International Business Machines Corporation

Timothy Jon Vincent

Curt Lee Cotner

Paul Miller Bird

Walid Rjaibi

Gerald George Kiernan

Sean W McKeough

Robert Alan Begg

Matthew Albert Huras

Yao-Ching Stephen Chen

Douglas James Doole

George M Wilson

Irene C Liu

Thomas Abel Beavin

Xun Xue

Paul Arnold Ostler

Brent P Gross

Claire Willey McFeely

William T O'Connell

Regina J Liu

Irene Ching-Hua Liu

Dengfeng Gao

Stephen Yao Ching Chen

Gregory R Stager

Joseph Serge Limoges

Dominique Jeremy Evans

Klaus B Schiefer

Roger L Zheng

David J Kuang

Liyan Zhou

Jo-Anne M Kirton

Xun Li

Joyce A Taylor

Eric L Alton

Harley W Boughton

Yuping Ding

Melissa N Bousfield

Access to a data element stored within a database object is controlled. A request is received from a user to perform an operation in relation to the database object, the operation including retrieval of information from the data element of the database object. Prior to retrieving information from the data element, a determination is made whether at least a portion of the information from the data element is subject to masking in accordance with an access policy. In response to determining that information from the data element is subject to masking, the request is modified to require that information from the data element be retrieved in a masked condition.

Masking sensitive data of table columns retrieved from a database

According to one embodiment of the present invention, a system processes a database query, and comprises a computer system including at least one processor. The system identifies one or more expressions within the database query utilizing a database object with value masking. Masking requirements are determined for each identified expression and the database object utilized by that identified expression is replicated to provide masked and actual versions of that database object in response to the masking requirements for that expression including masked values and actual values of that database object. The value masking of the database object is applied to the identified expressions within the database query based on the determined masking requirements to produce search results with masked values for the database query. Embodiments of the present invention further include a method and computer program product for processing a database query in substantially the same manner described above.

Query transformation for masking data within database objects

Provided are techniques for creating one or more fine-grained access control rules that are associated with a base table. A materialized query table is created from the base table without applying the one or more fine-grained access control rules associated with the base table when obtaining data from the base table. A fine-grained access control protection indicator is turned on for the materialized query table. In response to receiving a direct access request to the materialized query table in a query referencing the materialized query table, access is provided to the data in the materialized query table by applying one or more fine-grained access control rules associated directly with the materialized query table to the data in the materialized query table before returning the data.

Managing materialized query tables (MQTS) over fine-grained access control (FGAC) protected tables

A method for committing transactions in a distributed system are provided. The method provides for receiving a request from a client to commit a transaction at a coordinator node in the distributed system, tracking a tail log sequence number for every other node in the distributed system, determining a max log sequence number associated with the transaction for each participant node in the distributed system, and committing the transaction at the coordinator node when the tail log sequence number for each participant node is greater than or equal to the max log sequence number associated with the transaction at the respective participant node.

Commitment of transactions in a distributed system

A data server of a data processing system is operably coupled to a database and in communication with a middleware server. A connection between the data server and the middleware server is established and managed. A set of attributes identifying trusted middleware servers is instituted with the data server. The middleware server transmits a connection request to the data server. The connection request has request attributes including identifying the connection request as being for a new connection or reuse of an existing connection with different connection request attributes. A connection with the middleware server is established by the data server based on the connection request. A connection status message is received by the middleware server from the data server indicating a status of the connection request. A trust indicator for the connection is established at the data server according to a trust status identified by the set of attributes for the middleware server.

Method for establishing a trusted relationship between a data server and a middleware server

A method, computer program product and computing device for promoting reuse of previously generated access plans are disclosed. SQL statements containing literals are amended so as to substitute a parameter marker for each literal. Amended statements are provided to the DBMS along with parameters including the substituted literals and a substitution indicator indicating that the substitution has been performed. The DBMS assesses the soundness of the substitutions that are performed. Soundness may be measured in terms of the semantic correctness of the amended statement and the likelihood that the literal substitution will improve DBMS efficiency. If a substitution is unsound, the DBMS may obtain and optimize the original version of the amended SQL statement. Otherwise, the amended statement is optimized. Advantageously, SQL statements originally differing only in the value of one or more literals may become functionally equivalent, and the reuse of cached, previously generated access plans is thus promoted.

Substituting parameter markers for literals in database query language statement to promote reuse of previously generated access plans

A system provides efficient multi-protocol database transaction processing in a multi-communications protocol and multi-programming model computing environment. The system separates the source and the target functionalities, and uses generic function names linked to function pointers, in order to permit the source layer to call embedded functions in the target layer. As an example, the system provides a source layer code path that includes embedded call-back functions and embedded generic function names. A target layer code path is set to include embedded functions and generic call-back function names. A function pointer array permits the source layer code path to call functions embedded in the target layer code path using the generic function names. A call-back function pointer array permits the target layer code path to call the call-back functions embedded in the source layer code path using the generic call-back function names.

System and method for enabling efficient multi-protocol database transaction processing

A database server helps to streamline the retrieval of LOB values by deciding to send a locator in replacement of the LOB value, or the LOB value itself, depending upon the specific LOB value being retrieved. A threshold value is determined in a fetch query, and the LOB sizes below that threshold are sent as values in a corresponding fetch response, and the lengths above are sent as locators in the fetch response. Indicators are inserted in a fetch parameter of the response to inform the receiving client the form of retrieval that was used for each requested LOB value being returned.

System and method for executing a large object fetch query against a database

Library management for libraries of user-defined routines in a database system. Libraries are stored in a long-term storage device and loaded into working memory in the database system when routines in the libraries are to be executed. An unload thread is defined to carry out the process of unloading libraries from the working memory when such libraries are inactive. The unload thread becomes active on a defined timing interval. The unload thread accesses a hash table and a most recently used list to determine which of the loaded libraries is inactive and which of the libraries ought to be unloaded. The hash table maintains information as to which libraries have been accessed in the most recent past defined timing interval. The size of the most recently used list can be defined such that all libraries associated with the list are retained in working memory.

Management of user-defined routine libraries in database environments

Working memory in an SQL database system is organized in workspaces. Agent workspaces are defined into which working copies of SQL executable logic information are loaded. Application workspaces are also defined for the loading of working copies of SQL executable logic information. Reference copies of the SQL information are available in a global SQL cache. An application SQL context data structure is used as an entry point to access working copies of SQL information in the agent or application workspaces. An application workspace is associated with an application and is maintained until the last application in the set is not active. An agent workspace is associated with an agent in the database system and is maintained until the agent is no longer active.

Organization of SQL working memory in a transaction-bounded processing environment

An SQL database management system for executing SQL requests from applications. The SQL database management system includes a hierarchical arrangement of data structures comprising packages, section entries, sibling control blocks and sections, for representing SQL context information and SQL statement information. Each package represents SQL context information on an application component-level basis. Each section entry is associated with a package and corresponds to a set of SQL actions. Each section entry is potentially associated with one or more sibling control blocks. Each sibling control block is associated with one section and represents context information relating to a unique SQL request. Each section includes logic for a specific SQL statement.

Support for concurrent active SQL statements having shared SQL context information

A database management system provides for the execution of invokable user-defined routines. Applications specify user-defined routines as being threadsafe or not threadsafe and specify the language of user-defined routines. Execution of routines will be carried out dependent on the threadsafe characteristic of the routines and on the language of the routines. Routines are assigned to processes based on their language to have any given process execute routines of the same language. Routines that are specified to be threadsafe are executed in threads in a potentially multi-threaded process. Each routine that is specified to be not threadsafe is executed in a fenced-mode processes in which no other routine is being executed.

Mechanism for invocation of user-defined routines in a multi-threaded database environment

A cursor query identifier is defined to uniquely identify cursors in a relational database system that supports nested routine invocation. The identifier includes a cursor nesting level value that corresponds to the nested level at which the cursor is opened. The identifier also includes a invocation identifier that corresponds to the routine within which a cursor is opened. The third part of the identifier is a unique cursor counter. The definition of the cursor query identifier permits cursors to be opened within nested levels of the same relational database context and to be uniquely identified for reference by database system and by applications accessing the system.

Unique identification of SQL cursor occurrences in a repetitive, nested environment

A method for providing database connections in a network includes: (a) mapping a first plurality of logical connections for a transaction at the application server to a physical connection between the application server and the database server; (b) sending a request of the transaction to the database server utilizing one of the first plurality of logical connections, where the request is sent utilizing the physical connection; and (c) processing the request by a logical agent on the database server, where the logical agent is associated with the transaction, where the request is maintained in one of a second plurality of logical connections within the logical agent. In this manner, connections are logically separated from one another with minimal storage implications. Conflicts and unpredictable behavior can also be avoided.

System and method for providing multiple virtual database connections in a relational database system

A system and method for managing deadlocks in a database management system (DBMS) for a demultiplexed database system. The DBMS supports applications that are capable of holding and retaining locks on database resources while disassociated from worker agents. The system and method includes an application scheduler for managing requests for access to the database, and a deadlock detector for identifying a deadlock. The application scheduler assigns one worker agent to an application requesting access to a database resource, assigns a flag to an application holding a lock on the database resource while disassociated from a worker agent, and in cooperation with the deadlock detector, resolves the deadlock between the application requesting access and the flagged application holding the lock.

Growing community of inventors

Toronto, Canada

Timothy Jon Vincent