Efficient data structures for multi-dimensional security

• US 20080201766A1
• Filed: 02/16/2007
• Published: 08/21/2008
• Est. Priority Date: 02/16/2007
• Status: Active Grant

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Corporation
• Inventors: Amirov, Anton, Jacob, Sanjay, Shetty, Rohan Ratnaker, Yang, Mark Xiahong, Dong, George Randell
• Granted Patent: US 8,196,184 B2
• Time in Patent Office: Days
• US Class Current: 726/4
• CPC Class Codes: G06F 16/283 Multi-dimensional databases or data warehouses, e.g. MOLAP or ROLAP
• CPC Class Codes: G06F 21/6227 where protection concerns the structure of data, e.g. records, types, queries
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: Y10S 707/957 Multidimensional
• CPC Class Codes: Y10S 707/958 Data cubes

Abstract

Efficient data structures are generated to enforce permissions on a multi-dimensional representation in a performance management application. A model site is generated having at least one model with at least one dimension. User permissions and group permissions are set for the model. The user permission and the group permissions are deployed to a relational database. A collective user permission table is generated based on the user permissions and the group permissions. Thus, an end user may receive permissions associated with a model and permissions associated with particular dimensions of a model without an inefficient consumption of resources.

Claims

1. A computer-implemented method for providing multi-dimensional security, the method comprising:

generating a model having a dimension;

associating a group role with the model, wherein the group role includes a group permission for accessing data associated with the model;

associating a user with the model, wherein the user includes a user permission for accessing data associated with the model;

generating a collective user permissions table, wherein the collective user permissions table identifies collective user permissions based on the group permissions for accessing data associated with the model and user permissions for accessing data associated with the model; and

pushing the collective user permissions to a multi-dimensional store to provide multi-dimensional security for a multi-dimensional representation.

2. The computer-implemented method of claim 1, wherein the model is associated with a model site, and wherein the model is actuated on the model site.

3. The computer-implemented method of claim 1, wherein the model includes a plurality of dimensions.

4. The computer-implemented method of claim 1, wherein the model includes a permission customization selector, wherein the permission customization selector is configured to provide customization to a user permission associated with the group permission.

5. The computer-implemented method of claim 4, wherein the permission customization selector is associated with the dimension of the model for customizing a user permission associated with the dimension.

6. The computer-implemented method of claim 1, wherein the user is a member of the group role, and wherein the user permission is different than the group permission.

7. The computer-implemented method of claim 1, wherein the user permission and the group permission include at least one member of a group comprising:

no permission, total access permission, read permission, write permission, and read-write permission.

8. The computer-implemented method of claim 1, wherein the group permission is set by a slider interface that indicates at least one member of a group comprising:

a low permission, a medium permission, and a high permission.

9. The computer-implemented method of claim 1, wherein generating a collective user permissions table further comprises:

determining a number of dimensions associated with the model;

determining user permissions for each of the dimensions;

determining group permissions for each of the dimensions;

generating a security table for each of the dimensions;

determining the user membership in the group role; and

generating the collective user permissions table, wherein the generation of the collective user permissions table is based on the security table for each of the dimensions and the user membership in the group role.

10. A computer-readable storage medium having computer-executable instructions for providing multi-dimensional security, the instructions comprising:

generating a model site having a plurality of models;

actuating a model associated with the site, wherein the model includes a dimension that indicates a data category;

associating a group role with the model, wherein the group role includes a group permission for accessing the model;

associating a user with the model, wherein the user is a member of the group role, wherein the user includes a user permission for accessing the model;

generating the collective user permissions table, wherein the generation of the collective user permissions table is based on the security table for each of the dimensions and the user membership in the group role;

associating the collective user permissions with a multi-dimensional store to provide security for a multi-dimensional representation when a user queries the multi-dimensional representation.

11. The computer-readable storage medium of claim 10, wherein the model includes a plurality of dimensions.

12. The computer-readable storage medium of claim 10, wherein the model includes a permission customization selector, wherein the permission customization selector is configured to provide customization to a user permission associated with the group permission.

13. The computer-readable storage medium of claim 12, wherein the permission customization selector is associated with the dimension of the model for customizing a user permission associated with the dimension.

14. The computer-readable storage medium of claim 10, wherein the user permission is different than the group permission.

15. The computer-readable storage medium of claim 10, wherein the user permission and the group permission include at least one member of a group comprising:

no permission, total access permission, read permission, write permission, and read-write permission.

16. The computer-readable storage medium of claim 10, wherein the group permission is set by a slider interface that indicates at least one member of a group comprising:

a low permission, a medium permission, and a high permission.

17. A system for providing multi-dimensional security, the instructions comprising:

a processor; and

a memory having computer executable instructions stored thereon, wherein the computer executable instructions are configured to;

actuate a model, wherein the model includes a plurality of dimensions that indicate a data catagory;

associate a group role with the model, wherein the group role includes a group permission for accessing the model;

associate a user with the model, wherein the user is a member of the group role, wherein the user includes a user permission for accessing the model, wherein the user permission includes less access than the group permission;

determine a number of dimensions associated with the model;

determine user permissions for each of the dimensions;

determine group permissions for each of the dimensions;

generate a security table for each of the dimensions;

determine the user membership in the group role; and

generate the collective user permissions table, wherein the generation of the collective user permissions table is based on the security table for each of the dimensions and the user membership in the group role; and

associate the collective user permissions table with a multi-dimensional store to provide security for a multi-dimensional representation when a user queries the multi-dimensional representation.

18. The computer-readable storage medium of claim 17, wherein the model includes a permission customization selector, wherein the permission customization selector is configured to provide customization to a user permission associated with the group permission.

19. The computer-readable storage medium of claim 17, wherein the user permission and the group permission include at least one member of a group comprising:

no permission, total access permission, read permission, write permission, and read-write permission.

20. The computer-readable storage medium of claim 17, wherein the group permission is set by a slider interface that indicates at least one member of a group comprising:

a low permission, a medium permission, and a high permission.