Method and system for controlling data access to organizational data maintained in hierarchical
View Patent ↗Embodiments are described for a system and method of controlling access to information in an organization by defining a hierarchical organizational structure of boxes, and security configuration comprising user records, security roles, rules to map users to boxes, and rules to grant roles to users via mapped boxes. Access control is applied in the context of a defined organizational structure using the effective set of access control policies computed in real time per each data access request from any given user.
1. A computer-implemented method of controlling access to information in an organization, in response to a user request for information to a server having access to the information, comprising:
storing organizational data of the organization onto a non-transient computer readable medium that is accessible by the server, wherein the organization data is structured into domains that contain one or more charts each containing boxes representing data entities having a hierarchical relationship to other boxes, wherein each domain represents different subsets of data entities, and each domain includes a chart user ID parameter that defines which field to use to match boxes;
copying original organizational data of the chart to random access memory accessible to the server to generate an optimized data structure representing a current state of that chart;
defining one or more principal boxes per user within a chart to perform rule-based assignment of security roles and to compute structural conditions for data access by the user, wherein a principal box for the user in the chart is identified by a chart user ID value, and wherein the user has a unique chart user ID value for each domain;
statically granting security roles to the user by explicitly configuring a link between a user record and a role within the organization;
defining users identified by authentication credentials through at least one of: the statically granted security role, and user information received from an external source with each request for information;
using one or more role assignment rules to dynamically grant a role to the user upon the user making a request for information through a server executed process, the process including re-computing in real-time by the server, effective data access rights of the requesting user, upon a data access request from the requesting user for one or more boxes in a specific chart; and
upon receiving the user request and in real time, executing a server process mapping user records to corresponding principal boxes in the charts of the organizational data using chart user ID values that are defined in user records to determine if a principal box that is responsive to the user request satisfies any role in the effective set of policies, and generating a response containing the principal boxes to which the user is authorized access and omitting principal boxes to which the user is not authorized access, wherein the mapping user records to corresponding principal boxes in the charts includes:
re-computing in real-time by the server, a plurality of available boxes and their respective attributes based on the effective data access rights, upon the data access request; and
selecting all boxes from a chart of a domain having a chart user ID parameter value that matches the user's unique chart user ID value for the domain.
2. The method of claim 1 wherein the requests for information include a request by the requesting user to access a requested box within the chart.
3. The method of claim 2 wherein the data access control configuration defines a structural condition that compares the relative hierarchical position of the requested box and the principal boxes within the chart for the purposes of record-level and field-level data access control.
4. The method of claim 2 wherein the data access control configuration defines a box-level condition that defines a Boolean condition to be evaluated against field values and other properties of the requested box for the purposes of record-level and field-level data access control.
5. The method of claim 2 wherein the data access control configuration combines structural conditions and box-level conditions for the purposes of record-level and field-level data access control.
6. The method of claim 1 further comprising, through server-executed processes, receiving and executing requests to re-organize the data in the organization chart constrained by the recomputed current access rights of the requesting user, wherein any resulting change takes immediate effect on data access rights for subsequent requests from any user.
7. The method of claim 1 further comprising, through server-executed processes, receiving and executing requests to change a security configuration constrained by the recomputed current access rights of the requesting user, wherein any resulting change takes immediate effect on data access rights for subsequent requests from any user, and wherein the security configuration is at least one of: users, roles, role assignment rules, chart user IDs for a user, and a field chosen to match a chart user ID value.
8. The method of claim 1 further comprising:
at the server, executing record-level and field-level data access control on one or more requested boxes to determine if the requested boxes as a whole and data in each of the plurality of fields of the requested boxes is allowed to be accessed by the requesting user; and
returning data related to the allowed boxes and allowed fields.
9. The method of claim 8 , further comprising assuming values of prohibited fields to be empty for the purposes of searching, filtering and sorting, in order to prevent or reduce an ability of users to estimate prohibited field values using defined operations.
10. The method of claim 1 wherein the entities of the organization comprise one of a person, position, or assignment, and wherein the organizational data comprises personnel data records used in a data management application.
11. The method of claim 1 comprising:
statically assigning roles through the user records; and
dynamically assigning the roles through the principal boxes at runtime through the chart user ID values.
12. The method of claim 1 wherein role rules are assigned to the boxes applied to the principal boxes corresponding to a current user.
13. A system to manage access to information in an organization, comprising:
a non-transient memory component storing data records relating to resources in the organization, the data records being structured into domains that contain one or more charts each containing boxes representing data entities having a hierarchical relationship to other boxes, and having defined one or more principal boxes per user within a chart to perform rule-based assignment of security roles and to compute structural conditions for data access by the user, wherein a principal box for the user in the chart is identified by a chart user ID value, wherein each domain represents different subsets of data entities, and each domain includes a chart user ID parameter that defines which field to use to match boxes, and wherein the user has a unique chart user ID value for each domain;
random access memory accessible to a processor-based server into which original organizational data of the chart is copied to generate an optimized data structure representing a current state of that chart;
a graphical user interface (GUI) component executed by the processor-based server defining and displaying the hierarchical relationship of the resources, wherein each resource is represented as a box in an organization chart of the organization;
a configuration component executed by the processor-based server defining users and other security configurations for the organization by using one or more role assignment rules to dynamically grant a role to the user upon the user making a request for information; and
a data access component running on a server capable of re-computing effective data access rights of the requesting user and a plurality of available boxes and fields in real time in response to a request by a requesting user, by mapping, upon receiving the request, user records to corresponding principal boxes in the charts of the organizational data using chart user ID values that are defined in user records to determine if a principal box that is responsive to the user request satisfies any role in the effective set of policies, and generating a response containing the principal boxes to which the user is authorized access and omitting principal boxes to which the user is not authorized access, wherein the mapping user records to corresponding principal boxes in the charts includes:
re-computing in real-time by the server, effective data access rights of the requesting user, upon a data access request from the requesting user for one or more boxes in a specific chart; and
selecting all boxes from a chart of a domain having a chart user ID parameter value that matches the user's unique chart user ID value for the domain.
14. The system of claim 13 wherein the data records are used in a data management application, and wherein the resources are selected from the group consisting of: people, positions, departments, and organizational entities.
15. The system of claim 14 wherein each data record comprises a plurality of fields, each field of the plurality of fields containing data regarding a specific characteristic of the resource represented by a respective box in the organization chart.
16. The system of claim 15 wherein the request comprises a request to access a requested box within the organization chart, the system further comprising:
a processing component running on a server executing field-level policies on the fields of the requested box to determine if data in each of the plurality of fields is allowed to be accessed by the requesting user; and
a data transfer of the GUI returning data related to one or more fields of the requested box to the requesting user if access to the requested box is allowed, and if access is allowed to the one or more fields.
17. The system of claim 16 wherein the role of each resource is associated with a data access condition specifying a range of boxes hierarchically relative to a user's box that are allowed data access through the user's box, and wherein the range of boxes comprises one of: the box itself only, and a hierarchical level in the organization chart relative to one of the box itself or a supervisor box in the organization chart.
18. The method of claim 1 wherein changing role assignment rules causes dynamic role assignment.