SECURITY MIGRATION IN A BUSINESS INTELLIGENCE ENVIRONMENT

• US 20170026358A1
• Filed: 07/25/2016
• Published: 01/26/2017
• Est. Priority Date: 03/15/2012
• Status: Active Grant

• Current Assignee: Motio Incorporated (Peak6 LLC)
• Original Assignee: Motio Incorporated (Peak6 LLC)
• Inventors: Hankins, Lance W., James, Jonathan Edmund
• Granted Patent: US 9,660,973 B2
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: G06F 21/335 for accessing specific resources, e.g. using Kerberos tickets
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/0807 using tickets, e.g. Kerberos cryptographic mechanisms or cryptographic arrangements for entity authentication using tickets or tokens H04L9/3213
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources

Abstract

In various implementations, local identifiers associated with users may be utilized to enable access one or more functions in a Business Intelligence (BI) Environment. A mapping may be generated to associate local identifiers and users. The mapping may be utilized to enable access in the BI environment by retrieving the local identifier from a mapping and enabling access in the BI environment based on the local identifier. In various implementations, a user may access the system as another user.

Claims

1-20. -20. (canceled)

21. A computer implemented method comprising:

receiving a request from a first user for access, as a second user, to a business intelligence environment, wherein the first user provides first user identification information associated with the first user and second user identification information associated with the second user;

determining whether to allow the first user to access the business intelligence environment as the second user based at least partially on an access listing, wherein the access listing includes;

user identification information for one or more authorized users authorized to access the business intelligence environment as another user; and

at least one of user identities, user identification information, roles, or groups of users on which one or more of the authorized users is authorized to request access;

determining a local identifier of the second user if the determination is made to allow the first user access as the second user; and

allowing the first user access to the business intelligence environment as the second user if the determination is made to allow the access, wherein the access in the business intelligence environment is enabled based on the determined local identifier of the second user.

22. The method of claim 21 further comprising generating an audit trail of at least one of access by the first user as the second user when the requested access is allowed or attempted access when the requested access is denied;

and storing the audit trail.

23. The method of claim 21 further comprising:

generating an audit trail of at least one of access by the first user as the second user when the requested access is allowed or attempted access when the requested access is denied;

storing the audit trail;

retrieving the audit trail;

presenting the audit trail; and

restricting alteration of at least a portion of the audit trail.

24. The method of claim 21 wherein determining a local identifier of a second user is at least partially based on a mapping retrieved through a Security Migration System Namespace, wherein the retrieved mapping includes one or more local identifiers generated by a different Security Namespace.

25. The method of claim 21 further comprising authenticating the first user identification information and validating the second user identification through a Security Migration System Namespace, wherein the Security Migration System Namespace authenticates based at least partially on a type of user.

26. The method of claim 21 further comprising authenticating the first user identification information and validating the second user identification through a Security Migration System Namespace, wherein the Security Migration System Namespace authenticates based at least partially on a type of user, and wherein authenticating the first user identification information based at least partially on the type of user comprises:

determining the type of user based at least on the provided first user identification information;

authenticating the provided first user identification information independently of an External Security Source if the user type comprises a local user; and

delegating the authentication of the first user identification information to the External Security Source, if the user type does not comprise a local user.

27. The method of claim 21 further comprising authenticating the first user identification information and validating the second user identification through a Security Migration System Namespace, wherein the Security Migration System Namespace authenticates based at least partially on a type of user, and wherein validating the second user identification information based at least partially on the type of user comprises:

determining the type of user based at least partially on the provided second user identification information;

validating the provided second user identification information independently of an External Security Source if the user type comprises a local user; and

delegating the validation of the second user identification information to the External Security Source, if the user type does not comprise a local user.

28. A computer implemented method comprising:

receiving an authentication request, via a Security Migration System Namespace, for authorization for access to a Business Intelligence Environment of a user based on provided user identification information, wherein the Security Migration System Namespace is adapted to coordinate with a Security Migration System to expose one or more security principals to the Business Intelligence Environment;

determining whether to authorize the access by requesting validation of the user based at least partially on the provided user identification information, wherein determining whether to authorize the access comprises authenticating the provided user information by delegating authentication to a First External Security Source;

determining a local identifier associated with the validated user at least partially based on a retrieved mapping, if a determination is made to authorize a user, wherein the retrieved mapping includes local identifiers generated by a Second Security Namespace, wherein the Second Security Namespace is associated with a Second External Security Source, and wherein the Second External Security Source is distinct from the First External Security Source; and

enabling the access in the Business Intelligence Environment based at least partially on the determined local identifier.

29. The method of claim 28 wherein determining whether to authorize the access further comprises:

determining whether the user is in a first set of users; and

authenticating the provided user identification information independently of the First External Security Source and independently of the Second External Security Source if the user is determined to be in the first set of users; and

delegating authentication to a First External Security Source if the user is determined to not be in the first set of users.

30. The method of claim 28 further comprising defining one or more new security principals to have access to the Business Intelligence Environment, wherein defining a new user comprises:

determining whether the new user is a local user;

allowing authentication of the new user independent of the First External Security Source and Second External Security Source if the new user is a local user;

allowing authentication of the new user through the First External Security Source if the new user is not a local user; and

generating a new local identifier associated with the First External Security Source if the new user is not a local user.

31. The method of claim 28 further comprising allowing the Security Migration System Namespace to authenticate the user independent of the First External Security Source and the Second External Security Source.

32. The method of claim 28 further comprising if access to the Second External Security Source is restricted, and allowing the Security Migration System Namespace to authenticate the user independent of the Second External Security Source if access to the Second External Security Source is restricted.

33. The method of claim 28 further comprising if access to the First External Security Source is restricted, and allowing the Security Migration System Namespace to authenticate the user independent of the First External Security Source and the Second External Security Source.

34. The method of claim 28 wherein the authentication request for authorization for access comprises a request from the user for access, as a second user, to the Business Intelligence Environment;

and wherein the user identification information comprises first user identification information associated with the first user and second user identification information associated with the second user; and

further comprising;

determining whether to allow the first user to access the business intelligence environment as the second user based at least partially on an access listing, wherein the access listing includes;

user identification information for one or more authorized users authorized to access the business intelligence environment as another user; and

at least one of user identities, user identification information, roles, or groups of users on which one or more of the authorized users is authorized to request access;

determining a local identifier of the second user from the retrieved mapping if the determination is made to allow the first user access as the second user; and

allowing the first user access to the business intelligence environment as the second user if the determination is made to allow the access, wherein the access in the business intelligence environment is enabled based on the determined local identifier of the second user.

35. A computer implemented method comprising:

retrieving at least a portion of a plurality of security principals defined in a First External Security Source;

retrieving, from a First Security Namespace, at least one or more local identifiers associated with one or more of the retrieved security principals, wherein each local identifier uniquely identifies one of the security principals in a Business Intelligence Environment, and wherein one or more of the local identifiers are generated by the First Security Namespace, and wherein the First Security Namespace exposes one or more of the security principals from the First External Security Source for functions in the Business Intelligence Environment using one or more of the local identifiers;

generating a mapping of at least a portion of the retrieved security principals and one or more of the retrieved associated local identifiers;

retrieving one or more additional security principals defined in a Second External Security Source;

identifying one or more matching security principals based on a determination of whether one or more of the security principals in the generated mapping are associated with one or more of the additional security principals;

generating one or more additional associations in the mapping, wherein one or more of the additional associations comprises an association of one or more of the local identifiers in the mapping that are associated with one or more of the matching security principals and one or more of the additional security principals;

providing a Security Migration System Namespace adapted to coordinate with the Security Migration System to expose one or more of the additional security principals to the Business Intelligence Environment using one or more of the local identifiers from the generated mapping and previously used by the First Security Namespace, wherein the Security Migration System Namespace is distinct from the First Security Namespace, and wherein the Security Migration System Namespace is capable of enabling access in the Business Intelligence Environment that is based on the generated mapping and that is independent of user authentication provided by the First External Security Source.

36. The method of claim 35 wherein determining whether one or more of the security principals in the generated mapping are associated with one or more of the additional security principals comprises:

retrieving a set of configurable mapping rules; and

determining whether one or more security principals in the generated mapping are associated with one or more of the additional security principals based on the set of configurable mapping rules.

37. The method of claim 35 wherein the Security Migration System Namespace adapted to coordinate with the Security Migration System to expose one or more of the security principals to the Business Intelligence Environment using one or more of the local identifiers from the generated mapping and previously used by the First Security Namespace.

38. The method of claim 35 further comprising validating one or more of the matching security principals prior to enabling access in the Business Intelligence environment, and wherein validating one or more of the matching security principal is delegated to the Second External Security Source, and wherein access in the Business Intelligence Environment is enabled based on at least one of the local identifiers from the generated mapping.

39. The method of claim 35 further comprising validating one or more of the security principals prior to enabling access in the Business Intelligence environment, and wherein validating of one or more security principals that are not matching security principals is independent of the Second External Security Source and the First External Security Source, and wherein access in the Business Intelligence Environment is enabled based on at least one of the local identifiers from the generated mapping

40. The method of claim 35 further comprising storing the generated mapping in a memory coupled to a Security Migration System.