Patent Document ID: 8316051
Application ID: 10006543
Patent Status: 1

Claim One:
1. A method for managing access to data in a database subject to a plurality of label-based security policies, the method comprising the steps of: receiving, a request for performing an operation set of one or more operations on data in a table of the database; determining which policies, of the plurality of label-based security policies, apply to the table based on a policy set of one or more policies associated with the table; for each operation in the operation set, determining whether to perform the operation on a row of the table based on a set of labels associated with the row, the set of labels corresponding to the policy set; adding, to the table, a first policy column that stores labels for a first policy of the policy set that has a first policy type that is selected from the group consisting of: (a) a compartmented policy type in which a label associated with a particular row must exactly match a subject's label in order for the subject to gain access to the particular row, (b) a multi-level policy type in which a label associated with the particular row must be at a same or lower level of security than a level of security associated with the subject in order for the subject to gain access to the particular row, and (c) a hierarchical policy type in which a label associated with the particular row must be at a same level of security associated with the subject or at a lower level on a same branch of a hierarchy that contains the level of security associated with the subject in order for the subject to gain access to the particular row; and adding, to the table, a second policy column that stores labels for a second policy of the policy set that has a second policy type that is selected from the group; wherein the first policy type differs from the second policy type; and wherein the method is executed by a database management system comprising one or more computer systems.