David Kogan - San Mateo CA, US Rajendra S. Pingte - Foster City CA, US Chao Liang - Fremont CA, US Yujie Cao - Redwood Shores CA, US
Assignee:
Oracle International Corporation - Redwood Shores CA
International Classification:
G06F 7/00 G06F 17/30
US Classification:
707793, 707809, 718 1, 718104
Abstract:
Techniques for migrating duration trees from a source database server (or instance) to a destination database server (or instance) are provided. A duration is a memory management construct that allows database components to group related areas of memory together. A source duration tree is captured at the source database server and combined with a destination duration tree at the destination database server. Any duration identifiers in the source duration tree that conflict with (i. e. , are the same as) a duration identifier in the destination duration tree are mapped to new duration identifiers.
Karl Dias - Foster City CA, US Leonidas Galanis - San Jose CA, US Jonathan Klein - Redwood City CA, US Venkateshwaran Venkataramani - Sunnyvale CA, US Yujun Wang - Cupertino CA, US Richard Sarwal - Portola Valley CA, US Leng Tan - Sunnyvale CA, US Graham Wood - El Granada CA, US Benoit Dageville - Foster City CA, US Chao Liang - Fremont CA, US Sanjay Kaluskar - Menlo Park CA, US
Assignee:
Oracle International Corporation - Redwood Shores CA
International Classification:
G06F 7/00 G06F 17/00
US Classification:
707610, 709248
Abstract:
A method and apparatus for capturing database system workload and replaying that workload in a database system is provided. According to one aspect, in order to subject a test database system to the same workload to which the production database system actually would be subjected, a database server in the production system captures and records workload that the database server receives from external entities. This captured workload is processed. Processes external to a database server in the test database system send the processed workload to that database server. As a result, the test database system is subjected to the same workload to which the production database system originally was subjected. The foregoing technique permits a database administrator to determine how the production database system will fare if the difference that is present in the test database system is introduced into the production database system.
Capturing And Re-Creating The State Of A Queue When Migrating A Session
Ravikanth Kasamsetty - Union City CA, US Ravi Koti - Bangalore, IN Sanjay Kaluskar - Menlo Park CA, US Chao Liang - Fremont CA, US
Assignee:
ORACLE INTERNATIONAL CORPORATION - REDWOOD SHORES CA
International Classification:
G06F 15/16
US Classification:
709203000
Abstract:
A method and apparatus for migrating the session state of an original session from a first node to a second node, such that a process, executing in the migrated session, may enqueue and dequeue messages from a queue of messages and experience the same behavior from the queue of messages as if the process was enqueuing and dequeuing messages in the original session. Advantageously, all the benefits of migrating a session from one node to another node may be realized, even when the session contains queuing state information that describes the state of a queue of messages. Data that indicates how many messages one or more subscribers have removed from the queue of messages may also be stored to preserve proper behavior of the queue of messages for multiple subscribers when sessions are migrated.
Chao Liang - Fremont CA, US Feng Cao - Belmont CA, US Rajendra Pingte - Foster City CA, US
Assignee:
ORACLE INTERNATIONAL CORPORATION - Redwood Shores CA
International Classification:
G06F 17/30 G06F 12/00
US Classification:
707 8, 707201, 707E17032, 707E17134
Abstract:
Techniques are described herein for capturing and restoring database session state. Production database server components save the session state of each of a plurality of database sessions. The components store workload units that are processed in these sessions. The components store updated session states in response to certain events. Thus, the components may capture multiple session states, pertaining to various different points in time, for each session. The captured session states and the captured workload are moved to a test database server. A user selects, from among the time points represented by the session states, a point in time at which the user would like workload replay to begin. Sessions are re-created on the test database server. Session states of these sessions are set to reflect the session states as they existed at the user-selected time point. Workload units are replayed in the sessions relative to the test database server.
Sql Transformation-Based Optimization Techniques For Enforcement Of Data Access Control
Tanvir Ahmed - Hayward CA, US Thomas Keefe - Mill Valley CA, US Chao Liang - San Ramon CA, US Vikram Pesati - San Jose CA, US
International Classification:
G06F 17/30
US Classification:
707713, 707E17017
Abstract:
Techniques are provided for a database server to identify a query that comprises an access check operator specifying a data access control policy, and if so, to re-write the query to produce an optimized query execution plan. A first technique rewrites a query comprising an access check operator based on the privileges associated with the database principal requesting the query. The rewritten query exposes the access predicates relevant to the requesting principal to subsequent database optimization processes. A second technique rewrites a query comprising an access check operator that specifies a data security policy that does not include a denied privilege. A third technique rewrites a query that comprises an access check operator specifying one or more database table columns that store row-specific access control lists. The rewritten queries are used to generate a query execution plan that provides for several query execution optimizations.
Fine-Grained Access Control For Data Manipulation Language (Dml) Operations On Relational Data
Embodiments allow, within database security policies, the grant of data change operation-specific privileges to particular users to be applied within particular data realms in a given table. Furthermore, according to one or more embodiments, User Privilege column-level privileges are explicitly associated with one or more data access operations such that the grant of such a column-level privilege allows the user to perform only those data access operations that are explicitly associated with the column-level privilege. Enforcement of the data security policies includes prevention of data leakage via WHERE and RETURNING INTO clauses. According to one or more embodiments, a two-phase rewrite is used to optimize enforcement of column-level privileges. During the two-phase rewrite of a given query, the privileges checked during enforcement of the User Privilege data security policies are pruned to avoid unnecessary privilege checks given the columns that are accessed in the query.
Fine-Grained Access Control For Data Manipulation Language (Dml) Operations On Relational Data
- Redwood Shores CA, US Yi Ru - Belmont CA, US Chao Liang - San Ramon CA, US Vikram Reddy Pesati - San Jose CA, US
International Classification:
G06F 21/62 G06F 17/30 H04L 29/06
Abstract:
Embodiments allow, within database security policies, the grant of data change operation-specific privileges to particular users to be applied within particular data realms in a given table. Furthermore, according to one or more embodiments, User Privilege column-level privileges are explicitly associated with one or more data access operations such that the grant of such a column-level privilege allows the user to perform only those data access operations that are explicitly associated with the column-level privilege. Enforcement of the data security policies includes prevention of data leakage via WHERE and RETURNING INTO clauses. According to one or more embodiments, a two-phase rewrite is used to optimize enforcement of column-level privileges. During the two-phase rewrite of a given query, the privileges checked during enforcement of the User Privilege data security policies are pruned to avoid unnecessary privilege checks given the columns that are accessed in the query.
Integrating A User's Security Context In A Database For Access Control
- Redwood Shores CA, US Chao Liang - San Ramon CA, US Tanvir Ahmed - Hayward CA, US Vikram R. Pesati - San Jose CA, US
International Classification:
G06F 21/62 H04L 29/06 G06F 17/30
Abstract:
Techniques are provided for integrating application-level user security context with a database. A session manager, in a middle tier that includes an application, obtains the security context of a user and establishes, in the database, a light-weight session (LWS) that reflects the security context. The security context is synchronized between the middle tier and database before application code execution. The database maintains an isolated copy of the LWS for the unit of application code executed as the security context. The database sends to the session manager the identifier of the copy of LWS. Before allowing a request from an application to be sent to the database, the session manager, transparent to the application, inserts an identifier that identifies the LWS. In this way, the database processes an application request in the context of the corresponding user's security context that is the same as the security context in the middle tier.