I recently came across this term "Virtual Private Database" and I'm wondering what criteria need to be satisfied to allow use of the term.
I first saw the term in an HP/Fortify doc:
A virtual private database is used to ensure separation between customers. The database is setup as a virtual per-client relational database management system (RDBMS) instance with database encryption, ensuring that users can only access their own data in their own database.
And here is some Oracle documentation:
Oracle Virtual Private Database (VPD) enables you to create security policies to control database access at the row and column level. Essentially, Oracle Virtual Private Database adds a dynamic WHERE clause to a SQL statement that is issued against the table, view, or synonym to which an Oracle Virtual Private Database security policy was applied.
Oracle Virtual Private Database enforces security, to a fine level of granularity, directly on database tables, views, or synonyms. Because you attach security policies directly to these database objects, and the policies are automatically applied whenever a user accesses data, there is no way to bypass security.
Does the policy have to be applied by the Database software in order for it to be a VPDB? Can the policy be applied by your application? Does the Database have to do the encryption?
Say your application encrypts a field in a table and your application has rules that in effect apply a policy that ensures that users can only access their own data. Does one then have a VPDB?