DATA ACCESS CONTROL IN HIERARCHICAL MULTI-DIMENSIONAL DATASETS

1 . A computer implemented method comprising:

receiving, at a computing device, a request for a particular user identification (ID) to perform a particular operation on a particular data object;

creating and storing, in one or more digital data repositories, an object mapping that associates each data object of a plurality of data objects with one or more tuples of a plurality of tuples, each tuple of the plurality of tuples comprising one or more dimension values of a multidimensional organization structure, each of the one or more dimension values corresponding to a different hierarchical dimension of a plurality of hierarchical dimensions of the multidimensional organization structure;

creating and storing, in one or more digital data repositories, an entitlement mapping that associates each operation of one or more operations with a tuple of the plurality of tuples, each operation of the one or more operations comprising an operation that the particular user ID is entitled to perform on data objects in different parts of the multidimensional organization structure of the respective associated tuple;

using the object mapping, determining a first tuple based on the particular data object;

using the entitlement mapping, determining a second tuple based on the particular operation;

for each hierarchical dimension of the plurality of hierarchical dimensions:

generating a first hierarchical set of one or more dimension values based on the dimension value of the first tuple that corresponds to the respective hierarchical dimension;

generating a second hierarchical set of one or more dimension values based on the dimension value of the second tuple that corresponds to the respective hierarchical dimension;

identifying a match between the one or more dimension values of the first hierarchical set and the one or more dimension values of the second hierarchical set;

in response to identifying a match for each hierarchical dimension of the plurality of hierarchical dimensions, the computing device granting the particular user ID access to the particular data object.

2 . The method of claim 1 , wherein generating the first hierarchical set of one or more dimension values based on the dimension value of the first tuple comprises:

performing a flow down query on the dimension value of the first tuple that corresponds to the respective hierarchical dimension to generate the one or more dimension values of the first hierarchical set.

3 . The method of claim 1 , wherein generating the second hierarchical set of one or more dimension values based on the dimension value of the second tuple comprises:

performing a flow down query on the dimension value of the second tuple that corresponds to the respective hierarchical dimension to generate the one or more dimension values of the second hierarchical set.

4 . The method of claim 1 , wherein the flow down query is performed using a CONNECT BY operator.

5 . The method of claim 1 , further comprising:

creating and storing, in one or more digital data repositories, hierarchical data comprising a plurality of nodes, each node of the plurality of nodes comprising a dimension value, an identification value, and a parent node identification value;

wherein performing the flow down query includes traversing one or more nodes of the plurality of nodes of the hierarchical data.

6 . The method of claim 1 , further comprising:

in response to not identifying a match between the one or more dimension values of the first hierarchical set and the one or more dimension values of the second hierarchical set, the computing device restricting access to the particular data object from the particular user ID.

7 . The method of claim 1 , further comprising:

generating a third hierarchical set of one or more dimension values based on a dimension value of an exception tuple that corresponds to the respective hierarchical dimension;

removing the one or more dimension values of the third hierarchical set from the one or more dimension values of second hierarchical set to create an exception hierarchical set of one or more dimension values;

for each hierarchical dimension of the plurality of hierarchical dimensions, identifying a match between the one or more dimension values of the first hierarchical set and the one or more dimension values of the third hierarchical set;

in response to identifying the match for each hierarchical dimension of the plurality of hierarchical dimensions, the computing device granting the particular user ID access to the particular data object.

8 . The method of claim 1 , further comprising:

in response to not identifying a match for each hierarchical dimension of the plurality of hierarchical dimensions, the computing device restricting access to the particular data object from the particular user ID.

9 . A computer system comprising:

one or more processors;

one or more memories storing instructions which, when executed by the one or more processors, cause the one or more processors to perform:

receiving, at a computing device, a request for a particular user identification (ID) to perform a particular operation on a particular data object;

creating and storing, in one or more digital data repositories, an object mapping that associates each data object of a plurality of data objects with one or more tuples of a plurality of tuples, each tuple of the plurality of tuples comprising one or more dimension values of a multidimensional organization structure, each of the one or more dimension values corresponding to a different hierarchical dimension of a plurality of hierarchical dimensions of the multidimensional organization structure;

creating and storing, in one or more digital data repositories, an entitlement mapping that associates each operation of one or more operations with a tuple of the plurality of tuples, each operation of the one or more operations comprising an operation that the particular user ID is entitled to perform on data objects in different parts of the multidimensional organization structure of the respective associated tuple;

using the object mapping, determining a first tuple based on the particular data object;

using the entitlement mapping, determining a second tuple based on the particular operation;

for each hierarchical dimension of the plurality of hierarchical dimensions:

generating a first hierarchical set of one or more dimension values based on the dimension value of the first tuple that corresponds to the respective hierarchical dimension;

generating a second hierarchical set of one or more dimension values based on the dimension value of the second tuple that corresponds to the respective hierarchical dimension;

identifying a match between the one or more dimension values of the first hierarchical set and the one or more dimension values of the second hierarchical set;

in response to identifying a match for each hierarchical dimension of the plurality of hierarchical dimensions, the computing device granting the particular user ID access to the particular data object.

10 . The system of claim 9 , wherein generating the first hierarchical set of one or more dimension values based on the dimension value of the first tuple comprises:

performing a flow down query on the dimension value of the first tuple that corresponds to the respective hierarchical dimension to generate the one or more dimension values of the first hierarchical set.

11 . The system of claim 9 , wherein generating the second hierarchical set of one or more dimension values based on the dimension value of the second tuple comprises:

performing a flow down query on the dimension value of the second tuple that corresponds to the respective hierarchical dimension to generate the one or more dimension values of the second hierarchical set.

12 . The system of claim 9 , wherein the flow down query is performed using a CONNECT BY operator.

13 . The system of claim 9 , further comprising: creating and storing, in one or more digital data repositories, hierarchical data comprising a plurality of nodes, each node of the plurality of nodes comprising a dimension value, an identification value, and a parent node identification value;

wherein performing the flow down query includes traversing one or more nodes of the plurality of nodes of the hierarchical data.

14 . The system of claim 9 , further comprising: in response to not identifying a match between the one or more dimension values of the first hierarchical set and the one or more dimension values of the second hierarchical set, the computing device restricting access to the particular data object from the particular user ID.

15 . The system of claim 9 , further comprising: generating a third hierarchical set of one or more dimension values based on a dimension value of an exception tuple that corresponds to the respective hierarchical dimension;

removing the one or more dimension values of the third hierarchical set from the one or more dimension values of second hierarchical set to create an exception hierarchical set of one or more dimension values;

for each hierarchical dimension of the plurality of hierarchical dimensions, identifying a match between the one or more dimension values of the first hierarchical set and the one or more dimension values of the third hierarchical set;

in response to identifying the match for each hierarchical dimension of the plurality of hierarchical dimensions, the computing device granting the particular user ID access to the particular data object.

16 . The system of claim 9 , further comprising: in response to not identifying a match for each hierarchical dimension of the plurality of hierarchical dimensions, the computing device restricting access to the particular data object from the particular user ID.

17 . One or more non-transitory computer readable media storing one or more sequences of instructions which, when executed, cause:

receiving, at a computing device, a request for a particular user identification (ID) to perform a particular operation on a particular data object;

creating and storing, in one or more digital data repositories, an object mapping that associates each data object of a plurality of data objects with one or more tuples of a plurality of tuples, each tuple of the plurality of tuples comprising one or more dimension values of a multidimensional organization structure, each of the one or more dimension values corresponding to a different hierarchical dimension of a plurality of hierarchical dimensions of the multidimensional organization structure;

creating and storing, in one or more digital data repositories, an entitlement mapping that associates each operation of one or more operations with a tuple of the plurality of tuples, each operation of the one or more operations comprising an operation that the particular user ID is entitled to perform on data objects in different parts of the multidimensional organization structure of the respective associated tuple;

using the object mapping, determining a first tuple based on the particular data object;

using the entitlement mapping, determining a second tuple based on the particular operation;

for each hierarchical dimension of the plurality of hierarchical dimensions:

generating a first hierarchical set of one or more dimension values based on the dimension value of the first tuple that corresponds to the respective hierarchical dimension;

generating a second hierarchical set of one or more dimension values based on the dimension value of the second tuple that corresponds to the respective hierarchical dimension;

identifying a match between the one or more dimension values of the first hierarchical set and the one or more dimension values of the second hierarchical set;

in response to identifying a match for each hierarchical dimension of the plurality of hierarchical dimensions, the computing device granting the particular user ID access to the particular data object.

18 . The one or more non-transitory computer readable media of claim 17 , wherein generating the first hierarchical set of one or more dimension values based on the dimension value of the first tuple comprises:

performing a flow down query on the dimension value of the first tuple that corresponds to the respective hierarchical dimension to generate the one or more dimension values of the first hierarchical set.

19 . The one or more non-transitory computer readable media of claim 17 , wherein generating the second hierarchical set of one or more dimension values based on the dimension value of the second tuple comprises:

performing a flow down query on the dimension value of the second tuple that corresponds to the respective hierarchical dimension to generate the one or more dimension values of the second hierarchical set.

20 . The one or more non-transitory computer readable media of claim 17 , wherein the flow down query is performed using a CONNECT BY operator.