Embeddable cloud analytics

• US 10,162,876 B1
• Filed: 12/17/2015
• Issued: 12/25/2018
• Est. Priority Date: 06/20/2014
• Status: Active Grant

• Current Assignee: Amazon Technologies, Inc. (Amazon.com, Inc.)
• Original Assignee: Amazon Technologies, Inc. (Amazon.com, Inc.)
• Inventors: Raghavan, Srinivasan Sundar, Sivasubramanian, Swaminathan, Rath, Timothy Andrew, Karnik, Mukul Vijay, Devgan, Amol, Kalki, Santosh
• Primary Examiner(s): Brown, Anthony
• Assistant Examiner(s): Corum, Jr., William
• Application Number:
  US14/973,629
• Time in Patent Office: 1,104 Days
• CPC Class Codes: G06F 16/26 Visual data mining; Browsing structured data
• CPC Class Codes: G06F 16/283 Multi-dimensional databases or data warehouses, e.g. MOLAP or ROLAP
• CPC Class Codes: G06F 21/335 for accessing specific resources, e.g. using Kerberos tickets
• CPC Class Codes: G06F 21/6227 where protection concerns the structure of data, e.g. records, types, queries
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32

Abstract

An analytics module may be embedded into an application developed, published, or used by an entity in addition to the owner of the data under analysis. An access token may be submitted by the analytics module to a provider of hosted services. The access token may correspond to an n-dimensional cube containing data at a level of granularity permitted to the application. The access token may incorporate additional policies controlling access to the corresponding n-dimensional cube.

Claims

1. A system comprising:

one or more computing nodes in communication with one or more storage devices; and

one or more memories having stored thereon computer-readable instructions that, upon execution by the one or more computing nodes, cause the system at least to;

receive a request to enable analytical operations to be performed on behalf of an application, the operations to be performed using an n-dimensional array created by the one or more computing nodes on the one or more storage devices in response to the request;

send a token comprising information indicative of an identity of the n-dimensional array and information indicative of policies for controlling access to the n-dimensional array;

receive a request to perform a data analytics operation, the request comprising a copy of the token; and

perform the data analytics operation by at least accessing data in the n-dimensional array, the accessing based at least in part on the information indicative of policies for controlling access to the n-dimensional array.

4. The system of claim 1, further comprising one or more memories having stored thereon computer-readable instructions that, upon execution by the one or more computing nodes, cause the system at least to:

identify a maximum depth of analysis based at least in part on the information indicative of policies for controlling access to the n-dimensional array; and

perform the data analytics operation by at least limiting access to data beyond the maximum depth.

5. The system of claim 4, further comprising one or more memories having stored thereon computer-readable instructions that, upon execution by the one or more computing nodes, cause the system at least to:

reject a second request to perform a second data analysis operation when performing the second data analysis operation would require access to a level of a hierarchy of the n-dimensional array beyond the maximum depth.

6. The system of claim 1, further comprising one or more memories having stored thereon computer-readable instructions that, upon execution by the one or more computing nodes, cause the system at least to:

identify a branch of a hierarchy of the n-dimensional array permitted for use in the data analytics operation, based at least in part on the information indicative of policies for controlling access to the n-dimensional array; and

perform the data analytics operation by at least limiting access to data not in the identified branch of the hierarchy.

7. The system of claim 1, further comprising one or more memories having stored thereon computer-readable instructions that, upon execution by the one or more computing nodes, cause the system at least to:

identify a subset of data of the n-dimensional array which may be accessed for use in performing the data analytics operation; and

permit access to aggregated data corresponding to data outside of the identified subset of data.

2. A computer-implemented method comprising:

receiving a first request to enable data analytics operations on behalf of a client, the operations to be performed on an n-dimensional array hosted by one or more computing nodes;

sending a token comprising information indicative of an identity of the n-dimensional array and a policy for controlling access to the n-dimensional array;

receiving, a second request to perform a data analytics operation, the request comprising a copy of the token; and

performing the data analytics operation in response to the second request, based at least in part on applying the policy for controlling access to the n-dimensional array.

8. The computer-implemented method of claim 2, further comprising:

performing the data analytics operation by at least limiting access to data beyond a maximum depth of analysis, the maximum depth of analysis identified based at least in part on the policy for controlling access to the n-dimensional array.

9. The computer-implemented method of claim 2, further comprising:

rejecting a second request to perform a second data analysis operation based at least in response to determining that performing the second data analysis operation would require access to a level of a hierarchy of the n-dimensional array beyond a maximum depth.

10. The computer-implemented method of claim 2, further comprising:

identifying a branch of a hierarchy of the n-dimensional array permitted for use in the data analytics operation, the identifying based at least in part on the policy for controlling access to the n-dimensional array; and

performing the data analytics operation by at least limiting access to data not in the identified branch of the hierarchy.

11. The computer-implemented method of claim 2, wherein the token comprises information indicative of at least one of a maximum depth of analysis, one or more permitted dimensions, and one or more permitted branches of a hierarchy.

12. The computer-implemented method of claim 2, further comprising:

identifying a subset of data of the n-dimensional array which may be accessed for use in performing the data analytics operation; and

performing the data analytics operation by at least accessing aggregated data in place of data outside of the identified subset of data.

13. The computer-implemented method of claim 2, further comprising:

identifying a subset of data points within the n-dimensional array associated with a visualization component; and

generating the token to be indicative of authorized access to the subset of data points.

3. A computer-implemented method comprising:

receiving a first request to enable a data analytics operation;

sending a token comprising information indicative of an n-dimensional array and information indicative of data within the n-dimensional array that is usable to perform the data analytics operation;

receiving, from a client, a second request to perform the data analytics operation, the request comprising a copy of the token; and

processing the second request to perform the data analytics operation by at least locating the n-dimensional array using the information indicative of the n-dimensional array and preventing access to a subset of data within the n-dimensional array based at least in part on the information indicative of data within the n-dimensional array that is usable to perform the data analytics operation.

14. The computer-implemented method of claim 3, wherein the information indicative of data within the n-dimensional array that is usable to perform the data analytics operation comprises information indicative of a branch of a hierarchy of the n-dimensional array.

15. The computer-implemented method of claim 3, wherein the information indicative of data within the n-dimensional array that is usable to perform the data analytics operation comprises information indicative of a dimension of the n-dimensional array.

16. The computer-implemented method of claim 3, further comprising:

identifying a valid time period for performing the data analytics operation based at least in part on the token.

17. The computer-implemented method of claim 3, further comprising:

tracking usage of the n-dimensional array based at least in part on the token.

18. The computer-implemented method of claim 3, wherein the token is made publicly available and the second request comprises information identifying a party associated with the second request.

19. The computer-implemented method of claim 3, further comprising:

identifying a subset of data points within the n-dimensional array used by a visualization component; and

generating the token to comprise information indicative of accessing the subset of data points.

20. The computer-implemented method of claim 3, further comprising:

identifying a time period for performing the data analytics operation based at least in part on the token; and

permitting access to the n-dimensional array based at least in part on the time period.