Method and system for implementing security filters for reporting systems

• US 7,356,840 B1
• Filed: 06/19/2001
• Issued: 04/08/2008
• Est. Priority Date: 06/19/2001
• Status: Active Grant

• Current Assignee: Microstrategy Incorporated
• Original Assignee: Microstrategy Incorporated
• Inventors: Saylor, Michael J., Yuan, Jun, Sahasrabudhe, Sadanand, Hurwood, William, Warikoo, Abhimanyu, Bedell, Jeffrey A., Li, Benjamin Z., Boysko, Glenn J., Trundle, Steven S., Carranza, Eduardo
• Primary Examiner(s): REVAK, CHRISTOPHER A
• Application Number:
  US09/883,509
• Time in Patent Office: 2,485 Days
• Field of Search: 713/150, 713/168, 713182-186, 713200-202, 707/1, 707/3, 707/6, 707/9
• US Class Current: 726/13
• CPC Class Codes: G06F 16/24575 using context
• CPC Class Codes: G06F 16/283 Multi-dimensional databases or data warehouses, e.g. MOLAP or ROLAP
• CPC Class Codes: G06F 21/6227 where protection concerns the structure of data, e.g. records, types, queries
• CPC Class Codes: G06F 2221/2141 Access rights, e.g. capability lists, access control lists, access tables, access matrices

Abstract

Security filters that manage user access to data based on user identification and other data when a user attempts to access information via a query or other mechanisms. Security filters may be implemented to prevent users from viewing or otherwise accessing certain data in a database or other source of information in a reporting or other system. The level of access authorized by a security filter may be based on a user'"'"'s role, capabilities, or other criteria. For example, a regional manager may have a security filter that allows a user to view data from the user'"'"'s particular region regardless of the report the user runs. A security filter may include a filter expression, a top level and a bottom level where each component may be further define a user'"'"'s ability to access certain data.

Claims

1. A method for implementing a security filter for regulating access to data associated with a reporting system, comprising the steps of:

enabling a user to submit a user identification input and a user request to an on-line analytical processing system;

identifying the user based on user identification input;

retrieving data associated with the on-line analytical processing system in accordance with the user request;

filtering the retrieved data based on at least one security filter associated with the identified user; and

presenting the data as a report to the user through a user interface.

2. The method of claim 1 wherein the security filter comprises a filter expression that specifies a subset of data in at least one database.

3. The method of claim 2 wherein the security filter comprises a top range attribute that specifies a highest level of analysis to which the security filter is applied.

4. The method of claim 2 wherein the security filter comprises a bottom range attribute that specifies a lowest level of analysis to which the security filter is applied.

5. The method of claim 1 wherein the user is associated with a group of users wherein the security filter is a group level security filter.

6. The method of claim 2 wherein the security filter varies by user and at least one fact/metric element.

7. A system for implementing a security filter for regulating access to data associated with a reporting system, comprising:

a user input for enabling a user to submit a user identification input and a user request to an on-line analytical processing system;

an identification module for identifying the user based on user identification input;

an access module for retrieving data associated with the on-line analytical processing system in accordance with the user request;

at least one security filter for filtering the retrieved data wherein the at least one security filter is associated with the identified user; and

a user interface for presenting the data as a report to the user.

8. The system of claim 7 wherein the security filter comprises a filter expression that specifies a subset of data in at least one database.

9. The system of claim 8 wherein the security filter comprises a top range attribute that specifies a highest level of analysis to which the security filter is applied.

10. The system of claim 8 wherein the security filter comprises a bottom range attribute that specifies a lowest level of analysis to which the security filter is applied.

11. The system of claim 7 wherein the user is associated with a group of users wherein the security filter is a group level security filter.

12. The system of claim 8 wherein the security filter varies by user and at least one fact/metric element.

13. A processor-readable medium comprising code for execution by a processor to implement a security filter for regulating access to data associated with a reporting system, the medium comprising:

code for causing a processor to enable a user to submit a user identification input and a user request to an on-line analytical processing system;

code for causing a processor to identify the user based on user identification input;

code for causing a processor to retrieve data associated with the on-line analytical processing system in accordance with the user request;

code for causing a processor to filter the retrieved data based on at least one security filter associated with the identified user; and

code for causing a processor to present the data as a report to the user through a user interface.

14. The medium of claim 13 wherein the security filter comprises a filter expression that specifies a subset of data in at least one database.

15. The medium of claim 14 wherein the security filter comprises a top range attribute that specifies a highest level of analysis to which the security filter is applied.

16. The medium of claim 14 wherein the security filter comprises a bottom range attribute that specifies a lowest level of analysis to which the security filter is applied.

17. The medium of claim 13 wherein the user is associated with a group of users wherein the security filter is a group level security filter.

18. The medium of claim 14 wherein the security filter varies by user and at least one fact/metric element.