Declarative data security for a rapid application development tool component

• US 8,099,788 B2
• Filed: 09/16/2008
• Issued: 01/17/2012
• Est. Priority Date: 09/16/2008
• Status: Active Grant

• Current Assignee: Oracle International Corporation (Oracle Corporation)
• Original Assignee: Oracle International Corporation (Oracle Corporation)
• Inventors: Munday, Terence
• Primary Examiner(s): Smithers, Matthew
• Application Number:
  US12/211,797
• Publication Number:
  US 20100070763A1
• Time in Patent Office: 1,218 Days
• Field of Search: 713/167, 726/27, 717/117
• US Class Current: 726/27
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: G06F 8/38 for implementing user interfaces

Abstract

A security privilege view object instance. The security privilege view object instance provides security at the view object instance level, permitting multiple application modules to utilize a single entity object with different data privileges. In an embodiment, a view object implementation method is overridden to add selected security filters at instantiation of a view object instance.

Claims

1. A computer-implemented method performed in a software architecture having data and a plurality of security privileges associated with the data, the method comprising:

under the control of one or more computing devices configured with executable instructions,

providing a plurality of named view parameters for selection, each named view parameter corresponding to one of said plurality of security privileges; and

in response to receiving a first request for instantiation of a view and association of the view with at least one of the plurality of named view parameters, applying each security privilege associated with said at least one of the plurality of named parameters to an instance of the view according to one or more first data privileges of a first role of a user such that, when the user has a second role with one or more second data privileges that allow data access additional to data access allowed by the one or more first data privileges, the additional data access of the one or more second data privileges is excluded.

2. The method of claim 1, further comprising, in response to receiving a second request for instantiation of the view and association of the view with a different at least one of the plurality of named view parameters, applying each security privilege associated with said different at least one of the plurality of named parameters to a second instance of the view.

3. The method of claim 1, wherein applying each security privilege associated with said at least one of the plurality of named parameters to an instance of the view comprises overriding a view implementation to apply said each security privilege.

4. The method of claim 3, wherein overriding the view implementation comprises constructing predicates for each said security privilege, and utilizing the predicates to apply said each security privilege.

5. The method of claim 3, wherein overriding the view implementation comprises creating a privilege object for each view parameter, and passing the privilege object to a data security provider.

6. The method of claim 5, wherein, in response to providing the privilege object, an instance set is provided, and the predicate is constructed from the instance set.

7. The method of claim 1, wherein providing a plurality of named view parameters for selection comprises utilizing a rapid application development tool.

8. A computer-readable medium having computer-executable instructions for performing the method in claim 1.

9. A computer-implemented method, comprising:

under the control of one or more computing devices configured with executable instructions,

in a model-view-controller software architecture configured to create entity objects and view objects and having a data store with security privileges associated therewith, providing a plurality of named view criteria for selection, each named view criteria corresponding to one of said plurality of security privileges; and

in response to receiving a first request for instantiation of a view object and association of the view object with at least one of the plurality of named view criteria, applying each security privilege associated with said at least one of the plurality of named criteria to a view object instance according to one or more first data privileges of a first role of a user such that, when the user has a second role with one or more second data privileges that allow data access additional to data access allowed by the one or more first data privileges, the additional data access of the one or more second data privileges is excluded.

10. The method of claim 9, further comprising, in response to receiving a second request for instantiation of the view object and association of the view object with a different at least one of the plurality of named view criteria, applying each security privilege associated with said different at least one of the plurality of named criteria to a second view object instance.

11. The method of claim 9, wherein applying each security privilege associated with said at least one of the plurality of named view criteria to an instance of the view object comprises overriding a view object implementation to apply said each security privilege.

12. The method of claim 11, wherein overriding the view object implementation comprises constructing predicates for each said security privilege, and utilizing the predicates to apply said each security privilege.

13. The method of claim 11, wherein overriding the view implementation comprises creating a privilege object for each named view criteria, and passing the privilege object to a data security provider.

14. The method of claim 13, wherein, in response to providing the privilege object, an instance set is provided, and the predicate is constructed from the instance set.

15. The method of claim 9, wherein providing a plurality of named view criteria for selection comprises utilizing a rapid application development tool.

16. A computer-readable medium having computer-executable instructions for performing the method in claim 9.

17. A non-transitory computer-readable medium having computer-executable instructions for performing a method, the method comprising:

forming a user interaction environment associated with a data store, the data store having security privileges associated therewith; and

installing a view object instance in the user interaction environment, the view object instance being associated with at least one of the security privileges such that, when the view object is instantiated in the user interaction environment, the at least one security privileges is applied according to one or more first data privileges of a first role of a user such that, when the user has a second role with one or more second data privileges that allow data access additional to data access allowed by the one or more first data privileges, the additional data access of the one or more second data privileges is excluded.

18. The computer-readable medium of claim 17, wherein the method further comprises installing a second view object instance in the user interaction environment, the second view object instance being associated with at least one of the security privileges.