Importance

Loading Importance Indicators...

Abstract

A system and method is provided that facilitates database-level access control using rule-based derived accessor groups. The system may comprise a database including a plurality of object data records for which user access rules are stored in the database via a plurality of derived accessor groups associated with each object data record. The database may store definitions of each derived accessor group in tables that specify both positive relationships and negative relationships between the derived accessor groups and primitive user groups. Such primitive user groups may be associated with users that have membership in the primitive user groups. The positive relationships specify primitive user groups that have memberships in particular derived accessor groups. Also the negative relationships specify primitive user groups that are not permitted membership in particular derived accessor groups. The definitions of the derived groups may be stored in the database so as to enable lookup of derived group memberships from primitive user group memberships for a user in a same single SQL query that is performed to access only object data records from the database for which the derived accessor groups specify that the user has permission to access.

Loading the Abstract Image...

First Claim