Database security

• US 20020016924A1
• Filed: 04/27/2001
• Published: 02/07/2002
• Est. Priority Date: 04/27/2000
• Status: Active Grant

• Current Assignee: Oracle International Corporation (Oracle Corporation)
• Original Assignee: Hyperion Solutions Corporation (Oracle Corporation)
• Inventors: Novy, Robert F., Shah, Arun, Ertl, Robert A.
• Granted Patent: US 7,167,859 B2
• Time in Patent Office: Days
• US Class Current: 713/200
• CPC Class Codes: G06F 16/283 Multi-dimensional databases or data warehouses, e.g. MOLAP or ROLAP
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: G06F 21/6227 where protection concerns the structure of data, e.g. records, types, queries
• CPC Class Codes: Y10S 707/99932 Access augmentation or optimizing
• CPC Class Codes: Y10S 707/99937 Sorting
• CPC Class Codes: Y10S 707/99939 Privileged access

Abstract

Disclosed is a system, method, and apparatus for calculating metrics by using hierarchical level metadata to describe the various structures within the database. The hierarchical level metadata permit calculation of complex metrics by an analytical server which would otherwise be difficult or impossible. As a result of the way that the analytical server calculates the metrics, slicing and drilling are supported. Additionally, dimension and fact level security are also supported.

Claims

1. A method for restricting access to information, said method comprising:

receiving a request from a requester, said request associated with a plurality of request levels of a corresponding plurality of dimensions; and

comparing each of the plurality of request levels with each of a corresponding set of security levels.

2. The method of claim 1, further comprising:

retrieving the set of security levels from a plurality of sets of security levels, wherein each of the plurality of sets of security levels are associated with at least one requestor.

3. The method of claim 1, further comprising:

generating a query for the request with the request levels, wherein each of the plurality of request levels are equal or exceed each of the corresponding set of security levels; and

generating a query with at least one of the security levels, wherein at least one of the security levels exceeds a corresponding one of the request levels.

4. The method of claim 1, wherein the request is associated with one or more request constraints, and further comprising:

retrieving one or more security constraints; and

comparing each of the request constraints to a corresponding one of the security constraints.

5. The method of claim 4, further comprising:

generating the query wherein each of the request constraints is equivalent to the corresponding one of the security constraints; and

denying the request, wherein one of the request constraints is different from the corresponding one of the security constraints.

6. The method of claim 1, further comprising:

determining whether the requester is in a restricted group;

wherein the requester is in a restricted group, adding a request level to the request, wherein the added request level indicates that the requester is in the restricted group; and

wherein the requester is in an unrestricted group, adding request levels to the request, wherein the added request level indicates that the requester is in the unrestricted group.

7. The method of claim 6, further comprising:

determining one or more measures associated with the request;

selecting a stargroup associated with each of the one or more measures associated with the request, wherein the stargroup further comprises one or more stars; and

comparing each of the requested levels and the added levels to a corresponding plurality of aggregate levels associated with the stars.

8. A computer readable medium for storing a plurality of instructions for restricting access to information, said plurality of instructions comprising:

receiving a request from a requester, said request associated with a plurality of request levels of a corresponding plurality of dimensions; and

comparing each of the plurality of request levels with each of a corresponding set of security levels.

9. The computer readable medium of claim 8, wherein the plurality of instructions further comprising:

retrieving the set of security levels from a plurality of sets of security levels, wherein each of the plurality of sets of security levels are associated with at least one requester.

10. The computer readable medium of claim 8, wherein the plurality of instructions further comprising:

generating a query for the request, wherein each of the plurality of request levels are equal or exceed each of the corresponding set of security levels; and

generating a query with at least one of the security levels, wherein at least one of the security levels exceeds a corresponding one of the request levels.

11. The computer readable medium of claim 8, wherein the request is associated with one or more request constraints, and the plurality of instructions further comprising:

retrieving one or more security constraints; and

comparing each of the request constraints to a corresponding one of the security constraints.

12. The computer readable medium of claim 11, wherein the plurality of instructions further comprising:

generating the query wherein each of the request constraints is equivalent to the corresponding one of the security constraints; and

denying the request, wherein one of the request constraints is different from the corresponding one of the security constraints.

13. The computer readable medium of claim 8, wherein the plurality of instructions further comprising:

determining whether the requestor is in a restricted group;

wherein the requester is in a restricted group, adding a request level to the request, wherein the added request level indicates that the requester is in the restricted group; and

wherein the requester is in an unrestricted group, adding request levels to the request, wherein the added request level indicates that the requestor is in the unrestricted group.

14. The computer readable medium of claim 13, wherein the plurality of instructions further comprising:

determining one or more measures associated with the request;

selecting a stargroup associated with each of the one or more measures associated with the request, wherein the stargroup further comprises one or more stars; and

comparing each of the requested levels and the added levels to a corresponding plurality of aggregate levels associated with the stars.