US 12,587,530 B2Granted

Cloud architecture for enforcing multi-dimensional data security using security assignments beyond role-based access controls

AssigneeOracle International Corporation

InventorsAlvin Law, Suraj Singh, Kishore Kondepudi, Satya Anur

Life of this patent

Estimating the term…

Loading patent…

Abstract

An object access service is implemented on a computer system for configuring and enforcing multi-dimensional data security using security assignments beyond role-based access controls. The computer system accesses a request submitted on behalf of a user for access to database structure(s). The computer system requests predicate(s) mapped to role(s) assigned to the user and stored in association with the database structure(s). Predicate(s) submitted to the database may be dynamically filled in by the database pursuant to retrieving data from the database structure(s) to reference security assignment field(s) and security assignment value(s) of the security assignment. The predicate(s) are used to retrieve a security assignment that restricts access to the database structure(s) beyond the role(s) assigned to the user. The security assignment is used to restrict data accessible from the database structure(s) to generate a result set, which is transmitted to a client consumer system for consumption via a consumer interface.

Claims20

Dependent claims

A computer-implemented method comprising:

accessing a user request on behalf of a user for one or more types of access to one or more database structures of a database;
requesting, from an authorization service, one or more predicates that are persistently mapped, in one or more predicate database structures, to one or more roles persistently assigned, in a role assignment database structure, to the user and stored in association with at least one type of access of the one or more types of access and at least one database structure of the one or more database structures;
wherein the one or more predicates indicate the at least one type of access and the at least one database structure for which the one or more roles of the user provide at least one of the one or more types of access;
using the one or more predicates from the authorization service to retrieve, from a security assignment database structure, a security assignment for the user relative to the at least one database structure of the one or more database structures of the database, wherein the security assignment assigns, to one or more security assignment fields, one or more security assignment values corresponding to one or more records of the at least one database structure accessible to the user, wherein the security assignment restricts access to the at least one database structure at least in part by preventing access one or more other records that do not have the one or more security assignment values for the one or more security assignment fields, wherein the one or more other records are otherwise accessible under the one or more roles;
using the at least one type of access for the at least one database structure further restricted by the security assignment, retrieving, in a database session for a base user with more access than the user, a result set from the one or more database structures at least in part by specifying one or more conditions in a query that selects data from the one or more database structures where the one or more security assignment fields match the one or more security assignment values, wherein the one or more conditions in the query exclude data from the one or more database structures where the one or more security assignment fields do not match the one or more security assignment values;
and
transmitting at least part of the result set to a consumer system for consumption via a consumer interface.

4 more elements

A computer-program product comprising one or more non-transitory machine-readable storage media, including stored instructions configured to cause a computing system to perform a set of actions including:

accessing a user request on behalf of a user for one or more types of access to one or more database structures of a database;
requesting, from an authorization service, one or more predicates that are persistently mapped, in one or more predicate database structures, to one or more roles persistently assigned, in a role assignment database structure, to the user and stored in association with at least one type of access of the one or more types of access and at least one database structure of the one or more database structures;
wherein the one or more predicates indicate the at least one type of access and the at least one database structure for which the one or more roles of the user provide at least one of the one or more types of access;
using the one or more predicates from the authorization service to retrieve, from a security assignment database structure, a security assignment for the user relative to the at least one database structure of the one or more database structures of the database, wherein the security assignment assigns, to one or more security assignment fields, one or more security assignment values corresponding to one or more records of the at least one database structure accessible to the user, wherein the security assignment restricts access to the at least one database structure at least in part by preventing access one or more other records that do not have the one or more security assignment values for the one or more security assignment fields, wherein the one or more other records are otherwise accessible under the one or more roles;
using the at least one type of access for the at least one database structure further restricted by the security assignment, retrieving, in a database session for a base user with more access than the user, a result set from the one or more database structures at least in part by specifying one or more conditions in a query that selects data from the one or more database structures where the one or more security assignment fields match the one or more security assignment values, wherein the one or more conditions in the query exclude data from the one or more database structures where the one or more security assignment fields do not match the one or more security assignment values;
and
transmitting at least part of the result set to a client consumer system for consumption via a consumer interface.

4 more elements

A system comprising:

one or more processors;
one or more non-transitory computer-readable media storing instructions, which, when executed by the system, cause the system to perform a set of actions including:
accessing a user request on behalf of a user for one or more types of access to one or more database structures of a database;
requesting, from an authorization service, one or more predicates that are persistently mapped, in one or more predicate database structures, to one or more roles persistently assigned, in a role assignment database structure, to the user and stored in association with at least one type of access of the one or more types of access and at least one database structure of the one or more database structures;
wherein the one or more predicates indicate the at least one type of access and the at least one database structure for which the one or more roles of the user provide at least one of the one or more types of access;
using the one or more predicates from the authorization service to retrieve, from a security assignment database structure, a security assignment for the user relative to the at least one database structure of the one or more database structures of the database, wherein the security assignment assigns, to one or more security assignment fields, one or more security assignment values corresponding to one or more records of the at least one database structure accessible to the user, wherein the security assignment restricts access to the at least one database structure at least in part by preventing access one or more other records that do not have the one or more security assignment values for the one or more security assignment fields, wherein the one or more other records are otherwise accessible under the one or more roles;
using the at least one type of access for the at least one database structure further restricted by the security assignment, retrieving, in a database session for a base user with more access than the user, a result set from the one or more database structures at least in part by specifying one or more conditions in a query that selects data from the one or more database structures where the one or more security assignment fields match the one or more security assignment values, wherein the one or more conditions in the query exclude data from the one or more database structures where the one or more security assignment fields do not match the one or more security assignment values;
and
transmitting at least part of the result set to a client consumer system for consumption via a consumer interface.

6 more elements

Dependencies are inferred from the claim text.