Associating security trimmers with documents in an enterprise search system

• US 7,979,458 B2
• Filed: 01/16/2007
• Issued: 07/12/2011
• Est. Priority Date: 01/16/2007
• Status: Active Grant

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Corporation
• Inventors: Kapadia, Arshish Cyrus, Zeller, Mark Jeremy, Dasan, Shajan
• Primary Examiner(s): Robinson; Greta L
• Assistant Examiner(s): Wilcox; James J
• Application Number:
  US11/653,518
• Publication Number:
  US 20080172390A1
• Time in Patent Office: 1,638 Days
• Field of Search: None
• US Class Current: 707/769
• CPC Class Codes: G06F 16/93 Document management systems
• CPC Class Codes: G06F 16/951 Indexing; Web crawling techniques
• CPC Class Codes: G06F 21/6227 where protection concerns the structure of data, e.g. records, types, queries
• CPC Class Codes: G06F 2221/2119 Authenticating web pages, e.g. with suspicious links
• CPC Class Codes: G06F 2221/2141 Access rights, e.g. capability lists, access control lists, access tables, access matrices

Abstract

Methods and computer-readable media are provided for associating security trimmers with documents in an enterprise search system. According to one method, a search index is maintained that includes one or more document identifiers corresponding to documents stored at back-end computing systems. Each document identifier in the search index is associated with one or more security trimmer implementations. When a query request is received from a user, the search index is queried to identify documents referenced by the search index that match search terms provided with the query request. For each document that matches the search terms, the associated security trimmer implementations are identified and executed to retrieve the access rights to view the document for the current user from the back-end computing system where the document is stored.

Claims

1. A computer-implemented method for associating security trimmers with documents, the computer-implemented method comprising performing computer-implemented operations for:

maintaining a search index at a Web server computer, the search index comprising one or more document identifiers, wherein each document identifier comprises a URL referencing a document and having an associated crawl rule identifier;

maintaining a security trimmer configuration store comprising one or more security trimmer implementations comprising one or more security trimmer identifiers, each security trimmer identifier referencing a security trimmer and having associated configuration information for configuring the security trimmer, each security trimmer configured to invoke an application programming interface (API) exposed by a back-end computing system for determining whether a user has access rights to a document;

maintaining a crawl rule definition store comprising one or more crawl rules, each crawl rule comprising a regular expression on a document identifier and being associated with one or more security trimmer identifiers, and each crawl rule being further associated with a priority value;

selecting the crawl rule for use with the document identifier based upon the priority value;

receiving a query request from the user at the Web server computer, the query request including one or more search terms;

in response to receiving the query request at the Web server computer, querying the search index to identify an identified document that matches the search terms;

identifying the security trimmer implementations for the identified document using the associated crawl rule identifier and crawl rule definition store;

executing the security trimmer corresponding to the identified security trimmer implementations to retrieve access rights for the identified document, the access rights being retrieved from the API exposed by the back-end computing system;

associating each crawl rule with a trimmer resolver, the trimmer resolver being configured to receive the access rights from each of the security trimmers and to determine, based upon the received access rights, whether the user is permitted to view the identified document;

executing the trimmer resolver to determine whether the user is permitted to view the identified document; and

if the user is permitted to view the identified document, causing the identified document to be displayed to the user.

2. The method of claim 1, wherein each document identifier in the search index is associated with security data obtained from a back-end data store storing the document associated with the document identifier.

3. The method of claim 2, wherein the security trimmer of each security trimmer implementation is associated with a security data queue configured for storing security data associated with each document identifier.

4. The method of claim 3, wherein the security trimmer of each security trimmer implementation is associated with a uniform resource locator queue configured for storing one or more document identifiers.

5. A computer-readable storage medium having computer-executable instructions stored thereon that, when executed by a computer, cause the computer to:

maintain a search index at a Web server computer, the search index comprising one or more document identifiers, wherein each document identifier comprises a URL referencing a document and having an associated crawl rule identifier;

maintain a security trimmer configuration store comprising one or more security trimmer implementations comprising one or more security trimmer identifiers, each security trimmer identifier referencing a security trimmer and having associated configuration information for configuring the security trimmer, each security trimmer configured to invoke an application programming interface (API) exposed by a back-end computing system for determining whether a user has access rights to a document;

maintain a crawl rule definition store comprising one or more crawl rules, each crawl rule comprising a regular expression on a document identifier and being associated with one or more security trimmer identifiers, and each crawl rule being further associated with a priority value;

select the crawl rule for use with the document identifier based upon the priority value;

receive a query request from the user at the Web server computer, the query request including one or more search terms;

in response to receive the query request at the Web server computer, query the search index to identify an identified document that matches the search terms;

identify the security trimmer implementations for the identified document using the associated crawl rule identifier and crawl rule definition store;

execute the security trimmer corresponding to the identified security trimmer implementations to retrieve access rights for the identified document, the access rights being retrieved from the API exposed by the back-end computing system;

associate each crawl rule with a trimmer resolver, the trimmer resolver being configured to receive the access rights from each of the security trimmers and to determine, based upon the received access rights, whether the user is permitted to view the identified document;

execute the trimmer resolver to determine whether the user is permitted to view the identified document; and

if the user is permitted to view the identified document, cause the identified document to be displayed to the user.

6. The computer-readable storage medium of claim 5, wherein each document identifier in the search index is associated with security data obtained from a back-end data store storing the document associated with the document identifier.

7. The computer-readable storage medium of claim 6, wherein the security trimmer of each security trimmer implementation is associated with a security data queue configured for storing security data associated with each document identifier.

8. The computer-readable storage medium of claim 7, wherein the security trimmer of each security trimmer implementation is associated with a uniform resource locator queue configured for storing one or more document identifiers.