Method and System for Securing Academic ERP Database using Datasource Proxy
A secured academic ERP system comprises an ERP database storing data for an academic institution, an application server for authenticating users and generating requests to access the ERP database for the users, a security system that accesses a user permissions table that maps the users to permitted organizations within an academic institution and modifying the requests to limit the requests to the permitted organizations for the users making the requests, and a datasource for receiving the modified requests and passing those requests to the ERP database. This system extends security beyond the traditional role-based data security model to support the finer granularity security at the level of the content. This is achieved without the need for a new database architecture or the use of separate databases for different organizations
1 . A method for securing an academic ERP database, comprising:
intercepting requests to access the ERP database;
accessing a user permissions table that maps users to permitted organizations within an academic institution;
modifying the requests to limit the requests to the permitted organizations for the users making the requests; and
passing the modified requests to the ERP database.
2 . A method as claimed in claim 1 , wherein the requests are received from an application server.
3 . A method as claimed in claim 1 , wherein the requests include queries for the ERP database.
4 . A method as claimed in claim 1 , wherein the requests include updates for the ERP database.
5 . A method as claimed in claim 1 , wherein the user permissions table lists users and the permitted organizations for each of the users.
6 . A method as claimed in claim 5 , wherein the permitted organizations replaces tables in the requests to produce a narrowing sub-query
7 . A method as claimed in claim 1 , wherein the user permissions table lists users and the permitted categories for each of the users.
8 . A method as claimed in claim 1 , further comprising parsing the requests for tables of the ERP database that are secured.
9 . A method as claimed in claim 1 , further comprising accessing a security definitions source for a secured table included in the request, wherein the security definitions source specifies how the requests are modified based on the user permissions.
10 . A method as claimed in claim 8 , wherein the security definitions source contains a subquery that is used to generate the modified requests.
11 . A method as claimed in claim 9 , wherein the security definitions source comprises XML files, with each file being used to secure an entity within the ERP database.
12 . A method as claimed in claim 1 , wherein the organizations within the academic institution includes divisions and departments within the divisions.
13 . A method as claimed in claim 12 , further comprising accessing a security definitions source for a secured table included in the request, wherein the security definitions source contains a subquery that is used to generate the modified requests for both divisions and departments.
14 . A method as claimed in claim 1 , wherein the modified requests are passed to a JDBC datasource, which accesses the ERP database.
15 . A secured academic ERP system, comprising:
an ERP database storing data for an academic institution;
an application server for authenticating users and generating requests to access the ERP database for the users;
a security system that accesses a user permissions table that maps the users to permitted organizations within an academic institution and modifies the requests to limit the requests to the permitted organizations for the users making the requests; and
a datasource for receiving the modified requests and passing those requests to the ERP database.
16 . A system as claimed in claim 15 , wherein the requests include queries for the ERP database.
17 . A system as claimed in claim 15 , wherein the requests include updates for the ERP database.
18 . A system as claimed in claim 15 , wherein the user permissions table lists users and the permitted organizations for each of the users.
19 . A system as claimed in claim 15 , wherein the user permissions table lists users and the permitted categories for each of the users.
20 . A system as claimed in claim 15 , wherein the security system parses the requests for tables of the ERP database that are secured.
21 . A system as claimed in claim 15 , further comprising a security definitions source, which is accessed by the security system, that specifies how the requests are modified based on the user permissions.
22 . A system as claimed in claim 21 , wherein the security definitions source contains a subquery that is used to generate the modified requests.
23 . A system as claimed in claim 21 , wherein the security definitions source comprises XML files, with each file being used to secure an entity within the ERP database.
24 . A system as claimed in claim 15 , wherein the organizations within the academic institution includes divisions and departments within the divisions.
25 . A system as claimed in claim 15 , wherein the datasource is a JDBC datasource.