Flexible Authorization Model for Secure Search

• US 20070214129A1
• Filed: 02/28/2007
• Published: 09/13/2007
• Est. Priority Date: 03/01/2006
• Status: Abandoned Application

• Current Assignee: Oracle International Corporation (Oracle Corporation)
• Original Assignee: Oracle International Corporation (Oracle Corporation)
• Inventors: Davis, Mark, Krishnaprasad, Muralidhar, Bhavsar, Meeten, Bhatkar, Sachin, Yang, Chi-Ming, Hsin, Cindy, Delgado, Joaquin, Ouyang, Hui, Ture, Mark, Koide, Hiroshi, Nimani, Visar
• Application Number:
  US11/680,558
• Publication Number:
  US 20070214129A1
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: G06F 16/951 Indexing; Web crawling techniques

Abstract

A flexible and extensible architecture allows for secure searching across an enterprise. Such an architecture can provide a simple Internet-like search experience to users searching secure content inside (and outside) the enterprise. The architecture allows for the crawling and searching of a variety or sources across an enterprise, regardless of whether any of these sources conform to a conventional user role model. The architecture further allows for security attributes to be submitted at query time, for example, in order to provide real-time secure access to enterprise resources. The user query also can be transformed to provide for dynamic querying that provides for a more current result list than can be obtained for static queries.

Claims

1. A method for authorizing a user in a secure search system, comprising:

receiving a query from an authenticated user of the secure search system;

obtaining security attribute values for the authenticated user in response to the query;

appending the security attribute values to the query and passing the appended query to an appropriate data source for the query;

receiving results for the query from the appropriate data source based on terms in the query and the security attribute values; and

transmitting the results to the user.

2. A method according to claim 1, further comprising:

crawling a plurality of documents from a plurality of secure data sources across an enterprise; and

indexing each of the plurality of documents.

3. A method according to claim 2, further comprising:

storing a copy of at least a portion of each crawled document.

4. A method according to claim 2, further comprising:

crawling documents outside the enterprise.

5. A method according to claim 1, further comprising:

obtaining the security attribute values for the user from an identity management system associated with the appropriate secure data source.

6. A method according to claim 2, wherein:

the appended user query is executed against indexed documents from the crawl.

7. A method according to claim 6, wherein:

the results for the user are based on documents from the crawl to which the user has access based on the security attribute values appended to the query.

8. A method according to claim 1 wherein:

the security attribute values include at least one value for a grant or deny attribute.

9. A method according to claim 1, wherein:

the security attribute values specify at least one of a role, group, or project associated with the user.

10. A method according to claim 3, further comprising:

fixing attributes for at least one stored copy of a document.

11. A method according to claim 3, wherein:

fixing attributes occurs at crawl time.

12. A system for authorizing a user in a secure search system, comprising:

a search module operable to receive a query from an authenticated user of the secure search system; and

a callback mechanism operable to obtain security attribute values for the authenticated user in response to the query, the security attribute values being provided by an identity management system for a secure data source, the search module being operable to append the security attribute values to the query and pass the appended query to the secure data source, the search module being further operable to receive results for the query from the secure data source based on terms in the query and the security attribute values and transmit the results to the user.

13. A system according to claim 12, further comprising:

a crawler plug-in for the search module operable crawl a plurality of documents from a plurality of secure data sources across an enterprise.

14. A system according to claim 13, wherein:

the search module is further operable to index each of the plurality of crawled documents.

15. A system according to claim 13, wherein:

the search module is further operable to store a copy of each of the plurality of crawled documents.

16. A system according to claim 13, wherein:

the crawler plug-in is further operable to crawl documents outside the enterprise.

17. A system according to claim 12, wherein:

the search module is further operable to obtain the security attribute values for the user from an identity management system associated with the appropriate secure data source.

18. A system according to claim 12, wherein:

the security attribute values include at least one value for a grant or deny attribute.

19. A system according to claim 12, wherein:

the security attribute values specify at least one of a role, group, or project associated with the user.

20. A computer program product embedded in a computer readable medium for authorizing a user in a secure search system, comprising:

program code for receiving a query from an authenticated user of the secure search system;

program code for obtaining security attribute values for the authenticated user in response to the query;

program code for appending the security attribute values to the query and passing the appended query to an appropriate data source for the query;

program code for receiving results for the query from the appropriate data source based on terms in the query and the security attribute values; and

program code for transmitting the results to the user.

21. A computer program product according to claim 20, further comprising:

program code for crawling a plurality of documents from a plurality of secure data sources across an enterprise; and

program code for indexing each of the plurality of documents.

22. A computer program product according to claim 21, further comprising:

program code for storing a copy of at least a portion of each crawled document.

23. A computer program product according to claim 21, further comprising:

program code for crawling documents outside the enterprise.

24. A computer program product according to claim 20, further comprising:

program code for obtaining the security attribute values for the user from an identity management system associated with the appropriate secure data source.