Associating security trimmers with documents in an enterprise search system

• US 20080172390A1
• Filed: 01/16/2007
• Published: 07/17/2008
• Est. Priority Date: 01/16/2007
• Status: Active Grant

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Corporation
• Inventors: Kapadia, Arshish Cyrus, Zeller, Mark Jeremy, Dasan, Shajan
• Granted Patent: US 7,979,458 B2
• Time in Patent Office: Days
• US Class Current: 707/9
• CPC Class Codes: G06F 16/93 Document management systems
• CPC Class Codes: G06F 16/951 Indexing; Web crawling techniques
• CPC Class Codes: G06F 21/6227 where protection concerns the structure of data, e.g. records, types, queries
• CPC Class Codes: G06F 2221/2119 Authenticating web pages, e.g. with suspicious links
• CPC Class Codes: G06F 2221/2141 Access rights, e.g. capability lists, access control lists, access tables, access matrices

Abstract

Methods and computer-readable media are provided for associating security trimmers with documents in an enterprise search system. According to one method, a search index is maintained that includes one or more document identifiers corresponding to documents stored at back-end computing systems. Each document identifier in the search index is associated with one or more security trimmer implementations. When a query request is received from a user, the search index is queried to identify documents referenced by the search index that match search terms provided with the query request. For each document that matches the search terms, the associated security trimmer implementations are identified and executed to retrieve the access rights to view the document for the current user from the back-end computing system where the document is stored.

Claims

1. A method for associating a security trimmer implementation with a document, the method comprising:

maintaining a search index having one or more document identifiers stored therein, each document identifier corresponding to a document stored at a back-end computing system;

associating each document identifier stored in the search index with one or more security trimmer implementations;

receiving a query request from a user including one or more search terms;

in response to the query request, querying the search index to identify one or more documents matching the search terms; and

for each document matching the search terms, executing the security trimmer implementations associated with the corresponding document identifier to retrieve access rights to view the document for the user.

2. The method of claim 1, further comprising:

receiving the access rights from each of the security trimmer implementations; and

based upon the access rights received from each of the security trimmer implementations, determining whether to display each document matching the search terms to the user.

3. The method of claim 2, wherein associating each document identifier stored in the search index with one or more security trimmer implementations comprises:

associating each document identifier stored in the search index with one or more crawl rules; and

associating each crawl rule with one or more security trimmer implementations.

4. The method of claim 3, further comprising:

associating each crawl rule with a security trimmer resolver, each security trimmer resolver operative to determine the security trimmer implementations to execute for a particular document identifier, to receive the access rights from the security trimmer implementations, and to determine whether to display a document to the user based on the access rights.

5. The method of claim 4, wherein the security trimmer implementations are executed simultaneously.

6. The method of claim 4, further comprising:

associating a priority value with each crawl rule; and

selecting the crawl rule for use with a particular document identifier based upon the priority value.

7. The method of claim 4, wherein opaque security information is associated with each document identifier, and wherein each security trimmer implementation is operative to transmit the opaque security information associated with a document identifier along with a request for access rights for the document corresponding to the document identifier to a back-end computing system.

8. A computer-readable medium having computer-executable instructions stored thereon which, when executed by a computer, cause the computer to:

maintain a search index for storing one or more document identifiers, each document identifier corresponding to a document stored at a back-end computing system and being associated with a crawl rule;

associate each crawl rule with one or more security trimmer implementations, each security trimmer implementation defining a security trimmer and a configuration for the security trimmer;

perform a query of the search index to generate search results including one or more document identifiers; and

for each document identifier in the search results, to identify one or more associated crawl rule and security trimmer implementations, and to execute the associated security trimmer implementations to obtain access rights for the document corresponding to the document identifier.

9. The computer-readable medium of claim 8, comprising further computer-executable instructions which, when executed by the computer, cause the computer to:

receive the access rights for each document identifier in the search results; and

to determine whether to display each document identifier in the search results based on the access rights.

10. The computer-readable medium of claim 9, wherein each crawl rule is further associated with a trimmer resolver, and wherein the trimmer resolver is operative to determine whether to display each document identifier in the search results associated with a corresponding crawl rule.

11. The computer-readable medium of claim 9, comprising further computer-executable instructions which, when executed by the computer, cause the computer to:

store security data associated with each document identifier, the security data retrieved from the back-end computing system at which the document corresponding to the document identifier is stored; and

to

provide the security data to the security trimmer implementations in obtaining the access rights for the document corresponding to the document identifier.

12. The computer-readable medium of claim 9, wherein each of the security trimmer implementations includes an associated uniform resource locator queue.

13. The computer-readable medium of claim 9, wherein each of the security trimmer implementations includes an associated security data queue.

14. The computer-readable medium of claim 9, wherein each of the security trimmer implementations are executed simultaneously.

15. A method for associating security trimmers with documents, the method comprising:

maintaining a search index comprising one or more document identifiers, each document identifier referencing a document and having an associated crawl rule identifier;

maintaining a security trimmer configuration store comprising one or more security trimmer identifiers, each security trimmer identifier referencing a security trimmer implementation and having associated configuration information for configuring the security trimmer implementation;

maintaining a crawl rule definition store comprising one or more crawl rules, each crawl rule being associated with one or more security trimmer identifiers;

receiving a query request from a user including one or more search terms;

in response to the query request, querying the search index to identify one or more documents that match the search terms; and

for each document matching the search terms, identifying the security trimmer implementations for the document using the associated crawl rule identifier and crawl rule definition store, and executing the security trimmer implementations to retrieve access rights to view the document for a current user.

16. The method of claim 15, wherein each crawl rule is further associated with a priority value, and wherein the method further comprises utilizing the priority value to identify the crawl rule that should be utilized when a document identifier corresponds to more than one crawl rule.

17. The method of claim 16, wherein each crawl rule is further associated with a trimmer resolver, and wherein the trimmer resolver is operative to receive the access rights from each of the trimmer implementations and to determine based on the access rights whether the current user is permitted to view a document.

18. The method of claim 17, wherein each document identifier in the search index is associated with security data obtained from a back-end data store storing the document associated with the document identifier.

19. The method of claim 18, wherein each security trimmer implementation is associated with a security data queue.

20. The method of claim 19, wherein each security trimmer implementation is associated with a uniform resource locator queue.