Techniques for managing access to physical data via a data abstraction model

A method for creating a logical security model based on a physical security model, the method comprising:

• automatically traversing physical data to identify physical access rights rules;
• creating a plurality of views defining logical access rights rules for the identified physical access rights rules of the physical data;
• and
• selectively applying the plurality of views to a logical model comprising a plurality of logical field definitions mapping to corresponding physical fields of the physical data, wherein the application of the plurality of views to the logical model operates to make selected logical fields unavailable to a user of the logical model, the selected logical fields being those for which logical access rights rules exist, whereby access to the physical data is restricted on the basis of the applied plurality of views.

A computer-readable medium containing a program which, when executed by a processor, performs operations for creating a logical security model based on a physical security model, the operations comprising:

• traversing physical data to identify physical access rights rules;
• creating a plurality of views defining logical access rights rules for the identified physical access rights rules of the physical data;
• and
• selectively applying the plurality of views to a logical model comprising a plurality of logical field definitions mapping to corresponding physical fields of the physical data, wherein the application of the plurality of views to the logical model operates to make selected logical fields unavailable to a user of the logical model, the selected logical fields being those for which logical access rights rules exist, whereby access to the physical data is restricted on the basis of the applied plurality of views.

A system, comprising:

• a physical security model defining user access rights to physical data;
• and
• a logical model security manager for creating a logical security model based on the physical security model, the logical model security manager being configured to:
• for each of the user access rights defined by the physical security model, create a logical access right definition for a logical model, wherein the logical model comprises a plurality of logical field definitions each comprising a field name and access information for accessing a field of the physical data;
• and
• apply the logical access right definitions to the logical model so that the logical model reflects the user access rights to the physical data.

A system, comprising:

• a physical security model defining physical access rights rules;
• a logical model security manager for creating a logical security model based on the physical security model, the logical model security manager being configured to:
• traverse physical data to identify the physical access rights rules;
• create a plurality of views defining logical access rights rules for the identified physical access rights rules of the physical data;
• and
• selectively apply the plurality of views to a logical model comprising a plurality of logical field definitions mapping to corresponding physical fields of the physical data, wherein the application of the plurality of views to the logical model operates to make selected logical fields unavailable to a user of the logical model, the selected logical fields being those for which logical access rights rules exist, whereby access to the physical data is restricted on the basis of the applied plurality of views.