Patent ID: 7599937
Filing Date: 2009-10-06
Classification: G06F,Y10S

Abstract:
1. A system for facilitating a secure database, the system comprising: a memory having stored therein computer executable components; a first component that creates a table with a security descriptor column; a second component that creates a security descriptor store associated with the table, wherein the security descriptor store comprises at least one security descriptor that includes access information, permission that identifies a kind of access associated with the at least one security descriptor, and one or more principals to whom the at least one security descriptor applies, wherein the one or more principals include at least one of one or more user names, one or more groups of users, one or more user identifiers, or one or more types of users; a third component that populates at least one row of the table with a security descriptor identifier; a fourth component that receives a query and user context information; a fifth component that associates a row of the table with security information, wherein the table comprises at least one row and at least two columns, wherein one of the at least two columns stores a security descriptor associated with the row of the table, wherein the security descriptor associated with the row of the table identifies the security information stored in the security descriptor store, wherein the security descriptor associated with the row of the table is included in all access paths to the table, and wherein access paths to the table include at least one of following: an access path to the table stored as an un-ordered collection; an access path to a clustered index on the table; an access path to a non-clustered index on the table; or an access path to materialized views defined on the table; a sixth database engine component that provides a response to the query, wherein the response comprises rows, if any, that satisfy the query, and wherein the security information associated with the row of the table is satisfied by the user context information; a seventh query component that determines an optimal way to answer the query based on a cost-based optimization strategy, wherein the query is optimized prior to providing the response; and a processor that executes the computer executable components.