Integrated database user privilege management

Patent metadata

Field	Value
Publication number	US-11514186-B2
Application number	US-202117230787-A
Country	US
Kind code	B2
Filing date	Apr 14, 2021
Priority date	Apr 14, 2021
Publication date	Nov 29, 2022
Grant date	Nov 29, 2022

Abstract

A method for integrated database user privilege management can be implemented. The method presents a computer interface for managing access privileges of one or more users to a database comprising independent data and dependent data, and retrieves one or more role objects, record filter objects, and attribute filter objects assigned to a user. A role object defines access privileges to selected values of the independent data and dependent data. A record filter object can modify the access privileges defined in the one or more role objects. An attribute filter object defines access privileges to selected attributes of the independent data. The method can calculate, and present on the computer interface, a list of attributes of the independent data and a list of dependent data that the user has access privileges based on the one or more role objects, record filter objects, and attribute filter objects assigned to the user.

First claim

The invention claimed is:

1. A computer-implemented method comprising:
presenting a computer interface for managing access privileges of one or more users to a database comprising independent data and dependent data, wherein the dependent data changes more frequently than the independent data;
retrieving one or more role objects, one or more record filter objects, and one or more attribute filter objects assigned to a user, wherein a role object defines access privileges to selected values of the independent data and the dependent data, a record filter object is configured to modify the access privileges defined in the one or more role objects, and an attribute filter object defines access privileges to selected attributes of the independent data;
calculating a list of attributes of the independent data and a list of dependent data that the user has access privileges based on the one or more role objects, one or more record filter objects, and one or more attribute filter objects assigned to the user; and
presenting, on the computer interface, the list of attributes of the independent data and the list of dependent data that the user has access privileges, wherein the method further comprises:
cloning at least some of the one or more role objects, the one or more record filter objects, or the one or more attribute filter objects assigned to the user to another user via a single presented user interface action; and
exporting at least one of the one or more role objects, the one or more record filter objects, or the one or more attribute filter objects assigned to the user.

2. The method of claim 1 , further comprising summarizing on the computer interface counts of role objects, counts of record filter objects, and counts of attribute filter objects respectively assigned to the one or more users.

3. The method of claim 1 ), further comprising assigning the user to at least one user group, and refreshing simultaneously the list of attributes of the independent data and the list of dependent data that the user has access privileges if the at least one user group has access privileges defined by at least one record filter or one attribute filter.

4. The method of claim 1 ), further comprising receiving an indication to modify one of the one or more role objects assigned to the user, and refreshing simultaneously the list of attributes of the independent data and the list of dependent data that the user has access privileges.

5. The method of claim 1 ), further comprising receiving an indication to modify one of the one or more record filter objects assigned to the user, and refreshing simultaneously the list of dependent data that the user has access privileges.

6. The method of claim 1 ), further comprising receiving an indication to modify one of the one or more attribute filter objects assigned to the user, and refreshing simultaneously the list of attributes of the independent data that the user has access privileges.

7. The method of claim 1 ), further comprising calculating access privilege to a dependent data based on a logical operation of a plurality of values of the independent data, and removing the access privilege to the dependent data if access privilege to one of the plurality of values of the independent data is removed.

8. The method of claim 1 ), further comprising determining a privilege object has not been modified by another process before modifying the privilege object, wherein the privilege object is one of the one or more role objects, the one or more record filter objects, or the one or more attribute filter objects.

9. A computing system comprising:
memory;
one or more hardware processors coupled to the memory; and
one or more computer readable storage media storing instructions that, when loaded into the memory, cause the one or more hardware processors to perform operations comprising:
presenting a computer interface for managing access privileges of one or more users to a database comprising independent data and dependent data, wherein the dependent data changes more frequently than the independent data;
retrieving one or more role objects, one or more record filter objects, and one or more attribute filter objects assigned to a user, wherein a role object defines access privileges to selected values of the independent data and the dependent data, a record filter object is configured to modify the access privileges defined in the one or more role objects, and an attribute filter object defines access privileges to selected attributes of the independent data;
calculating a list of attributes of the independent data and a list of dependent data that the user has access privileges based on the one or more role objects, one or more record filter objects, and one or more attribute filter objects assigned to the user; and
presenting, on the computer interface, the list of attributes of the independent data and the list of dependent data that the user has access privileges, wherein the operations further comprise:
presenting a single user interface action that when activated, performs cloning at least some of the one or more role objects, the one or more record filter objects, or the one or more attribute filter objects assigned to the user to another user via the single presented user interface action; and
presenting a user interface action that when activated, performs exporting at least one of the one or more role objects, the one or more record filter objects, or the one or more attribute filter objects assigned to the user for audit or analysis purposes.

10. The system of claim 9 ), wherein the operations further comprise summarizing on the computer interface counts of role objects, counts of record filter objects, and counts of attribute filter objects respectively assigned to the one or more users.

11. The system of claim 9 ), wherein the operations further comprise assigning the user to at least one user group, and refreshing simultaneously the list of attributes of the independent data and the list of dependent data that the user has access privileges if the at least one user group has access privileges defined by at least one record filter or one attribute filter.

12. The system of claim 9 ), wherein the operations further comprise receiving an indication to modify one of the one or more role objects assigned to the user, and refreshing simultaneously the list of attributes of the independent data and the list of dependent data that the user has access privileges.

13. The system of claim 9 ), wherein the operations further comprise receiving an indication to modify one of the one or more record filter objects assigned to the user, and refreshing simultaneously the list of dependent data that the user has access privileges.

14. The system of claim 9 ), wherein the operations further comprise receiving an indication to modify one of the one or more attribute filter objects assigned to the user, and refreshing simultaneously the list of attributes of the independent data that the user has access privileges.

15. The system of claim 9 ), wherein access privilege to a dependent data is determined by a logical operation of a plurality of values of the independent data, wherein the access privilege to the dependent data is removed if access privilege to one of the plurality of values of the independent data is removed.

16. One or more non-transitory computer-readable media containing program instructions for causing a computer to perform a method comprising:
presenting a computer interface for managing access privileges of one or more users to a database comprising independen

Assignees

• Sap Se

Inventors

• Gandhi Unmesh Vidhyadhar
• Nair Sumesh
• Riera Pascal
• Primeau Eric
• Holban Evelyna

Classifications

• G06F21/6227 Primary

  where protection concerns the structure of data, e.g. records, types, queries · CPC title

• G06F16/21 Primary

  Design, administration or maintenance of databases · CPC title

• G06F21/604

  Tools and structures for managing or administering access control systems · CPC title

• G06F3/0482

  Interaction with lists of selectable items, e.g. menus · CPC title

• G06F2221/2141

  Access rights, e.g. capability lists, access control lists, access tables, access matrices · CPC title