SYSTEM AND METHOD FOR EFFICIENTLY SECURING ENTERPRISE DATA RESOURCES

• US 20120233689A1
• Filed: 03/13/2012
• Published: 09/13/2012
• Est. Priority Date: 05/22/2008
• Status: Active Grant

• Current Assignee: Dmitri Korablev, Gregory Danforth
• Original Assignee: Dmitri Korablev, Gregory Danforth
• Inventors: Korablev, Dmitri, Danforth, Gregory
• Granted Patent: US 8,433,717 B2
• Time in Patent Office: Days
• US Class Current: 726/17
• CPC Class Codes: G06F 21/604 Tools and structures for managing or administering access control systems
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database

Abstract

Some embodiments provide a system and method that secures access to data objects of an enterprise that includes multiple data objects and multiple user applications that access data attributes of the data objects. In some embodiments, secure access is provided via a secure resource that secures access to data attributes of at least two objects by defining access control permissions for the secure resource and applying the defined access control permissions to the data attributes of the secure resource.

Claims

1. For a data management system that secures access to a plurality of data objects stored within a data hierarchy of an enterprise, a method of securing access to data attributes of the data objects, said method comprising:

identifying groupings of subsets of data attributes from different data objects in the data hierarchy;

receiving control permissions for said groupings; and

defining control permissions for the data attributes in each particular grouping based on the received control permissions for the particular grouping.

2. The method of claim 1, wherein the subset of data attributes comprises less than all the data attributes of a particular data object.

3. The method of claim 1, wherein the data attributes are at different levels of the data hierarchy.

4. The method of claim 1 further comprising performing a query over at least one particular data object in the set of data objects, wherein access to a data attribute of the particular data object identified within a grouping is restricted based on the defined control permission for said grouping.

5. The method of claim 1, wherein the groupings are not objects within the plurality of data objects that are accessible by applications of the enterprise.

6. The method of claim 5, wherein defining the control permission occurs transparently to the operations of the applications.

7. The method of claim 1 further comprising modifying the control permissions for data attributes identified within a particular grouping by modifying the control permissions for the particular grouping.

8. The method of claim 1, wherein the data attributes comprise at least two of data files, data attributes, data objects, and data directories.

9. For a data management system that secures access to a plurality of data objects stored within a data hierarchy of an enterprise, a method of securing access to data attributes of the data objects, said method comprising:

providing a first user interface tool for defining a grouping of elements from different levels of the data hierarchy, said grouping comprising at least a data attribute of a first data object in the data hierarchy and a data attribute of a second a data object in the data hierarchy; and

providing a second user interface tool for assigning access permissions to the grouping.

10. The method of claim 9, wherein the elements for the grouping initially comprise elements with different control permissions.

11. The method of claim 10, wherein providing the second user interface tool for assigning access permissions to the grouping assigns similar access permissions to all elements in the grouping.

12. The method of claim 9 further comprising defining access permissions to a data object that is not within a grouping, wherein said control permissions are applied to all data attributes of the data object.

13. The method of claim 9, wherein said access permissions are used during user queries to restrict access to the elements in the grouping.

14. For a data management system that secures access to a plurality of data objects stored within a data hierarchy of an enterprise, a graphical user interface (GUI) for securing access to data attributes of the data objects, said GUI comprising:

a first user interface tool for defining a grouping of elements from different levels of the data hierarchy, wherein the elements comprise at least two of data attributes of a data object, a data object, and sets of data attributes from different data objects; and

a second user interface tool for assigning control permissions to the grouping that are applied to each element within the grouping, wherein said control permissions are used during user queries to restrict access to the element.

15. A computer readable storage medium storing a computer program that secures access to data attributes of a plurality of data objects stored within a data hierarchy of an enterprise, the computer program comprising sets of instructions for:

identifying groupings of subsets of data attributes from different data objects in the data hierarchy;

receiving control permissions for said groupings; and

defining control permissions for the data attributes in each particular grouping based on the defined control permissions for the particular grouping.

16. The computer readable storage medium of claim 15, wherein the subset of data attributes comprises less than all the data attributes of a particular data object.

17. The computer readable storage medium of claim 15, wherein the data attributes are at different levels of the data hierarchy.

18. The computer readable storage medium of claim 15, wherein the computer program further comprises a set of instructions for performing a query over at least one particular data object in the set of data objects, wherein access to a data attribute of the particular data object identified within a grouping is restricted based on the defined control permission for said grouping.

19. The computer readable storage medium of claim 15, wherein the groupings are not objects within the plurality of data objects that are accessible by applications of the enterprise.

20. The computer readable storage medium of claim 19, wherein the set of instructions for defining the control permission occurs transparently to the operations of the applications.