Data processing: database and file management or data structures – Database design – Data structure types
Reexamination Certificate
2000-04-03
2004-11-16
Vu, Kim (Department: 2135)
Data processing: database and file management or data structures
Database design
Data structure types
C707S793000
Reexamination Certificate
active
06820082
ABSTRACT:
BACKGROUND OF THE INVENTION
The present invention relates generally to database management systems, and more particularly to database security for controlling database access and updates.
Conventional database systems utilize a plurality of tables to store information such as users, relationship of users, and access privileges of users. Database systems often utilize three tier software architecture which includes a user interface, database, and an application server located between the user interface and database. In a network environment the application server provides resources to multiple clients. For example, a user retrieves information from tables by entering input that is converted to queries by an application server. The application server submits the queries to a database server. In response to the query, the database server accesses the tables specified in the query to determine which information within the tables satisfies the queries. The information that satisfies the queries is then retrieved by the database server and transmitted to the application server, and ultimately to the user.
The application server may provide process management where business logic is executed and provides functions such as queuing, application execution, and database access, for example. Business logic may include programs that perform functions such as retrieving data from files, ensuring security and integrity, and undertaking table manipulations (e.g., updates, deletions, calculations, and the like). The business logic and management of these systems is typically implemented using compiled code. Since the business logic and database management cannot be reconfigured without revising the code and recompiling the program, making changes to the application server is often time consuming and can only be performed by someone with in depth knowledge of the system.
Furthermore, changes to database security may also be difficult for users of the system to implement. Security is typically provided through access control lists which specify the privileges of particular users with respect to data to identify which users are allowed access to data or are permitted to edit the data. The users may be grouped together by system administrators so that security is defined for certain groups. If changes to the security system are required, to allow additional people or groups access to specific data, for example, the access control lists need to be redefined. Access control lists may either be associated with tables or with rows within a table. Another common technique is to define security based on views, which are predefined subsets of a table. To provide true row-level security control for individual users, every user would have to have their own view. Since views are part of the low-level code of an application, adding a new user would require updating the application. In the first case, it is difficult to control access or updates to specific rows within the table since a user typically has access to all of a table or none of a table. This makes it difficult to handle common situations, such as when a user wants to access or update rows that the user has created. In the second case, where access control lists are defined for each row, the number of access control lists can be very large. It is not uncommon to have tables that contain from ten thousand to over one million rows. While individual access control lists provide very fine control, the control lists quickly become unmanageable and updating thousands of control lists is not practical. As a result, security is compromised or does not properly reflect the desired controls.
Another drawback with access control lists is that they do not depend upon the state of the data in a row. For example, access control lists do not allow a user to update a row that he created as long its status is “draft,” and prevent the user from updating the row once its status changes to “submitted.”
There is, therefore, a need for a database management system that provides an easily configurable business logic that allows for security policies that can be created to apply to different situations and applied automatically.
SUMMARY OF THE INVENTION
A rule-based database security system and method are disclosed. In one aspect of the invention a method is for processing requests from a user to perform an action with respect to data stored in an electronic database. The method includes defining a plurality of user defined rules containing security constraints for accessing the data and receiving a request at a user interface. The request is transferred from the user interface to a rule engine. The plurality of rules are applied to the request to determine if the request passes the security constraints and the request is modified if required to meet the security constraints. The method further includes accessing the data to perform the request if the request meets the security constraints.
In another aspect of the present invention a method for processing requests for accessing a database includes receiving a query for data from the database at a user interface and transferring the query to a rule engine. The rule engine has a plurality of user defined rules containing security constraints for accessing the data. The method further includes modifying the query by applying the plurality of rules to the query to limit the amount of data requested from the database based on the security constraints. The modified query is issued to the database and data obtained from the databases is transmitted to the user.
A database security management system of the present invention is operable to interface between a user and an electronic database and configured to process requests from the user to perform an action with respect to data stored in the database. The system includes a user interface operable to receive a request from the user to obtain data within the electronic database, form a query based on the request, and pass the query to a rule engine. The user request includes a user identifier. The system further includes a data manager operable to submit the request to the database and return requested data to the rule engine. The rule engine includes a plurality of user defined rules which apply security constraints to the query and/or the requested data, based on the user identifier.
In another aspect of the invention, a database security management system is operable to interface between a user and an electronic database and configured to process requests from the user to perform an action with respect to data stored in the database. The system includes a user interface operable to receive a request from the user to obtain data within the database and pass the request to a rule engine. The rule engine includes a plurality of security rules and is operable to evaluate the request against the plurality of rules to determine if the user has authority to perform requested action with respect to the data. The security rules are based on a relation between the user and the data.
In yet another aspect of the present invention, a method for processing requests from a user to perform an action with respect to data stored in an electronic database includes defining a plurality of user defined rules containing security constraints for accessing the data and receiving a request at a user interface. The request is transferred from the user interface to a rule engine. The method further includes applying the plurality of rules to the request to determine if the request passes the security constraints. The rules are based on a relation between the user and the data. The data is accessed to perform the request if the request meets the security constraints.
The above is a brief description of some deficiencies in the prior art and advantages of the present invention. Other features, advantages, and embodiments of the invention will be apparent to those skilled in the art from the following description, drawings, and claims.
REFERENCES:
patent: 5265221 (1993-11-01), Miller
patent: 5355474 (
Cook William R.
Gannholm Martin R.
Allegis Corporation
Hamilton Monplaisir
Van Pelt & Yi LLP
Vu Kim
LandOfFree
Rule based database security system and method does not yet have a rating. At this time, there are no reviews or comments for this patent.
If you have personal experience with Rule based database security system and method, we encourage you to share that experience with our LandOfFree.com community. Your opinion is very important and Rule based database security system and method will most certainly appreciate the feedback.
Profile ID: LFUS-PAI-O-3319090