Patent ID: 7711750

Claim:
A system embodied on computer-readable storage medium that when executed on one or more processors facilitates row-level database security, comprising: a component that utilizes an enhanced structured query language (SQL) programming language to create a plurality of row-level security expressions for one or more rows of data, wherein at least two row-level security expressions are created for the same row of data, the component associates one of the two row-level security expressions with a selected user, and wherein an SQL GRANT or DENY utility is utilized to associate the row-level security expression with the user, the GRANT utility utilized to associate a security expression with the user that provides access to row data when the row data satisfies the security expression and the DENY utility utilized to associate a security expression with the user that prohibits access to row data when the row data satisfies the security expression; and a data management component that utilizes at least one security expression to evaluate a queried row of data, wherein the at least one security expression is invoked based on the identity of the query initiator, and the row of data is made accessible to the query initiator only when the row satisfies the at least one security expression, wherein the GRANT utility employs a syntax including at least an expression name, a column name, a data name and a user name, where the expression name specifies a name of the security expression associated with the GRANT utility, the column name specifies a column to evaluate against the security expression associated with the GRANT utility, the data name specifies a source data to evaluate against the security expression associated with the GRANT utility, and the user name specifies a user or user group to associate with the security expression associated with the GRANT utility, wherein the DENY utility employs a syntax including at least an expression name, a data name and a user name, where the expression name specifies a name of the security expression associated with the DENY utility, the data name specifies a source data to evaluate against the security expression associated with the DENY utility, and the user name specifies a user or user group to associate with the security expression associated with the DENY utility.