Method and system for optimizing row level security in database systems

1. A computer-implemented method for implementing a security policy in a database, comprising:

receiving a request associated with a first table row and a second table row in a database table;

obtaining a set of access control lists (ACLs) associated with the database;

evaluating the ACLs to obtain a corresponding set of ACL results associated with the database;

storing the ACL results;

applying a set of predicates to the stored ACL results and the first table row to obtain a first access privilege for the first table row, wherein a predicate determines the relevance of a corresponding ACL result to one or more rows of the database table;

applying the predicates to the stored ACL results and the second table row to obtain a second access privilege for the second table row, without re-evaluating the ACLs, thereby allowing evaluation of access privileges for the first and second table rows without repeatedly evaluating the ACLs; and

producing a result in response to the request.

2. The computer-implemented method of claim 1 , wherein obtaining the ACL results involves:

storing the ACL results in a bitmap; and

providing the bitmap for subsequent retrieval of the ACL results.

3. The computer-implemented method of claim 2 , wherein an ACL result is stored in the bitmap as a grant, a deny, an irrelevant, or an unknown.

4. The computer-implemented method of claim 1 , wherein applying the set of predicates to the stored ACL results and the second table row involves:

obtaining a predicate associated with an ACL;

evaluating the predicate based on the second table row; and

determining access privileges for the request based on the evaluated predicate and a stored ACL result for the ACL.

5. The computer-implemented method of claim 4 , wherein the first and second access privileges are associated with at least one of a read privilege, a write privilege, and an execute privilege.

6. The computer-implemented method of claim 4 , wherein the first and second access privileges are determined based on an order of the ACL results.

7. The computer-implemented method of claim 1 , wherein the request corresponds to a database query.

8. The computer-implemented method of claim 1 ,

wherein an ACL result is based on a security context associated with the request, and

wherein the security context corresponds to at least one of session information associated with the request, a user associated with the request, and a role of the user.

9. A system for implementing a security policy in a database, comprising:

a processor;

a memory;

a security repository comprising a set of access control lists (ACLs) associated with the database;

a request manager configured to:

receive a request associated with a first table row and a second table row in a database table; and

obtain the ACLs associated with the database;

a security manager configured to:

evaluate the ACLs to obtain a corresponding set of ACL results associated with the database;

store the ACL results;

apply a set of predicates to the stored ACL results and the first table row to obtain a first access privilege for the first table row, wherein a predicate determines the relevance of a corresponding ACL result to one or more rows of the database table; and

apply the predicates to the stored ACL results and the second table row to obtain a second access privilege for the second table row, without re-evaluating the ACLs, thereby allowing evaluation of access privileges for the first and second table rows without repeatedly evaluating the ACLs; and

an output manager configured to produce a result in response to the request.

10. The system of claim 9 , wherein the security manager is configured to obtain the ACL results by:

storing the ACL results in a bitmap; and

providing the bitmap for subsequent retrieval of the ACL results.

11. The system of claim 10 , wherein an ACL result is stored in the bitmap as a grant, a deny, an irrelevant, or an unknown.

12. The system of claim 9 , wherein the security manager is configured to apply the set of predicates to the stored ACL results and the second table row by:

obtaining a predicate associated with an ACL;

evaluating the predicate based on the second table row; and

determining access privileges for the request based on the evaluated predicate and a stored ACL result for the ACL.

13. The system of claim 12 , wherein the first and second access privileges are associated with at least one of a read privilege, a write privilege, and an execute privilege.

14. The system of claim 12 , wherein the first and second access privileges are determined based on an order of the ACL results.

15. The system of claim 9 ,

wherein the security manager corresponds to a query optimizer, and

wherein the request corresponds to a database query.

16. The system of claim 9 ,

wherein an ACL result is based on a security context associated with the request, and

wherein the security context corresponds to at least one of session information associated with the request, a user associated with the request, and a role of the user.

17. A computer-readable storage medium storing instructions that when executed by a computer cause the computer to perform a method for implementing a security policy, the method comprising:

receiving a request associated with a first table row and a second table row in a database table;

obtaining a set of access control lists (ACLs) associated with the database;

evaluating the ACL to obtain a corresponding set of ACL results associated with the database;

storing the ACL results;

applying a set of predicates to the stored ACL results and the first table row to obtain a first access privilege for the first table row, wherein a predicate determines the relevance of a corresponding ACL result to one or more rows of the database table;

applying the predicates to the stored ACL results and the second table row to obtain a second access privilege for the second table row, without re-evaluating the ACLs, thereby allowing evaluation of access privileges for the first and second table rows without repeatedly evaluating the ACLs; and

producing a result in response to the request.

18. The computer-readable storage medium of clam 17 , wherein obtaining the ACL results involves:

storing the ACL results in a bitmap; and

providing the bitmap for subsequent retrieval of the ACL results.

19. The computer-readable storage medium of claim 18 , wherein an ACL result is stored in the bitmap as a grant, a deny, an irrelevant, or an unknown.

20. The computer-readable storage medium of claim 17 , wherein applying the set of predicates to the stored ACL results and the second table row involves:

obtaining a predicate associated with an ACL;

evaluating the predicate based on the second table row; and

determining access privileges for the request based on the evaluated predicate and a stored ACL result for the ACL.

21. The computer-readable storage medium of claim 20 , wherein the access privilege is associated with at least one of a read privilege, a write privilege, and an execute privilege.

22. The computer-readable storage medium of claim 20 , wherein the first and second access privileges are determined based on an order of the ACL results.

23. The computer-readable storage medium of claim 17 , wherein the request corresponds to a database query.

24. The computer-readable storage medium of claim 17 ,

wherein an ACL result is based on a security context associated with the request, and

wherein the security context corresponds to at least one of session information associated with the request, a user associated with the request, and a role of the user.