Patent ID: 7962513

Claim:
A method for applying security policies to database requests comprising: mapping one or more pieces of information to a corresponding first set of metadata at a database appliance coupled between a database server and a database client, wherein mapping the one or more pieces of information comprises mapping one or more entities comprising at least a database table as defined at a database managed by the database server to a the first set of metadata and storing the first set of metadata at the database appliance; receiving a database request referencing the one or more entities at the database from the database client at the database appliance according to a database language supported by the database server; at the database appliance: determining a second set of metadata corresponding to the database request, wherein the second set of metadata at least partially overlaps with the first set of metadata; selecting one or more policies based on the database request, wherein the one or more policies comprises an enabling policy or a disabling policy and each policy comprises an associated set of conditions and an action; applying the one or more policies at the database appliance at least partially based on metadata in both the first set of metadata and the second set of metadata wherein applying a policy comprises evaluating at least a portion of the first set of metadata or at least a portion of the second set of metadata using the set of conditions associated with the policy to determine if the policy is met and taking the action associated with the policy if the policy is met; wherein mapping one or more pieces of information to the corresponding first set of metadata at the database appliance further comprises mapping a user name for a user entity as defined at the database to a user group not defined at the database; wherein determining the second set of metadata corresponding to the database request further comprises fetching at least a portion of the second set of metadata corresponding to the database request from an information system external to the database client and the database server; and wherein applying one or more policies comprises applying a set of enabling policies and, if the database request meets at least one enabling policy, applying a set of disabling policies.