Daniel A Wong, 62Carmichael, CA

6578037, Jun 10, 2003

Jun 7, 2000

09/589602

Daniel Manhung Wong - Sacramento CA
Chon Hei Lei - Alameda CA

Oracle Corporation - Redwood Shores CA

G06F 1730

707 10, 707 9

Described is a technique for controlling access to data in a database system. Groups of security policies are established for a database schema object, such as a table or a view. A security policy reflects access rules for accessing the database schema object. Access to the database schema object is restricted based on security policy groups selected for the user. The security policy groups are selected based on information associated with a user that is maintained or accessed by the database system. A default security policy is established and used to restrict access of users accessing the database schema object. The information associated with the user contains an attribute that identifies a policy group. The database management system uses the attribute to select policy groups that restrict the users access to the database scheme object. When the attribute does not identify any security policy group established for the database schema object, all security policies established for the database schema object are used to restrict access to the database schema object.

6745332, Jun 1, 2004

Jun 29, 1999

09/342312

Daniel M. Wong - Sacramento CA
Chon H. Lei - San Leandro CA

Oracle International Corporation - Redwood Shores CA

G06F 1130

713201, 713202, 713164, 713161

Methods for enabling database privileges are provided. The methods eliminate strict dependency on tradition password, or âsecretâ based security systems. Instead, database privileges are enabled based on verifying information stored in one or more frames of a call stack corresponds to trusted security logic. In another embodiment, database privileges are enabled based on policies identified in the trusted security logic. The methods and techniques described herein provide a flexible and extensible mechanisms for verifying that trusted security logic has been executed prior to enabling database privileges.

6813617, Nov 2, 2004

May 7, 2003

10/431971

Daniel Manhung Wong - Sacramento CA
Chon Hei Lei - Alameda CA

Oracle International Corporation - Redwood Shores CA

G06F 1730

707 4, 707 3, 707 5, 707 9

A fine-grained access control mechanism uses policy functions that are associated with a database object (e. g. table and view). The policy functions are invoked, when, for example, a database server detects that a query is issued against the database object. The policy functions return optimizer hints, which are added to the query.

6986060, Jan 10, 2006

May 23, 2000

09/577220

Daniel ManHung Wong - Sacramento CA, US

Oracle International Corp. - Redwood Shores CA

H04L 9/00
G06F 15/16
G06F 17/30

713201, 713202, 707 9, 709229

One embodiment of the present invention provides a system for sharing a security context between different sessions on a database server. The system operates by receiving a request at the database server through a database session between the database server and an application on a database client. The system looks up an identifier for an application client that was previously associated with the database session. The system uses this identifier to look up the security context containing attributes related to the application client within a storage area associated with the database server. Next, the system performs a database operation to satisfy the request and in doing so enforces access rights associated with the security context. In one embodiment of the present invention, the request includes a database query directed to a database on the database server. In one embodiment of the present invention, performing the database operation involves modifying the database query to enforce access rights associated with the security context.

7117197, Oct 3, 2006

Apr 26, 2000

09/559171

Daniel ManHung Wong - Sacramento CA, US
Chon Hei Lei - Alameda CA, US
Patrick F. Sack - Ashburn VA, US

Oracle International Corp. - Redwood Shores CA

G06F 17/30

707 3, 707 10, 707100

One embodiment of the present invention provides a system that selectively audits accesses to a relational database system. This system starts by receiving a query from a client at a database server. The system processes this query at the database server to produce a query result. The system also creates an audit record for rows in relational tables that are accessed by the query, and that satisfy an auditing condition. Next, the system records the audit record in an audit record store and returns the query result to the client. Integrating the auditing facility into the relational database system in this manner ensures that auditing is performed in the same way regardless of which application generates the query. Furthermore, this auditing is transparent to applications and users. In one embodiment of the present invention, the system additionally modifies the query so that processing the query causes the audit record to be created and recorded for rows in relational tables that are accessed by the query and that satisfy the auditing condition.

7127448, Oct 24, 2006

Apr 26, 2000

09/559206

Daniel ManHung Wong - Sacramento CA, US

Oracle International Corporation - Redwood Shores CA

G06F 17/30

707 2, 707 3, 707 4, 707 10

One embodiment of the present invention provides a system that selectively audits accesses to a relational database. The system receives a query at the relational database and modifies the query so that processing the query causes an audit record to be created and recorded for rows in relational tables that are accessed by the query and that satisfy an auditing condition. Next, the system processes the modified query to produce a query result. This processing causes an audit record to be created for rows in relational tables that are accessed by the query and that satisfy the auditing condition. The system records the audit record in an audit record store, and then returns the query result. In one embodiment of the present invention, if the query includes a select statement, the system inserts a case statement into the select statement. This case statement calls a function that causes the audit record to be created and recorded if the auditing condition is satisfied.

7228300, Jun 5, 2007

May 7, 2003

10/431972

Chon Hei Lei - Alameda CA, US
Daniel Manhung Wong - Sacramento CA, US

Oracle International Corporation - Redwood Shores CA

G06F 17/30

707 3, 707 4

A fine-grained access control mechanism uses policy functions that are associated with a database object (e. g. table and view). The policy functions are invoked, when, for example, a database server detects that a query is issued against the database object. The value of a policy function remains constant under certain conditions. For example, once a database server is brought up, the value of a policy function may remain the same. Users can specify the conditions under which the value of a policy function remain constant. Based on this information, when a policy function is computed while processing a query, the database server caches the value of the policy function. When processing another query that requires the value of the policy function, the database server retrieves the result from the cache rather than re-computing the policy function, as long as the condition under which the policy function remains constant persists.

7310647, Dec 18, 2007

Jan 23, 2004

10/763583

Chon Hei Lei - Alameda CA, US
Daniel Manhung Wong - Sacramento CA, US
Thomas Keefe - Mill Valley CA, US
Kristy Browder Edwards - San Francisco CA, US

Oracle International Corporation - Redwood Shores CA

G06F 17/30

707101, 707200

Returning rows having column values masked is disclosed. In response to receiving a database command, a modified database command is created that specifies whether to mask a value by returning a mask of the value instead of the value. In an embodiment, the condition expression is included in a policy function that is referenced by a policy. In an embodiment, the policy determines how the condition expressions are used. The condition expression may be used to determine which column values to mask. The condition expression may also be used to filter which rows are returned.