Row-level security in a relational database management system

1. An apparatus for use within a database management system having a data manager and a database, for determining whether a user is authorized to perform a requested operation on a row of data held within the database, the user being associated with a user security label and the row having a row security label, the apparatus comprising:

a user security unit having recorded therein a hierarchy of security labels;

a read security unit connected to the user security unit and between the data manager and the database, and configured to return the row from the database to the data manager only if the user security label is located in the hierarchy at a level with privileges that are greater than or equal to privileges for a level in the hierarchy at which the row security label is located.

2. The apparatus of claim 1, further comprising a write security unit connected to the data security unit and between the data manager and the database, and configured to set the row security label to the same value as the user security label if the requested operation is a row update operation.

3. The apparatus of claim 2, wherein the write security unit is further configured to set the row security label with a level lower than the user security level if the user is authorized to update rows with a lower level security label and if security categories specified for the lower level security label are a proper subset of security categories associated with the user security label.

4. The apparatus of claim 1, wherein the requested operation is submitted in a request from a user that does not contain a view operation.

5. The apparatus of claim 1, wherein a table containing the row of data contains access control information for limiting user access to the database.

6. The apparatus of claim 1, further comprising a cache configured to store security information associated with a cached security label, wherein the read access control unit uses the security information in the cache if the row security label matches the cached security label.

7. The apparatus of claim 1, wherein the read security unit compares, for each row of the database satisfying the requested operation, the user security level associated with the user with the row security level associated with the row.

8. The apparatus of claim 1, wherein the hierarchy of security labels correspond to a group of different levels of security in a multilevel security system.

9. A program product embodied on a computer readable medium, for controlling access to a relational database, comprising program instructions which when executed cause a computer to:

receive a user request for data from the database, the request including a request to perform a database operation and a user security label;

determine user security information from the user security label;

retrieve, in response to the user request, rows of data from a table in the database satisfying the database operation, the rows each having a security label;

determine row security information for each of the retrieved rows based on the row's security label;

determine, for each retrieved row, whether the user is authorized to access the row based on the user security information and the row security information by determining if the user security information dominates the row security information; and

return only the rows for which the user is determined to have authorization to access.

10. The program product of claim 9, wherein the request one or more queries of one or more tables.

11. The program product of claim 9, wherein the table containing the rows of data contains access control information for limiting user access to the database.

12. The program product of claim 9, wherein the database operation is a query.

13. The program product of claim 9, wherein the database operation involves a row update.

14. The program product of claim 9, wherein said determining row security information includes checking a cache for row security information corresponding to the row's security label.

15. The program product of claim 9, wherein the user security label is one of plurality of security labels arranged in a hierarchy of security levels.

16. The program product of claim 15, wherein the user is determined to be authorized to access the retrieved row only if the user security level corresponds to a security level having greater than or equal degree of access than a security level indicated by the retrieved row's security label.

17. The program product of claim apparatus of claim 15, wherein the hierarchy of security labels correspond to a group of different levels of security in a multilevel security system.

18. The program product of claim 9, wherein the determining if the user security information dominates the row security information is based on comparing, for each row of the database satisfying the requested operation, the user security level associated with the user with the row security level associated with the row.