Data store access permission system with interleaved application of deferred access control filters

• US 10,198,466 B2
• Filed: 03/22/2017
• Issued: 02/05/2019
• Est. Priority Date: 05/14/2015
• Status: Active Grant

• Current Assignee: Deephaven Data Labs, LLC
• Original Assignee: Deephaven Data Labs, LLC
• Inventors: Wright, Charles, Caudy, Ryan, Basralian, Raffi, Bronnimann, Herve
• Primary Examiner(s): Syed, Farhan M
• Application Number:
  US15/466,836
• Publication Number:
  US 20170192910A1
• Time in Patent Office: 685 Days
• CPC Class Codes: G06F 11/1451 by selection of backup contents
• CPC Class Codes: G06F 11/1464 for networked environments
• CPC Class Codes: G06F 11/1469 Backup restoration techniques
• CPC Class Codes: G06F 12/0261 using reference counting
• CPC Class Codes: G06F 12/084 with a shared cache
• CPC Class Codes: G06F 12/1483 using an access-table, e.g. matrix or list
• CPC Class Codes: G06F 15/17331 Distributed shared memory [DSM], e.g. remote direct memory access [RDMA]
• CPC Class Codes: G06F 16/113 Details of archiving lifecycle management in storage systems G06F3/0649; backup systems G06F11/1446
• CPC Class Codes: G06F 16/144 Query formulation
• CPC Class Codes: G06F 16/162 Delete operations erasing in storage systems G06F3/0652
• CPC Class Codes: G06F 16/215 Improving data quality; Data cleansing, e.g. de-duplication, removing invalid entries or correcting typographical errors
• CPC Class Codes: G06F 16/22 Indexing; Data structures therefor; Storage structures
• CPC Class Codes: G06F 16/221 Column-oriented storage; Management thereof
• CPC Class Codes: G06F 16/2228 Indexing structures
• CPC Class Codes: G06F 16/2237 Vectors, bitmaps or matrices
• CPC Class Codes: G06F 16/2246 Trees, e.g. B+trees
• CPC Class Codes: G06F 16/2255 Hash tables
• CPC Class Codes: G06F 16/2264 Multidimensional index structures
• CPC Class Codes: G06F 16/2272 Management thereof
• CPC Class Codes: G06F 16/2282 Tablespace storage structures; Management thereof
• CPC Class Codes: G06F 16/2291 : User-Defined Types; Storage management thereof
• CPC Class Codes: G06F 16/23 : Updating
• CPC Class Codes: G06F 16/2308 : Concurrency control transaction processing G06F9/466
• CPC Class Codes: G06F 16/2358 : Change logging, detection, and notification replication G06F16/27
• CPC Class Codes: G06F 16/2365 : Ensuring data consistency and integrity
• CPC Class Codes: G06F 16/2372 : Updates performed during offline database operations
• CPC Class Codes: G06F 16/2379 : Updates performed during online database operations; commit processing
• CPC Class Codes: G06F 16/242 : Query formulation
• CPC Class Codes: G06F 16/2428 : Query predicate definition using graphical user interfaces, including menus and forms G06F16/2423 takes precedence
• CPC Class Codes: G06F 16/245 : Query processing
• CPC Class Codes: G06F 16/2453 : Query optimisation
• CPC Class Codes: G06F 16/24534 : Query rewriting; Transformation
• CPC Class Codes: G06F 16/24535 : of sub-queries or views
• CPC Class Codes: G06F 16/24537 : of operators
• CPC Class Codes: G06F 16/24539 : using cached or materialised query results
• CPC Class Codes: G06F 16/2455 : Query execution
• CPC Class Codes: G06F 16/24553 : of query operations
• CPC Class Codes: G06F 16/2456 : Join operations
• CPC Class Codes: G06F 16/24561 : Intermediate data storage techniques for performance improvement
• CPC Class Codes: G06F 16/2457 : with adaptation to user needs
• CPC Class Codes: G06F 16/24575 : using context
• CPC Class Codes: G06F 16/248 : Presentation of query results
• CPC Class Codes: G06F 16/254 : Extract, transform and load [ETL] procedures, e.g. ETL data flows in data warehouses
• CPC Class Codes: G06F 16/27 : Replication, distribution or synchronisation of data between databases or within a distributed database system; Distributed database system architectures therefor
• CPC Class Codes: G06F 16/278 : Data partitioning, e.g. horizontal or vertical partitioning
• CPC Class Codes: G06F 16/285 : Clustering or classification
• CPC Class Codes: G06F 16/9024 : Graphs; Linked lists G06F16/9027 takes precedence
• CPC Class Codes: G06F 16/907 : Retrieval characterised by using metadata, e.g. metadata not derived from the content or metadata generated manually
• CPC Class Codes: G06F 16/951 : Indexing; Web crawling techniques
• CPC Class Codes: G06F 16/9535 : Search customisation based on user profiles and personalisation
• CPC Class Codes: G06F 16/9538 : Presentation of query results
• CPC Class Codes: G06F 16/9566 : URL specific, e.g. using aliases, detecting broken or misspelled links
• CPC Class Codes: G06F 16/9574 : of access to content, e.g. by caching
• CPC Class Codes: G06F 17/40 : Data acquisition and logging for input to computer G06F3/00
• CPC Class Codes: G06F 21/00 : Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
• CPC Class Codes: G06F 21/6209 : to a single file or object, e.g. in a secure envelope, encrypted and accessed using a key, or with access control rules appended to the object itself
• CPC Class Codes: G06F 2201/805 : Real-time
• CPC Class Codes: G06F 2201/84 : Using snapshots, i.e. a logical point-in-time copy of the data
• CPC Class Codes: G06F 2212/1052 : Security improvement
• CPC Class Codes: G06F 2212/154 : Networked environment
• CPC Class Codes: G06F 2212/163 : Server or database system
• CPC Class Codes: G06F 2212/60 : Details of cache memory
• CPC Class Codes: G06F 3/0481 : based on specific properties of the displayed interaction object or a metaphor-based environment, e.g. interaction with desktop elements like windows or icons, or assisted by a cursor's changing behaviour or appearance
• CPC Class Codes: G06F 3/0482 : Interaction with lists of selectable items, e.g. menus
• CPC Class Codes: G06F 3/0483 : Interaction with page-structured environments, e.g. book metaphor
• CPC Class Codes: G06F 3/04847 : Interaction techniques to control parameter settings, e.g. interaction with sliders or dials
• CPC Class Codes: G06F 3/0485 : Scrolling or panning
• CPC Class Codes: G06F 3/04895 : Guidance during keyboard input operation, e.g. prompting
• CPC Class Codes: G06F 3/0605 : by facilitating the interaction with a user or administrator
• CPC Class Codes: G06F 3/0656 : Data buffering arrangements
• CPC Class Codes: G06F 3/067 : Distributed or networked storage systems, e.g. storage area networks [SAN], network attached storage [NAS]
• CPC Class Codes: G06F 40/117 : Tagging; Marking up details of markup languages G06F40/143; Designating a block; Setting of attributes style sheets, e.g. eXtensible Stylesheet Language Transformation [XSLT], G06F40/154
• CPC Class Codes: G06F 40/134 : Hyperlinking
• CPC Class Codes: G06F 40/166 : Editing, e.g. inserting or deleting
• CPC Class Codes: G06F 40/174 : Form filling; Merging
• CPC Class Codes: G06F 40/177 : of tables; using ruled lines
• CPC Class Codes: G06F 40/18 : of spreadsheets form-filling G06F40/174
• CPC Class Codes: G06F 40/183 : Tabulation, i.e. one-dimensional positioning
• CPC Class Codes: G06F 40/216 : using statistical methods
• CPC Class Codes: G06F 40/274 : Converting codes to words; Guess-ahead of partial word inputs
• CPC Class Codes: G06F 8/30 : Creation or generation of source code
• CPC Class Codes: G06F 8/41 : Compilation
• CPC Class Codes: G06F 8/427 : Parsing
• CPC Class Codes: G06F 8/60 : Software deployment
• CPC Class Codes: G06Q 40/04 : Trading; Exchange, e.g. stocks, commodities, derivatives or currency exchange
• CPC Class Codes: H04L 12/18 : for broadcast or conference , e.g. multicast
• CPC Class Codes: H04L 51/046 : Interoperability with other network applications or services
• CPC Class Codes: H04L 51/212 : using filtering or selective blocking
• CPC Class Codes: H04L 61/5069 : for group communication, multicast communication or broadcast communication
• CPC Class Codes: H04L 63/101 : Access control lists [ACL]
• CPC Class Codes: H04L 63/102 : Entity profiles
• CPC Class Codes: H04L 67/01 : Protocols
• CPC Class Codes: H04L 67/1001 : for accessing one among a plurality of replicated servers
• CPC Class Codes: H04L 67/141 : Setup of application sessions admission control or resource allocation in data switching networks H04L47/70
• CPC Class Codes: H04L 67/34 : involving the movement of software or configuration parameters network booting or remote initial program loading [RIPL] G06F9/4416
• CPC Class Codes: H04L 67/56 : Provisioning of proxy services store-and-forward switching systems in data switching networks H04L12/54
• CPC Class Codes: H04L 67/566 : Grouping or aggregating service requests, e.g. for unified processing
• CPC Class Codes: H04L 67/568 : Storing data temporarily at an intermediate stage, e.g. caching
• CPC Class Codes: H04L 67/5681 : Pre-fetching or pre-delivering data based on network characteristics
• CPC Class Codes: H04L 69/16 : Implementation or adaptation of Internet protocol [IP], of transmission control protocol [TCP] or of user datagram protocol [UDP]

Abstract

Described are methods, systems and computer readable media for a permissions system including relationships of partitioning, grouping, and the application of access control deferred filters.

Claims

1. A system for automatically applying access control deferred filters to a first table object, the system comprising:

one or more hardware processors;

a computer readable data storage device coupled to the one or more hardware processors, the computer readable data storage device having stored thereon software instructions that, when executed by the one or more hardware processors, cause the one or more hardware processors to perform operations including;

receiving a user request submitted from a computing device for data from the first table object;

requesting, from an access control list source stored in a computer medium, access control groups for a user;

requesting, from an access control filter source in the computer medium, a set of filter generators for each access control group;

determining, for each set of filter generators for each access control group, a filter generator based on first table metadata for the first table object configured to identify a computer medium source of the first table object data;

for each determined filter generator, executing the determined filter generator to create a generator filter for the first table object;

combining each of the generated filters for the first table object into an access control filter;

creating a second table object in memory that references the first table object;

associating the access control filter with the second table;

making the second table object available for user operations;

receiving a second user request from a computing device to perform a filtering operation on the second table object;

accessing metadata of the second table object;

retrieving a tree-based table storage structure from the metadata;

traversing the tree-based table storage structure starting at a table root of the tree-based table storage structure;

when the second user request requests data from one or more partition columns of the tree-based table storage structure, applying one or more partition column filters based on a partition column structure of the tree;

when the second user request contains a filtering operation for one or more grouping columns of the tree-based table storage structure, in a first pass, executing user-specified filters on the one or more partition columns that execute only system-specified code, and between the first and a second pass, applying internal access-control filters, thereby removing all rows for which the user does not have authorized access by;

retrieving the access control filter from the metadata;

extracting filters from the access control filter that apply to the access control groups for the user;

choosing a filter from the extracted filters;

applying the chosen filter to the second user request;

applying on the second pass one or more second grouping column filters based on a first filter request contained in the second user request;

applying one or more normal filters contained in the second user request to identify a filtered data source result; and

returning a final set of data.

2. The system of claim 1, wherein the access control filter includes an access control disjunctive filter.

3. The system of claim 1, wherein the access control filter includes an access control conjunctive filter.

4. A system for automatically applying access control deferred filters to a first table object, the system comprising:

one or more hardware processors;

a computer readable data storage device coupled to the one or more hardware processors, the computer readable data storage device having stored thereon software instructions that, when executed by the one or more hardware processors, cause the one or more hardware processors to perform operations including;

receiving a user request submitted from a computing device for data from the first table object;

requesting, from an access control list source stored in a computer medium, access control groups for a user;

requesting, from an access control filter source in the computer medium, a set of filter generators for each access control group;

determining, for each set of filter generators for each access control group, a filter generator based on first table metadata for the first table object configured to identify a computer medium source of the first table object data;

for each determined filter generator, executing the determined filter generator to create a generator filter for the first table object;

combining each of the generated filters for the first table object into an access control filter;

creating a second table object in memory that references the first table object;

associating the access control filter with the second table;

making the second table object available for user operations;

receiving a second user request from a computing device to perform a data access operation on the second table object;

accessing metadata of the second table object;

retrieving a tree-based table storage structure from the metadata;

traversing the tree-based table storage structure starting at a table root of the tree-based table storage structure;

when the second user request requests data from one or more columns of the tree-based table storage structure, applying internal access-control filters, thereby removing all rows for which the user does not have authorized access by;

retrieving the access control filter from the metadata;

extracting filters from the access control filter that apply to the access control groups for the user;

choosing a filter from the extracted filters;

applying the chosen filter to the second user request;

applying the data access operation; and

returning a final set of data.

5. A method for applying access control deferred filters to a first table object in a computer medium, the method comprising:

receiving a user request submitted from a computing device for data from the first table object;

requesting, from an access control list source stored in a computer medium, access control groups for a user;

requesting, from an access control filter source in the computer medium, a set of filter generators for each access control group;

determining, for each set of filter generators for each access control group, a filter generator based on first table metadata for the first table object configured to identify a computer medium source of the first table object data;

for each determined filter generator, executing the determined filter generator to create a generator filter for the first table object;

combining each of the generated filters for the first table object into an access control filter;

creating a second table object in memory that references the first table object;

associating the access control filter with the second table;

making the second table object available for user operations;

receiving a second user request from a computing device to perform a filtering operation on the second table object;

accessing metadata of the second table object;

retrieving a tree-based table storage structure from the metadata;

traversing the tree-based table storage structure starting at a table root of the tree-based table storage structure;

when the second user request requests data from one or more partition columns of the tree-based table storage structure, applying one or more partition column filters based on a partition column structure of the tree;

when the second user request contains a filtering operation for one or more grouping columns of the tree-based table storage structure, in a first pass, executing user-specified filters on the one or more partition columns that execute only system-specified code, and on a second pass, applying internal access-control filters, thereby removing all rows for which the user does not have authorized access by;

retrieving the access control filter from the metadata;

extracting filters from the access control filter that apply to the access control groups for the user;

choosing a filter from the extracted filters;

applying the chosen filter to the second user request;

applying one or more second grouping column filters based on a first filter request contained in the second user request;

applying one or more normal filters contained in the second user request to identify a filtered data source result; and

returning a final set of data.

6. The method of claim 5, wherein the access control filter includes an access control disjunctive filter.

7. The method of claim 5, wherein the access control filter includes an access control conjunctive filter.

8. A method for applying access control deferred filters to a first table object in a computer medium, the method comprising:

receiving a user request submitted from a computing device for data from the first table object;

requesting, from an access control list source stored in a computer medium, access control groups for a user;

requesting, from an access control filter source in the computer medium, a set of filter generators for each access control group;

determining, for each set of filter generators for each access control group, a filter generator based on first table metadata for the first table object configured to identify a computer medium source of the first table object data;

for each determined filter generator, executing the determined filter generator to create a generator filter for the first table object;

combining each of the generated filters for the first table object into an access control filter;

creating a second table object in memory that references the first table object;

associating the access control filter with the second table;

making the second table object available for user operations;

receiving a second user request from a computing device to perform a data access operation on the second table object;

accessing metadata of the second table object;

retrieving a tree-based table storage structure from the metadata;

traversing the tree-based table storage structure starting at a table root of the tree-based table storage structure;

when the second user request requests data from one or more columns of the tree-based table storage structure, applying internal access-control filters, thereby removing all rows for which the user does not have authorized access by;

retrieving the access control filter from the metadata;

extracting filters from the access control filter that apply to the access control groups for the user;

choosing a filter from the extracted filters;

applying the chosen filter to the second user request;

applying the data access operation; and

returning a final set of data.

9. A nontransitory computer readable medium having stored thereon software instructions that, when executed by one or more processors, cause the one or more processors to perform operations including:

receiving a user request submitted from a computing device for data from the first table object;

requesting, from an access control list source stored in a computer medium, access control groups for a user;

requesting, from an access control filter source in the computer medium, a set of filter generators for each access control group;

determining, for each set of filter generators for each access control group, a filter generator based on first table metadata for the first table object configured to identify a computer medium source of the first table object data;

for each determined filter generator, executing the determined filter generator to create a generator filter for the first table object;

combining each of the generated filters for the first table object into an access control filter;

creating a second table object in memory that references the first table object;

associating the access control filter with the second table;

making the second table object available for user operations;

receiving a second user request from a computing device to perform a filtering operation on the second table object;

accessing metadata of the second table object;

retrieving a tree-based table storage structure from the metadata;

traversing the tree-based table storage structure starting at a table root of the tree-based table storage structure;

if the second user request requests data from one or more partition columns of the tree-based table storage structure, applying one or more partition column filters based on a partition column structure of the tree;

if the second user request contains a filtering operation for one or more grouping columns of the tree-based table storage structure, in a first pass, executing user-specified filters on the one or more partition columns that execute only system-specified code, and on a second pass, applying internal access-control filters, thereby removing all rows for which the user does not have authorized access by;

retrieving the access control filter from the metadata;

extracting filters from the access control filter that apply to the access control groups for the user;

choosing a filter from the extracted filters;

applying the chosen filter to the second user request; and

returning a final set of data.

10. The nontransitory computer readable medium of claim 9, wherein the access control filter includes an access control disjunctive filter.

11. The nontransitory computer readable medium of claim 9, wherein the access control filter includes an access control conjunctive filter.

12. A nontransitory computer readable medium having stored thereon software instructions that, when executed by one or more processors, cause the one or more processors to perform operations including:

receiving a user request submitted from a computing device for data from the first table object;

requesting, from an access control list source stored in a computer medium, access control groups for a user;

requesting, from an access control filter source in the computer medium, a set of filter generators for each access control group;

determining, for each set of filter generators for each access control group, a filter generator based on first table metadata for the first table object configured to identify a computer medium source of the first table object data;

for each determined filter generator, executing the determined filter generator to create a generator filter for the first table object;

combining each of the generated filters for the first table object into an access control filter;

creating a second table object in memory that references the first table object;

associating the access control filter with the second table;

making the second table object available for user operations;

receiving a second user request from a computing device to perform a data access operation on the second table object;

retrieving a tree-based table storage structure associated with the second table object;

traversing the tree-based table storage structure starting at a table root of the tree-based table storage structure;

when the second user request requests data from one or more columns of the tree-based table storage structure, applying internal access-control filters, thereby removing all rows for which the user does not have authorized access by;

extracting filters from the access control filter that apply to the access control groups for the user;

choosing a filter from the extracted filters;

applying the chosen filter to the second user request;

applying the data access operation; and

returning a final set of data.