Patent Application
20200379988
The field of the invention is data processing, or, more specifically, methods, apparatus, and products for row-level worksheet security.
Modern businesses may store large amounts of data in remote databases within cloud-based data warehouses. This data may be accessed using database query languages, such as structured query language (SQL). However, some query responses may include too much data to present efficiently in a web application.
Methods, systems, and apparatus for row-level worksheet security are disclosed in this specification. Row-level worksheet security may include creating a referencing worksheet from a data source worksheet, wherein the data source worksheet comprises a function configured to select, based on one or more user-relative functions, at least a subset of a plurality of rows from a data set in a database for presentation; presenting the at least a subset of the plurality of rows by: evaluating the one or more user-relative functions; and selecting, based on the filter, the at least a subset of the plurality of rows.
The foregoing and other objects, features and advantages of the invention will be apparent from the following more particular descriptions of exemplary embodiments of the invention as illustrated in the accompanying drawings wherein like reference numbers generally represent like parts of exemplary embodiments of the invention.
Exemplary methods, apparatus, and products for row-level worksheet security in accordance with the present invention are described with reference to the accompanying drawings, beginning with
Stored in RAM (168) is an operating system (154). Operating systems useful in computers configured for row-level worksheet security according to embodiments of the present invention include UNIX™, Linux™, Microsoft Windows™, AIX™, IBM's i OS™, and others as will occur to those of skill in the art. The operating system (154) in the example of
The data access computing system (152) of
The example data access computing system (152) of
The exemplary data access computing system (152) of
The communications adapter (167) is communicatively coupled to a wide area network (190) that also includes a cloud-based data warehouse (192) and a client computing system (194). The cloud-based data warehouse (192) is a computing system or group of computing systems that hosts a database for access over the wide area network (190). The client computing system (194) is a computing system that accesses the database via the data access computing system (152). The client computing system (194) may access the database using a client application (196), which may include a browser or a dedicated application for accessing the database via the data access computing system (152).
The GUI (202) presents, in part, worksheets to a user. A worksheet (also referred to as a dataset) is a presentation of a data set from a database (206). A referencing worksheet is a worksheet that is linked from another worksheet (referred to as a data source worksheet). The referencing worksheet inherits the data set presented in the data source worksheet (i.e., data not excluded from presentation). The referencing worksheet may also inherit the results of formula applied to other data but not the formulas themselves. The referencing worksheet may be limited to the data set presented or otherwise made available in the data source worksheet (unless the user generating the referencing worksheet has access to excluded data in the database). A referencing worksheet may be linked from any number of data sources, including multiple data source worksheets.
The exemplary GUI (202) includes a spreadsheet structure (204) and a list structure (206). The spreadsheet structure (204) includes a data set (shown as empty rows) with six columns (column A (208A), column B (208B), column C (208C), column D (208D), column E (208E), column F (208F)).
The spreadsheet structure (204) is a graphical element and organizing mechanism for the data set. The spreadsheet structure (204) displays the data within the data set as rows of data organized by columns (column A (208A), column B (208B), column C (208C), column D (208D), column E (208E), column F (208F)). The columns delineate different categories of the data in each row of the data set. The columns may also be calculations using other columns in the data set.
The list structure (206) is a graphical element used to define and organize the hierarchical relationships between the columns (column A (208A), column B (208B), column C (208C), column D (208D), column E (208E), column F (208F)) of the data set. The term “hierarchical relationship” refers to subordinate and superior groupings of columns. For example, a database may include rows for an address book, and columns for state, county, city, and street. A data set from the database may be grouped first by state, then by county, and then by city. Accordingly, the state column would be at the highest level in the hierarchical relationship, the county column would be in the second level in the hierarchical relationship, and the city column would be at the lowest level in the hierarchical relationship.
The list structure (206) presents a dimensional hierarchy to the user. Specifically, the list structure (206) presents levels arranged hierarchically across at least one dimension. Each level within the list structure (206) is a position within a hierarchical relationship between columns (column A (208A), column B (208B), column C (208C), column D (208D), column E (208E), column F (208F)). The keys within the list structure (206) identify the one or more columns that are the participants in the hierarchical relationship. Each level may have more than one key.
One of the levels in the list structure (206) may be a base level. Columns selected for the base level provide data at the finest granularity. One of the levels in the list structure (206) may be a totals or root level. Columns selected for the totals level provide data at the highest granular level. For example, the totals level may include a field that calculates the sum of each row within a single column of the entire data set (i.e., not partitioned by any other column).
The GUI (202) may enable a user to drag and drop columns (column A (208A), column B (208B), column C (208C), column D (208D), column E (208E), column F (208F)) into the list structure (206). The order of the list structure (206) may specify the hierarchy of the columns relative to one another. A user may be able to drag and drop the columns in the list structure (206) at any time to redefine the hierarchical relationship between columns. The hierarchical relationship defined using the columns selected as keys in the list structure (206) may be utilized in charts such that drilling down (e.g., double click on a bar), enables a new chart to be generated based on a level lower in the hierarchy.
In this example, assume a data set for tracking attorney billings for clients. Each record (e.g., row) corresponds to an amount of billable time worked on a particular client matter by a particular attorney. Accordingly, each row may include columns “Matter” for a matter number, “Date” for a date at which the time was billed, “Hours” for an amount of time billed, and “Attorney Email” for the email address of the attorney billing the time. This data set is reflected in the spreadsheet structure (204) of the worksheet. Continuing with this example, assume that the data set may be accessed via the GUI (202) by various user accounts. Each user account may be associated with various attributes, such as a name, email address, phone number, etc. Attributes of a user account may also include a role. The role of a user account may correspond to a job title or position (e.g., “Partner,” “Associate,” “Paralegal,” etc.). The attributes of a user account may be accessed and exposed through a user-relative function. A user-relative function is a function that, when called, returns an attribute for a user accessing the database via the GUI (202). For example, calling the function user.email( ) would return the email of whatever user is currently accessing the database to cause the function to be called.
The GUI (202) of
For example, to view all rows for matter number “18114,” the filter may comprise an expression “‘Matter’==‘18114’”. The filter would then select for presentation all rows for which the Boolean expression is true (e.g., all rows having “18114” in the “Matter” column). As another example, to view all rows between Jan. 1, 2019 and Jan. 15, 2019, the filter may comprise an expression “‘Date’>=‘2019-01-04’ AND ‘Date’<=‘2019-01-15’”. The filter would then select for presentation all rows for which the Boolean expression is true (e.g., all rows having a “Date” value between Jan. 1, 2019 and Jan. 15, 2019).
To provide row-level worksheet security, the Boolean expression of the filter may be based on user attributes accessed via a user-relative function. Here, the filter includes an expression “‘Attorney Email’==user.email( )”. This Boolean expression would evaluate as “TRUE” for any row where the value of the “Attorney Email” column matches the email address of the user accessing the database via the GUI (202). Continuing with the example of a data set for billable attorney time, an attorney accessing the data set would only see rows where they are the attorney of record according to the “Attorney Email” column. As another example, the filter may include combinations of user-relative functions. For example, assume the filter includes an expression “‘Attorney Email’==user.email( ) OR user.role( )==‘Partner’”. Using this expression, a user accessing the data set would only see rows where they are the attorney of record according to the “Attorney Email” column unless that user is a “Partner,” who would see all rows.
Referencing worksheets may then be created from this data source worksheet. The referencing worksheets would include the filter as defined in the filter input (302). The user-relative functions would return, on execution, one or more attributes of a user account accessing the referencing worksheet. Based on the user-relative functions referenced in the filter, the filter would evaluate differently for each user. Thus, users accessing the data set using a referencing worksheet may each view differing limited presentations of the data set. The filter may be immutable in the referencing worksheets. This ensures that a user of a referencing worksheet cannot modify or disable the filter in order to see a less or differently restricted presentation of the data set. Row-level security filters may be applied during a query or after the query.
Continuing with the example from
For further explanation,
The referencing worksheet inherits the filter of the data source worksheet. The filter comprises a Boolean expression based on one or more columns of the data set and the one or more user-relative functions. The one or more user-relative functions are configured to return, on execution, one or more attributes of a user account accessing the referencing worksheet.
The method of
For example, assume a referencing worksheet inheriting a filter comprising the expression “‘Attorney Email’==user.email( )”. Further assume that the referencing worksheet is accessed by a user having an email address “Bob@law.firm.” The user-relative function “user.email( )” of the filter would evaluate (506) as “Bob@law.firm.” Thus, selecting (508), based on the filter, the at least a subset of the plurality of rows would comprise selecting, from the plurality of rows, those rows having an “Attorney Email” value of “Bob@law.firm.”
Further that the referencing worksheet is accessed by a user having an email address “Karen@law.firm.” The user-relative function “user.email( )” of the filter would evaluate (506) as “Karen @law.firm.” Selecting (508), based on the filter, the at least a subset of the plurality of rows would comprise selecting, from the plurality of rows, those rows having an “Attorney Email” value of “Karen@law.firm.” Thus, different users accessing reference worksheets with the same filter expression view different presentations of the same data set due to the user-relative functions.
For further explanation,
For further explanation,
The method of
The method of
In view of the explanations set forth above, readers will recognize that the benefits of row-level worksheet security according to embodiments of the present invention include:
Exemplary embodiments of the present invention are described largely in the context of a fully functional computer system for linking and composing worksheets. Readers of skill in the art will recognize, however, that the present invention also may be embodied in a computer program product disposed upon computer readable storage media for use with any suitable data processing system. Such computer readable storage media may be any storage medium for machine-readable information, including magnetic media, optical media, or other suitable media. Examples of such media include magnetic disks in hard drives or diskettes, compact disks for optical drives, magnetic tape, and others as will occur to those of skill in the art. Persons skilled in the art will immediately recognize that any computer system having suitable programming means will be capable of executing the steps of the method of the invention as embodied in a computer program product. Persons skilled in the art will recognize also that, although some of the exemplary embodiments described in this specification are oriented to software installed and executing on computer hardware, nevertheless, alternative embodiments implemented as firmware or as hardware are well within the scope of the present invention.
The present invention may be a system, a method, and/or a computer program product. The computer program product may include a computer readable storage medium (or media) having computer readable program instructions thereon for causing a processor to carry out aspects of the present invention.
The computer readable storage medium can be a tangible device that can retain and store instructions for use by an instruction execution device. The computer readable storage medium may be, for example, but is not limited to, an electronic storage device, a magnetic storage device, an optical storage device, an electromagnetic storage device, a semiconductor storage device, or any suitable combination of the foregoing. A non-exhaustive list of more specific examples of the computer readable storage medium includes the following: a portable computer diskette, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or Flash memory), a static random access memory (SRAM), a portable compact disc read-only memory (CD-ROM), a digital versatile disk (DVD), a memory stick, a floppy disk, a mechanically encoded device such as punch-cards or raised structures in a groove having instructions recorded thereon, and any suitable combination of the foregoing. A computer readable storage medium, as used herein, is not to be construed as being transitory signals per se, such as radio waves or other freely propagating electromagnetic waves, electromagnetic waves propagating through a waveguide or other transmission media (e.g., light pulses passing through a fiber-optic cable), or electrical signals transmitted through a wire.
Computer readable program instructions described herein can be downloaded to respective computing/processing devices from a computer readable storage medium or to an external computer or external storage device via a network, for example, the Internet, a local area network, a wide area network and/or a wireless network. The network may comprise copper transmission cables, optical transmission fibers, wireless transmission, routers, firewalls, switches, gateway computers and/or edge servers. A network adapter card or network interface in each computing/processing device receives computer readable program instructions from the network and forwards the computer readable program instructions for storage in a computer readable storage medium within the respective computing/processing device.
Computer readable program instructions for carrying out operations of the present invention may be assembler instructions, instruction-set-architecture (ISA) instructions, machine instructions, machine dependent instructions, microcode, firmware instructions, state-setting data, or either source code or object code written in any combination of one or more programming languages, including an object oriented programming language such as Smalltalk, C++ or the like, and conventional procedural programming languages, such as the “C” programming language or similar programming languages. The computer readable program instructions may execute entirely on the user's computer, partly on the user's computer, as a stand-alone software package, partly on the user's computer and partly on a remote computer or entirely on the remote computer or server. In the latter scenario, the remote computer may be connected to the user's computer through any type of network, including a local area network (LAN) or a wide area network (WAN), or the connection may be made to an external computer (for example, through the Internet using an Internet Service Provider). In some embodiments, electronic circuitry including, for example, programmable logic circuitry, field-programmable gate arrays (FPGA), or programmable logic arrays (PLA) may execute the computer readable program instructions by utilizing state information of the computer readable program instructions to personalize the electronic circuitry, in order to perform aspects of the present invention.
Aspects of the present invention are described herein with reference to flowchart illustrations and/or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the invention. It will be understood that each block of the flowchart illustrations and/or block diagrams, and combinations of blocks in the flowchart illustrations and/or block diagrams, can be implemented by computer readable program instructions.
These computer readable program instructions may be provided to a processor of a general purpose computer, special purpose computer, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, create means for implementing the functions/acts specified in the flowchart and/or block diagram block or blocks. These computer readable program instructions may also be stored in a computer readable storage medium that can direct a computer, a programmable data processing apparatus, and/or other devices to function in a particular manner, such that the computer readable storage medium having instructions stored therein comprises an article of manufacture including instructions which implement aspects of the function/act specified in the flowchart and/or block diagram block or blocks.
The computer readable program instructions may also be loaded onto a computer, other programmable data processing apparatus, or other device to cause a series of operational steps to be performed on the computer, other programmable apparatus or other device to produce a computer implemented process, such that the instructions which execute on the computer, other programmable apparatus, or other device implement the functions/acts specified in the flowchart and/or block diagram block or blocks.
The flowchart and block diagrams in the Figures illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments of the present invention. In this regard, each block in the flowchart or block diagrams may represent a module, segment, or portion of instructions, which comprises one or more executable instructions for implementing the specified logical function(s). In some alternative implementations, the functions noted in the block may occur out of the order noted in the figures. For example, two blocks shown in succession may, in fact, be executed substantially concurrently, or the blocks may sometimes be executed in the reverse order, depending upon the functionality involved. It will also be noted that each block of the block diagrams and/or flowchart illustration, and combinations of blocks in the block diagrams and/or flowchart illustration, can be implemented by special purpose hardware-based systems that perform the specified functions or acts or carry out combinations of special purpose hardware and computer instructions.
It will be understood from the foregoing description that modifications and changes may be made in various embodiments of the present invention without departing from its true spirit. The descriptions in this specification are for purposes of illustration only and are not to be construed in a limiting sense. The scope of the present invention is limited only by the language of the following claims.
| Number | Date | Country | |
|---|---|---|---|
| 62853870 | May 2019 | US |
