Integration user for analytical access to read only data stores generated from transactional systems

• US 9,449,188 B2
• Filed: 10/10/2014
• Issued: 09/20/2016
• Est. Priority Date: 10/10/2014
• Status: Active Grant

• Current Assignee: Salesforce.com, Inc.
• Original Assignee: Salesforce.com, Inc.
• Inventors: Schneider, Donovan, Im, Fred, Chakravarthy, Vijayasarathy
• Primary Examiner(s): REVAK, CHRISTOPHER A
• Application Number:
  US14/512,249
• Publication Number:
  US 20160104003A1
• Time in Patent Office: 711 Days
• Field of Search: None
• US Class Current: 1/1
• CPC Class Codes: G06F 16/2379 Updates performed during online database operations; commit processing
• CPC Class Codes: G06F 16/254 Extract, transform and load [ETL] procedures, e.g. ETL data flows in data warehouses
• CPC Class Codes: G06F 21/105 Arrangements for software license management or administration, e.g. for managing licenses at corporate level
• CPC Class Codes: G06F 21/1077 Recurrent authorisation
• CPC Class Codes: G06F 21/62 Protecting access to data via a platform, e.g. using keys or access control rules
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/102 Entity profiles

Abstract

The technology disclosed preserves the tenant specificity and user specificity of the tenant data by associating user IDs to complementary special IDs referred to as the integration user(s). In particular, it combines the traceability of user actions, the integration of security models and the flexibility of a service ID into one integration user(s).

Claims

1. A computer-implemented method of controlling and tracking usage of an analytic data analysis system associated with a transactional data management system, the method including:

a transactional data management system that manages data stored in a transaction data store receiving a logon request with an associated user ID for use of the transactional data management system, authenticating the logon request, and identifying that authorizations associated with the user ID include usage of the analytical data analysis system;

wherein the analytical data analysis system responds to requests to visualize data stored in an analytic data store that is a subset of, but not all of, the data stored in the transactional data store; and

responsive to a request to use the analytical data analysis system with the user ID, invoking a complementary special ID linked to the user ID, wherein

the special ID grants rights related to a specific analytic data analysis system;

the special ID rights provide read-only access to at least one analytic data store accessed through the specific analytic data analysis system; and

use of the transactional data management system is separately licensed and accounted for from the analytical data analysis system.

2. The computer-implemented method of claim 1, further including:

associating with the special ID security attributes particular to retrieval of data objects from the specific analytic data analysis system.

3. The computer-implemented method of claim 1, further including:

applying first security translation rules that accept one or more security attributes from the transactional data management system as predicates; and

generating one or more security tokens to associate with the special ID when interacting with the specific analytic data analysis system; and

wherein the security tokens govern access using the special ID to objects managed by the specific analytic data analysis system.

4. The computer-implemented method of claim 1, further including:

associating with the special ID security attributes particular to the specific analytic data analysis system by accessing a plurality of heterogeneous transactional data management systems that have divergent security models;

accessing data in the plurality of transactional data management systems and creating objects that merge the data from two or more of the transactional data management systems; and

processing first security translation rules that accept the data set security attributes from the two or more transactional data management systems as predicates and generating one or more security tokens to associate with each secured object that merges the data.

5. An apparatus to control and track usage of an analytic data analysis system associated with a transactional data management system, the apparatus comprising:

a computer including a processor;

a memory coupled to the processor, wherein the memory includes computer program instructions causing the computer to implement a process including;

a transactional data management system that manages data stored in a transaction data store receiving a logon request with an associated user ID for use of the transactional data management system, authenticating the logon request, and identifying that authorizations associated with the user ID include usage of the analytical data analysis system;

wherein the analytical data analysis system responds to requests to visualize data stored in an analytic data store that is a subset of, but not all of, the data stored in the transactional data store; and

responsive to a request to use the analytical data analysis system with the user ID, invoking a complementary special ID linked to the user ID, wherein

the special ID grants rights related to a specific analytic data analysis system;

the special ID rights provide read-only access to at least one analytic data store accessed through the specific analytic data analysis system; and

use of the transactional data management system is separately licensed and accounted for from the analytical data analysis system.

6. The apparatus of claim 5, further including computer program instructions causing the computer to implement a process including:

associating with the special ID security attributes particular to retrieval of data objects from the specific analytic data analysis system.

7. The apparatus of claim 5, further including computer program instructions causing the computer to implement a process including:

applying first security translation rules that accept one or more security attributes from the transactional data management system as predicates; and

generating one or more security tokens to associate with the special ID when interacting with the specific analytic data analysis system; and

wherein the security tokens govern access using the special ID to objects managed by the specific analytic data analysis system.

8. The apparatus of claim 5, further including computer program instructions causing the computer to implement a process including:

associating with the special ID security attributes particular to the specific analytic data analysis system by accessing a plurality of heterogeneous transactional data management systems that have divergent security models;

accessing data in the plurality of transactional data management systems and creating objects that merge the data from two or more of the transactional data management systems; and

processing first security translation rules that accept the data set security attributes from the two or more transactional data management systems as predicates and generating one or more security tokens to associate with each secured object that merges the data.

9. A non-transitory computer-readable storage medium storing computer program instructions that cause a computer to implement a process including:

a transactional data management system that manages data stored in a transaction data store receiving a logon request with an associated user ID for use of the transactional data management system, authenticating the logon request, and identifying that authorizations associated with the user ID include usage of the analytical data analysis system;

wherein the analytical data analysis system responds to requests to visualize data stored in an analytic data store that is a subset of, but not all of, the data stored in the transactional data store; and

responsive to a request to use the analytical data analysis system with the user ID, invoking a complementary special ID linked to the user ID, wherein

the special ID grants rights related to a specific analytic data analysis system;

the special ID rights provide read-only access to at least one analytic data store accessed through the specific analytic data analysis system; and

use of the transactional data management system is separately licensed and accounted for from the analytical data analysis system.

10. A non-transitory computer-readable storage medium of claim 9, further including computer program instructions that cause the computer to implement a process including:

associating with the special ID security attributes particular to retrieval of data objects from the specific analytic data analysis system.

11. A non-transitory computer-readable storage medium of claim 9, further including computer program instructions that cause the computer to implement a process including:

applying first security translation rules that accept one or more security attributes from the transactional data management system as predicates;

generating one or more security tokens to associate with the special ID when interacting with the specific analytic data analysis system; and

wherein the security tokens govern access using the special ID to objects managed by the specific analytic data analysis system.

12. A non-transitory computer-readable storage medium of claim 9, further including computer program instructions that cause the computer to implement a process including:

associating with the special ID security attributes particular to the specific analytic data analysis system by accessing a plurality of heterogeneous transactional data management systems that have divergent security models;

accessing data in the plurality of transactional data management systems and creating objects that merge the data from two or more of the transactional data management systems; and

processing first security translation rules that accept the data set security attributes from the two or more transactional data management systems as predicates and generating one or more security tokens to associate with each secured object that merges the data.