System and methods for providing query-based permissions to data

• US 10,339,338 B2
• Filed: 07/26/2018
• Issued: 07/02/2019
• Est. Priority Date: 02/18/2016
• Status: Active Grant

• Current Assignee: Workiva Inc.
• Original Assignee: Workiva Inc.
• Inventors: Haila, David Andrew, Cummins, Graham, Lamb, Robert Ray, Cranendonk, Jeroen Sebastian
• Primary Examiner(s): Waldron, Scott A.
• Application Number:
  US16/046,373
• Publication Number:
  US 20180336364A1
• Time in Patent Office: 341 Days
• CPC Class Codes: G06F 16/245 Query processing
• CPC Class Codes: G06F 21/6227 where protection concerns the structure of data, e.g. records, types, queries
• CPC Class Codes: G06F 2221/2113 Multi-level security, e.g. mandatory access control
• CPC Class Codes: G06F 2221/2137 Time limited access, e.g. to a computer or data

Abstract

A method includes generating, in a graph database, an access role vertex that defines an access role of a user, where the access role vertex is connected to a user vertex representing the user; generating a query vertex including a traversal clause that represents a query of the graph database; generating a permission edge between the access role vertex and the query vertex, where the permission edge defines the access role'"'"'s permission to access the results of the query; receiving a request to execute the query on behalf of the user; in response to the request, traversing the graph database according to the traversal clause to locate a set of vertices; and generating a set of results based on the set of vertices.

Claims

1. A method implemented on a computing device, the method comprising:

generating, in a graph database, an access role vertex that defines an access role of a user, wherein the access role vertex is connected to a user vertex representing the user;

generating a query vertex comprising a traversal clause that represents a query of the graph database;

generating a permission edge between the access role vertex and the query vertex, wherein the permission edge defines the access role'"'"'s default permission to access results of the query;

generating an edit rule vertex, wherein the edit rule vertex comprises a rule that defines a permission to edit the results of the query;

generating an edge between the query vertex and the edit rule vertex;

generating an edge between the access role vertex and the edit rule vertex, wherein the permission to edit the results of the query defined by the rule overrides the default permission defined by the permission edge;

receiving a request to execute the query on behalf of the user;

in response to the request, traversing the graph database according to the traversal clause to locate a set of vertices; and

generating a set of results based on the set of vertices.

2. The method of claim 1, wherein the permission defined by the rule is more permissive than the default permission defined by the permission edge.

3. The method of claim 1, wherein the traversal clause identifies a data vertex, and traversing the graph database according to the traversal clause comprises traversing the graph database starting from the data vertex.

4. The method of claim 3, wherein the data vertex identified in the traversal clause is the user vertex.

5. The method of claim 3, wherein the data vertex identified in the traversal clause is the access role vertex.

6. The method of claim 1, further comprising displaying, to the user, the set of results.

7. The method of claim 1, wherein the default permission defined by the permission edge is view permission.

8. A method implemented on a computing device, the method comprising:

generating, in a graph database, an access role vertex that defines an access role of a user, wherein the access role vertex is connected to a user vertex representing the user;

generating a query vertex comprising a traversal clause that represents a query of the graph database;

generating a permission edge between the access role vertex and the query vertex, wherein the permission edge defines the access role'"'"'s default permission to access results of the query, wherein the results of the query comprise a set of vertices that is specific to the user;

generating an edit rule vertex, wherein the edit rule vertex comprises a rule that defines a permission to edit the results of the query;

generating an edge between the query vertex and the edit rule vertex;

generating an edge between the access role vertex and the edit rule vertex, wherein the permission to edit the results of the query defined by the rule overrides the default permission defined by the permission edge;

identifying, from the graph database, the set of vertices that is specific to the user;

receiving a request to execute the query on behalf of the user; and

in response to the request, traversing only the identified set of vertices that is specific to the user to generate a sub-graph specific to the user.

9. The method of claim 8, wherein the permission defined by the rule is more permissive than the default permission defined by the permission edge.

10. The method of claim 8, wherein the traversal clause identifies a data vertex, and identifying the set of vertices that is specific to the user comprises traversing the graph database starting from the data vertex.

11. The method of claim 10, wherein the data vertex identified in the traversal clause is the user vertex.

12. The method of claim 10, wherein the data vertex identified in the traversal clause is the access role vertex.

13. The method of claim 8, further comprising:

generating a report using data in the sub-graph; and

displaying the report to the user.

14. The method of claim 8, wherein the sub-graph comprises the set of vertices that is specific to the user and the query vertex.

15. The method of claim 8, wherein the sub-graph comprises a reference to the set of vertices that is specific to the user and a reference to the query vertex.

16. The method of claim 8, further comprising:

receiving a request to modify data;

updating the graph database to include the modified data;

determining whether the request to modify data modifies data in the identified set of vertices; and

based on a determination that the request to modify data modifies data in the identified set of vertices, regenerating the sub-graph to include the modified data.

17. The method of claim 8, wherein the default permission defined by the permission edge is view permission.

18. A method implemented on a computing device, the method comprising:

generating, in a graph database, a first access role vertex that defines an access role of a first user, wherein the first access role vertex is connected to a first user vertex representing the first user;

generating, in the graph database, a second access role vertex that defines an access role of a second user, wherein the second access role vertex is connected to a second user vertex representing the second user;

generating a query vertex comprising a traversal clause that represents a query of the graph database;

generating a permission edge between the first access role vertex and the query vertex, wherein the permission edge defines the first access role'"'"'s default permission to access the results of the query;

generating an edit rule vertex, wherein the edit rule vertex comprises a rule that defines a permission to edit the results of the query;

generating an edge between the query vertex and the edit rule vertex;

generating an edge between the first access role vertex and the edit rule vertex, wherein the permission to edit the results of the query defined by the rule overrides the default permission defined by the permission edge;

receiving, from the first user, an indication that the database query is to be shared with the second user;

in response to the received indication, generating an edge between the second access role vertex and the query vertex;

receiving a request to execute the database query on behalf of the second user;

in response to the request, traversing the graph database according to the traversal clause to locate a set of vertices, wherein the set of vertices includes at least one vertex in the graph database that was not accessible to the second user before the edge was generated between the second access role vertex and the query vertex; and

displaying, to the second user, a set of results based on the located set of vertices.

19. The method of claim 18, wherein the default permission defined by the rule is more permissive than the default permission defined by the permission edge.

20. The method of claim 18, wherein the traversal clause identifies a data vertex, and traversing the graph database according to the traversal clause comprises traversing the graph database starting from the data vertex.

21. The method of claim 20, wherein the data vertex identified in the traversal clause is the user vertex.

22. The method of claim 20, wherein the data vertex identified in the traversal clause is the access role vertex. defined by the permission edge is view permission.

23. The method of claim 18, wherein the default permission defined by the permission edge is view permission.