Caching the results of security policy functions
A fine-grained access control mechanism uses policy functions that are associated with a database object (e.g. table and view). The policy functions are invoked, when, for example, a database server detects that a query is issued against the database object. The value of a policy function remains constant under certain conditions. For example, once a database server is brought up, the value of a policy function may remain the same. Users can specify the conditions under which the value of a policy function remain constant. Based on this information, when a policy function is computed while processing a query, the database server caches the value of the policy function. When processing another query that requires the value of the policy function, the database server retrieves the result from the cache rather than re-computing the policy function, as long as the condition under which the policy function remains constant persists.
1. A method used for executing queries, the method comprising the steps of:
storing first data that indicates one or more conditions under which output of a function remains constant;
in response to receiving a query:
computing a value of the function, and
based on said first data, determining whether to store the value in a cache;
in response to determining to store the value in the cache, storing in the cache the value in association with the function;
after performing the step of storing, receiving a second query, wherein processing the second query requires the output of the function; and
in response to receiving said second query, determining based on said first data whether to retrieve said value from said cache as the output of said function; and
in response to determining to retrieve said value from said cache, retrieving said value from said cache.
2. The method of claim 1 , wherein:
the one or more conditions include that the second query access a particular database object; and
the step of storing in the cache includes storing the value in association with the database object.
3. The method of claim 1 , wherein the one or more conditions include that processing the second query requires the value of said function.
4. The method of claim 1 , wherein:
the first query is associated with a session;
the one or more conditions include that the second query is associated with the session; and
the step of storing in the cache includes storing the value in association with the session.
5. The method of claim 4 , wherein:
the one or more conditions include that the second query access a particular database object; and
the step of storing in the cache includes storing the value in association with the particular database object.
6. The method of claim 4 , wherein the step of storing the value in association with the session includes storing the value in memory to which access by a process is restricted based on a particular session associated with the process.
7. The method of claim 1 , wherein:
the method includes receiving user input that specifies the one or more conditions; and
said first data is generated in response to receiving said user input.
8. The method of claim 7 , wherein said user input identifies a policy function type.
9. The method of claim 1 , wherein said value is a string representing a predicate.
10. A computer-readable storage medium carrying one or more sequences of instructions which, when executed by one or more processors, causes the one or more processors to perform the method recited in claim 1 .
11. A computer-readable storage medium carrying one or more sequences of instructions which, when executed by one or more processors, causes the one or more processors to perform the method recited in claim 2 .
12. A computer-readable storage medium carrying one or more sequences of instructions which, when executed by one or more processors, causes the one or more processors to perform the method recited in claim 3 .
13. A computer-readable storage medium carrying one or more sequences of instructions which, when executed by one or more processors, causes the one or more processors to perform the method recited in claim 4 .
14. A computer-readable storage medium carrying one or more sequences of instructions which, when executed by one or more processors, causes the one or more processors to perform the method recited in claim 5 .
15. A computer-readable storage medium carrying one or more sequences of instructions which, when executed by one or more processors, causes the one or more processors to perform the method recited in claim 6 .
16. A computer-readable storage medium carrying one or more sequences of instructions which, when executed by one or more processors, causes the one or more processors to perform the method recited in claim 7 .
17. A computer-readable storage medium carrying one or more sequences of instructions which, when executed by one or more processors, causes the one or more processors to perform the method recited in claim 8 .
18. A computer-readable storage medium carrying one or more sequences of instructions which, when executed by one or more processors, causes the one or more processors to perform the method recited in claim 9 .
19. A method used for executing queries, the method comprising the steps of:
means for storing first data that indicates one or more conditions under which output of a function remains constant;
means for, in response to receiving a query:
computing a value of the function, and
based on said first data, determining whether to store the value in a cache;
in response to determining to store the value in the cache, storing in the cache the value in association with the function;
after the step of storing, receiving a second query, wherein processing the second query requires the output of the function; and
means for determining, in response to receiving said second query and based on said first data, whether to retrieve said value from said cache as the output of said function; and
in response to determining to retrieve said value from said cache, retrieving said value from said cache.
20. The method of claim 19 , wherein:
the method includes receiving user input that specifies the one or more conditions; and
said first data is generated in response to receiving said user input.
21. A method used for executing queries, the method comprising the steps of:
in response to receiving a query:
computing a value of a function, and
detecting one or more conditions under which the function remains
constant;
in response to detecting said one or more conditions under which the function
remains constant, storing in a cache the value in association with the
function;
after performing the step of storing, receiving a second query, wherein processing
the second query requires the output of the function;
in response to receiving said second query, determining to retrieve said value
from said cache as the output of said function; and
in response to determining to retrieve said value from said cache, retrieving said
value from said cache.
22. The method of claim 21 , wherein: the one or more conditions include that the second query access a particular
database object; and
the step of storing in the cache includes storing the value in association with the
database object.
23. The method of claim 21 , wherein the one or more conditions include that processing the second query requires the value of said function.
24. The method of claim 21 , wherein:
the first query is associated with a session;
the one or more conditions include that the second query is associated with the
session; and
the step of storing in the cache includes storing the value in association with the
session.
25. The method of claim 24 , wherein:
the one or more conditions include that the second query access a particular
database object; and
the step of storing in the cache includes storing the value in association with the
particular database object.
26. The method of claim 24 , wherein the step of storing the value in association with the session includes storing the value in memory to which access by a process is restricted based on a particular session associated with the process.
27. The method of claim 21 , wherein the method includes receiving user input that specifies the one or more conditions.
28. The method of claim 27 , wherein said user input identifies a policy function type.
29. The method of claim 21 , wherein said value is a string representing a predicate.
30. A computer-readable storage medium carrying one or more sequences of instructions which, when executed by one or more processors, causes the one or more processors to perform the method recited in claim 21 .
31. A computer-readable storage medium carrying one or more sequences of instructions which, when executed by one or more processors, causes the one or more processors to perform the method recited in claim 22 .
32. A computer-readable storage medium carrying one or more sequences of instructions which, when executed by one or more processors, causes the one or more processors to perform the method recited in claim 23 .
33. A computer-readable storage medium carrying one or more sequences of instructions which, when executed by one or more processors, causes the one or more processors to perform the method recited in claim 24 .
34. A computer-readable storage medium carrying one or more sequences of instructions which, when executed by one or more processors, causes the one or more processors to perform the method recited in claim 25 .
35. A computer-readable storage medium carrying one or more sequences of instructions which, when executed by one or more processors, causes the one or more processors to perform the method recited in claim 26 .
36. A computer-readable storage medium carrying one or more sequences of instructions which, when executed by one or more processors, causes the one or more processors to perform the method recited in claim 27 .
37. A computer-readable storage medium carrying one or more sequences of instructions which, when executed by one or more processors, causes the one or more processors to perform the method recited in claim 28 .
38. A computer-readable storage medium carrying one or more sequences of instructions which, when executed by one or more processors, causes the one or more processors to perform the method recited in claim 29 .