AUTHORIZATION CONTROLLED SEARCHING

• US 20090063490A1
• Filed: 08/27/2007
• Published: 03/05/2009
• Est. Priority Date: 08/27/2007
• Status: Active Grant

• Current Assignee: SAP SE
• Original Assignee: SAP AG (SAP SE)
• Inventors: Hofmann, Juergen, Kresser, Florian, Finke, Thomas, Istrate, Ionut, Fuerst, Karl, Koch, Marieta
• Granted Patent: US 7,809,751 B2
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: G06F 16/24 Querying
• CPC Class Codes: G06F 21/6227 where protection concerns the structure of data, e.g. records, types, queries
• CPC Class Codes: Y10S 707/99931 Database or file accessing
• CPC Class Codes: Y10S 707/99939 Privileged access
• CPC Class Codes: Y10S 707/99948 Application of database or data structure, e.g. distributed, multimedia, or image

Abstract

Methods and apparatus, including computer program products, for authorization controlled searching. In general, a search request is received, a database data structure is searched where the data structure is populated with records that include data and criteria for authorization to access the data, and a set of results is presented to a user, where the set of results includes data from the data structure for which a user is authorized the criteria is used to determine which results to include in the set of results. The criteria for authorization to access the data may be simple or complex, and may be based on a formation of associations from multiple layers of associations.

Claims

1. A computer program product, tangibly embodied in a computer-readable medium, the computer program product being operable to cause data processing apparatus to perform operations comprising:

receiving a search request;

searching a database data structure populated with records based on data from a plurality of database data structures, the records comprising data and criteria for authorization to access the data, the searching comprising;

generating a set of results comprising data from the database data structure for which a user is authorized and omitting data from the database data structure for which the user is not authorized, the generating comprising using the criteria to determine which results to include in the set of results; and

presenting the set of results to the user.

2. The product of claim 1, wherein the database data structure is generated from a join of two or more of the database data structures to include the data and the criteria in the records, the two ore more of the database data structures having the data and the criteria in separate data structures.

3. The product of claim 1, wherein the database data structure is generated from the database data structures where the criteria is specific to an attribute of one of the database data structures.

4. The product of claim 3, wherein the database data structure is generated from the database data structures where the criteria is specific to an attribute of a node of a business object instance.

5. The product of claim 1, wherein the data comprises unstructured data.

6. The product of claim 1, wherein the data comprises structured data.

7. The product of claim 6, wherein the structured data comprises business objects.

8. The product of claim 1, wherein the data comprises a combination of structured and unstructured data.

9. The product of claim 1, wherein the records represent instances of nodes of business objects.

10. The product of claim 1, wherein the criteria comprises names of users, roles, profiles, or groups.

11. The product of claim 1, wherein the generating the set of results comprises modifying a query of the search request to include user information corresponding to the criteria.

12. The product of claim 1, wherein the generating the set of results comprises filtering the set of results based on user information and the criteria.

13. The product of claim 1, wherein the operations further comprise:

populating the database data structure with the records, wherein the populating comprises populating a column of the criteria to be used to determine whether the user is authorized to access a record based solely on the criteria and environment information, the environment information comprising user information, the populating the column comprising accessing two or more layers of associations in a table of business object node instances and the database data structures including authorization information to find the criteria to be used to determine whether the user has access to the record.

14. The product of claim 13, wherein the user information comprises a name of the user.

15. The product of claim 1, wherein the database data structure has structured data and the operations further comprise:

performing a search of another database data structure having unstructured data in response to the search request; and

adding results of the search of the another database data structure of unstructured data to the set of results.

16. The product of claim 1, wherein the operations further comprise storing the set of results in volatile memory.

17. The product of claim 1, wherein the presenting comprises displaying the set of results to the user.

18. A method comprising:

receiving a search request;

searching a database data structure populated with records based on data from a plurality of database data structures, the records comprising data and criteria for authorization to access the data, the searching comprising;

generating a set of results comprising data from the database data structure for which a user is authorized and omitting data from the database data structure for which the user is not authorized, the generating comprising using the criteria to determine which results to include in the set of results; and

presenting the set of results to the user.

19. The method of claim 18, further comprising:

populating the database data structure with the records, wherein the populating comprises populating a column of the criteria to be used to determine whether the user is authorized to access a record based solely on the criteria and environment information, the environment information comprising user information, the populating the column comprising accessing two or more layers of associations in database data structures of business object node instances and the database data structures including authorization information to find the criteria to be used to determine whether the user has access to the record.

20. A computer program product, tangibly embodied in a computer-readable medium, the computer program product being operable to cause data processing apparatus to perform operations comprising:

populating a database data structure with records based on data from a plurality of database data structures, the records comprising data and criteria for authorization to access the data, the populating comprising populating a column of the criteria to be used to determine whether a user is authorized to access a record based solely on the criteria and environment information, the environment information comprising user information, the populating the column comprising accessing two or more layers of associations in database data structures of business object node instances and the database data structures including authorization information to find the criteria to be used to determine whether the user has access to the record;

receiving a search request;

searching the database data structure, the searching comprising generating a set of results comprising data from the index for which a user is authorized and omitting data from the database data structure for which the user is not authorized, the generating comprising using the criteria to determine which results to include in the set of results; and

presenting the set of results to the user.