Source: https://patents.google.com/patent/US7171413B2/en
Timestamp: 2020-08-08 19:07:28
Document Index: 441850751

Matched Legal Cases: ['art 34', 'art 40', 'art 40', 'art 36', 'art 42', 'art 40', 'art 38', 'art 44']

US7171413B2 - Two phase intermediate query security using access control - Google Patents
Two phase intermediate query security using access control Download PDF
US7171413B2
US7171413B2 US10/651,892 US65189203A US7171413B2 US 7171413 B2 US7171413 B2 US 7171413B2 US 65189203 A US65189203 A US 65189203A US 7171413 B2 US7171413 B2 US 7171413B2
US10/651,892
US20050050046A1 (en
Nicholas K. Puz
2003-08-29 Priority to US10/651,892 priority Critical patent/US7171413B2/en
2003-08-29 Assigned to INTERNATIONAL BUSINESS MACHINES CORPORATION reassignment INTERNATIONAL BUSINESS MACHINES CORPORATION ASSIGNMENT OF ASSIGNORS INTEREST (SEE DOCUMENT FOR DETAILS). Assignors: BHAGHAVAN, RUPA, BONDAR, VITALIY, PUZ, NICHOLAS K., RICHARDT, RANDAL J.
2005-03-03 Publication of US20050050046A1 publication Critical patent/US20050050046A1/en
2007-01-30 Publication of US7171413B2 publication Critical patent/US7171413B2/en
230000001131 transforming Effects 0.000 claims description 20
A method, system and article of manufacture for two phase intermediate query security using access control. A networked client-server computer system having a plurality of users of the client-server system and including software performing database queries via a DBMS for users of the system implements the method. The method includes receiving a query string from one of the users by the client system, the query string including references to database objects. The received query string is transformed by the client system to an intermediate query string, and a first phase query security is performed by the client system including identifying the referenced database objects and inserting a security marker into the intermediate query string for each respective identified database object, and sending the intermediate query string to the server system. Access control checks are performed by the server system on the inserted security markers in the intermediate query string, and the inserted security markers are replaced with corresponding DBMS code to enforce access control.
This application is related to co-pending U.S. patent application Ser. No. 10/367,086 titled “System and Method for Implementing Access Control for Queries to a Content Management System,” which is assigned to the same assignee as the present application, and which is incorporated herein by reference.
The present invention relates to relational database query formulation and access control checks related to the query formulation on client-server systems using a query language, access marker formulation by client-side software and query language access control formulation by server-side software.
Users of a client-server system frequently access database tables stored in relational databases by formulating queries such as, for example, users of a content management system (CMS) generating Structured Query Language (SQL) to access a database. If a user-submitted query spans multiple database objects, or if the query selects items of one database object based on conditions in another database object, the CMS must check that the submitting user has access permissions to each of the database objects referenced in the query, regardless of whether or not the particular database object will be returned to the user. This leads to inefficiencies, particularly when a query spans multiple database objects or traverses through many database objects referenced by the query, as the client-side software of the CMS generates and submits the necessary SQL joins and conditions necessary to confirm that the user has the necessary access permissions.
In accordance with the present invention, there is provided a method of two-phase query security in a networked client-server computer system including software performing database queries via a DBMS for users of the system. A query string is received from one of the users by the client system, the query string including references to database objects. The received query string is transformed by the client system to an intermediate query string, and a first phase query security is performed by the client system, including identifying the referenced database objects and inserting a security marker into the intermediate query string for each respective identified database object, and then sending the intermediate query string to the server system. During the second phase, access control checks are performed by the server system on the inserted security markers in the intermediate query string, and the inserted security markers are replaced with corresponding DBMS code to enforce access control.
The invention may take physical form in certain parts and steps and arrangements of parts and steps, the preferred embodiments of which will be described in detail in this specification and illustrated in the accompanying drawings hereof and wherein:
In the example shown in the figure, the first query part 34 includes a first SQL part 40 and a first security marker 46. The first security marker 46 contains “Employee—3” as a result of the first SQL part 40 accessing the Employee data table referenced in the schema 32. The second query part 36 includes a second SQL part 42 and a second security marker 48. The second security marker 48 contains “Journal—1” as a result of the first SQL part 40 accessing the aforementioned Journal data table. The third query part 38 includes a third SQL part 44 which, as shown, includes only parentheses, and a null (non-existent) third security marker 50 indicating that no access checks are required for the third query part. In the illustrated embodiment, the final query part does not require access security checks since the final SQL part consists only of parentheses optionally inserted by the client-side software 14. It is to be appreciated that user queries are normally much longer than the exemplary query 30 and the resulting query will include more than 3 query parts.
By distributing the above-described tasks of generating the main query 74–80 and generating the access control checks 84 between the client and the server respectively, the query engine achieves a very extensible and efficient solution to a rather complicated problem. To summarize and rephrase aspects of the present application for clarity, the client sends to the server a sequence of query parts, each of which consists of an SQL portion (what the user is looking for) and a marker portion (what should be protected by access control). The server then determines the required SQL joins and conditions that should be inserted in place of the markers in the main user query in order to enforce the appropriate access control rules.
US10/651,892 2003-08-29 2003-08-29 Two phase intermediate query security using access control Expired - Fee Related US7171413B2 (en)
US10/651,892 US7171413B2 (en) 2003-08-29 2003-08-29 Two phase intermediate query security using access control
US20050050046A1 US20050050046A1 (en) 2005-03-03
US7171413B2 true US7171413B2 (en) 2007-01-30
ID=34217504
US10/651,892 Expired - Fee Related US7171413B2 (en) 2003-08-29 2003-08-29 Two phase intermediate query security using access control
US (1) US7171413B2 (en)
CN106326222A (en) * 2015-06-16 2017-01-11 阿里巴巴集团控股有限公司 Data processing method and device
2003-08-29 US US10/651,892 patent/US7171413B2/en not_active Expired - Fee Related
CN106326222B (en) * 2015-06-16 2019-08-02 阿里巴巴集团控股有限公司 A kind of data processing method and device
US20050050046A1 (en) 2005-03-03
US20170364498A1 (en) 2017-12-21 Registry driven interoperability and exchange of documents
US9495553B2 (en) 2016-11-15 Providing path-level access control for structured documents stored in a database
US8768931B2 (en) 2014-07-01 Representing and manipulating RDF data in a relational database management system
Heflin et al. 2000 Dynamic ontologies on the web
Free format text: ASSIGNMENT OF ASSIGNORS INTEREST;ASSIGNORS:PUZ, NICHOLAS K.;RICHARDT, RANDAL J.;BHAGHAVAN, RUPA;AND OTHERS;REEL/FRAME:014471/0189