A secure distributed database management query system is disclosed. One or more knowledge stores hold data in the form of statements that represent relationships between nodes in a directed graph data structure. The statements in the database may include security information in the form of statements specifying which users are allowed access at a statement level. A query may include a FROM clause that denotes a multiplicity of knowledge stores that can be queried simultaneously.

Database query system and method

Efficient data structures are generated to enforce permissions on a multi-dimensional representation in a performance management application. A model site is generated having at least one model with at least one dimension. User permissions and group permissions are set for the model. The user permission and the group permissions are deployed to a relational database. A collective user permission table is generated based on the user permissions and the group permissions. Thus, an end user may receive permissions associated with a model and permissions associated with particular dimensions of a model without an inefficient consumption of resources.

Efficient data structures for multi-dimensional security

A method, system, and collaborative user interface for creating a collaborative environment for users to work on shared resources on a computer network. Each resource is capable of being subdivided into sub-resources in a hierarchical manner, and each sub-resource is treated in a transactional way in the sphere of control to which it is delegated/copied, which ensures proper treatment with respect to the resource from which it originated. The method thus provides a powerful management system allowing a number of people to work simultaneously on various parts of the shared resources.

Method for data-centric collaboration

An authorisation privilege for an access request is inferred when no explicit privilege exists. The inference can be performed by way of mining occurrence patterns or derived from user hierarchy, profile, click history, transaction history or role. For any access request, the respective explicit privilege or inferred privilege is verified by the database or security administrator before the access request is permitted. Conditions expressed in an access policy are evaluated on the occurrence of predefined events. The events extend beyond user access requests, and include external events, composite events and access of a referential type. The access policy is framed in ‘event, condition, access enforcement’ terminology. The access control rules can be parameterised and can be instantiated by data obtained from inference rules associated with the conditions of the policy. The conditions have an evaluation component and an inference component. The access privileges supported are: read, write and indirect read. An indirect read operation typically allows a user qualified access to one or more portions of a database, but not the entire database.

Event-based database access execution

Techniques are provided for dynamically establishing and managing authentication and trust relationships. An identity service acquires and evaluates contracts associated with relationships between principals. The contracts permit the identity service to assemble authentication information, aggregated attributes, and aggregated policies which will drive and define the various relationships. That assembled information is consumed by the principals during interactions with one another and constrains those interactions. In some embodiments, the constraints are dynamically modified during on-going interactions between the principals.

Techniques for dynamically establishing and managing authentication and trust relationships

The invention provides a dynamic rules-based secure data access system that may be used in a variety of applications that include a requirement for controlled secure access to a database (100). The rules-based access system has several features. One of these is that each user be assigned a role, either as an individual or as part of the group (120). Access rights may be assigned based one roles, but these can be modified within the system by individual users, that have authority to do so. Further, the data resources that each user is allowed to access (130), based on his or her role, and the extent of viewing and of data manipulation allowed, is further controlled based on assigned 'rights and privileges' (210). Another feature is that the database may be viewed as structured and organized into 'business functions', which are useful in business enterprises, such as sales, marketing, customer supports, etc (200). Users may be restricted to only certain functions, based on their roles (160). Within the business function units, the resources may be regarded as are further subdivided into several hierarchy levels; such as business objects, and instances of these objects (190). Users may be allowed access to only a specific business function, and only specific levels within that functional unit, based on role (220). Further, data may be restricted within each of the hierarchy levels, so that a user with access may not be allowed to see or manipulate all resources on a particular level within the hierarchy.

Nishad Kamat

Papers

Dynamic rules-based secure data access system for business computer platforms