Conditional role activation in a database

Patent metadata

Field	Value
Publication number	US-9330276-B2
Application number	US-201213729698-A
Country	US
Kind code	B2
Filing date	Dec 28, 2012
Priority date	Dec 28, 2012
Publication date	May 3, 2016
Grant date	May 3, 2016

Abstract

Methods, systems and computer-readable storage mediums encoded with computer programs executed by one or more processors for conditional role activation in a database are disclosed. In an embodiment, a request to activate a role for a user of a database system is received, and a predicate for conditional activation of the role is determined. The conditions of the predicate are evaluated, and if the conditions of the predicate are satisfied, the role is activated for the user. If, however, one or more of the conditions of the predicate are not satisfied, the role is not activated for the user.

First claim

What is claimed is:

1. A computer-implemented method, comprising:
receiving, by a database that enforces which users may activate which roles for the database, a request to activate a role for a first user of the database, the role corresponding to one or more privileges associated with functions of the database;
determining, by the database, that a predicate for conditional activation of the role using a ROLE element of SQL (structured query language) was defined and stored in the database prior to receiving the request, wherein a first predicate includes one or more conditions that must be satisfied for the role to be activated for the first user, and wherein a second predicate includes one or more conditions different from the first predicate that must be satisfied for the role to be activated for a second user of the two or more users;
evaluating the conditions of the first predicate by the database, wherein the database determines whether the conditions of the first predicate are satisfied;
if the conditions of the first predicate are satisfied, activating, by the database, the role for the user, wherein the activating enables the first user to perform the functions of the database associated with the role; and
if one or more of the conditions of the first predicate are not satisfied, not activating, by the database, the role for the first user, wherein the not activating prevents the first user from performing the functions of the database associated with the role.

2. The computer-implemented method of claim 1 , further comprising:
receiving a request to grant the role in the database;
receiving, as part of the request, the conditions and one or more users associated with the role;
generating the first predicate in the database system, the first predicate including the conditions; and
creating, in the database, an association between the role and one or more of the users.

3. The computer-implemented method of claim 1 , wherein the receiving comprises:
determining whether the first user is associated with the role in the database, wherein if the first user is not associated with the role, the role is not activated for the first user.

4. The computer-implemented method of claim 3 , further comprising:
determining that the first user is not associated with role in the database; and
providing an error message to the first user indicating that the role was not activated for the first user.

5. The computer-implemented method of claim 1 , wherein the determining the predicate comprises:
determining that the first predicate includes one or more conditions that must be satisfied for the role to be activated for the first user and a third user.

6. The computer-implemented method of claim 1 , wherein the receiving comprises:
receiving the request either automatically upon a login of the first user to the database or manually based upon a request from the first user.

7. The computer-implemented method of claim 1 , wherein the receiving comprises:
determining that the request includes a structured query language (SQL) statement, including a WHERE clause indicating the one or more conditions of the first predicate.

8. The computer-implemented method of claim 1 , wherein two or more users are associated with each of the predicates and the role, wherein at least one of the predicates includes two or more conditions.

9. The computer-implemented method of claim 1 , wherein the role both grants the first user privileges to perform the one or more functions associated with the role and explicitly restricts one or more additional privileges from the first user for performing one or more prohibited functions associated with the database.

10. The computer-implemented method of claim 1 , wherein the receiving comprises:
receiving the request to grant a plurality of roles to the first user.

11. The computer-implemented method of claim 1 , wherein the database comprises a relational database including one or more SQL functions used to perform the evaluating.

12. The computer-implemented method of claim 1 , wherein if the ROLE is not defined for a third user in the database prior to receiving the request, then the ROLE is not activated for the third user, and wherein the ROLE is defined for the first user prior to receiving the request.

13. The computer-implemented method of claim 1 , wherein determining that a predicate for conditional activation of the role using a ROLE element comprises determining whether the first user is accessing the database using a secure or insecure connection, wherein if the first user is accessing the database using a secure connection, the role is activated for the first user, and wherein if the first user is accessing the database using an insecure connection the role is not activated for the first user.

14. The computer-implemented method of claim 1 , wherein the role comprises an administrative role with regard to the database, wherein a user having the administrative roll logs directly into the database.

15. The computer-implemented method of claim 1 , wherein the system state comprises a current time, wherein a ROLE element of SQL corresponding to the role is only activated for the first user during a specifically defined time interval during a day as measured by the current time, wherein the role is not activated for the first user during any other time interval.

16. A database, comprising:
a role manager implemented on a processor that when executed by the processor is configured to:
receive, by the database that enforces which users may activate which roles for the database, a request to activate a role for a first user of the database, the role corresponding to one or more privileges associated with functions of the database;
determine, by the database, that a predicate for conditional activation of the role using a ROLE element of SQL (structured query language) was defined and stored in the database prior to receiving the request, wherein a first predicate includes one or more conditions that must be satisfied for the role to be activated for a first user, and wherein a second predicate includes one or more conditions different from the first predicate that must be satisfied for the role to be activated for a second user of the two or more users; and

a verifier configured to:
evaluate the conditions of the first predicate by the database, wherein the database determines whether the conditions of the first predicate are satisfied;

wherein conditions of the first predicate are satisfied, activating, by the database, the role for the first user, wherein the activating enables the first user to perform the functions of the database associated with the role, and
wherein if one or more of the conditions of the predicate are not satisfied, not activating, by the database, the role for the first user, wherein the not activating prevents the first user from performing the functions of the database associated with the role.

17. The database of claim 16 , wherein the role manager is further configured to:
receive a request to create the role in the database;
receive, as part of the request, the conditions and one or more users associated with the role;
generate the predicate in the database, the predicate including the received conditions;
create the role in the database, including an association between the role and one or more of the users.

18. The database of claim 16 , wherein the role manager is further configured to:
determine that the first user is associated with the role in the database, wherein if the

Assignees

• Banks Barbara
• Chitkara Rajnish
• Sybase Inc

Inventors

• Banks Barbara
• Chitkara Rajnish

Classifications

• G06F16/20

  of structured data, e.g. relational data · CPC title

• G06F2221/2117

  User registration · CPC title

• G06F2221/2141

  Access rights, e.g. capability lists, access control lists, access tables, access matrices · CPC title

• G06F21/6227 Primary

  where protection concerns the structure of data, e.g. records, types, queries · CPC title

• G06F17/30286

  Physics · mapped topic