What constitutes a Virtual Private Database?

Question

I recently came across this term "Virtual Private Database" and I'm wondering what criteria need to be satisfied to allow use of the term.

I first saw the term in an HP/Fortify doc:

A virtual private database is used to ensure separation between customers. The database is setup as a virtual per-client relational database management system (RDBMS) instance with database encryption, ensuring that users can only access their own data in their own database.

And here is some Oracle documentation:

Oracle Virtual Private Database (VPD) enables you to create security policies to control database access at the row and column level. Essentially, Oracle Virtual Private Database adds a dynamic WHERE clause to a SQL statement that is issued against the table, view, or synonym to which an Oracle Virtual Private Database security policy was applied.

Oracle Virtual Private Database enforces security, to a fine level of granularity, directly on database tables, views, or synonyms. Because you attach security policies directly to these database objects, and the policies are automatically applied whenever a user accesses data, there is no way to bypass security.

Does the policy have to be applied by the Database software in order for it to be a VPDB? Can the policy be applied by your application? Does the Database have to do the encryption?

Say your application encrypts a field in a table and your application has rules that in effect apply a policy that ensures that users can only access their own data. Does one then have a VPDB?

TIA

Answer 1

The name is slightly misleading, but Oracle have obviously used it in a similar way to VPN being a virtual private network.

With a VPN, the network is actually public, but encryption and authentication provide privacy without the network itself needing to be private.

With Oracle's VPD, the database can be public (or at least open within an organisation) with access controlled through authentication and encryption so private areas can be created virtually within this public database.

In order to manage this, the database software needs to run the additional clauses and encryption to enforce the controls.

Your scenario, where the encryption and authentication is done separately to the database should still be able to provide the same Virtual Private Database.