Mohammed Rafiq, 74San Jose, CA

8584196, Nov 12, 2013

May 5, 2008

12/114915

Mohammed Irfan Rafiq - Mountain View CA, US
Sabina Petride - Menlo Park CA, US
Sam Idicula - Mountain View CA, US
Ashwini Surpur - Cupertino CA, US
Nipun Agarwal - Santa Clara CA, US
Bhushan Khaladkar - Mountain View CA, US
Tim Wing Yu - Cupertino CA, US

Oracle International Corporation - Redwood Shores CA

G06F 21/00

726 1, 726 26, 370392

One embodiment of the present invention provides a system for efficiently evaluating a security policy. During operation, the system retrieves one or more roles associated with the user. Next, the system checks if a session-level cache exists for a set of Access Control Entries (ACEs) which is associated with the one or more roles. If this session-level cache exists, the system returns the set of ACEs from the session-level cache. Otherwise, the system generates the set of ACEs associated with the one or more roles from an Access Control List (ACL). During operation, the system can also update the one or more roles associated with the user and update the set of ACEs based on the updated one or more roles and the ACL. The system subsequently updates the session level cache with the updated set of ACEs and updated one or more roles.

2009014, Jun 4, 2009

Nov 29, 2007

11/947235

Sam Idicula - San Jose CA, US
Thomas Keefe - Mill Valley CA, US
Mohammed Irfan Rafiq - Mountain View CA, US
Tanvir Ahmed - Hayward CA, US
Vikram Pesati - San Jose CA, US
Nipun Agarwal - Santa Clara CA, US

ORACLE INTERNATIONAL CORPORATION - Redwood Shores CA

H04L 9/32

726 2

Embodiments of the present invention provide systems and techniques for creating, updating, and using an ACL (access control list). A database system may include a constraining ACL which represents a global security policy that is to be applied to all applications that interact with the database. By ensuring that all ACLs inherit from the constraining ACL, the database system can ensure that the global security policy is applied to all applications that interact with the database. During operation, the system may receive a request to create or update an ACL. Before creating or updating the ACL, the system may modify the ACL to ensure that it inherits from the constraining ACL. In an embodiment, the system grants a privilege to a user only if both the ACL and the constraining ACL grant the privilege.

2009015, Jun 18, 2009

Dec 13, 2007

11/955781

Sam Idicula - Mountain View CA, US
Mohammed Irfan Rafiq - Santa Clara CA, US
Nipun Agarwal - Santa Clara CA, US

ORACLE INTERNATIONAL CORPORATION - Redwood Shores CA

G06F 17/30

707 9, 707E17001

One embodiment of the present invention provides a system for efficiently caching a system-wide Access Control Entry (ACE) for a subject requesting an action on an object associated with an application. During operation, the system retrieves a security class that is associated with an application. The system then checks if a constrained system-wide ACE associated with the subject, the object, the requested action, and the security class exists in a cache. If so, then the system retrieves the entry. Otherwise, the system retrieves a system-wide ACE associated with the subject and the requested action. The system also retrieves a local ACE associated with the subject, the object, the requested action, and the security class. Next, the system constrains the system-wide ACE with the local ACE and caches the result so that the constrained system-wide ACE is associated with the subject, the object, the requested action, and the security class.

2009031, Dec 24, 2009

Jun 23, 2008

12/144028

Sam Idicula - Mountain View CA, US
Mohammed Irfan Rafiq - Mountain View CA, US
Nipun Agarwal - Santa Clara CA, US

Oracle International Corporation - Redwood Shores CA

G06F 17/30
G06F 7/00

707 2, 707 4, 707E17017

One embodiment of the present invention provides a system that facilitates performing a cost-based optimization of authorization checks in a database system. During operation, the system receives a query at the database system. Next, the system estimates a cost for executing the query, which involves estimating a cost for evaluating authorization checks, which involve functional evaluations of access rights for data accessed by the query. The system then rewrites the query to include evaluating authorization checks within the query. The system also estimates a cost for executing the rewritten query. Next, the system determines if executing the rewritten query has a lower cost than executing the query and performing the authorization checks. If so, the system executes the rewritten query. However, if not, the system executes the query.

2010003, Feb 11, 2010

Aug 8, 2008

12/188675

Mohammed Irfan Rafiq - Mountain View CA, US
Chon Hei Lei - Alameda CA, US
Vikram Kapoor - Cupertino CA, US
Thomas F. Keefe - Mill Valley CA, US
Nipun Agarwal - Santa Clara CA, US
Thomas Baby - Maple Valley WA, US
Sam Idicula - Santa Clara CA, US
Vikram Reddy Pesati - San Jose CA, US

ORACLE INTERNATIONAL CORPORATION - Redwood Shores CA

G06F 17/30

707 9, 707E17005

One embodiment of the present invention provides a system that implements a security policy in a database. During operation, the system receives a request associated with a set of objects in the database. Next, the system obtains a set of access control lists (ACLs) associated with the database, wherein a respective ACL specifies one or more access privileges associated with a user or user group, and wherein a respective ACLs is not specific to a particular object in the database. The system then evaluates the ACLs to obtain a set of ACL results associated with the request and processes the request by applying the set of ACL results to the objects without evaluating the ACLs repeatedly for each of the objects.