Rule based database access control—a practical approach

This paper describes a scheme to partition a database into fragments, and to associate access constraints in the form of declarative rules with these fragments. We present SQL extensions to specify data fragmentation and access constraints. nom this, a compiler generates triggers which verify that users do not violate the constraints. Major practical requirements for the implementation of our access control scheme are that existing application code must be left unchanged, and that an efficient implementation based on standard database management systems is possible. Our strategy has been applied successfully at Telenor -a Norwegian telephony service provider.