Enabling access to a subset of data

• US 8,650,634 B2
• Filed: 01/14/2009
• Issued: 02/11/2014
• Est. Priority Date: 01/14/2009
• Status: Active Grant

• Current Assignee: Globalfoundries US Incorporated (GlobalFoundries, Inc.)
• Original Assignee: International Business Machines Corporation
• Inventors: Bajekal, Sadanand Rajaram
• Primary Examiner(s): Zand, Kambiz
• Assistant Examiner(s): Shayanfar, Ali
• Application Number:
  US12/353,329
• Publication Number:
  US 20100180337A1
• Time in Patent Office: 1,854 Days
• Field of Search: 726/19, 707/770
• US Class Current: 726/17
• CPC Class Codes: G06F 21/30 Authentication, i.e. establishing the identity or authorisation of security principals
• CPC Class Codes: G06F 21/6227 where protection concerns the structure of data, e.g. records, types, queries
• CPC Class Codes: G06F 2221/2117 User registration
• CPC Class Codes: G06F 2221/2141 Access rights, e.g. capability lists, access control lists, access tables, access matrices

Abstract

A method includes receiving, at a computing device, one or more replicated authorization databases. At least one of the one or more replicated authorization databases corresponds to a subscription to access selected data. The selected data is aggregated from a plurality of sources. The method also includes storing the one or more replicated authorization databases at the computing device. The method also includes determining, via the replicated authorization databases, user permission to access the selected data via the computing device. The method also includes enabling access to the selected data at the computing device after determining the user permission to access the selected data.

Claims

1. A method, comprising:

partitioning an ontology data structure having multiple domains to create a set of authorization databases, wherein each of the authorization databases is associated with a user subscription type;

identifying, based at least partially on a first user profile, entitlement rights of a first user to access a subset of data, the data aggregated from a plurality of sources, wherein at least a portion of the data is aggregated substantially in real-time;

identifying a first subset of authorization databases, the first subset of authorization databases including at least one but not all databases in the set of authorization databases, the first subset of authorization databases selected based on a subscription associated with the first user, wherein the first subset of authorization databases includes permissions to access the subset of data; and

selectively replicating the first subset of authorization databases to a first computing device associated with the first user, wherein the replicated first subset of authorization databases includes the permissions to access the subset of data.

2. The method of claim 1, wherein the first user profile includes information that identifies the user subscription type.

3. The method of claim 1, further comprising receiving, at an access manager, a login notification from the computing device associated with the first user and retrieving the first user profile in response to receiving the login notification.

4. The method of claim 3, further comprising:

identifying a second subset of authorization databases based on a second user profile, the second subset of authorization databases selected based on a second subscription associated with the second user, wherein the second subset of authorization databases is different than the first subset of authorization databases; and

selectively replicating the second subset of authorization databases to a second computing device associated with the second user.

5. The method of claim 4, wherein at least one authorization database is in the first subset of authorization databases and in the second subset of authorization databases.

6. The method of claim 4, wherein selectively replicating the second subset of authorization databases is performed substantially simultaneously with selectively replicating the first subset of authorization databases.

7. A system to enable access to a subset of data, the system comprising:

a network interface configured to communicate with a remote computing device via a network, the network interface to receive a login notification from a computing device associated with a user,

a directory services server including user information associated with entitlements of each of a plurality of users to access a subset of data, the data including subscription data from a plurality of data sources, wherein the user information includes a user profile;

a policy server coupled to the directory services server, the policy server including a set of policies useable to determine entitlements for a particular user based on a user profile of the particular user, the policy server configured to identify a subset of authorization databases from a set of authorization databases based on the entitlements, wherein each of the authorization databases is associated with a user subscription type; and

an access manager configured to selectively replicate the subset of authorization databases to the remote computing device to enable user access of the particular user to the subset of the data, wherein the subset of authorization databases includes permissions to access the subset of data.

8. The system of claim 7, wherein the set of authorization databases are created by partitioning an ontology data structure representation of the data.

9. The system of claim 8, wherein the ontology data structure includes a hierarchical tree structure that is logically partitioned into a plurality of domains.

10. The system of claim 9, wherein a first subset of the plurality of domains is associated with a second subset of the authentication databases and a third subset of the plurality of domains is associated with a fourth subset of the authentication databases.

11. A computer program product comprising a tangible computer usable storage device having computer usable program code stored thereon, the computer usable program code comprising:

computer usable program code configured to identify entitlements of a user to access selected data, the selected data including subscription data collected from a plurality of sources;

computer usable program code configured to identify one or more authorization databases from a set of authorization databases based on the entitlements of the user, wherein each of the authorization databases is associated with a user subscription type; and

computer usable program code configured to selectively replicate the one or more authorization databases to a computing device associated with the user based on the entitlements of the user to access the selected data, wherein the one or more authorization databases includes permissions to access the selected data.

12. The computer program product of claim 11, further comprising computer usable program code configured to aggregate the data collected from the plurality of sources substantially in real-time.

13. The computer program product of claim 11, wherein the computer usage program code configured to selectively replicate the one or more authorization databases is configured to selectively replicate the one or more databases in response to a login notification received from the computing device.