Patent ID: 7200595

Claim:
A computer-implemented system that facilitates secure access to a database, comprising: a security descriptor store component that stores security descriptors which embody security information associated with at least one row of the database, the database comprising at least one table having the at least one row and at least two columns, one of the at least two columns storing a security descriptor associated with the at least one row, the security descriptor identifying security information stored in the security descriptor store component associated with the at least one row, where security descriptor column is included in all access paths to the at least one table, and where the security information stored in the security descriptor comprising a kind of access is granted or denied; a database engine component provides a response to a query of the database, the response being based, at least in part, upon the security information stored in the security descriptor that is evaluated based upon information stored in the database and security context information of a user issuing the query, the response further comprising rows from the table if the rows are satisfied by the user security context information; a query component comprising a query optimizer determines an optimal way to answer the query and employs a cost-based optimization strategy; and a user session memory cache stores a computed result of whether a given security context has a given permission with respect to a particular security descriptor.