Database security

• US 7,167,859 B2
• Filed: 04/27/2001
• Issued: 01/23/2007
• Est. Priority Date: 04/27/2000
• Status: Expired due to Term

• Current Assignee: Oracle International Corporation (Oracle Corporation)
• Original Assignee: Hyperion Solutions Corporation (Oracle Corporation)
• Inventors: Novy, Robert F., Shah, Arun, Ertl, Robert A.
• Primary Examiner(s): Sheikh; Ayaz
• Assistant Examiner(s): Abrishamkar; Kaveh
• Application Number:
  US09/844,717
• Publication Number:
  US 20020016924A1
• Time in Patent Office: 2,097 Days
• Field of Search: 713/200, 707/202, 707/7, 707/100, 707/2, 707/9, 707/10, 726/27
• US Class Current: 1/1
• CPC Class Codes: G06F 16/283 Multi-dimensional databases or data warehouses, e.g. MOLAP or ROLAP
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: G06F 21/6227 where protection concerns the structure of data, e.g. records, types, queries
• CPC Class Codes: Y10S 707/99932 Access augmentation or optimizing
• CPC Class Codes: Y10S 707/99937 Sorting
• CPC Class Codes: Y10S 707/99939 Privileged access

Abstract

Disclosed is a system, method, and apparatus for calculating metrics by using hierarchical level metadata to describe the various structures within the database. The hierarchical level metadata permit calculation of complex metrics by an analytical server which would otherwise be difficult or impossible. As a result of the way that the analytical server calculates the metrics, slicing and drilling are supported. Additionally, dimension and fact level security are also supported.

Claims

1. A method for restricting access to information in a dimensional database, the dimensional database having dimension tables, fact tables, and metadata describing the fact tables, said method comprising:

receiving a request from a requestor, said request associated with a plurality of request levels of a corresponding plurality of dimensions and said request associated with at least one fact, the request levels being levels of dimensional hierarchies and the requestor having a security designation; and

providing security measures at each of a dimension level and a fact level of the database, wherein providing security at the dimension level comprises;

comparing each of the plurality of request levels with each of a corresponding set of security levels, the security levels restricting the levels of each dimensional hierarchy to which the requestor is permitted access;

and wherein providing security at the fact level is distinct from providing security at the dimension level and providing security at the fact level comprises;

defining a security level for the at least one fact, wherein the security level for the at least one fact is stored as metadata in the database; and

comparing the security level for the at least one fact with the security designation of the requestor, the security designation restricting the facts to which the requestor is permitted access.

2. The method of claim 1, further comprising:

retrieving the set of security levels from a plurality of sets of security levels, wherein each of the plurality of sets of security levels are associated with at least one requestor.

3. The method of claim 1, further comprising:

generating a query for the request with the request levels, wherein each of the plurality of request levels are equal or exceed each of the corresponding of security levels; and

generating a query with at least one of the security levels, wherein at least one of the security levels exceeds a corresponding one of the request levels.

4. The method of claim 1, wherein the request is associated with one or more request constraints, and further comprising:

retrieving one or more security constraints; and

comparing each of the request constraints to a corresponding one of the security constraints.

5. The method of claim 4, further comprising:

generating the query wherein each of the request constraints is equivalent to the corresponding one of the security constraints; and

denying the request, wherein one of the request constraints is different from the corresponding one of the security constraints.

6. The method of claim 1, further comprising:

determining whether the requestor is in a restricted group;

wherein the requestor is in a restricted group, adding a request level to the request, wherein the added request level indicates that the requestor is in the restricted group; and

wherein the requestor is in an unrestricted group, adding request levels to the request, wherein the added request level indicates that the requestor is in the unrestricted group.

7. The method of claim 6, further comprising:

determining one or more measures associated with the request;

selecting a stargroup associated with each of the one or more measures associated with the request, wherein the stargroup further comprises one or more stars; and

comparing each of the requested levels and the added levels to a corresponding plurality of aggregate levels associated with the stars.

8. A computer readable medium for storing a plurality of instructions for restricting access to information in a dimensional database, the dimensional database having dimension tables, fact tables, metadata describing the fact tables, said plurality of instructions comprising:

receiving a request from a requestor, said request associated with a plurality of request levels of a corresponding plurality of dimensions and said request associated with at least one fact, the request levels being levels of dimensional hierarchies and the requestor having a security designation; and

providing security measures at each of a dimension level and a fact level of the database, wherein providing security at the dimension level comprises;

comparing each of the plurality of request levels with each of a corresponding set of security levels, the security levels restricting the levels of each dimensional hierarchy to which the requestor is permitted access;

and wherein providing security at the fact level is distinct from providing security at the dimension level and providing security at the fact level comprises;

defining a security level for the at least one fact, wherein the security level for the at least one fact is stored as metadata in the database; and

comparing the security level for the at least one fact with the security designation of the requestor, the security designation restricting the facts to which the requestor is permitted access.

9. The computer readable of claim 8, wherein the plurality of instructions further comprising:

retrieving the set of security levels from a plurality of sets of security levels, wherein each of the plurality of sets of security levels are associated with at least one requestor.

10. The computer readable medium of claim 8, wherein the plurality of instructions further comprising:

generating a query for the request, wherein each of the plurality of request levels are equal or exceed each of the corresponding set of security levels; and

generating a query with at least one of the security levels, wherein at least one of the security levels exceeds a corresponding one of the request levels.

11. The computer readable medium of claim 8, wherein the request is associated with one or more request constraints, and the plurality of instructions further comprising:

retrieving one or more security constraints; and

comparing each of the request constraints to a corresponding one of the security constraints.

12. The computer readable medium of claim 11, wherein the plurality of instructions further comprising:

generating the query wherein each of the request constraints is equivalent to the corresponding one of the security constraints; and

denying the request, wherein one of the request constraints is different from the corresponding one of the security constraints.

13. The computer readable medium of claim 8, wherein the plurality of instructions further comprising:

determining whether the requestor is in a restricted group;

wherein the requestor is in restricted group, adding a request level to the request, wherein the added request level indicates that the requestor is in the restricted group; and

wherein the requestor is an unrestricted group, adding request levels to the request, wherein the added request level indicates that the requestor is in the unrestricted group.

14. The computer readable medium of claim 13, wherein the plurality of instructions further comprising:

determining one or more measures associated with the request;

selecting a stargroup associated with each of the one or more measures associated with the request, wherein the stargroup further comprises one or more stars; and

comparing each of the requested levels and the added levels to a corresponding plurality of aggregate levels associated with the stars.