Scalable Fine Grained Access Control Within A Search Engine
AssigneeHyland UK Operations Limited
InventorJoel Bernstein
Life of this patent
Estimating the term…
Abstract
A system and method for providing fine-grained access control in a search engine. Access control predicates associated with a search query, including fixed-width and/or variable-width tokens, are received from the search engine, and are formatted in a machine-readable binary format to generate a single byte array. A pre-sorted memory index structure associated with the single byte array is generated, by sorting the access control predicates according to their token width. The pre-sorted memory index structure is merge joined with an uninverted terms index that includes a sorted list of all terms in a field associated with the search query, and a document index mapping the document identifier (ID) to a term ordinal for a specific field.
Claims20
An access control method comprising:
- receiving from a search engine at least one access control predicate;
- generating an array responsive to formatting the at least one access control predicate;
- generating a memory index structure associated with the array, the memory index structure being pre-sorted based on a sort order of a plurality of access control predicates received from the search engine;
- merging the pre-sorted memory index structure with an uninverted terms index that includes:
- a sorted list of a plurality of search terms;
- and
- a document index mapping a document identifier (ID) to a term ordinal for a predetermined value associated with one or more search terms;
- and
- identifying one or more matches for the document ID against the one or more access control predicates by testing the ordinal term against a bitset of ordinal terms to determine whether the document ID matches against the one or more access control predicates.
A non-transitory computer program product storing instructions that, when executed by at least one programmable processor, cause the at least one programmable processor to perform operations comprising:
- receive, from a search engine, one or more access control predicates associated with a search query, the one or more access control predicates including fixed-width and/or variable-width tokens;
- format the one or more access control predicates in a machine-readable binary format to generate a single byte array;
- sort the one or more access control predicates according to their associated fixed-width and/or variable width tokens;
- generate a pre-sorted memory index structure associated with the single byte array based on the sorting;
- and
- merge join the pre-sorted memory index structure with an uninverted terms index, the uninverted terms index having a sorted list of all terms in a field associated with the search query, and having a document index mapping a document identifier (ID) to a term ordinal for a specific field, the merge joining identifying document ID matches against the one or more access control predicates.
A system for providing fine-grained access control in a search engine, the system comprising:
- at least one programmable processor;
- and
- a machine-readable medium storing instructions that, when executed by the at least one processor, cause the at least one programmable processor to perform operations comprising:
- receive, from the search engine, one or more access control predicates associated with a search query, the one or more access control predicates including fixed-width and/or variable-width tokens;
- format the one or more access control predicates in a machine-readable binary format to generate a single byte array;
- sort the one or more access control predicates according to their associated fixed-width and/or variable width tokens;
- generate a pre-sorted memory index structure associated with the single byte array based on the sorting;
- and
- merge join the pre-sorted memory index structure with an uninverted terms index, the uninverted terms index having a sorted list of all terms in a field associated with the search query, and having a document index mapping a document identifier (ID) to a term ordinal for a specific field, the merge joining identifying document ID matches against the one or more access control predicates.
Dependencies are inferred from the claim text.