Patent ID: 7661141
Filing Date: 2010-02-09
Classification: G06F

Abstract:
1. A system that facilitates database security, comprising: an input component that receives a query, wherein the query includes a unique identifier that specifies a user generating the query; an expression bank that receives a plurality of row-level security expressions defined by an administrator of a database, wherein the plurality of row-level security expressions are functions of data organized in a single database table of the database and define access to one or more rows of data stored in the single database table, wherein each row-level security expression includes one or more unique identifiers such that each row-level security expression is only accessible to those queries whose unique identifier matches one of the one or more unique identifiers of each row-level security expression, wherein at least one of the plurality of row-level security expressions grants the user access to the data stored in the single database table and at least one of the plurality of row-level security expressions denies the user access to the data stored in the single database table; a query management component that inserts one or more of the row-level security expressions into the received query to generate an augmented query such that the augmented query includes all the information included in the received query and the inserted one or more row-level security expressions, the augmented query being utilized by the database to search data and return rows of data of the single database table that satisfy at least an aggregate of the row-level security expressions inserted into the augmented query such that the at least one row-level security expression granting access is satisfied and the at least one row-level security expression denying access is not satisfied; and an optimizer that employs rules of predicate to order the row-level security expressions in the query and non-security expressions in the query to ensure execution of the row-level security expressions prior to execution of the non-security expressions during data row evaluation to prevent information leaks.