Efficient data structures for multi-dimensional security

• US 8,819,783 B2
• Filed: 05/21/2012
• Issued: 08/26/2014
• Est. Priority Date: 02/16/2007
• Status: Active Grant

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Corporation
• Inventors: Amirov, Anton, Dong, George Randell, Jacob, Sanjay, Yang, Mark Xiahong, Shetty, Rohan Ratnakar
• Primary Examiner(s): Hoffman, Brandon
• Assistant Examiner(s): TRUONG, THONG P
• Application Number:
  US13/476,402
• Publication Number:
  US 20120233667A1
• Time in Patent Office: 827 Days
• Field of Search: 726/4
• US Class Current: 726/4
• CPC Class Codes: G06F 16/283 Multi-dimensional databases or data warehouses, e.g. MOLAP or ROLAP
• CPC Class Codes: G06F 21/6227 where protection concerns the structure of data, e.g. records, types, queries
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: Y10S 707/957 Multidimensional
• CPC Class Codes: Y10S 707/958 Data cubes

Abstract

Efficient data structures are generated to enforce permissions on a multi-dimensional representation in a performance management application. A model site is generated having at least one model with at least one dimension. User permissions and group permissions are set for the model. The user permission and the group permissions are deployed to a relational database. A collective user permission table is generated based on the user permissions and the group permissions. Thus, an end user may receive permissions associated with a model and permissions associated with particular dimensions of a model without an inefficient consumption of resources.

Claims

1. A method for multi-dimensional security, comprising:

displaying a graphical user interface for configuring multi-dimensional security for models having dimensions that are associated with a model site, the graphical user interface configured to;

associate a group role with a model by receiving a selection of what models and what dimensions are to be associated with the group role;

receive a selection for setting a group permission for the group role between a low permission and a high permission when determined;

associate a user with the model and the dimensions that includes a user permission for accessing data associated with the model and the dimensions;

display a permission customization selector that, when selected, enables receiving customizations to the user permission, wherein the user permission is associated with the group permission;

in response to receiving the selection, store the user permission and the group permission within a relational data store;

generate a collective user permissions table from the user permission and the group permission within the relational data store, wherein the collective user permissions table identifies collective user permissions based on the group permission for accessing data associated with the model and user permissions for accessing data associated with the model; and

push the collective user permissions that are stored in the relational data store to a multi-dimensional store to provide multi-dimensional security for a multi-dimensional representation.

2. The method of claim 1, wherein receiving the selection for setting a default permission for the group role between a low permission and a high permission further comprises configuring the graphical user interface to:

display options for setting the default permission to;

a low permission that specifies read and write access;

a medium permission that specifies read access and no write access, and a high permission that specifies no read/write access.

3. The method of claim 1, wherein the graphical user interface is further configured to:

display role attributes for a role associated with a model comprising displaying a name, a number of times the role is used in models, and a number of users associated with the role.

4. The method of claim 3, wherein the graphical user interface is further configured to:

display selectable options for setting access to each of a list of models on and off for the role.

5. The method of claim 4, wherein displaying the selectable options for setting access to each of a list of models on and off for the role further comprises configuring the graphical user interface to:

display a selection interface next to a display of the model name that includes an on access option and an off access option.

6. The method of claim 1, wherein the graphical user interface is further configured to:

display a security and roles tasks area that comprise options for adding users for a role, removing users for a role, and editing role default permissions.

7. The method of claim 1, wherein the graphical user interface is further configured to:

display a user customization user interface display that identifies users associated with a role and displays a customization pane for customizing user permissions associated with a role.

8. The method of claim 7, wherein each user that is associated with the role is individually selectable.

9. The method of claim 7, wherein the graphical user interface is further configured to:

display a number of users associated with different permissions within the role.

10. The method of claim 1, wherein the group permission is set by receiving a setting using a slider interface.

11. A computer-readable storage device having computer-executable instructions encoded thereon for providing multi-dimensional security, the instructions comprising:

displaying a graphical user interface for;

actuating models associated with a model site, wherein the models include a dimension that indicates a data category, and the dimension includes one of;

a static dimension permission that locks the permissions of the dimension from customization and a dynamic dimension permission that allows permissions to be customized;

associating a group role with one of the models, wherein the group role includes a group permission for accessing the model, and the group permission for the group role is set by a graphical interface that includes options for setting the group permission to;

a low permission that specifies read and write access;

a medium permission that specifies read access and no write access, and a high permission that specifies no read/write access;

associating a user with the model, wherein the user is a member of the group role, and the user includes a user permission for accessing the model; and

displaying a permission customization selector for receiving customization to the user permission, wherein the user permission is associated with the group permission.

12. The computer-readable storage device of claim 11, wherein the permission customization selector is associated with the dimension of the model for customizing a user permission associated with the dimension.

13. The computer-readable storage device of claim 11, wherein customizing the user permission includes receiving a selection of at least one member of a group comprising:

no permission, total access permission, read permission, write permission, and read-write permission.

14. The computer-readable storage device of claim 11, wherein the group permission is set by receiving a setting using a slider interface.

15. The computer-readable storage device of claim 11, further comprising:

displaying selectable options for setting access to each of a list of models on and off for the role.

16. The computer-readable storage device of claim 15, wherein displaying the selectable options for setting access to each of a list of models on and off for the role further comprising:

displaying a selection interface next to a display of the model name that includes an on access option and an off access option.

17. A system for providing multi-dimensional security, the instructions comprising:

a display;

a processor; and

a memory having computer executable instructions stored thereon, wherein the computer executable instructions, comprise;

displaying a graphical user interface for configuring multi-dimensional security for models having dimensions that are associated with a model site, the graphical user interface configured to;

associate a group role with a model by receiving a selection of what models and what dimensions are to be associated with the group role;

receive a selection for setting a default group permission for the group role between a low permission and a high permission when determined;

associate a user with the model and the dimensions that includes a user permission for accessing data associated with the model and the dimensions; and

display a permission customization selector that, when selected, enables receiving customizations to the user permission, wherein the user permission is associated with the default group permission.

18. The system of claim 17, wherein receiving the selection for setting a default permission for the group role between a low permission and a high permission comprises displaying options for setting the default permission to:

a low permission that specifies read and write access;

a medium permission that specifies read access and no write access, and a high permission that specifies no read/write access.

19. The system of claim 17, wherein the graphical user interface is further configured to:

display role attributes for a role associated with a model comprising displaying a name, a number of times the role is used in models, and a number of users associated with the role.

20. The system of claim 17, wherein the graphical user interface is further configured to:

display a user customization user interface display that identifies users associated with a role and displays a customization pane for customizing user permissions associated with a role