Access control for objects having attributes defined against hierarchically organized domains containing fixed number of values

• US 9,935,964 B2
• Filed: 02/23/2015
• Issued: 04/03/2018
• Est. Priority Date: 10/08/2014
• Status: Active Grant

• Current Assignee: Oracle Financial Services Software Limited (Oracle Corporation)
• Original Assignee: Oracle Financial Services Software Limited (Oracle Corporation)
• Inventors: Vadapandeshwara, Rajaram Narasimha, Srinivasa, Bhargava, Nagulakonda, Gangadhar
• Primary Examiner(s): CHIANG, JASON
• Application Number:
  US14/628,308
• Publication Number:
  US 20160104004A1
• Time in Patent Office: 1,135 Days
• CPC Class Codes: G06F 21/604 Tools and structures for managing or administering access control systems
• CPC Class Codes: G06F 21/62 Protecting access to data via a platform, e.g. using keys or access control rules
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 63/104 Grouping of entities
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

An aspect of the present disclosure facilitates controlling access to objects having attributes defined against hierarchically organized domains, with each domain containing a corresponding fixed number of values. In one embodiment, in response to receiving data indicating specific hierarchies of the hierarchically organized domains, the corresponding fixed number of values of the corresponding domains in each hierarchy is displayed. Accordingly, a user is enabled to select a desired set of values from the corresponding fixed number of values of the corresponding domains, and to specify a security rule for a combination of the selected set of values and a user entity. The security rule is thereafter enforced when objects having attributes matching the selected set of values are accessed by the user entity.

Claims

1. A method of controlling access to objects, said method comprising:

receiving data indicating a plurality of hierarchies of hierarchically organized domains, with each domain containing a corresponding fixed number of values,

said plurality of hierarchies including a first hierarchy and a second hierarchy,

said first hierarchy and said second hierarchy respectively specifying a first plurality of values and a second plurality of values which can be stored for attributes of said objects, wherein said objects are stored in a relational database server and access to said objects is performed using SQL (structured query language) queries;

displaying on a display unit at a first time instance, the values of the corresponding domains in each hierarchy of said plurality of hierarchies along with a plurality of user entities, wherein said first plurality of values and said second plurality of values are displayed on said display unit at said first time instance;

enabling a user to specify a first combination and a second combination,

said first combination comprising a user entity from said plurality of user entities, and a first set of values from the displayed values of the corresponding domains, wherein said first set of values includes a first value from said first plurality of values of said first hierarchy and a second value from said second plurality of values of said second hierarchy,

wherein said second combination comprises said user entity and a second set of values from the displayed values, said second set of values containing said first value and a third value from said second plurality of values of said second hierarchy,

wherein said user selects a third set of values from said first hierarchy, said third set of values comprising a fifth value of a first domain in said first hierarchy and a descendant flag, wherein said first domain is at a higher level in said first hierarchy, wherein said fifth value is associated with sub-domains that are at lower levels relative to said higher level in said first hierarchy,

wherein said descendant flag indicates whether or not to include the sub-domains under said fifth value in said selection,

wherein said selection includes the values of said first domain and the sub-domains under said fifth value in said third set of values if said descendant flag indicates sub-domains are to be included in said selection, and only the values of said first domain otherwise;

enabling said user to specify a first security rule and a second security rule, said first security rule being for said first combination of said user entity and said first set of values including said first value and said second value,

said second security rule being for said second combination of said user entity and said second set of values including said first value and said third value; and

enforcing said first security rule and said second security rule, wherein said first security rule is enforced when an object having attributes matching said first set of values, including a first attribute of the object matching said first value and a second attribute of the object matching said second value, is accessed by said user entity,

wherein said second security rule is enforced when another object having attributes matching said second set of values, including a third attribute of the another object matching said first value and a fourth attribute of the another object matching said third value, is accessed by said user entity,

wherein said user specifies both of said first security rule and said second security based on the values of the corresponding domains displayed on said display unit at said first time instance,

wherein access to a first object by said user entity is performed using a first SQL query, wherein said enforcing of said first security rule when said first object is accessed by said user entity comprises;

appending a condition to a WHERE clause of said first SQL query, said condition designed to check whether the attributes of said first object matches said first set of values.

2. The method of claim 1, wherein said displaying displays a plurality of tuples along respective lines with each tuple containing an ordered sequence of elements,

wherein each element is set to one of the values of a corresponding hierarchy of said plurality of hierarchies such that said plurality of tuples together represents a Cartesian product of values of all of said plurality of hierarchies,

wherein said selection comprises indicating a first line and a second line respectively corresponding to a first tuple of interest and a second tuple of interest, said first tuple of interest and said second tuple of interest being contained in said plurality of tuples, said first tuple of interest representing said first set of values including said first value and said second value, said second tuple of interest representing said second set of values including said first value and said third value,

wherein said first security rule is specified for said first combination of said user entity and said first tuple of interest,

wherein said second security rule is specified for said second combination of said user entity and said second tuple of interest,

wherein said enforcing enforces said first security rule when objects having attributes matching said first tuple of interest are accessed by said user entity,

wherein said enforcing enforces said second security rule when objects having attributes matching said second tuple of interest are accessed by said user entity.

3. The method of claim 2, wherein said lines are displayed along a first dimension and said plurality of user entities including said user entity are displayed along a second dimension,

wherein said selection comprises indicating for each user entity of said plurality of user entities, a corresponding set of lines of interest, wherein said first line and second line is indicated for said user entity,

wherein said enforcing enforces said first security rule and said second security rule when objects having attributes matching any of the tuples corresponding to said selected set of lines of interest are accessed by the corresponding user entity.

4. The method of claim 3, further comprising:

displaying a data map representing said plurality of tuples, wherein the values of each hierarchy of said plurality of hierarchies is displayed along a corresponding dimension of said data map; and

receiving from said user, a set of valid tuples contained in said plurality of tuples, each valid tuple representing a corresponding set of values that may be assigned to attributes of the objects,

wherein said displaying displays only said set of valid tuples as said lines along said first dimension.

5. The method of claim 1, wherein said plurality of hierarchies includes a third hierarchy having said plurality of user entities as nodes,

wherein said enabling enables said user to also select a set of user entities of said plurality of user entities, said set of user entities including said user entity,

wherein said method further comprises:

enabling said user to select a fourth set of values from said second hierarchy,

in response to said selection of said third set of values, said fourth set of values, and said set of user entities, displaying a plurality of tuples along respective lines with each tuple containing an ordered sequence of elements,

wherein elements at a first position, a second position and a third position in said ordered sequence, are respectively set to one of said set of user entities, one of said third set of values and one of said fourth set of values such that said plurality of tuples together represents a Cartesian product of said third set of values, said fourth set of values and said set of user entities,

wherein said user specifies said first security rule by selecting lines corresponding to a first set of tuples of said plurality of tuples, wherein a first tuple of said first set of tuples has said user entity in said first position, said first value in said second position and said second value in said third position,

wherein said user specifies said second security rule by selecting lines corresponding to a second set of tuples of said plurality of tuples, wherein a second tuple of said second set of tuples has said user entity in said first position, said first value in said second position and said third value in said third position.

6. The method of claim 5, wherein said first security rule permits access to corresponding objects having attributes matching said first set of values, wherein access is denied to objects if not permitted access by any corresponding security rule.

7. The method of claim 1, wherein said method is implemented in a financial application server, wherein said objects are application objects defined in a financial application executing in said financial application server.

8. A non-transitory machine readable medium storing one or more sequences of instructions for enabling a system to control access to objects, wherein execution of said one or more instructions by one or more processors contained in said system enables said system to perform the actions of:

receiving data indicating a plurality of hierarchies of hierarchically organized domains, with each domain containing a corresponding fixed number of values,

said plurality of hierarchies including a first hierarchy and a second hierarchy,

said first hierarchy and said second hierarchy respectively specifying a first plurality of values and a second plurality of values which can be stored for attributes of said objects, wherein said objects are stored in a relational database server and access to said objects is performed using SQL (structured query language) queries;

displaying on a display unit at a first time instance, the values of the corresponding domains in each hierarchy of said plurality of hierarchies along with a plurality of user entities, wherein said first plurality of values and said second plurality of values are displayed on said display unit at said first time instance;

enabling a user to specify a first combination and a second combination, said first combination comprising a user entity from said plurality of user entities, and a first set of values from the displayed values of the corresponding domains, wherein said first set of values includes a first value from said first plurality of values of said first hierarchy and a second value from said second plurality of values of said second hierarchy,

wherein said second combination comprises said user entity and a second set of values from the displayed values, said second set of values containing said first value and a third value from said second plurality of values of said second hierarchy,

wherein said user selects a third set of values from said first hierarchy, said third set of values comprising a fifth value of a first domain in said first hierarchy and a descendant flag, wherein said first domain is at a higher level in said first hierarchy, wherein said fifth value is associated with sub-domains that are at lower levels relative to said higher level in said first hierarchy,

wherein said descendant flag indicates whether or not to include the sub-domains under said fifth value in said selection,

wherein said selection includes the values of said first domain and the sub-domains under said fifth value in said third set of values if said descendant flag indicates sub-domains are to be included in said selection, and only the values of said first domain otherwise;

enabling said user to specify a first security rule and a second security rule, said first security rule being for said first combination of said user entity and said first set of values including said first value and said second value,

said second security rule being for said second combination of said user entity and said second set of values including said first value and said third value; and

enforcing said first security rule and said second security rule, wherein said first security rule is enforced when an object having attributes matching said first set of values, including a first attribute of the object matching said first value and a second attribute of the object matching said second value, is accessed by said user entity,

wherein said second security rule is enforced when another object having attributes matching said second set of values, including a third attribute of the another object matching said first value and a fourth attribute of the another object matching said third value, is accessed by said user entity,

wherein said user specifies both of said first security rule and said second security based on the values of the corresponding domains displayed on said display unit at said first time instance,

wherein access to a first object by said user entity is performed using a first SQL query, wherein said enforcing of said first security rule when said first object is accessed by said user entity comprises;

appending a condition to a WHERE clause of said first SQL query, said condition designed to check whether the attributes of said first object matches said first set of values.

9. The non-transitory machine readable medium of claim 8, wherein said displaying displays a plurality of tuples along respective lines with each tuple containing an ordered sequence of elements,

wherein each element is set to one of the values of a corresponding hierarchy of said plurality of hierarchies such that said plurality of tuples together represents a Cartesian product of values of all of said plurality of hierarchies,

wherein said selection comprises indicating a first line and a second line respectively corresponding to a first tuple of interest and a second tuple of interest, said first tuple of interest and said second tuple of interest being contained in said plurality of tuples, said first tuple of interest representing said first set of values including said first value and said second value, said second tuple of interest representing said second set of values including said first value and said third value,

wherein said first security rule is specified for said first combination of said user entity and said first tuple of interest,

wherein said second security rule is specified for said second combination of said user entity and said second tuple of interest,

wherein said enforcing enforces said first security rule when objects having attributes matching said first tuple of interest are accessed by said user entity,

wherein said enforcing enforces said second security rule when objects having attributes matching said second tuple of interest are accessed by said user entity.

10. The non-transitory machine readable medium of claim 9, wherein said lines are displayed along a first dimension and said plurality of user entities including said user entity are displayed along a second dimension,

wherein said selection comprises indicating for each user entity of said plurality of user entities, a corresponding set of lines of interest, wherein said first line and second line is indicated for said user entity,

wherein said enforcing enforces said first security rule and said second security rule when objects having attributes matching any of the tuples corresponding to said selected set of lines of interest are accessed by the corresponding user entity.

11. The non-transitory machine readable medium of claim 10, further comprising one or more instructions for:

displaying a data map representing said plurality of tuples, wherein the values of each hierarchy of said plurality of hierarchies is displayed along a corresponding dimension of said data map; and

receiving from said user, a set of valid tuples contained in said plurality of tuples, each valid tuple representing a corresponding set of values that may be assigned to attributes of the objects,

wherein said displaying displays only said set of valid tuples as said lines along said first dimension.

12. The non-transitory machine readable medium of claim 8, wherein said plurality of hierarchies includes a third hierarchy and having said plurality of user entities as nodes,

wherein said enabling enables said user to also select a set of user entities of said plurality of user entities, said set of user entities including said user entity,

further comprising one or more instructions for:

enabling said user to select a fourth set of values from said second hierarchy,

in response to said selection of said third set of values, said fourth set of values, and said set of user entities, displaying a plurality of tuples along respective lines with each tuple containing an ordered sequence of elements,

wherein elements at a first position, a second position and a third position in said ordered sequence, are respectively set to one of said set of user entities, one of said third set of values and one of said fourth set of values such that said plurality of tuples together represents a Cartesian product of said third set of values, said fourth set of values and said set of user entities,

wherein said user specifies said first security rule by selecting lines corresponding to a first set of tuples of said plurality of tuples, wherein a first tuple of said first set of tuples has said user entity in said first position, said first value in said second position and said second value in said third position,

wherein said user specifies said second security rule by selecting lines corresponding to a second set of tuples of said plurality of tuples, wherein a second tuple of said second set of tuples has said user entity in said first position, said first value in said second position and said third value in said third position.

13. The non-transitory machine readable medium of claim 8, wherein said first security rule permits access to corresponding objects having attributes matching said first set of values, wherein access is denied to objects if not permitted access by any corresponding security rule.

14. A computing system comprising:

a relational database server to store a plurality of objects;

an administrator system operable to;

receive data indicating a plurality of hierarchies of hierarchically organized domains, with each domain containing a corresponding fixed number of values,

said plurality of hierarchies including a first hierarchy and a second hierarchy,

said first hierarchy and said second hierarchy respectively specifying a first plurality of values and a second plurality of values which can be stored for attributes of said plurality of objects, wherein said objects are stored in a relational database server and access to said objects is performed using SQL (structured query language) queries;

display on a display unit at a first time instance, the values of the corresponding domains in each hierarchy of said plurality of hierarchies along with a plurality of user entities, wherein said first plurality of values and said second plurality of values are displayed on said display unit at said first time instance;

enable a user to specify a first combination and a second combination, said first combination comprising a user entity from said plurality of user entities, and a first set of values from the displayed values of the corresponding domains, wherein said first set of values includes a first value from said first plurality of values of said first hierarchy and a second value from said second plurality of values of said second hierarchy,

wherein said second combination comprises said user entity and a second set of values from the displayed values, said second set of values containing said first value and a third value from said second plurality of values of said second hierarchy,

wherein said user selects a third set of values from said first hierarchy, said third set of values comprising a fifth value of a first domain in said first hierarchy and a descendant flag, wherein said first domain is at a higher level in said first hierarchy, wherein said fifth value is associated with sub-domains that are at lower levels relative to said higher level in said first hierarchy,

wherein said descendant flag indicates whether or not to include the sub-domains under said fifth value in said selection,

wherein said selection includes the values of said first domain and the sub-domains under said fifth value in said third set of values if said descendant flag indicates sub-domains are to be included in said selection, and only the values of said first domain otherwise; and

enable said user to specify a first security rule and a second security rule, said first security rule being for said first combination of said user entity and said first set of values including said first value and said second value,

said second security rule being for said second combination of said user entity and said second set of values including said first value and said third value,

wherein said user specifies both of said first security rule and said second security based on the values of the corresponding domains displayed on said display unit at said first time instance; and

a server system operable to;

receive a user request from said user entity;

determine that a first object having attributes matching said first set of values, including a first attribute of said first object matching said first value and a second attribute of said first object matching said second value, is to be accessed for processing said user request; and

enforce said first security rule as against said first object in processing said user request, as a response to said user having specified said first security rule for said combination of said first set of values and said user entity,

wherein access to a first object by said user entity is performed using a first SQL query, wherein to enforce said first security rule when said first object is accessed by said user entity a condition is appended to a WHERE clause of said first SQL query, said condition designed to check whether the attributes of said first object matches said first set of values.

15. The computing system of claim 14, wherein said server system is a financial application server, wherein said plurality of objects are application objects defined in a financial application executing in said financial application server.

16. The computing system of claim 14, wherein said administrative system displays a plurality of tuples along respective lines with each tuple containing an ordered sequence of elements,

wherein each element is set to one of the values of a corresponding hierarchy of said plurality of hierarchies such that said plurality of tuples together represents a Cartesian product of values of all of said plurality of hierarchies,

wherein said selection comprises indicating a first line and a second line respectively corresponding to a first tuple of interest and a second tuple of interest, said first tuple of interest and said second tuple of interest being contained in said plurality of tuples, said first tuple of interest representing said first set of values including said first value and said second value, said second tuple of interest representing said second set of values including said first value and said third value,

wherein said first security rule is specified for said first combination of said user entity and said first tuple of interest,

wherein said second security rule is specified for said second combination of said user entity and said second tuple of interest,

wherein said enforcing enforces said first security rule when objects having attributes matching said first tuple of interest are accessed by said user entity,

wherein said enforcing enforces said second security rule when objects having attributes matching said second tuple of interest are accessed by said user entity.

17. The computing system of claim 16, wherein said lines are displayed along a first dimension and said plurality of user entities including said user entity are displayed along a second dimension,

wherein said selection comprises indicating for each user entity of said plurality of user entities, a corresponding set of lines of interest, wherein said first line and second line is indicated for said user entity,

wherein said enforcing enforces said first security rule and said second security rule when objects having attributes matching any of the tuples corresponding to said selected set of lines of interest are accessed by the corresponding user entity.

18. The computing system of claim 17, wherein said administrative system is further operable to:

display a data map representing said plurality of tuples, wherein the values of each hierarchy of said plurality of hierarchies is displayed along a corresponding dimension of said data map; and

receive from said user, a set of valid tuples contained in said plurality of tuples, each valid tuple representing a corresponding set of values that may be assigned to attributes of the objects,

wherein said administrative system displays only said set of valid tuples as said lines along said first dimension.

19. The computing system of claim 14, wherein said plurality of hierarchies includes a third hierarchy having said plurality of user entities as nodes,

wherein said enabling enables said user to also select a set of user entities of said plurality of user entities, said set of user entities including said user entity,

wherein said administrative system is further operable to:

enabling said user to select a fourth set of values from said second hierarchy,

in response to said selection of said third set of values, said fourth set of values, and said set of user entities, displaying a plurality of tuples along respective lines with each tuple containing an ordered sequence of elements,

wherein elements at a first position, a second position and a third position in said ordered sequence, are respectively set to one of said set of user entities, one of said third set of values and one of said fourth set of values such that said plurality of tuples together represents a Cartesian product of said third set of values, said fourth set of values and said set of user entities,

wherein said user specifies said first security rule by selecting lines corresponding to a first set of tuples of said plurality of tuples, wherein a first tuple of said first set of tuples has said user entity in said first position, said first value in said second position and said second value in said third position,

wherein said user specifies said second security rule by selecting lines corresponding to a second set of tuples of said plurality of tuples, wherein a second tuple of said second set of tuples has said user entity in said first position, said first value in said second position and said third value in said third position.

20. The computing system of claim 19, wherein said first security rule permits access to corresponding objects having attributes matching said first set of values, wherein access is denied to objects if not permitted access by any corresponding security rule.