Extensible, customizable database-driven row-level database security
AssigneeMicrosoft Corporation
InventorsJagan Peri, Jasjit Grewal, Michaeljon Miller, Navin Thadani, Tsvi Reiter, Youg Lu
Life of this patent
Estimating the term…
Abstract
The method and system of the claims decomposes an organization structure into a set of mapping objects, where each mapping object represents an affiliation between entities of an organization. Each object in the data model is associated with an owner by designating a set of ownership affiliation attributes for each object. A set of privileges is assigned to an affiliation and access is checked based on a user's affiliation to an object and a user's privilege depth. Single privilege checking is performed only as a last resort for special, infrequent situations.
Claims20
A computer-readable medium having computer-executable instructions for performing database-driven, row level security comprising:
- designating an object affiliation attribute for each secured object in the database object model;
- creating a mapping object representing an ownership affiliation in an object hierarchy, wherein the mapping object comprises a user affiliation attribute and an object affiliation attribute;
- and
- granting access to an object when an affiliation attribute of the user and an affiliation attribute of the object is contained in the mapping object.
A computer system comprising:
- an operating system providing a user authentication service;
- a database management system for managing a set of databases, the database management system using the user authentication service to authenticate a user connecting to the database management system;
- a customer relationship management system;
- a customer database accessed by the customer relationship management system through the database management system;
- an object in the customer database having an affiliation attribute;
- a mapping object in the customer database representing an ownership affiliation in an object hierarchy, wherein the mapping object comprises a user affiliation attribute and an object affiliation attribute.
A computing apparatus, comprising:
- a display unit that is capable of generating video images;
- an input device;
- a processing apparatus operatively coupled to said display unit and said input device, said processing apparatus comprising a processor and a memory operatively coupled to said processor;
- a network interface connected to a network and to the processing apparatus;
- said processing apparatus being programmed to:
- create a set of mapping objects that represent an affiliation in a customer relationship management system object hierarchy, wherein each mapping object of the set of mapping objects comprises an object affiliation attribute and a user affiliation attribute;
- and
- granting a user access to an object based on whether a mapping object shows a relationship between an affiliation attribute of the user and an affiliation attribute of the object.
Dependencies are inferred from the claim text.