Associating security trimmers with documents in an enterprise search system

• US 8,849,848 B2
• Filed: 06/07/2011
• Issued: 09/30/2014
• Est. Priority Date: 01/16/2007
• Status: Active Grant

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Corporation
• Inventors: Zeller, Mark Jeremy, Kapadia, Arshish Cyrus, Dasan, Shajan
• Primary Examiner(s): Abrishamkar, Kaveh
• Assistant Examiner(s): Wilcox, James J
• Application Number:
  US13/154,833
• Publication Number:
  US 20110238696A1
• Time in Patent Office: 1,211 Days
• Field of Search: None
• US Class Current: 707/769
• CPC Class Codes: G06F 16/93 Document management systems
• CPC Class Codes: G06F 16/951 Indexing; Web crawling techniques
• CPC Class Codes: G06F 21/6227 where protection concerns the structure of data, e.g. records, types, queries
• CPC Class Codes: G06F 2221/2119 Authenticating web pages, e.g. with suspicious links
• CPC Class Codes: G06F 2221/2141 Access rights, e.g. capability lists, access control lists, access tables, access matrices

Abstract

Methods and computer-readable media are provided for associating security trimmers with documents in an enterprise search system. According to one method, a search index is maintained that includes one or more document identifiers corresponding to documents stored at back-end computing systems. Each document identifier in the search index is associated with one or more security trimmer implementations. When a query request is received from a user, the search index is queried to identify documents referenced by the search index that match search terms provided with the query request. For each document that matches the search terms, the associated security trimmer implementations are identified and executed to retrieve the access rights to view the document for the current user from the back-end computing system where the document is stored.

Claims

1. A method for associating a security trimmer with a document, the method comprising:

maintaining, at a Web server computer executing an application program, a search index storing one or more document identifiers, each document identifier corresponding to a document stored at a back-end computing system;

associating at least one document identifier stored in the search index with one or more security trimmers comprising executable code for invoking an application programming interface exposed by the back-end computing system to determine whether a user has access rights for a document, wherein associating each document identifier stored in the search index with the one or more security trimmers comprises associating a unique security trimmer identifier and configuration information for each of the one or more security trimmers that configure the operation of the one or more security trimmers at execution time, associating each document identifier stored in the search index with one or more crawl rules, and associating each crawl rule with one or more security trimmers;

storing security data associated with each document identifier, the security data retrieved from the back-end computing system;

receiving a query from a user including one or more search terms;

in response to the query, querying the search index to identify one or more documents matching the search terms; and

for each document matching the search terms, executing security trimmers associated with a corresponding document identifier to invoke the application programming interface exposed by the back-end computing system and to transmit the security data and a request for access rights to the document to the back-end computing system to determine access rights of the user to view the document.

2. The method of claim 1, further comprising:

obtaining the access rights via execution of each of the security trimmers; and

based upon the access rights obtained via execution of each of the security trimmers, determining whether to display each document matching the search terms to the user.

3. The method of claim 1, wherein at least two of the security trimmers are executed simultaneously.

4. The method of claim 1, further comprising:

associating a priority value with each crawl rule; and

selecting the crawl rule for use with a particular document identifier based upon the priority value.

5. The method of claim 1, wherein the security data is associated with each document identifier, and wherein each security trimmer is configured to transmit the security data associated with the document identifier and the request for access rights for the document corresponding to the document identifier to the back-end computing system.

6. One of an optical disk, a magnetic storage device or a semi-conductor storage device having computer-executable instructions stored thereon that, when executed by a computer, cause the computer to:

maintain a search index storing one or more document identifiers, each document identifier corresponding to a document stored at a back-end computing system and being associated with a crawl rule;

store security data associated with each of the one or more document identifiers, the security data retrieved from the back-end computing system;

associate each crawl rule with one or more security trimmers, each of the security trimmers comprising a unique security trimmer identifier and configuration information for each of the one or more security trimmers that configure the operation of the one or more security trimmers at execution time, and executable code for invoking an application programming interface exposed by the back-end computing system to determine whether a user has access rights for a document;

perform a query of the search index to obtain search results including one or more document identifiers; and

for each document identifier in the search results,

identify one or more associated crawl rules and one or more associated security trimmers, and

execute the one or more security trimmers associated with a corresponding document identifier to invoke the application programming interface exposed by the back-end computing system and to transmit the security data and a request for access rights to the document to the back-end computing system to determine access rights of the user to view the document.

7. The optical disk, the magnetic storage device or the semi-conductor storage device of claim 6, further comprising computer-executable instructions that, when executed by the computer, cause the computer to:

obtain access rights for each document identifier in the search results; and

determine whether to display each document identifier in the search results based on the access rights.

8. The optical disk, the magnetic storage device or the semi-conductor storage device of claim 7, wherein each crawl rule is further associated with a trimmer resolver configured to determine whether to display each document identifier in the search results associated with a corresponding crawl rule.

9. The optical disk, the magnetic storage device or the semi-conductor storage device computer storage medium of claim 7, wherein each of the security trimmers includes an associated uniform resource locator queue.

10. The optical disk, the magnetic storage device or the semi-conductor storage device of claim 7, wherein each of the security trimmers includes an associated security data queue that stores the security data.

11. The optical disk, the magnetic storage device or the semi-conductor storage device of claim 7, wherein at least two of the security trimmers are executed simultaneously.

12. A method for associating security trimmers with documents, the method comprising:

maintaining, at a Web server computer executing an application program, a search index storing one or more document identifiers, each of the document identifiers referencing a document and being associated with a crawl rule identifier;

maintaining a security trimmer configuration store comprising one or more unique security trimmer identifiers, each of the unique security trimmer identifiers referencing a security trimmer and having associated configuration information for configuring the operation of the security trimmer at execution time, each security trimmer associated with a corresponding document identifier;

storing security data associated with each document identifier, the security data retrieved from a back-end computing system;

maintaining a crawl rule definition store comprising one or more crawl rules, each crawl rule being associated with one or more of the unique security trimmer identifiers;

receiving a query associated with a user, the query comprising one or more search terms;

querying the search index to identify one or more documents that match the search terms; and

for each document matching the search terms,

identifying security trimmers for the document using the associated crawl rule identifier and crawl rule definition store, and

executing the security trimmers identified to invoke the application programming interface exposed by the back-end computing system and to transmit the security data and a request for access rights to the document to the back-end computing system to determine access rights of the user to view the document.

13. The method of claim 12, wherein each crawl rule is further associated with a priority value, and wherein the method further comprises utilizing the priority value to identify the crawl rule that is to be utilized when a document identifier corresponds to more than one crawl rule.

14. The method of claim 13, wherein each crawl rule is further associated with a trimmer resolver configured to obtain access rights from each of the security trimmers and to determine based on the access rights if the user is authorized to view the document.

15. The method of claim 12, wherein each security trimmer is associated with a security data queue that stores the security data.

16. The method of claim 15, wherein each security trimmer is associated with a uniform resource locator queue.