ENABLING ACCESS TO A SUBSET OF DATA

• US 20100180337A1
• Filed: 01/14/2009
• Published: 07/15/2010
• Est. Priority Date: 01/14/2009
• Status: Active Grant

• Current Assignee: Globalfoundries US Incorporated (GlobalFoundries, Inc.)
• Original Assignee: International Business Machines Corporation
• Inventors: Bajekal, Sadanand Rajaram
• Granted Patent: US 8,650,634 B2
• Time in Patent Office: Days
• US Class Current: 726/19
• CPC Class Codes: G06F 21/30 Authentication, i.e. establishing the identity or authorisation of security principals
• CPC Class Codes: G06F 21/6227 where protection concerns the structure of data, e.g. records, types, queries
• CPC Class Codes: G06F 2221/2117 User registration
• CPC Class Codes: G06F 2221/2141 Access rights, e.g. capability lists, access control lists, access tables, access matrices

Abstract

A method includes receiving, at a computing device, one or more replicated authorization databases. At least one of the one or more replicated authorization databases corresponds to a subscription to access selected data. The selected data is aggregated from a plurality of sources. The method also includes storing the one or more replicated authorization databases at the computing device. The method also includes determining, via the replicated authorization databases, user permission to access the selected data via the computing device. The method also includes enabling access to the selected data at the computing device after determining the user permission to access the selected data.

Claims

1. A method, comprising:

receiving, at a computing device, one or more replicated authorization databases, at least one of the one or more replicated authorization databases corresponding to a subscription to access selected data, the selected data aggregated from a plurality of sources, wherein at least a portion of the selected data is real-time subscription data;

storing the one or more replicated authorization databases at the computing device;

determining, via the replicated authorization databases, user permission to access the selected data via the computing device; and

enabling access to the selected data at the computing device after determining the user permission to access the selected data.

2. The method of claim 1, wherein the one or more replicated authorization databases are selectively replicated from authorization databases that are created at an access manager by partitioning an ontology data structure having multiple domains, and wherein each of the authorization databases is associated with a user subscription type.

3. The method of claim 2, wherein the ontology data structure is logically partitioned based on at least one of a source of the data, a classification of the data, a type of the data, an identifier of the data, and a geographic classification of the data.

4. The method of claim 2, wherein the selected data includes financial market data.

5. The method of claim 4, wherein the financial market data includes at least one of stock quotes, market analysis reports, interest rate quotes, historical financial market data, and market-related news.

6. The method of claim 2, further comprising sending a login notification from the computing device to the access manager before receiving the one or more replicated authorization databases, and wherein the access manager selectively replicates the authorization databases to create the one or more replicated authorization databases based on the login notification.

7. The method of claim 1, further comprising defining actions that a user of the computing device is permitted to perform with respect to accessing the selected data based on the one or more replicated authorization databases.

8. A method, comprising:

partitioning an ontology data structure having multiple domains to create a set of authorization databases, wherein each of the authorization databases is associated with a user subscription type;

identifying, based at least partially on a first user profile, entitlement rights of a first user to access a subset of data, the data aggregated from a plurality of sources, wherein at least a portion of the data is aggregated substantially in real-time;

identifying a first subset of authorization databases, the first subset of authorization databases including at least one but not all databases in the set of authorization databases, the first subset of authorization databases selected based on a subscription associated with the first user, wherein the first subset of authorization databases includes permissions to access the subset of data; and

selectively replicating the first subset of authorization databases to a first computing device associated with the first user.

9. The method of claim 8, wherein the first user profile includes information that identifies the user subscription type.

10. The method of claim 8, further comprising receiving, at an access manager, a login notification from the computing device associated with the first user and retrieving the first user profile in response to receiving the login notification.

11. The method of claim 10, further comprising:

identifying a second subset of authorization databases based on a second user profile, the second subset of authorization databases selected based on a second subscription associated with the second user, wherein the second subset of authorization databases is different than the first subset of authorization databases; and

selectively replicating the second subset of authorization databases to a second computing device associated with the second user.

12. The method of claim 11, wherein at least one authorization database is in the first subset of authorization databases and in the second subset of authorization databases.

13. The method of claim 11, wherein selectively replicating the second subset of authorization databases is performed substantially simultaneously with selectively replicating the first subset of authorization databases.

14. A system to enable access to a subset of data, the system comprising:

a network interface to communicate with a remote computing device via a network, the network interface to receive a login notification from a computing device associated with a user,

a directory services server including user information associated with entitlements of each of a plurality of users to access a subset of data, the data including subscription data from a plurality of data sources, wherein the user information includes a user profile;

a policy server coupled to the directory services server, the policy server including a set of policies useable to determine entitlements for a particular user based on a user profile of the particular user, the policy server further identifying a subset of authorization databases from a set of authorization databases based on the entitlements; and

an access manager to selectively replicate the subset of authorization databases to the remote computing device to enable user access of the particular user to the subset of the data.

15. The system of claim 14, wherein the set of authorization databases are created by partitioning an ontology data structure representation of the data.

16. The system of claim 15, wherein the ontology data structure includes a hierarchical tree structure that is logically partitioned into a plurality of domains.

17. The system of claim 16, wherein a first subset of the plurality of domains is associated with a second subset of the authentication databases and a third subset of the plurality of domains is associated with a fourth subset of the authentication databases.

18. A computer program product comprising a computer usable medium having computer usable program code embodied therewith, the computer usable program code comprising:

computer usable program code configured to identify entitlements of a user to access selected data, the data including subscription data collected from a plurality of sources;

computer usable program code configured to identify one or more authorization databases from a set of authorization databases based on the entitlements of the user; and

computer usable program code configured to selectively replicate the one or more authorization databases to a computing device associated with the user.

19. The computer program product of claim 18, further comprising computer usable program code configured to aggregate the data collected from the plurality of sources substantially in real-time.

20. The computer program product of claim 19, wherein the data includes financial market data.