MULTI-USER DATABASE SYSTEM AND METHOD

1 . A database system comprising:

a database system memory storing a database of data records and shared program instructions between first and second database users, wherein the shared program instructions define a privacy model comprising privacy restrictions for the first and second database users, respectively, and specify an authorization model comprising a first set of authorizations that permit the first database user to manipulate a first subset of the data records consistent with the first user's privacy restrictions and a second set of authorizations that permit the second user to manipulate a second subset of the data records consistent with the second user's privacy restrictions;

at least a first database server including a processor configured to execute the shared program instructions, wherein the shared program instructions, when executed by the processor:

1. process a transaction submitted by the first or second database user;

2. determine whether the transaction conforms to the privacy and authorization models; and

3. if the transaction passes step 2, commit the transaction and manipulate the first or second subset of data records consistent with privacy and authorization models.

2 . A database system according to claim 1 , further comprising program instructions stored with the memory that, when executed, validate that the transaction includes a cryptographic authorization from the first or second user consistent with the authorization model.

3 . A database system according to claim 2 , wherein the cryptographic authorization comprises the transaction being cryptographically signed by the first or second database user.

4 . A database system according to claim 1 , further comprising an evidence log and program instructions stored in the memory that, when executed by the processor:

record an execution history of the shared program instructions;

record a request to submit the transaction; and/or

record any cryptographic authorizations submitted along with the transaction.

5 . A database system according to claim 4 , further comprising an execution engine including program instructions that, when executed by the processor:

validate that the privacy restrictions for the first or second database user and the first or second set of authorizations conform to respective global rules for the database system; and

record evidence of validation of the privacy restrictions and authorizations in the evidence log.

6 . A database system according to claim 1 , further comprising a transaction and concurrency engine having program instructions that, when executed by the processor, use a concurrency control protocol to process concurrent transactions submitted to the database system.

7 . A database system according to claim 1 , wherein the shared program instructions are, at least in part, stored procedures stored in the memory, and the system further comprises a procedural handler configured to:

determine, from the transaction submitted by the first or second database user, one or more stored procedures suitable to process the transaction; and

process, at least in part, the transaction by executing the one or more stored procedures.

8 . A database system according to claim 1 , further comprising an execution engine configured to execute the shared program instructions and enforce the privacy and authorization models.

9 . A database system according to claim 8 , wherein the execution engine is configured to limit access to the data records in a manner consistent with the privacy model.

10 . A database system according to claim 8 , wherein the execution engine is configured to execute the shared program instructions and, if specified by the shared program instructions, alter the privacy and authorization models consistent with the shared program instructions.

11 . A database system according to claim 10 , wherein the transaction is submitted by the second database user and the shared program instructions, when executed by the processor, change at least the first database user's access to the first subset of the data records.

12 . A database system according to claim 10 , wherein the transaction is submitted by the second database user and the shared program instructions, when executed by the processor, change at least the first database user's first set of authorizations that permit the first database user to manipulate the first subset of the data records.

13 . A database system according to claim 11 further comprising an evidence log and program instructions stored in the memory that, when executed by the processor:

record an execution history of the shared program instructions;

record a request to submit the transaction; and/or

record any cryptographic authorizations submitted along with the transaction,

wherein the shared program instructions, when executed by the processor, alter the privacy and authorization models only if certain data is present or not present in the evidence log or the transaction.

14 . A database system according to claim 4 , wherein the shared program instructions, when executed by the processor, perform step 3 of claim 1 and commit the transaction only if certain data is present or not present in the evidence log or the transaction itself.

15 . A database system according to claim 1 , wherein the shared program instructions, when executed by the processor, commit both the transaction and evidence of its privacy and authorization validity simultaneously.

16 . A method of processing a plurality of transactions using a database system comprising a database system memory configured to store a database of data records, and at least a first database server including a processor, the method comprising:

a) processing a transaction submitted by a first or second database user to the database server;

b) determining whether the transaction conforms to a privacy model and an authorization model defined by shared program instructions between the first and second database users, wherein the privacy model comprises privacy restrictions for the first and second database users, respectively, and the authorization model comprises a first set of authorizations that permit the first database user to manipulate a first subset of the data records consistent with the first user's privacy restrictions and a second set of authorizations that permit the second user to manipulate a second subset of the data records consistent with the second user's privacy restrictions; and

c) if the transaction passes step (b), committing the transaction and manipulating the first or second subset of data records consistent with the privacy and authorization models.

17 . A method according to claim 16 further comprising the step of:

validating that the transaction includes cryptographic authorization from the first or second database user in accordance with the privacy model and/or authorization model.

18 . A method according to claim 16 , wherein the transaction includes a request to manipulate, consistent with the first set of authorizations, the first subset of data records in response to a condition, wherein step 16 .b) comprises verifying occurrence of the condition and manipulating the first subset of data records consistent with the privacy and authorization models.

19 . A method according to claim 18 , wherein the condition includes determining whether a status of another transaction or a subset of the data records meets certain criteria.

20 . A method according to claim 16 , wherein the privacy model and/or authorization model specify one or more anticipated actions or results, as part of the submitted transaction.

21 . A method according to claim 16 , wherein the database system further comprises an evidence log, the method further comprising:

a) recording an execution history of the shared program instructions;

b) recording a request to submit the transaction, and/or

c) recording any cryptographic authorizations submitted along with the transaction.

22 . A method according to claim 21 , further comprising:

validating that the privacy restrictions for the first or second database users in the privacy model and the first or second set of authorizations in the authorization model conform to respective global rules for the database system; and

recording evidence of validation of the privacy restrictions and authorizations in the evidence log.

23 . A method according to claim 16 further comprising:

executing a concurrency control protocol to process concurrent transactions submitted to the database system.

24 . A method according to claim 16 , wherein the database system memory stores program instructions, at least in part, as stored procedures, wherein the method further comprises a procedural handler of the database server performing the steps of:

determining, from the transaction submitted by the first or second database user, one or more stored procedures suitable to process the transaction;

processing, at least in part, the transaction by executing the one or more stored procedures.