APPARATUS AND METHOD FOR ACCESSING DATA IN A MULTI-TENANT DATABASE ACCORDING TO A TRUST HIERARCHY

• US 20090282045A1
• Filed: 05/09/2008
• Published: 11/12/2009
• Est. Priority Date: 05/09/2008
• Status: Abandoned Application

• Current Assignee: SAP France SA (SAP SE)
• Original Assignee: Business Objects SA (SAP SE)
• Inventors: HSIEH, Mone Siu Man, WU, Ju
• Application Number:
  US12/118,607
• Publication Number:
  US 20090282045A1
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: G06F 21/6227 where protection concerns the structure of data, e.g. records, types, queries
• CPC Class Codes: G06F 2221/2145 Inheriting rights or properties, e.g., propagation of permissions or restrictions within a hierarchy
• CPC Class Codes: H04L 63/104 Grouping of entities

Abstract

A computer readable storage medium comprises executable instructions to establish a trust hierarchy between tenants of a multi-tenant database. Data access rights for the trust hierarchy are specified, the data access rights defined by the tenants of the multi-tenant database. Queries on the multi-tenant database are processed subject to the data access rights for the trust hierarchy.

Claims

1. A computer readable storage medium, comprising executable instructions to:

establish a trust hierarchy between tenants of a multi-tenant database;

specify data access rights for the trust hierarchy, the data access rights refined by the tenants of the multi-tenant database; and

process queries on the multi-tenant database subject to the data access rights specified for the trust hierarchy.

2. The computer readable storage medium of claim 1, wherein the executable instructions to establish a trust hierarchy further comprise executable instructions to define a plurality of security trusts in the trust hierarchy.

3. The computer readable storage medium of claim 2, wherein a security trust comprises a set of data access rights between a tenant of the multi-tenant database and one or more trustees.

4. The computer readable storage medium of claim 3, wherein the plurality of security trusts are selected from the list comprising:

complete trust, subsidiary trust, and partnership trust.

5. The computer readable storage medium of claim 3, wherein the executable instructions to establish a trust hierarchy further comprise executable instructions to associate one or more security trusts with each tenant of the multi-tenant database, the one or more security trusts selected by the each tenant.

6. The computer readable storage medium of claim 5, wherein the executable instructions to specify data access rights for the trust hierarchy further comprise executable instructions to specify restrictions on the set of data access rights of each one or more security trusts associated with each tenant of the multi-tenant database.

7. The computer readable storage medium of claim 6, further comprising executable instructions to create a plurality of trust universes for the trust hierarchy, the plurality of trust universes derived from one or more universes in the multi-tenant database.

8. The computer readable storage medium of claim 7, wherein a trust universe is associated with each security trust.

9. The computer readable storage medium of claim 7, wherein the executable instructions to create a plurality of trust universes further comprise executable instructions to create a plurality of security trust objects to associate a trust universe with each tenant in the multi-tenant database.

10. The computer readable storage medium of claim 9, wherein each security trust object stores the restrictions on the data access rights for a security trust associated with each tenant of the multi-tenant database.

11. The computer readable storage medium of claim 7, wherein the executable instructions to create a plurality of trust universes further comprise executable instructions to create a security trust table in the multi-tenant database to represent the one or more security trusts associated with each tenant of the multi-tenant database.

12. The computer readable storage medium of claim 11, wherein the executable instructions to create a plurality of trust universes further comprise executable instructions to create overloads of the trust universes subject to the restrictions stored on the security trust objects.

13. The computer readable storage medium of claim 12, further comprising executable instructions to assign the overloads of the trust universes to trustees of the one or more security trusts associated with each tenant of the multi-tenant database.

14. The computer readable storage medium of claim 10, wherein the executable instructions to process queries on the multi-tenant database further comprise executable instructions to convert the restrictions stored on the security trust objects to a SQL WHERE clause.

15. The computer readable storage medium of claim 7, wherein the executable instructions to process queries on the multi-tenant database further comprise executable instructions to:

present to a trustee of a security trust a set of trust universe objects that the trustee is entitled to access in the multi-tenant database, wherein;

each trust universe comprises a plurality of trust universe objects, and

each security trust specifies the trust universe objects that trustees of the security trust are entitled to access in the multi-tenant database.

16. The computer readable storage medium of claim 11, wherein the executable instructions to process queries on the multi-tenant database further comprise executable instructions to process queries for a trustee on each trust universe associated with each security trust between the trustee and the tenants of the multi-tenant database.

17. A computer readable storage medium, comprising executable instructions to:

define a multi-tenant database having a plurality of tenants, wherein each tenant has one or more users;

create a plurality of data access rights to the multi-tenant database for each tenant of the multi-tenant database;

associate a set of data access rights for a trustee associated with a first tenant to a portion of the multi-tenant database associated with a second tenant; and

process a query from the trustee on the multi-tenant database for the portion of the multi-tenant database associated with the second tenant subject to the set of data access rights for the trustee.

18. The computer readable storage medium of claim 17, further comprising executable instructions to create a trust universe, the trust universe comprising a trust universe object to store restrictions based on the set of data access rights.

19. The computer readable storage medium of claim 18, further comprising executable instructions to:

convert the restrictions stored in the trust universe object into a restriction selected from a schema restriction, a table restriction, a row restriction and a column restriction; and

generate an overload of the trust universe according to the restrictions.

20. The computer readable storage medium of claim 17, further comprising executable instructions to:

process a further query from the trustee for portions of the database associated with a plurality of trusting tenants, each trusting tenant having granted the data access rights to the trustee; and

create a report showing results from the further query, the report having similar data from each trusting tenant.

21. The computer readable storage medium of claim 17, further comprise executable instructions to:

define a plurality of security trusts for the multi-tenant database, where a security trust is associated with a tenant;

create a plurality of trust universes for the plurality of security trusts;

associate one or more trust universes with each tenant; and

create a plurality of security trust objects to store data access rights for the one or more trust universes associated with each tenant.

22. The computer readable storage medium of claim 21, wherein the executable instructions to associate one or more trust universes with each tenant comprise executable instructions to establish one or more security trusts for each tenant, each security trust associated with a trust universe and with one or more trustees.

23. The computer readable storage medium of claim 22, wherein the executable instructions to process queries on the multi-tenant database comprises executable instructions to present the trust universe associated with each security trust to the one or more trustees subject to the data access rights for the trust universe.

24. A method for accessing data in a multi-tenant database according to a trust hierarchy, comprising:

creating a plurality of security trusts in the trust hierarchy, each security trust establishing data access rights between a tenant of the multi-tenant database and one or more trustees;

associating one or more security trusts with each tenant of the multi-tenant database;

specifying the data access rights for the one or more security trusts associated with each tenant; and

converting the data access rights into queries on the multi-tenant database.

25. The method of claim 24, wherein converting the data access rights into queries of the multi-tenant database comprises deriving a plurality of trust universes for the plurality of security trusts, the plurality of trust universes comprising a plurality of trust universe objects, and the data access rights specifying restrictions on the plurality of trust universe objects for the one or more trustees of each security trust.