System and methods for providing query-based permissions to data

• US 9,692,764 B1
• Filed: 05/19/2016
• Issued: 06/27/2017
• Est. Priority Date: 02/18/2016
• Status: Active Grant

• Current Assignee: Workiva Inc.
• Original Assignee: Workiva Inc.
• Inventors: Haila, David Andrew, Cummins, Graham, Lamb, Robert Ray, Cranendonk, Jeroen Sebastian
• Primary Examiner(s): Waldron, Scott A
• Application Number:
  US15/159,340
• Time in Patent Office: 404 Days
• CPC Class Codes: G06F 16/245 Query processing
• CPC Class Codes: G06F 21/6227 where protection concerns the structure of data, e.g. records, types, queries
• CPC Class Codes: G06F 2221/2113 Multi-level security, e.g. mandatory access control
• CPC Class Codes: G06F 2221/2137 Time limited access, e.g. to a computer or data

Abstract

A method includes generating a database query in a database; receiving a first request to execute the database query on behalf of a first user; in response to the first request, executing the database query to generate a first set of results such that the first set of results is limited to data with which there is a semantic relationship in the database to a first datum representing the first user; receiving a second request to execute the database query on behalf of a second user; in response to the second request, executing the database query to generate a second set of results such that the second set of results is limited to data with which there is a semantic relationship in the database to a second datum representing the second user, where the first set of results and the second set of results are at least partially non-overlapping.

Claims

1. A method implemented on a computing device, the method comprising:

in a graph database that includes a vertex representing a first user and a vertex representing a second user,

generating a query vertex comprising a traversal clause that represents a query of the graph database, wherein the traversal clause identifies a vertex type;

generating a first edge between the vertex representing the first user and the query vertex, wherein the first edge defines the first user'"'"'s permission to access the results of the query;

receiving a first request to execute the query on behalf of the first user;

in response to the first request, traversing the graph database to locate a first set of vertices of the identified vertex type, such that each vertex of the first set of vertices is semantically related to the first user'"'"'s vertex;

generating a first set of results based on the first set of vertices;

displaying, to the first user, the first set of results;

generating a second edge between the vertex representing the second user and the query vertex, wherein the second edge defines the second user'"'"'s permission to access the results of the query;

receiving a second request to execute the query on behalf of the second user;

in response to the second request, traversing the graph database to locate a second set of vertices of the identified vertex type, such that each of the second set of vertices is semantically related to the second user'"'"'s vertex;

generating a second set of results based on the second set of vertices; and

displaying, to the second user, the second set of results,

wherein the first set of vertices and the second set of vertices are at least partially non-overlapping.

2. The method of claim 1, wherein

traversing the graph database to locate the first set of vertices of the identified vertex type comprises traversing the graph database starting from the vertex representing the first user;

and

traversing the graph database to locate the second set of vertices of the identified vertex type comprises traversing the graph database starting from the vertex representing the second user.

3. The method of claim 1, wherein

displaying, to the first user, the first set of results comprises transmitting a first report that includes the first set of results to a first computing device for display to the first user;

and

displaying, to the second user, the second set of results of the query comprises transmitting a second report that includes the second set of results to a second computing device for display to the second user.

4. The method of claim 1, wherein the first user'"'"'s permission is a first type of permission and the second user'"'"'s permission is a second type of permission,

wherein the first type of permission is different from the second type of permission.

5. A method implemented on a computing device, the method comprising:

in a graph database, generating a query vertex comprising a traversal clause that represents a query of the graph database, wherein the traversal clause identifies a vertex type;

receiving, from a first user, an indication that the query is to be shared with a second user, wherein the first user is represented in the graph database by a vertex and the second user is represented in the graph database by a vertex;

in response to the received indication, generating an edge from the second user'"'"'s vertex to the query vertex, wherein the generated edge defines the second user'"'"'s permission to access vertices located as a result of the query;

receiving a request to execute the query on behalf of the second user;

in response to the request, traversing the graph database to locate each vertex of the identified vertex type that is semantically related to the first user'"'"'s vertex; and

displaying, to the second user, a set of results based on the located vertices,

wherein the located vertices include at least one vertex in the graph database that was not accessible to the second user before the edge was generated in response to the received indication.

6. The method of claim 5, wherein displaying, to the second user, the set of results comprises transmitting a report that includes the set of results to a second computing device for display to the second user.

7. The method of claim 5, further comprising:

generating an edge from the first user'"'"'s vertex to the query vertex, wherein the generated edge defines the first user'"'"'s permission to access the vertices located as a result of the query,

wherein the first user'"'"'s permission is a first type of permission and the second user'"'"'s permission is a second type of permission, and the first type of permission is the same as the second type of permission.

8. The method of claim 5, further comprising:

generating an edge from the first user'"'"'s vertex to the query vertex, wherein the generated edge defines the first user'"'"'s permission to access the vertices located as a result of the query,

wherein the first user'"'"'s permission is a first type of permission and the second user'"'"'s permission is a second type of permission, and the first type of permission is different from the second type of permission.

9. A method implemented on a computing device, the method comprising:

in a graph database, generating a query vertex comprising a traversal clause that represents a query of the graph database, wherein the traversal clause identifies a vertex type;

generating an edge from a user'"'"'s vertex to the query vertex, wherein the generated edge defines the user'"'"'s permission to access a set of vertices of the identified vertex type, wherein the set of vertices is specific to the user;

identifying, from the graph database, the set of vertices that are specific to the user, by traversing the graph database to locate each vertex of the identified vertex type that is semantically related to the user'"'"'s vertex;

receiving a request to execute the query on behalf of the user;

in response to the request, traversing only the identified set of vertices that are specific to the user to generate a report; and

displaying the report to the user.

10. The method of claim 9, wherein the report includes the set of vertices that are specific to the user and the query.

11. The method of claim 9, wherein the report includes a reference to the set of vertices that are specific to the user and a reference to the query.

12. The method of claim 9, wherein traversing the graph database to locate the set of vertices that are specific to the user comprises starting the traversal from the vertex representing the user.

13. The method of claim 9, wherein the user'"'"'s permission includes a first type of permission to access to the query, the method further comprising:

granting, to the user, the first type of permission to access the located set of vertices.

14. The method of claim 9, further comprising:

receiving a request to modify data;

updating the graph database to include the modified data;

determining whether the request to modify data modifies data in the located set of vertices; and

based on a determination that the request to modify data modifies data in the located set of vertices, regenerating the report to include the modified data.

15. The method of claim 9, further comprising:

generating a second edge from a second user'"'"'s vertex to the query vertex, wherein the generated second edge defines the second user'"'"'s permission to access a second set of vertices of the identified vertex type, wherein the second set of vertices is specific to the second user;

identifying, from the graph database, the second set of vertices that are specific to the second user, by traversing the graph database to locate each vertex of the identified vertex type that is semantically related to the second user'"'"'s vertex;

receiving a request to execute the query on behalf of the second user; and

in response to the request to traversing only the second set of vertices that are specific to the second user to generate a second report.

16. The method of claim 15, wherein

the second report includes the second set of vertices and the database query,

and

the method further comprises storing the second set of vertices that are specific to the second user in memory to be separate from the set of vertices that are specific to the user.

17. The method of claim 15, wherein

the second report includes a reference to the second set of vertices that are specific to the second user and a reference the database query,

and

the method further comprises storing the reference to the second set of vertices that are specific to the second user in memory to be separate from the reference to the set of vertices that are specific to the user.

18. The method of claim 9, further comprising:

receiving, from the user, an indication that the query is to be shared with the second user, wherein the second user is represented in the graph database by a vertex;

in response to the received indication, generating an edge from the second user'"'"'s vertex to the query vertex, wherein the generated edge defines the second user'"'"'s permission to access the set of vertices that are specific to the user;

receiving a request to execute the query on behalf of the second user; and

in response to the request to execute the query on behalf of the second user, traversing only the set of vertices that are specific to the user to generate a second report.

19. A method implemented on a computing device, the method comprising:

in a graph database, generating a first query vertex comprising a first traversal clause that represents a first query of the graph database, wherein the first traversal clause identifies a vertex type;

generating a first edge from a user'"'"'s vertex to the first query vertex, wherein the generated first edge defines the user'"'"'s permission to access a first set of vertices of the vertex type;

in the graph database, generating a second query vertex comprising a second traversal clause that represents a second query of the graph database, wherein the second traversal clause identifies the vertex type;

generating a second edge from the user'"'"'s vertex to the second query vertex, wherein the generated second edge defines the user'"'"'s permission to access a second set of vertices of the vertex type;

traversing the graph database to locate each vertex of the first set of vertices that is semantically related to the user'"'"'s vertex;

traversing the graph database to locate each vertex of the second set of vertices that is semantically related to the user'"'"'s vertex, wherein the second set of vertices and the first set of vertices share at least one common vertex;

for the at least one common vertex, comparing the permission defined by the first edge and the permission defined by the second edge; and

based on a result of the comparison, granting, to the user, either the permission defined by the first edge or the permission defined by the second edge to access to the at least one common vertex.

20. The method of claim 19, further comprising:

determining whether the permission defined by the first edge is more permissive than the permission defined by the second edge;

granting, to the user, the permission defined by the edge to access the at least one shared vertex if the permission defined by the first edge is more permissive; and

granting, to the user, the permission defined by the second edge to access the at least one shared vertex if the permission defined by the second edge is more permissive.

21. The method of claim 19, further comprising:

granting, to the user, the permission defined by the first edge to access the remaining data in the first set of vertices; and

granting, to the user, the permission defined by the second edge to access the remaining data in the second set of vertices.

22. The method of claim 19, further comprising generating a data subset specific to the user, wherein the data subset comprises the at least one shared vertex, the remaining data in the first set of vertices, the remaining data in the second set of vertices, the first database query, the second database query, the first edge, and the second edge.

23. The method of claim 19, further comprising generating a data subset specific to the user, wherein the data subset comprises a reference to the at least one shared vertex, a reference to the remaining data in the first set of vertices, a reference to the remaining data in the second set of vertices, a reference to the first database query, a reference to the second database query, a reference to the first edge, and a reference to the second edge.