OPTIMIZING DATA CACHE WHEN APPLYING USER-BASED SECURITY

• US 20110213751A1
• Filed: 02/26/2010
• Published: 09/01/2011
• Est. Priority Date: 02/26/2010
• Status: Active Grant

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Iorio, Pierre, Griggs, John C., Lanthier, Gregoire D., Grosset, Robin N.
• Granted Patent: US 8,375,056 B2
• Time in Patent Office: Days
• US Class Current: 707/602
• CPC Class Codes: G06F 12/0864 using pseudo-associative means, e.g. set-associative or hashing
• CPC Class Codes: G06F 12/1458 by checking the subject access rights
• CPC Class Codes: G06F 16/24552 Database cache management
• CPC Class Codes: H04L 67/306 User profiles
• CPC Class Codes: H04L 67/5681 Pre-fetching or pre-delivering data based on network characteristics
• CPC Class Codes: H04L 67/5682 Policies or rules for updating, deleting or replacing the stored data

Abstract

A secure caching system and caching method include receiving a user request for data, the request containing a security context, and searching a cache for the requested data based on the user request and the received security context. If the requested data is found in cache, returning the cached data in response to the user request. If the requested data is not found in cache, obtaining the requested data from a data source, storing the obtained data in the cache and associating the obtained data with the security context, and returning the requested data in response to the user request. The search for the requested data can include searching for a security list that has the security context as a key, the security list including an address in the cache of the requested data.

Claims

1. A secure caching method comprising:

receiving a user request for data and a security context;

searching a cache for the requested data based on the user request and the received security context;

if the requested data is found in the cache, returning the cached data in response to the user request, and

if the requested data is not found in the cache, obtaining the requested data from a data source, storing the obtained data in the cache and associating the obtained data with the security context, and returning the requested data in response to the user request.

2. The method according to claim 1, wherein the cached data is stored with a corresponding list that associates the cached data with the security context and wherein if the requested data is not found in the cache, generating a new list for associating the obtained data stored in the cache with the security context by storing references to the obtained data stored in the cache.

3. The method according to claim 2, wherein the new list is stored in a list storage unit in which number of stored lists increases incrementally based on received user queries.

4. The method according to claim 2, further comprising purging a list from a list storage unit if a change in the cached data compromises integrity of the list.

5. The method according to claim 2, further comprising initializing a list storage unit prior to using the cache, wherein the initializing comprises submitting queries to the data source for commonly used data for commonly used security contexts, loading the cache with the results of the queries and creating security lists which reference the cached data.

6. The method according to claim 2, further comprising checking stored lists for redundancy and if two identical lists are found, the two identical lists are collapsed into a single list.

7. The method according to claim 1, wherein the data is metadata.

8. The method according to claim 1, wherein the security context is a user security profile.

9. A secure caching method in a system connected to a user and a data source, said data source having defined access rights based on a security context of users, the method comprising:

receiving a user request including a security context and a data identifier;

checking in a list storage for the presence of a list identified by the security context and the data identifier; and

if the list is not present, creating a list in the list storage identified by the security context and the data identifier, retrieving data from the data source, and storing the retrieved data in a data storage, and populating the created list with addresses of storage of the retrieved data stored in the data storage; and

if the list is present, retrieving data from the data storage using the storage addresses in said list.

10. The method according to claim 9, wherein the data identifier is a cube dimension identifier.

11. The method according to claim 9, wherein the data storage is a cache that comprises data provided from a plurality of heterogeneous remote data sources.

12. The method according to claim 9, further comprising preloading the data storage and the list storage, wherein the list storage is preloaded with lists corresponding to commonly used security contexts and data identifiers, and the data storage is preloaded with commonly used data referenced by said preloaded lists.

13. The method according to claim 9, wherein the data stored in data storage is OLAP metadata.

14. A caching system comprising:

a processor executing software modules; and

a memory storing the software module,

wherein the software modules comprise;

a receiver module which receives a user request for data and a security context;

a search module which searches a cache for the requested data based on the user request and the received security context;

a management module which obtains the cached data in response to the user request if the requested data is found in the cache, and

wherein if the requested data is not found in the cache, the management module obtains the requested data from a data source, stores the obtained data in the cache and associates the obtained data with the security context, and returns the requested data in response to the user request.

15. The system according to claim 14, wherein if the search module does not find the requested data in the cache, the management module generates a new list for associating the obtained data stored in the cache with the security context by storing references to the obtained data stored in the cache.

16. The system according to claim 15, wherein the management module stores the new list in a list storage unit in which number of stored lists increases incrementally based on unique received user queries.

17. The system according to claim 15, further comprising a purge module which purges a list from a list storage unit if a change in the cached data compromises integrity of the list.

18. The system according to claim 15, further comprising a preloading module which initializes a list storage unit prior to using the cache, wherein the preloading module submits queries to the data source for commonly used data for commonly used security contexts, preloads the cache with the results of the queries and creates new security lists which reference the cached data.

19. The system according to claim 15, further comprising a check module which checks stored lists for redundancy and if two identical lists are found, which collapses the two identical lists into a single list.

20. A computer readable medium storing instructions for secure caching, the instructions comprising:

receiving a user request for data and a security context;

searching a cache for the requested data based on the user request and the received security context;

if the requested data is found in the cache, returning the cached data in response to the user request, and

if the requested data is not found in the cache, obtaining the requested data from a data source, storing the obtained data in the cache and associating the obtained data with the security context.

21. The computer readable medium according to claim 20, wherein the instructions further comprise:

if the requested data is not found in the cache, generating a new list for associating the obtained data stored in the cache with the security context by storing references to the obtained data stored in the cache.

22. The computer readable medium according to claim 21, wherein the instructions further comprise the new list is stored in a list storage unit in which number of stored lists increases incrementally based on unique received user queries.

23. The computer readable medium according to claim 21, wherein the instructions further comprises purging a list from a list storage unit if a change in the cached data compromises integrity of the list.

24. The computer readable according to claim 21, wherein the instructions further comprises initializing a list storage unit prior to using the cache, wherein the initializing comprises submitting queries to the data source for commonly used data for commonly used security contexts, loading the cache with the results of the queries and creating new security lists which reference the cached data.

25. The computer readable according to claim 21, wherein the instructions further comprises checking stored lists for redundancy and if two identical lists are found, the two identical lists are collapsed into a single list.