System and method for secure full-text indexing

• US 7,392,253 B2
• Filed: 03/03/2005
• Issued: 06/24/2008
• Est. Priority Date: 03/03/2005
• Status: Expired due to Fees

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Corporation
• Inventors: Gursky, Dennis, Samsonov, Yevgeniy A., Peltonen, Kyle G.
• Primary Examiner(s): Chace; Christian
• Assistant Examiner(s): RADTKE, MARK A
• Application Number:
  US11/072,726
• Publication Number:
  US 20060200446A1
• Time in Patent Office: 1,209 Days
• Field of Search: None
• US Class Current: 1/1
• CPC Class Codes: G06F 16/31 Indexing; Data structures therefor; Storage structures
• CPC Class Codes: G06F 16/951 Indexing; Web crawling techniques
• CPC Class Codes: Y10S 707/99933 Query processing, i.e. searching
• CPC Class Codes: Y10S 707/99938 Concurrency, e.g. lock management in shared database
• CPC Class Codes: Y10S 707/99939 Privileged access
• CPC Class Codes: Y10S 707/99943 Generating database or data structure, e.g. via user interface

Abstract

Documents are indexed in accordance with a process that separates the filtering and word breaking portions of the process so that they are performed under a restricted security setting. When a document is requested by an indexer, the document is retrieved and then passed to the higher security process. The document is then filtered one or more filters and tokenized by one or more wordbreakers under the restricted security setting before being passed to the indexer. The restricted security setting prevents security vulnerabilities from being exploited during the filtering and word breaking processes.

Claims

1. A computer-implemented method for secure full-text indexing of a document, the method comprising:

providing an index component, a document handler component, and a document processing component, wherein the document handler component has a first security setting, wherein the document processing component has a second security, wherein the index component has a third security setting;

receiving, at the document handler component, a document identifier from the index component;

cross-checking the document identifier received at the document handler component with an identifier associated with the index component to verify that the index component requested the document;

temporarily shutting down the document processing component when the cross-checking verifies that the index component did not request the document; and

when the cross-checking verifies that the index component did request the document, obtaining, at the document handler component, a document corresponding to the document identifier, processing the obtained document at the document processing component, and forwarding the obtained processed document to the index component.

2. The computer-implemented method of claim 1, wherein the first security setting associated with the document handler component includes a security setting which provides the document handler component read access to a database of the document and no write access to the database of the document.

3. The computer-implement method of claim 1, wherein the second security setting associated with the document processing component includes a security setting which provides no read access for the document processing component and no write access for the document processing component.

4. The computer-implemented method of claim 1, wherein the third security setting associated with the index component includes a security setting which provides no read access to a database of the document, no write access to the database of the document, and write access to an index database.

5. The computer-implemented method of claim 1, wherein the document processing component includes a filter and a word breaker.

6. The computer-implemented method of claim 1, wherein the document identifier is batched by the index component before being sent by the index component.

7. The computer-implemented method of claim 1, wherein the document handler component receives the document identifier directly from the index component.

8. The computer-implemented method of claim 1, wherein the document handler component receives the document identifier from the document processing component.

9. A computer-readable storage medium having computer executable instructions for secure full-text indexing of a document, the instructions comprising:

providing an index component, a document handler component, and a document processing component, wherein each of the index component, document handler component and document processing component are separate components and include separate security settings;

receiving, at the document handler component, a document identifier from the index component;

cross-checking the document identifier received at the document handler component with an identifier associated with the index component to verify that the index component requested the document;

temporarily shutting down the document processing component when the cross-checking verifies that the index component did not request the document; and

when the cross-checking verifies that the index component did request the document, obtaining, at the document handler component, a document corresponding to the document identifier, processing the obtained document at the document processing component, and forwarding the obtained processed document to the index component.

10. The computer-readable storage medium of claim 9, wherein the document processing component includes a filter and a word breaker.

11. The computer-readable storage medium of claim 9, wherein the document identifier is batched by the index component before being sent by the index component.

12. The computer-readable storage medium of claim 9, wherein the document handler component receives the document identifier directly from the index component.

13. The computer-readable storage medium of claim 9, wherein the document handler component receives the document identifier from the document processing component.

14. A system for secure full-text indexing of a document, the system comprising:

a processor; and

a memory having computer-executable instructions associated therewith, the computer executable instructions being configured to;

provide an index component, a document handler component, and a document processing component,

wherein the document handler component has a first security setting, wherein the first security setting provides the document handler component read access to a database of the document,

wherein the document processing component has a second security setting, wherein the second security setting provides no read access for the document processing component and no write access for the document processing component, wherein the index component has a third security setting,

wherein the third security setting provides no read access to the database of the document, no write access to the database of the document, and write access to an index database;

receive, at the document handler component, a document identifier from the index component;

cross-check the document identifier received at the document handler component with an identifier associated with the index component to verify that the index component requested the document;

temporarily shut down the document processing component when the cross-checking verifies that the index component did not request the document; and

when the cross-checking verifies that the index component did request the document,

obtain, at the document handler component, a document corresponding to the document identifier,

process the obtained document at the document processing component, and

forward the obtained processed document to the index component.

15. The system of claim 14, wherein the document handler component receives the document identifier directly from the index component.

16. The system of claim 14, wherein the document handler component receives the document identifier from the document processing component.