Stored data access controller

Patent metadata

Field	Value
Publication number	US-9507956-B2
Application number	US-201414467187-A
Country	US
Kind code	B2
Filing date	Aug 25, 2014
Priority date	Jan 9, 2014
Publication date	Nov 29, 2016
Grant date	Nov 29, 2016

Abstract

A stored data access controller, configured to control access to data items, stored in a data storage apparatus, composed of data values encoding a labelled link between a subject graph node and an object graph node. The stored data access controller comprising: a query module, configured to receive a query requesting a specified subset of the data items and further configured to obtain the specified subset of the data items as a preliminary query result. The stored data access controller further comprising: a suppression module, configured to obtain the preliminary query result from the query module, and to generate a revised version of the preliminary query result by selectively suppressing the data value of one or more graph nodes in accordance with access control information attributed to the label of a labelled link between the subject graph node and the object graph node.

First claim

The invention claimed is:

1. A stored data access controller, configured to control access to data items encoding graph data and stored in a data storage apparatus, each data item encoding a labelled link between a subject graph node and an object graph node and being composed of a data value for each of the three elements, the three triple elements being:
a subject, identifying the subject graph node linked by the labelled link encoded by the data item;
an object, identifying the object graph node linked by the labelled link encoded by the data item; and
a predicate, being the label of the labelled link encoded by the data item;
the stored data access controller comprising a processor, a memory, and a data input/output unit, configured to:
receive a query requesting, as a query result, a specified subset of the data items stored in the data storage apparatus, and configured to obtain data items belonging to the specified subset from the data storage apparatus as a preliminary query result;
store the label of each of a plurality of labelled links from the encoded graph data in association with access control information attributed to the label, wherein access control information attributed to the label of a labelled link is identified by a data item having the form of a triple including the label of the labelled link as subject and data identifying the access control information as object;
obtain the preliminary query result from the query module, to generate a revised version of the preliminary query result by selectively suppressing information from the preliminary query result, and to output, as the requested query result in response to the received query, the revised version of the preliminary query result;
wherein selectively suppressing information comprises, for the or each of one or more graph nodes, suppressing the data value representing the graph node in accordance with the stored access control information attributed to the label of a labelled link between the graph node and another graph node, the graph node being either the subject graph node or the object graph node linked by the labelled link.

2. The stored data access controller according to claim 1 , wherein suppressing data values comprises removing data values and/or anonymising data values.

3. The stored data access controller according to claim 1 , wherein the access control information comprises a suppression condition and suppressing the data value representing the graph node in accordance with access control information comprises extracting the suppression condition, determining whether or not the suppression condition is satisfied, and if the suppression condition is satisfied, suppressing the data value.

4. The stored data access controller according to claim 3 , wherein
the query includes a requester ID identifying the source of the query;
the stored data access controller is operable to obtain access attributes associated with the requester ID; and
the suppression condition comprises at least one criterion dependent upon the access attributes associated with the requester ID.

5. The stored data access controller according to claim 4 , wherein
the access attributes comprise a requester access level from among a graded sequence of requester access levels;
the suppression condition comprises a requester access level criterion which specifies a requester access level from among the graded sequence of requester access levels; and
the stored data access controller is configured to compare the specified requester access with the requester access level attributed to the requester, and in dependence upon the result of the comparison, to determine whether or not the requester access level criterion is satisfied.

6. The stored data access controller according to claim 1 , wherein selectively suppressing information further comprises enforcing a data access policy, the data access policy comprising one or more rules applicable by the stored data access controller, the one or more rules being enforceable by the stored data access controller to determine which information to suppress from among the preliminary query results.

7. The stored data access controller according to claim 1 , wherein the data items encode more than one graph database, and each of the more than one graph databases is stored on distinct data storage apparatus having individual search and data retrieval functions.

8. The stored data access controller according to claim 1 , wherein the access control information attributed to one label is inherited by other labels which are stored as children of the one label in the predicate ontology storage unit.

9. A data storage system, comprising:
a data storage apparatus configured to store data items encoding graph data, each data item being composed of data values encoding a labelled link between a subject graph node and an object graph node; and
a stored data access controller configured to control access to data items encoding graph data and stored in a data storage apparatus, each data item encoding a labelled link between a subject graph node and an object graph node and being composed of a data value for each of the three triple elements, the three triple elements being:
a subject, identifying the subject graph node linked by the labelled link encoded by the data item;
an object, identifying the object graph node linked by the labelled link encoded by the data item; and
a predicate, being the label of the labelled link encoded by the data item;

the stored data access controller comprising a processor, a memory, and a data input/output unit, configured to:
receive a query requesting, as a query result, a specified subset of the data items stored in the data storage apparatus, and configured to obtain data items belonging to the specified subset from the data storage apparatus as a preliminary query result;
obtain the preliminary query result from the query module, to generate a revised version of the preliminary query result by selectively suppressing information from the preliminary query result, and to output, as the requested query result in response to the received query, the revised version of the preliminary query result;
store the label of each of a plurality of labelled links from the encoded graph data in association with access control information attributed to the label, wherein access control information attributed to the label of a labelled link is identified by a data item having the form of a triple including the label of the labelled link as subject and data identifying the access control information as object
wherein selectively suppressing information comprises, for the or each of one or more graph nodes, suppressing the data value representing the graph node in accordance with the stored access control information attributed to the label of a labelled link between the graph node and another graph node, the graph node being either the subject graph node or the object graph node linked by the labelled link.

10. A data access control method for controlling access to data items encoding graph data and stored in a data storage apparatus, each data item encoding a labelled link between a subject graph node and an object graph node and being composed of a data value for each of three tripled elements, the three triple element being:
a subject, identifying the subject graph node linked by the labelled link encoded by the data item;
an object, identifying the object graph node linked by the labeled link encoded by the data item; and
a predicate, being the label of the labelled link encoded by the data item;
the method comprising:
receiving a query requesting, as a query result, a specified subset of

Assignees

• Fujitsu Ltd

Inventors

• Snelling David

Classifications

• G06F16/245

  Query processing · CPC title

• G06F16/248

  Presentation of query results · CPC title

• G06F16/9024

  Graphs; Linked lists (G06F16/9027 takes precedence) · CPC title

• G06F21/6227 Primary

  where protection concerns the structure of data, e.g. records, types, queries · CPC title

• G06F21/6218 Primary

  to a system of files or objects, e.g. local or distributed file system or database · CPC title