Access control for database

1. A computer-implemented method, comprising:

receiving a command for performing a database operation with respect to a table of a database, wherein the table has a visible key column for identification information and one or more invisible token columns for token information;

obtaining the user's role from the command;

identifying a record in the table based on the user's role; and

performing the database operation on the identified record, wherein the database operation comprises:

updating a record in the table, and wherein performing the database operation on the identified record comprises:

retrieving old token information of the record;

preparing first new token information based on the command;

inserting a first new record with the first new token information placed in the one or more token columns;

preparing second new token information based on the old token information and the first new token information;

inserting a second new record with the second new token information placed in the one or more token columns; and

updating the old token information with the first new token information.

2. The method according to claim 1 , wherein the token information includes at least one of authorization information and time cycle.

3. The method according to claim 1 , wherein the table comprises a plurality of records having the same value under the visible key column but having different value under the one or more taken column.

4. The method according to claim 1 , wherein the database operation comprises:

inserting a record into the table, and wherein performing the database operation on the identified record comprises:

preparing token information for the record; and

inserting the record with the token information placed in the one or more token columns.

5. The method according to claim 1 , wherein the database operation comprises:

deleting a record in the table, and wherein performing the database operation on the identified record comprises:

preparing new token information based on the command and old token information of the identified record; and

updating the old token information with the new token information.

6. The method according to claim 1 , wherein the identifying a record in the table is based on a combination of the identification information and the token information corresponding to the user's role.

7. The method according to claim 1 , wherein the database operation comprises selecting a record in the table, and wherein performing the database operation on the identified record further comprises:

filtering candidate records based on their token information.

8. The method according to claim 2 , wherein the user's role is one of a plurality of security groups for record access control.

9. A system, wherein a table of a database has a visible key column for identification information and one or more token columns for token information, the system comprising:

one or more processors;

a memory coupled to at least one of the processors;

a set of computer program instructions stored in the memory and executed by at least one of the processors in order to perform actions of:

receiving a command for performing a database operation with respect to a table of a database, wherein the table has a visible key column for identification information and one or more invisible token columns for token information;

obtaining the user's role from the command;

identifying a record in the table based on the user's role; and

performing the database operation on the identified record, wherein the database operation comprises:

updating a record in the table, and wherein performing the database operation on the identified record comprises:

retrieving old token information of the record;

preparing first new token information based on the command;

inserting a first new record with the first new token information placed in the one or more token columns;

preparing second new token information based on the old token information and the first new token information;

inserting a second new record with the second new token information placed in the one or more token columns; and

updating the old token information with the first new token information.

10. The system according to claim 9 , wherein the database operation comprises inserting a record into the table, and the set of computer program instructions when executed further perform actions of:

preparing token information for the record; and

inserting the record with the token information placed in the one or more token columns.

11. The system according to claim 9 , wherein the database operation comprises deleting a record in the table, and wherein the set of computer program instructions when executed further perform actions of:

preparing new token information based on the command and old token information of the identified record; and

updating the old token information with the new token information.

12. The system according to claim 9 , wherein the identifying a record in the table is based on a combination of the identification information and the token information corresponding to the user's role.

13. The system according to claim 9 , wherein the database operation comprises selecting a record in the table, and wherein the set of computer program instructions when executed further perform actions of:

filtering candidate records based on their token information.

14. The system according to claim 9 , wherein the token information includes at least one of authorization information and time cycle.

15. A computer program, wherein a table has a visible key column for identification information and one or more token columns for token information, the computer program comprising a computer readable storage medium having program instructions embodied therewith, the program instructions executable by a processor to cause the processor to:

receive a command for performing a database operation with respect to a table of a database, wherein the table has a visible key column for identification information and one or more invisible token columns for token information;

obtain the user's role from the command;

identify a record in the table based on the user's role; and

perform the database operation on the identified record, wherein the database operation comprises:

updating a record in the table, and wherein performing the database operation on the identified record comprises:

retrieving old token information of the record;

preparing first new token information based on the command;

inserting a first new record with the first new token information placed in the one or more token columns;

preparing second new token information based on the old token information and the first new token information;

inserting a second new record with the second new token information placed in the one or more token columns; and

updating the old token information with the first new token information.

16. The computer program according to claim 15 , wherein the database operation comprises inserting a record into the table, and wherein the program instructions executable by the processor cause the processor to:

prepare token information for the record; and

insert the record with the token information placed in the one or more token columns.

17. The computer program according to claim 15 , wherein the database operation comprises deleting a record in the table, and wherein the program instructions executable by the processor cause the processor to:

prepare new token information based on the command and old token information of the identified record; and

update the old token information with the new token information.

18. The computer program according to claim 15 , wherein the identifying a record in the table is based on a combination of the identification information and the token information corresponding to the user's role.

19. The computer program according to claim 15 , wherein the database operation comprises selecting a record in the table, and wherein the program instructions executable by the processor cause the processor to:

filter candidate records based on their token information.

20. The computer program according to claim 15 , wherein the token information includes at least one of authorization information and time cycle.