US6631371B1
Expired / Lapsed
US
⏱️ 0.0 years remaining
Database fine-grained access control
Assignee: Oracle International Corp
•
Filing: 2002-09-18
•
Granted: 2003-10-07
•
Expires: 2022-09-18
Abstract
Abstract A method and mechanism are provided for accessing data. Values are stored for a set of context attributes associated with a session between a database user and a database server. The database system includes an attribute setting mechanism that selectively restricts access to the set of context attributes based on a policy. During the session, the database server executes a query that contains a reference to one or more of the context attributes. For example, the query may contain a predicate that requires a comparison between a context attribute value and a constant. The database server processes the query based on current values of the one or more of the context attributes referenced in the query. A mechanism is also provided for dynamically attaching predicates to queries, where the predicates are attached based on a policy. For example, the database system detects that a query is issued against a database object. Prior to executing the query, a policy function associated with the database object is invoked. The policy function creates a modified query by selectively adding zero or more predicates to the query based on a policy associated with the database object. The modified query is then executed.
Inventors
- 👤 Chon Hei Lei
- 👤 Douglas James McMahon
Bibliographic Details
Application Number
—
Jurisdiction
US
Data Source
google_patents
Last Synchronized
2026-11-03 21:36
CPC Classifications
G; G06; G06F; G06F21/00; G06F21/60; G06F21/62; G06F21/6218; G06F21/6227; G06F16/00; G06F16/20; G06F16/24; G06F16/245; G06F16/2457; G06F16/24575; Y; Y10; Y10S; Y10S707/00; Y10S707/953; Y10S707/955; Y10S707/964; Y10S707/966; Y10S707/99931; Y10S707/99932; Y10S707/99933; Y10S707/99934; Y10S707/99935; Y10S707/99939
Claims Analysis
Total Claims: 48
Claim 1
Independent Claim
65 words
A method for accessing data, the method comprising the steps of: storing values for a set of context attributes; appending to a query a predicate that identifies a function, wherein the function has an input parameter that identifies a particular context attribute from the set of context attributes; and executing the query as if the predicate specified the value associated with the particular context attribute.
Claim 2
Independent Claim
65 words
A method for accessing data, the method comprising the steps of: storing values for a set of context attributes; appending to a query a predicate that identifies a function, wherein the function has an input parameter that identifies a particular context attribute from the set of context attributes; and executing the query as if the predicate specified the value associated with the particular context attribute.
Claim 3
Dependent Claim
34 words
The method of claim 1 , wherein the particular context attribute is associated with a date, and the step of executing the query includes executing the query as if the predicate specified the date.
Claim 4
Dependent Claim
34 words
The method of claim 1 , wherein the particular context attribute is associated with a time, and the step of executing the query includes executing the query as if the predicate specified the time.
Claim 5
Dependent Claim
38 words
The method of claim 1 , wherein the particular context attribute is associated with a type of application, and the step of executing the query includes executing the query as if the predicate specified the type of application.
Claim 6
Independent Claim
68 words
A method for accessing data, the method comprising the steps of: storing values for a set of context attributes; providing an attribute accessing mechanism that accesses the set of context attributes; executing a policy function to determine the current value of a particular context attribute from the set of context attributes by invoking the attribute accessing mechanism; and appending the current value to a predicate of a query.
Claim 7
Independent Claim
68 words
A method for accessing data, the method comprising the steps of: storing values for a set of context attributes; providing an attribute accessing mechanism that accesses the set of context attributes; executing a policy function to determine the current value of a particular context attribute from the set of context attributes by invoking the attribute accessing mechanism; and appending the current value to a predicate of a query.
Claim 8
Independent Claim
65 words
A method of accessing data, the method comprising the steps of: storing values for a set of context attributes; providing an attribute setting mechanism that selectively restricts access to the set of context attributes based on a policy; and enforcing the policy based at least in part on whether a statement in a query is at least one of SELECT, INSERT, UPDATE, and DELETE statement.
Claim 9
Independent Claim
65 words
A method of accessing data, the method comprising the steps of: storing values for a set of context attributes; providing an attribute setting mechanism that selectively restricts access to the set of context attributes based on a policy; and enforcing the policy based at least in part on whether a statement in a query is at least one of SELECT, INSERT, UPDATE, and DELETE statement.
Claim 10
Dependent Claim
36 words
The method of claim 6 , wherein the statement is a SELECT statement, and the step of enforcing the policy is based at least in part on the fact that the statement is a SELECT statement.
Claim 11
Dependent Claim
33 words
The method of claim 6 , wherein the statement is an INSERT statement, and the step of enforcing the policy is based at least in part on the statement being an INSERT statement.
Claim 12
Dependent Claim
33 words
The method of claim 6 , wherein the statement is an UPDATE statement, and the step of enforcing the policy is based at least in part on the statement being an UPDATE statement.
Claim 13
Dependent Claim
33 words
The method of claim 6 , wherein the statement is a DELETE statement, and the step of enforcing the policy is based at least in part on the statement being a DELETE statement.
Claim 14
Independent Claim
111 words
A method for a plurality of participating database servers participating in a distributed transaction to access data, the method comprising the steps of: storing values for a set of context attributes within a participating database server of said plurality of participating database servers; providing an attribute setting mechanism that selectively restricts access to the set of context attributes based on a policy; each participating database server of the plurality of database servers accessing data by performing the steps of: executing a query that contains a reference to one or more of the context attributes; and processing the query based on current values of the one or more of the context attributes.
Claim 15
Independent Claim
111 words
A method for a plurality of participating database servers participating in a distributed transaction to access data, the method comprising the steps of: storing values for a set of context attributes within a participating database server of said plurality of participating database servers; providing an attribute setting mechanism that selectively restricts access to the set of context attributes based on a policy; each participating database server of the plurality of database servers accessing data by performing the steps of: executing a query that contains a reference to one or more of the context attributes; and processing the query based on current values of the one or more of the context attributes.
Claim 16
Dependent Claim
71 words
A computer-readable medium carrying instructions for accessing data, the instructions comprising instructions for performing the steps of: storing values for a set of context attributes; appending to a query a predicate that identifies a function, wherein the function has an input parameter that identifies a particular context attribute from the set of context attributes; and executing the query as if the predicate specified the value associated with the particular context attribute.
Claim 17
Dependent Claim
71 words
A computer-readable medium carrying instructions for accessing data, the instructions comprising instructions for performing the steps of: storing values for a set of context attributes; appending to a query a predicate that identifies a function, wherein the function has an input parameter that identifies a particular context attribute from the set of context attributes; and executing the query as if the predicate specified the value associated with the particular context attribute.
Claim 18
Dependent Claim
35 words
The computer-readable medium of claim 12 , wherein the particular context attribute is associated with a date, and the step of executing the query includes executing the query as if the predicate specified the date.
Claim 19
Dependent Claim
35 words
The computer-readable medium of claim 12 , wherein the particular context attribute is associated with a time, and the step of executing the query includes executing the query as if the predicate specified the time.
Claim 20
Dependent Claim
39 words
The computer-readable medium of claim 12 , wherein the particular context attribute is associated with a type of application, and the step of executing the query includes executing the query as if the predicate specified the type of application.
Claim 21
Dependent Claim
72 words
A computer-readable medium for accessing data, the instructions comprising instructions for performing the steps of: storing values for a set of context attributes; providing an attribute accessing mechanism that accesses the set of context attributes; executing a policy function to determine the current value of a particular context attribute from the set of context attributes by invoking the attribute accessing mechanism; and appending the current value to a predicate of a query.
Claim 22
Dependent Claim
72 words
A computer-readable medium for accessing data, the instructions comprising instructions for performing the steps of: storing values for a set of context attributes; providing an attribute accessing mechanism that accesses the set of context attributes; executing a policy function to determine the current value of a particular context attribute from the set of context attributes by invoking the attribute accessing mechanism; and appending the current value to a predicate of a query.
Claim 23
Dependent Claim
69 words
A computer-readable medium for accessing data, the instructions comprising instructions for performing the steps of: storing values for a set of context attributes; providing an attribute setting mechanism that selectively restricts access to the set of context attributes based on a policy; and enforcing the policy based at least in part on whether a statement in a query is at least one of SELECT, INSERT, UPDATE, and DELETE statement.
Claim 24
Dependent Claim
69 words
A computer-readable medium for accessing data, the instructions comprising instructions for performing the steps of: storing values for a set of context attributes; providing an attribute setting mechanism that selectively restricts access to the set of context attributes based on a policy; and enforcing the policy based at least in part on whether a statement in a query is at least one of SELECT, INSERT, UPDATE, and DELETE statement.
Claim 25
Dependent Claim
34 words
The computer-readable medium of claim 17 , wherein the statement is a SELECT statement, and the step of enforcing the policy is based at least in part on the statement being a SELECT statement.
Claim 26
Dependent Claim
34 words
The computer-readable medium of claim 17 , wherein the statement is an INSERT statement, and the step of enforcing the policy is based at least in part on the statement being an INSERT statement.
Claim 27
Dependent Claim
34 words
The computer-readable medium of claim 17 , wherein the statement is an UPDATE statement, and the step of enforcing the policy is based at least in part on the statement being an UPDATE statement.
Claim 28
Dependent Claim
34 words
The computer-readable medium of claim 17 , wherein the statement is a DELETE statement, and the step of enforcing the policy is based at least in part on the statement being a DELETE statement.
Claim 29
Dependent Claim
115 words
A computer-readable medium for a plurality of participating database servers participating in a distributed transaction to access data, the instructions comprising instructions for performing the steps of: storing values for a set of context attributes within a participating database server of said plurality of participating database servers; providing an attribute setting mechanism that selectively restricts access to said set of context attributes based on a policy; each participating database server of the plurality of database servers accessing data by performing the steps of: executing a query that contains a reference to one or more of the context attributes; and processing the query based on current values of the one or more of the context attributes.
Claim 30
Dependent Claim
115 words
A computer-readable medium for a plurality of participating database servers participating in a distributed transaction to access data, the instructions comprising instructions for performing the steps of: storing values for a set of context attributes within a participating database server of said plurality of participating database servers; providing an attribute setting mechanism that selectively restricts access to said set of context attributes based on a policy; each participating database server of the plurality of database servers accessing data by performing the steps of: executing a query that contains a reference to one or more of the context attributes; and processing the query based on current values of the one or more of the context attributes.
Claim 31
Independent Claim
102 words
A method for executing a query issued to a database server by a database client, the method comprising the steps of: said database server receiving said query; transparently to said database client and prior to the database server executing said query: said database server detecting that said query requires access to a database object, and in response to detecting that said query requires access to said database object: said database server creating a modified query by selectively adding one or more predicates to said query; and executing, within said database server, said modified query to access data managed by said database server.
Claim 32
Independent Claim
102 words
A method for executing a query issued to a database server by a database client, the method comprising the steps of: said database server receiving said query; transparently to said database client and prior to the database server executing said query: said database server detecting that said query requires access to a database object, and in response to detecting that said query requires access to said database object: said database server creating a modified query by selectively adding one or more predicates to said query; and executing, within said database server, said modified query to access data managed by said database server.
Claim 33
Dependent Claim
47 words
The method of claim 23 wherein: the database server maintains values for a plurality of context attributes; and the database server determines which predicates to add to said query based at least in part on current values of one or more of said plurality of context attributes.
Claim 34
Dependent Claim
33 words
The method of claim 24 , wherein the step of adding one or more predicates includes adding at least one predicate that references said one or more of said plurality of context attributes.
Claim 35
Dependent Claim
33 words
A computer-readable medium carrying one or more sequences of instructions which, when executed by one or more processors, causes the one or more processors to perform the method recited in claim 25 .
Claim 36
Dependent Claim
33 words
A computer-readable medium carrying one or more sequences of instructions which, when executed by one or more processors, causes the one or more processors to perform the method recited in claim 24 .
Claim 37
Dependent Claim
34 words
The method of claim 23 , wherein: said database object is a view that requires access to a particular table; and wherein said one or more predicates reference an attribute of said particular table.
Claim 38
Dependent Claim
33 words
A computer-readable medium carrying one or more sequences of instructions which, when executed by one or more processors, causes the one or more processors to perform the method recited in claim 28 .
Claim 39
Dependent Claim
44 words
The method of claim 23 wherein: the database object is a table; the query accesses the table through a view; and said database server, based on said query accessing the table through said view, performs the step of selectively adding one or more predicates.
Claim 40
Dependent Claim
33 words
A computer-readable medium carrying one or more sequences of instructions which, when executed by one or more processors, causes the one or more processors to perform the method recited in claim 30 .
Claim 41
Dependent Claim
61 words
The method of claim 23 , wherein the steps that are performed transparently to said database client and prior to the database server executing said query include: invoking a function that said database server associates with said database object but not with other database objects managed by said database server; and said function generating the one or more predicates to add.
Claim 42
Dependent Claim
33 words
A computer-readable medium carrying one or more sequences of instructions which, when executed by one or more processors, causes the one or more processors to perform the method recited in claim 32 .
Claim 43
Dependent Claim
36 words
The method of claim 32 , wherein: the method further includes invoking an administrative interface; and wherein invoking said administrative interface causes said database server to generate data that associates said function with said database object.
Claim 44
Dependent Claim
33 words
A computer-readable medium carrying one or more sequences of instructions which, when executed by one or more processors, causes the one or more processors to perform the method recited in claim 34 .
Claim 45
Dependent Claim
33 words
A computer-readable medium carrying one or more sequences of instructions which, when executed by one or more processors, causes the one or more processors to perform the method recited in claim 23 .
Claim 46
Independent Claim
167 words
A method for executing a query issued to a database server by a database client, the method comprising the steps of: invoking an administrative interface supported by the database server; wherein invoking said administrative interface causes said database server to generate data that associates a function with a database object; storing values for a set of context attributes within the database server; providing, within said database server, an attribute setting mechanism that governs access to said set of context attributes; the database server receiving the query from the database client; detecting that the query requires access to the database object; transparently to said database client and prior to the database server executing said query, invoking one or more functions associated with said database object, wherein said one or more functions includes said function; wherein invoking said function causes the attribute setting mechanism to change a value of said set of context attributes; and processing said query based on current values of said set of said context attributes.
Claim 47
Independent Claim
167 words
A method for executing a query issued to a database server by a database client, the method comprising the steps of: invoking an administrative interface supported by the database server; wherein invoking said administrative interface causes said database server to generate data that associates a function with a database object; storing values for a set of context attributes within the database server; providing, within said database server, an attribute setting mechanism that governs access to said set of context attributes; the database server receiving the query from the database client; detecting that the query requires access to the database object; transparently to said database client and prior to the database server executing said query, invoking one or more functions associated with said database object, wherein said one or more functions includes said function; wherein invoking said function causes the attribute setting mechanism to change a value of said set of context attributes; and processing said query based on current values of said set of said context attributes.
Claim 48
Dependent Claim
33 words
A computer-readable medium carrying one or more sequences of instructions which, when executed by one or more processors, causes the one or more processors to perform the method recited in claim 37 .
References Cited (Backward Citations)
US5265221A
Cited
US5276901A
Cited
US5428778A
Cited
US5787428A
Cited
US5815574A
Cited
US6134549A
Cited
US5751949A
Cited
US6026388A
Cited
US5765154A
Cited
US5940818A
Cited
US6308273B1
Cited
US6275824B1
Cited
US6363387B1
Cited
USPTO Annuity & Maintenance Windows
| Annuity Stage | Window Opens | Payment Deadline | Surcharge Period Until | Estimated Fee | Status |
|---|---|---|---|---|---|
| 3.5 Years (Year 4) | 2006-10-06 | 2007-04-07 | 2007-10-07 | $2000.00 | Window Closed / Lapsed |
| 7.5 Years (Year 8) | 2010-10-06 | 2011-04-07 | 2011-10-07 | $3760.00 | Window Closed / Lapsed |
| 11.5 Years (Year 12) | 2014-10-06 | 2015-04-07 | 2015-10-07 | $7700.00 | Window Closed / Lapsed |