Patent Document ID: 8930403
Application ID: 14335252

Base Claim:
1. A method of providing access control (AC) in respect of a relational database storing information in tables and columns and being accessible from a user interface, which is configured to accept a database query from a user and return information extracted from the database, the method being implemented at least in part at a policy enforcement point (PEP), which is located between the database and the user interface, and comprising: i) intercepting, at the PEP, a database query; ii) assigning attribute values by performing at least one of the following substeps: ii-a) assigning a resource attribute value based on at least one target table or target column in the query; ii-b) assigning an action attribute value based on a construct type in the query; and ii-c) assigning a subject and/or environment attribute value based on an identity of the user or on environment data; iii) partially evaluating an attributed-based AC policy defined in terms of said attributes, by constructing a partial policy decision request containing the attribute values assigned in step ii) and evaluating the AC policy for this, whereby a simplified attribute-based AC policy is obtained; iv) deriving an access condition, for which the simplified AC policy evaluates to permit access; and v) amending the database query by imposing said access condition; and vi) transmitting the amended query to the database.

---

Claim 3:
3. The method of claim 1 , wherein, if the access condition derived in step iv) is not satisfiable, steps v) and vi) are replaced by the step of: v′) sending a non-access notification to the user interface.