Abstract: Trusted client security factor-based authorizations at a server. The techniques allow the server to authorize client requested operations to access a protected resource or service based on trusted client security factors that are obtained at client machines and provided to the server.

Abstract: Techniques are provided for selectively or completely redacting the text of database commands submitted to a database system. The database server receives the clear text version of the commands, parses the commands, and generates an execution plan, as normal. However, prior to providing the text of the commands to any location that is externally visible, the database server determines whether the command qualifies as “sensitive”. If the command qualifies as sensitive, then a redacted version of the command is generated. In the case of selective redaction, portions of the redacted version remain in clear text, while selected portions are replaced with encrypted text. In the case of total redaction, the entire command is replaced with encrypted text.

Abstract: Trusted client security factor-based authorizations at a server. The techniques allow the server to authorize client requested operations to access a protected resource or service based on trusted client security factors that are obtained at client machines and provided to the server.

Abstract: Trusted client security factor-based authorizations. The techniques allow a server to authorize client requested operations to access a protected resource or service based on trusted client security factors that are obtained at client machines and provided to the server.

Abstract: Trusted client security factor-based authorizations at a server. The techniques allow the server to authorize client requested operations to access a protected resource or service based on trusted client security factors that are obtained at client machines and provided to the server.

Abstract: Techniques are provided for selectively or completely redacting the text of database commands submitted to a database system. The database server receives the clear text version of the commands, parses the commands, and generates an execution plan, as normal. However, prior to providing the text of the commands to any location that is externally visible, the database server determines whether the command qualifies as “sensitive”. If the command qualifies as sensitive, then a redacted version of the command is generated. In the case of selective redaction, portions of the redacted version remain in clear text, while selected portions are replaced with encrypted text. In the case of total redaction, the entire command is replaced with encrypted text.

Abstract: Trusted client security factor-based authorizations at a server. The computer-implemented techniques allow the server to authorize client requested operations to access a protected resource or service based on trusted client security factors that are obtained at client machines and provided to the server. A level of trust by the server in the client security factors is established by requiring that the client machine be pre-registered in a trusted machine registry before the server allows requests from the client machine to access a protected service or a protected resource. The registration of the client machine in the machine registry may be made by way of a probabilistically difficult to predict machine registration digest that encompasses a digest of a client program installed on the client machine and a machine identifier of the client machine.

Abstract: Trusted client security factor-based authorizations at a server. The techniques allow the server to authorize client requested operations to access a protected resource or service based on trusted client security factors that are obtained at client machines and provided to the server.

Abstract: Techniques for managing access to data in a database allow several policies to be applied simultaneously to the same row in a database table, and provide a pluggable module in the form of the database package that allows one or more access control security policies to be added to a common database server without taking the database server off line. Techniques include registering one or more packages of routines with a database management system. An access mediation routine in a first package is invoked for determining whether to allow operation on data in a first table associated with a first policy. Other techniques include, for each operation in an operation set, determining whether to perform the operation on a row of the table based on a set of labels associated with the row. The set of labels correspond to a policy set associated with the table.

Abstract: One embodiment of the present invention provides a system that selectively audits accesses to a relational database system. This system starts by receiving a query from a client at a database server. The system processes this query at the database server to produce a query result. The system also creates an audit record for rows in relational tables that are accessed by the query, and that satisfy an auditing condition. Next, the system records the audit record in an audit record store and returns the query result to the client. Integrating the auditing facility into the relational database system in this manner ensures that auditing is performed in the same way regardless of which application generates the query. Furthermore, this auditing is transparent to applications and users.