29 wherein said routine verifies that said call is from said stored procedure by inspecting one or more call stacks.
Claim 34
Dependent Claim
41 words
The computer-readable medium of claim 25 wherein the step of executing a query that contains a reference to one or more of said context attributes includes executing a query that contains a predicate that contains a reference to a context attribute.
Claim 35
Dependent Claim
23 words
The computer-readable medium of claim 31 wherein said predicate requires a comparison between said context attribute and a value specified by an expression.
Claim 36
Dependent Claim
40 words
The computer-readable medium of claim 26 wherein the server-side attribute setting mechanism selectively restricts access to said set of context attributes by preventing the database client from changing values associated with a first subset of said set of context attributes.
Claim 37
Dependent Claim
25 words
The computer-readable medium of claim 33 wherein the database server automatically sets the values associated with the context attributes that belong to said first subset.
Claim 38
Dependent Claim
36 words
The computer-readable medium of claim 26 wherein the server-side attribute setting mechanism performs a database lookup to determine whether the database client is allowed to set a particular context attribute in said set of context attributes.
Claim 39
Dependent Claim
73 words
The computer-readable medium of claim 25 wherein the query requires a portion of work to be performed by a foreign database server, the computer-readable medium further comprising instructions for performing the steps of: said database server sending values for at least one of said context attributes to said foreign database server; and said foreign database server using said values for at least one of said context attributes to execute said portion of work.
Claim 40
Dependent Claim
123 words
A computer-readable medium carrying one or more sequences of instructions for executing a query sent to a date server by a database client, wherein execution of the one or more sequences of instructions by one or more processors causes the one or more processors to perform the steps of: detecting, within the database server, that the query is issued against a database object; prior to the database server executing said query, invoking a policy function associated with said database object; said policy function creating a modified query by selectively adding zero or more predicates to said query based on a policy associated with said database object; and executing, within said database server, said modified query to access data managed by said database server.
Claim 41
Dependent Claim
123 words
A computer-readable medium carrying one or more sequences of instructions for executing a query sent to a date server by a database client, wherein execution of the one or more sequences of instructions by one or more processors causes the one or more processors to perform the steps of: detecting, within the database server, that the query is issued against a database object; prior to the database server executing said query, invoking a policy function associated with said database object; said policy function creating a modified query by selectively adding zero or more predicates to said query based on a policy associated with said database object; and executing, within said database server, said modified query to access data managed by said database server.
Claim 42
Dependent Claim
48 words
The computer-readable medium of claim 37 wherein: the database server maintains values for a plurality of context attributes; and the policy function determines which predicates to add to said query based at least in part on current values of one or more of said plurality of context attributes.
Claim 43
Dependent Claim
44 words
The computer-readable medium of claim 37 wherein: the database server maintains values for a plurality of context attributes; and the step of adding zero or more predicates includes adding at least one predicate that references one or more of said plurality of context attributes.
Claim 44
Dependent Claim
34 words
The computer-readable medium of claim 37 wherein the policy function determines which predicates to add to said query based at least in part on whether the query modifies data associated with the database object.
Claim 45
Dependent Claim
22 words
The computer-readable medium of claim 37 further comprising instructions for performing the step of the policy function setting a context attribute value.
Claim 46
Dependent Claim
42 words
The computer-readable medium of claim 41 wherein: said database object is a view that accesses a particular table; and the context attribute value set by the policy function is set to indicate that the particular table is being accessed through the view.
Claim 47
Dependent Claim
69 words
The computer-readable medium of claim 38 wherein: the database object is a table; the query accesses the table through a view; a second policy function associated with said view sets a particular context attribute value to indicate that the table is being accessed through the view; and the policy function determines which predicates to add to said query based at least in part on said particular context attribute value.
Claim 48
Dependent Claim
61 words
The computer-readable medium of claim 38 further comprising instructions for performing the steps of: providing a server-side attribute setting mechanism that selectively restricts access to said plurality of context attributes based on a policy; said server-side attribute setting mechanism selectively setting values of context attributes that belong to said plurality of context attributes in response to messages from said database client.
Claim 49
Dependent Claim
63 words
The computer-readable medium of claim 37 wherein: the database object is a view that accesses a table; and the modified query is executed by: a second policy function associated with said table creating a second modified query by selectively adding zero or more predicates to said modified query based on a second policy associated with said table; and executing said second modified query.
References Cited (Backward Citations)
USPTO Annuity & Maintenance Windows
| Annuity Stage | Window Opens | Payment Deadline | Surcharge Period Until | Estimated Fee | Status |
|---|---|---|---|---|---|
| 3.5 Years (Year 4) | 2005-11-25 | 2006-05-27 | 2006-11-26 | $2000.00 | Window Closed / Lapsed |
| 7.5 Years (Year 8) | 2009-11-25 | 2010-05-27 | 2010-11-26 | $3760.00 | Window Closed / Lapsed |
| 11.5 Years (Year 12) | 2013-11-25 | 2014-05-27 | 2014-11-26 | $7700.00 | Window Closed / Lapsed |