Data access authorization for dynamically generated database structures
Techniques for determining user authorization to access data in dynamically generated database structures are presented. A method can commence upon receiving database statements from a user that is authorized to access a set of data in a database. A physical plan derived from the received database statements to operate on the database is inspected for references to dynamically generated data structures such as aggregates. A modified physical plan having no aggregates and/or other altered database structures is used to issue low latency database statements to operation on the database for verifying user access authorization to the underlying data. In some cases, the foregoing database statements are based on a virtual multidimensional data model. In other cases, a low latency directive is included in the modified physical plan to facilitate a low latency authorization response.
1 . A method comprising:
receiving a set of database query statements from a user, the database query statements applied to a subject database including subject data, the user having authorization to access a first portion of the subject data, the user not having authorization to access a second portion of the subject data;
generating an authorization request including a low latency directive based on the set of database query statements, the authorization request generated in response to detecting an altered subject data structure to access the second portion of the subject data, the authorization request including an access token that provides access to the first portion of the subject data; and
producing a result set for the set of database query statements, the result set derived using data from the first portion and the second portion of the subject data.
2 . The method as in claim 1 , wherein the authorization request minimizes an authorization request response time associated with the authorization request.
3 . The method as in claim 1 , further comprising receiving the access token; wherein the access token provides access to both the first portion and the second portion of the subject data.
4 . The method as in claim 1 further comprising:
deriving a first subject database statement from the set of database query statements, the first subject database statement being a planned subject database statement; and
inspecting the first subject database statement for references to a set of subject data structures; and
based on the inspecting, detecting that the set of subject data structures do not reference data in the first portion of the subject data.
5 . The method as in claim 4 further comprising:
deriving a second subject database statement from the set of database query statements, the second subject database statement including the authorization request;
executing the second subject database statement; and
in response to the executing, receiving an authorization response confirming access to the second portion of the subject data.
6 . The method in claim 5 further comprising:
executing the first database statement, execution of the first database statement generating the set of subject data structures in the second portion of the subject data.
7 . A method comprising:
receiving a set of database query statements from a user, the database query statements applied to a subject database including subject data, the user having authorization to access a first portion of the subject data, the user not having authorization to access a second portion of the subject data;
generating an authorization request including a low latency directive based on the set of database query statements, the authorization request generated to access the second portion of the subject data, the low latency directive depending on a data type, the authorization request including an access token that provides access to the first portion of the subject data; and
producing a result set for the set of database query statements, the result set derived using data from the first portion and the second portion of the subject data.
8 . The method as in claim 1 , wherein the subject database is represented by a virtual multidimensional data model, the virtual multidimensional data model including one or more virtual cubes derived from a set of subject database attributes, the set of database query statements applied to the virtual multidimensional data model.
9 . The method as in claim 8 , wherein the result set derived from the set of database query statements is derived at least in part on the virtual multidimensional data model.
10 . A system comprising:
a database manager including storage media and a processor for a protected resource, configured for:
receiving a set of database query statements from a user, the database query statements applied to a subject database including subject data, the user having authorization to access a first portion of the subject data, the user not having authorization to access a second portion of the subject data;
generating an authorization request including a low latency directive based on the set of database query statements to minimize an authorization request response time associated with the authorization request, the authorization request generated to access the second portion of the subject data, the authorization request including an access token that provides access to the first portion of the subject data; and
producing a result set for the set of database query statements, the result set derived using data from the first portion and the second portion of the subject data.
11 . The system as in claim 10 further comprising:
generating the authorization request in response to detecting an altered subject data structure.
12 . The system as in claim 10 , further comprising receiving the access token, wherein the access token provides access to both the first portion and the second portion of the subject data.
13 . The system as in claim 10 further comprising:
deriving a first subject database statement from the set of database query statements, the first subject database statement being a planned subject database statement; and
inspecting the first subject database statement for references to a set of subject data structures; and
based on the inspecting, detecting that the set of subject data structures do not reference data in the first portion of the subject data.
14 . The system as in claim 13 further comprising:
deriving a second subject database statement from the set of database query statements, the second subject database statement including the authorization request;
executing the second subject database statement; and
in response to the executing, receiving an authorization response confirming access to the second portion of the subject data.
15 . The system in claim 14 further comprising:
executing the first database statement, execution of the first database statement generating the set of subject data structures in the second portion of the subject data.
16 . The system as in claim 10 , wherein the subject database is represented by a virtual multidimensional data model, the virtual multidimensional data model including one or more virtual cubes derived from a set of subject database attributes, the set of database query statements applied to the virtual multidimensional data model.
17 . The system as in claim 16 , wherein the result set derived from the set of database query statements is derived at least in part on the virtual multidimensional data model.
18 . A computer program product embodied in a non-transitory computer readable medium, the non-transitory computer readable medium having stored thereon a sequence of instructions which, when stored in memory and executed by a processor causes the processor to:
receive a set of database query statements from a user, the database query statements applied to a subject database including subject data, the subject database represented by a virtual multidimensional data model including one or more virtual cubes derived from a set of subject database attributes, the set of database query statements applied to the virtual multidimensional data model, and the user having authorization to access a first portion of the subject data, the user not having authorization to access a second portion of the subject data;
generate an authorization request including a low latency directive based on the set of database query statements, the authorization request generated to access the second portion of the subject data, the authorization request including an access token that provides access to the first portion of the subject data; and
produce a result set for the set of database query statements, the result set derived using data from the first portion and the second portion of the subject data.