Databases Reference
In-Depth Information
query is parsed and analyzed by the HDB driver for the purposes of policy
enforcement. The query is converted into an internal representation called
Query Graph Model (QGM), which is a convenient structure for semantic
analysis and query transformation. Given the tables and columns referenced
in a query, and contextual information, such as the business purpose for the
query, the relevant policy metadata is extracted from the database and inte-
grated into the model for the query. The original query is then transformed
to integrate policy restrictions. The resulting model is converted back into an
SQL string which is submitted to the database for execution. The submitted
query implements policy restrictions as additional query predicates.
JDBC Application
jdbc: executeQuery(“select …”)
jdbc: resultSet()
HDB JDBC Wrapper
SQL Parser
Query Graph Model
Query Transformation
Query Generation
Native JDBC Driver
Selective Policy Retrieval
SQL Query
Metadata
Data
Patient
Policy
Treatment
Database
Fig. 2.
HDB Active Enforcement JDBC Driver
Figure 3 is an example used to illustrate HDB query transformation for
policy enforcement. An application submits a query for the purpose of med-
ical research over the Patient and Treatment tables and selects diagnosis for
patients in California. The query is parsed and a QGM representation is built
for the query. Boxes represent operators such as select and tables. The exam-
ple has a single select operator, which is a join of the two tables. HDB policy
enforcement searches for policy metadata on these tables for the purpose of
medical research and modifies the query by introducing additional restric-
tions between tables and query operators ranging over them. These newly
introduced operators appear in the figure as boxes labeled AE. Further trans-
formations and simplifications may be applied to the query before translating
the query graph into a SQL query string. However, such transformations are
