Representing access permissions to documents

Patent metadata

Field	Value
Publication number	US-10496844-B2
Application number	US-201715441144-A
Country	US
Kind code	B2
Filing date	Feb 23, 2017
Priority date	Feb 23, 2017
Publication date	Dec 3, 2019
Grant date	Dec 3, 2019

Abstract

A record management system stores records for an organization having a plurality of members and a plurality of groups, and manages accessibility of the records for the organization according to a specified record access policy. The record management system generates an accessibility database that indicates, for each member, records that are explicitly or implicitly accessible by each member such that the records accessible for each member can be quickly determined if needed. A member has explicit access to a record if there is an explicit indication of accessibility between the member and the record. A member has implicit access to a record through membership associations to other members or groups that have access to the record. The record management system also receives search queries from members and returns records that are relevant and accessible to the members based on the accessibility database.

First claim

We claim:

1. A computer implemented method for processing search queries, the method comprising:
identifying, by a computer system, one or more first databases including first information indicating records explicitly accessible by each member from a plurality of members and records explicitly accessible by each group from a plurality of groups;
identifying, by the computer system, one or more second databases including second information indicating membership associations between the plurality of members and the plurality of groups;
generating, by the computer system, a third database by combining at least a portion of the first information and the second information, the third database storing a direct mapping indicating, for at least an identified member, records explicitly accessible by the identified member and records implicitly accessible by the identified member through the membership associations;
receiving a request from a client device associated with the identified member;
identifying, by the computer system based on the third database, one or more records relevant to the request that are accessible by the identified member, wherein identifying the one or more records accessible by the identified member based on the third database is computationally more efficient than identifying the one or more records based on the one or more first databases and the one or more second databases; and
transmitting the one or more identified records to the client device associated with the identified member.

2. The computer implemented method of claim 1 , the third database further indicating, for each of the plurality of members, records explicitly and implicitly accessible by each member.

3. The computer implemented method of claim 1 , wherein the membership associations include group memberships indicating which members in the plurality of members are part of each group in the plurality of groups, member-to-group access connections indicating a first set of groups that inherit access from a first set of members, and group-to-group access connections indicating a second set of groups that inherit access from a third set of groups.

4. The computer implemented method of claim 1 , wherein the third database is generated by combining the portion of the first information and the second information through matrix multiplication.

5. The computer implemented method of claim 1 , wherein the first information and the second information are encoded as Boolean variables, and the third database is generated by combining the portion of the first information and the second information through Boolean algebra.

6. The computer implemented method of claim 1 , wherein the third database is generated by combining the first information with a portion of the second information identified to be relevant to the identified member.

7. The computer implemented method of claim 1 , further comprising:
receiving, by a computer system, a first search query from a first client device associated with a first member;
receiving, by the computer system, a second search query from a second computer system associated with a second member;
determining, by the computer system, that the first member has access to less than a threshold number of membership associations based on the one or more second databases;
responsive to determining that the first member has access to less than the threshold number of membership associations:
determining, by the computer system, records accessible by the first member from the third database;
identifying, by the computer system, records relevant to the first search query from the determined records accessible by the first member; and
transmitting, by the computer system to the first client device, first search results that include the identified records relevant to the first search query;

determining, by the computer system, that the second member has access to more than the threshold number of membership associations based on the one or more second databases;
responsive to determining that the second member has access to more than the threshold number of membership associations:
identifying, by the computer system, records relevant to the second search query;
determining, by the computer system, records accessible by the second member from the identified records relevant to the second search query based on the third database; and
transmitting, by the computer system to the second client device, second search results that include the determined records accessible by the second member.

8. A non-transitory computer readable storage medium configured to store instructions, the instructions when executed by a processor cause the processor to perform the steps comprising:
identifying, by a computer system, one or more first databases including first information indicating records explicitly accessible by each member from a plurality of members and records explicitly accessible by each group from a plurality of groups;
identifying, by the computer system, one or more second databases including second information indicating membership associations between the plurality of members and the plurality of groups;
generating, by the computer system, a third database by combining at least a portion of the first information and the second information, the third database storing a direct mapping indicating, for at least an identified member, records explicitly accessible by the identified member and records implicitly accessible by the identified member through the membership associations;
receiving a request from a client device associated with the identified member;
identifying, by the computer system based on the third database, one or more records relevant to the request that are accessible by the identified member, wherein identifying the one or more records accessible by the identified member based on the third database is computationally more efficient than identifying the one or more records based on the one or more first databases and the one or more second databases; and
transmitting the one or more identified records to the client device associated with the identified member.

9. The non-transitory computer readable storage medium of claim 8 , wherein the third database further indicates, for each of the plurality of members, records explicitly and implicitly accessible by each member.

10. The non-transitory computer readable storage medium of claim 8 , wherein the membership associations include group memberships indicating which members in the plurality of members are part of each group in the plurality of groups, member-to-group access connections indicating a first set of groups that inherit access from a first set of members, and group-to-group access connections indicating a second set of groups that inherit access from a third set of groups.

11. The non-transitory computer readable storage medium of claim 8 , wherein instructions for generating the third database cause the processor to perform the step of:
combining the portion of the first information and the second information through matrix multiplication.

12. The computer implemented method of claim 8 , wherein the first information and the second information are encoded as Boolean variables, wherein instructions for generating the third database cause the processor to perform the step of:
combining the portion of the first information and the second information through Boolean algebra.

13. The non-transitory computer readable storage medium of claim 8 , wherein instructions for generating the third database cause the processor to perform the step of:
combining the first information

Assignees

• Salesforce Com Inc

Inventors

• Rickard Jr Scott Thurston
• Kale Anuprit
• Spivak Victor
• Grignon Yanik
• Chandrasekaran Venkatesan

Classifications

• G06F21/6227 Primary

  where protection concerns the structure of data, e.g. records, types, queries · CPC title

• G06F21/604

  Tools and structures for managing or administering access control systems · CPC title