The subject technology relates generally to database management, and more particularly to an interface for supporting data record access control in database management systems.
Content management systems and other database management systems are widely used today. However, because of the large volume of documents in content management systems, large number of users, and their different permissions to access the documents, document access control has become more and more sophisticated. For example, some content management systems control user access to documents by their roles. Accordingly, it is desirable to provide a user interface so that developers, who build applications on a platform, e.g., a content management system, can make sure that their applications can access and display data in the content management system properly.
The disclosed subject matter relates to a method for responding to a query in a database system. The method comprises: receiving record properties of a first data record and a second data record in the database system, wherein the record properties are defined dynamically based on application state. The method further comprises: receiving a first query for data objects in the database system; obtaining the first data record in response to the first query; obtaining record properties of the first data record; and displaying the first data record together with the record properties of the first data record on an interface.
The detailed description set forth below is intended as a description of various configurations of the subject technology and is not intended to represent the only configurations in which the subject technology may be practiced. The appended drawings are incorporated herein and constitute a part of the detailed description. The detailed description includes specific details for the purpose of providing a thorough understanding of the subject technology. However, the subject technology is not limited to the specific details set forth herein and may be practiced without these specific details. In some instances, well-known structures and components are shown in block diagram form in order to avoid obscuring the concepts of the subject technology.
In some content management systems, the permissions to access certain records and set of available actions on such records may be based on object states and user roles, and may be different for each record and user. This makes a static metadata describe application programming interface (“API”) inadequate to accurately describe the record properties given user permissions. Understanding permissions, actions, and other properties of a record is critical for application development so that the application may present the correct behavior to the end user. For example, the application will need to be able to hide fields (or make fields visible), make fields read-only (or editable), validate user input and present a set of valid actions to the end user based on the configuration of the content management system and actions available to end user. The present invention enhances content management systems by providing a user interface to external application developers to enable them to build applications that can support the dynamic security model of the content management system and describe run-time properties of data object records.
Dynamic security may allow an administrator of a customer of the content management system to set up security rules, that may define not only access to a particular data record, but also access to a particular field within the data record, depending on a rule. With this type of granular security, when the content management system returns a set of records, it is desirable to provide information indicating what an end user can do with the data record (e.g., view, or edit). The user programmatic interface of the present invention may provide a record property object and/or a static query describe object when returning data set in response to a query to support the dynamic security by providing information about actions an end user can take on the data records, and to provide metadata required to understand a data response.
The present invention may be used in various development use cases. One example is external application built on a content management API (e.g., Veeva™ Align). The application, which runs externally (not in the content management process) but provides a user interface on the content management data, will require record properties, metadata, and CRUD to provide an acceptable user experience.
Some concepts of the present invention are defined below:
Configuration metadata. In the present invention, configuration metadata refers to the data that describes the configuration of the content management system. Configuration metadata is static and consistent across records and users. Relevant configuration metadata may include:
Record properties. In the present invention, record properties refer to data that describes the run-time properties of an object record. The property values may be determined dynamically based on the application state, data, and configuration metadata. Property values will differ for each record and user.
Permission field level security (“FLS”) in the present invention is FLS defined at the Permission Level.
State-Role FLS in the present invention is FLS defined based on Object state or the combination of object state and user role.
The user computing devices 120a-120n may be any machine or system that is used by a user to access the content management system 110 via the network 150, and may be any commercially available computing devices including laptop computers, desktop computers, mobile phones, smart phones, tablet computers, netbooks, and personal digital assistants (PDAs).
The content storage system 111 may store content that user computing devices 120a-120n may access. Each content repository (e.g., 111a or 111b) may store a specific category of content, and allow users to interact with its content in a specific business context.
The content management server 112 is typically a remote computer system accessible over a remote or local network, such as the network 150. In one implementation, the content management server 112 may have a document access controller 114 which may control the process for setting up user roles, generating user groups, matching user groups and documents, and stamping user groups on matching documents.
In one implementation, the content management system 110 may be a multi-tenant system where various elements of hardware and software may be shared by one or more customers. For instance, a server may simultaneously process requests from a plurality of customers, and the content storage system 111 may store content for a plurality of customers. In a multi-tenant system, a user is typically associated with a particular customer. In one example, a user could be an employee of one of a number of pharmaceutical companies which are tenants, or customers, of the content management system 110.
In one embodiment, the content management system 110 may run on a cloud computing platform. Users can access content on the cloud independently by using a virtual machine image, or purchasing access to a service maintained by a cloud database provider.
In one embodiment, the content management system 110 may be provided as Software as a Service (“SaaS”) to allow users to access the content management system 110 with a thin client.
The processing unit 201 may be configured to execute computer instructions that are stored in a computer-readable medium, for example, the system memory 202. The processing unit 201 may be a central processing unit (CPU).
The system memory 202 typically includes a variety of computer readable media which may be any available media accessible by the processing unit 201. For instance, the system memory 202 may include computer storage media in the form of volatile and/or nonvolatile memory such as read only memory (ROM) and/or random access memory (RAM). By way of example, but not limitation, the system memory 202 may store instructions and data, e.g., an operating system, program modules, various application programs, and program data.
A user can enter commands and information to the computing device 200 through the input device 203. The input device 203 may be, e.g., a keyboard, a touchscreen input device, a touch pad, a mouse, a microphone, and/or a pen.
The computing device 200 may provide its output via the output device 304 which may be, e.g., a monitor or other type of display device, a speaker, or a printer.
The computing device 200, through the network interface 205, may operate in a networked or distributed environment using logical connections to one or more other computing devices, which may be a personal computer, a server, a router, a network PC, a peer device, a smart phone, or any other media consumption or transmission device, and may include any or all of the elements described above. The logical connections may include a network (e.g., the network 150) and/or buses. The network interface 205 may be configured to allow the computing device 200 to transmit and receive data in a network, for example, the network 150. The network interface 205 may include one or more network interface cards (NICs).
An enterprise may subscribe the content management service as a customer. End users may play different roles when accessing documents, e.g., owner and reviewer. In one implementation, end user setup records may be used to define the roles. As shown in
A customer's system administrator may define what role(s) an end user may play, assign end users, or employees, different roles, and manage the roles with the end user setup records. A system administrator may use attributes in fields of the user setup records to group users depending on its business need. The system administrator may select default fields and/or attributes provided by the content management system 110, or add new fields and/or attributes to customize user roles. In one example, one user setup record may define a user as a reviewer, who is familiar with a product Coldcap and a country Canada. An end user's access to a data record in the content management system 110 may depend on the role assigned to him/her.
At 503, a system administrator may login to the content management system 110.
At 505, the content management system 110 may receive configuration metadata from the system administrator. The configuration metadata may provide information about each record that is coming back in a response, for example, if the user has certain permissions on the particular record (e.g., edit and delete), and if a particular record field is editable or hidden from the user.
A record property object describes the properties of a data record, and may include information on why a field is not displayed, e.g., hidden. For each record it may include:
For requested fields on the record the response may include:
One example of a record property object is as follows:
In one example, a record may have five fields. One field may be read-only to an end user. The way it is represented may be: it will not be shown in “edit”, and not shown in “hidden”. Return may include an array of fields that are editable, and an array of fields that are hidden.
A query may be received at 510.
At 511, a set of data records responsive to the query may be obtained from the content management system 110 and returned by the content management server 112.
At 513, a record property object may be generated for each data record in the set of data records and returned by the content management server 112.
To eliminate the complexity in understanding a query response, a query describe object may be generated by the content management server 112 and returned as part of the response to a query at 515, and may provide static metadata required to understand a data response. It may include:
Examples of a couple of query describe objects are shown below:
In one example, when a response has four fields, the query describe object may provide metadata about each field and describe the shape of fields queried, including its name, its readable label, its datatype, and if it is a required field, unique field, a string, a number or a boolean. That metadata may apply to all records in the response, and provide information on how to process the response data.
Although the set of data records, record property objects, and query describe objects are shown to be obtained at 511, 513 and 515 separately in
At 517, the set of data records may be displayed together with the record property objects and the query describe objects on a user interface.
In one implementation, the query with properties pattern can be used by an external application which requires records and record properties for a set of records. This pattern will retrieve both with a single API call, reducing roundtrips. The response in this pattern contains both the “data” object and “record_property” object as a pair of symmetric arrays.
In one implementation, the reporting component of the content management system may have the requirement to filter data on the client side of the query language. In order to support this functionality when the query comes from reporting, the response may include hidden data fields and a client, e.g., an external program, is required to perform the hiding on the client side.
In one implementation, an error may be returned when a field is requested but the end user does not have access to. In one implementation, fields may not be returned for any cell (row-field) that the user does not have access to.
The present invention may be applied to any data query and any system that returns a data set, e.g., SQL. For example, an API that returns records from a relational database, may return record properties.
Adverse event management systems are used by pharmaceutical companies, or customers, for the collection, management, and real-time oversight of adverse events. As an adverse event is reported, it may go through a variety of different channels. A case may be created to record details of the adverse event, including what happened, how severe it is, and if it is expected. A medical reviewer may review the case, make sure it is coded with appropriate medical terms, and see what additional details are needed to analyze the relationship between the adverse event and the products that the patients were taking. The medical reviewer will then give an initial assessment, and submit the case to a government agency, e.g., FDA.
After an adverse event is reported, subsequent updates (e.g., lab reports or additional data) that may impact the initial assessment may become available. There is a lifecycle going on for the initial case, from case entry, medical review, ready for approval, to submission and case close. If an update comes in afterwards and provides more information about the adverse event, the user may submit a follow-up which may change how the adverse event is associated to a drug product. A follow-up is a new version of the case, and also has a lifecycle, from case entry, medical review, ready for approval, to submission and case close.
Pharmaceutical companies are required to report adverse events in a certain period of time. For example, they may have 15 days to report a life-threatening condition. The present invention provides a process for parallel follow-ups when there is a follow-up becoming available in the middle of either the initial case or an earlier follow-up, that is material and may change the case perspective but can't be included in the initial case or earlier follow-up because it is too close to their deadlines. The present invention facilitates submission of the initial case or the earlier follow-up, while processing a parallel follow-up for the secondary information at the same time.
The present invention may track cases with standard and configurable workflows, and streamline adverse event management with routing of cases for initial case, follow-ups, and parallel follow-ups. $
The present invention allows proper versioning of the initial case, its follow-ups and parallel follow-ups, and complete case separation. A parallel follow-up can be processed alongside the initial case, or its earlier follow-ups. User can submit the initial case or its earlier follow-ups before their deadlines, and then quickly submit the parallel follow-up.
Present invention allows creation of a complete copy of all versions of a case and their children when creating a follow-up or parallel follow-up. All data can be independently changed, without impacting another version. When the initial case is closed, its information is saved. Any follow-ups or parallel follow-ups will happen in isolation without impacting one or another.
The user computing devices 120a-120n may be any machine or system that is used by a user to access the content management system 110 via the network 150, and may be any commercially available computing devices including laptop computers, desktop computers, mobile phones, smart phones, tablet computers, netbooks, and personal digital assistants (PDAs).
The content storage system 111 may store content that user computing devices 120a-120n may access. Each content repository (e.g., 111a or 111b) may store a specific category of content, and allow users to interact with its content in a specific business context.
The content management server 112 is typically a remote computer system accessible over a remote or local network, such as the network 150. In one implementation, the content management server 112 may have a case management controller 614 which may control the routing of cases for initial case, follow-ups, and parallel follow-ups and version control of the case, as will be described in detail below.
In one implementation, the content management system 110 may be a multi-tenant system where various elements of hardware and software may be shared by one or more customers. For instance, a server may simultaneously process requests from a plurality of customers, and the content storage system 111 may store content for a plurality of customers. In a multi-tenant system, a user is typically associated with a particular customer. In one example, a user could be an employee of one of a number of pharmaceutical companies which are tenants, or customers, of the content management system 110.
In one embodiment, the content management system 110 may run on a cloud computing platform. Users can access content on the cloud independently by using a virtual machine image, or purchasing access to a service maintained by a cloud database provider.
In one embodiment, the content management system 110 may be provided as Software as a Service (“SaaS”) to allow users to access the content management system 110 with a thin client.
The present invention keeps a complete case version history.
At 903, a first user interface may be displayed to allow a user to select an existing case, or create a new case. In one embodiment, the case is for managing an adverse medial event.
If the user selects to create a new case, an initial case may be created, and a case entry user interface may be displayed at 905 for the user to enter data of the initial case. The status of the case is case entry 8011. One example of the case entry user interface 1000 is shown in
The case entry user interface 1000 may also include a button 1020 for storing the data and requesting medical review. The user may click on that button after finishing data entry for the initial case. At 907, an object may be created for the initial case in the content management system 600 and saved as v0.1 of the case when the button 1020 is clicked on.
At 908, the case status may change to medial review 8012. The medical review may be performed by appropriate medical reviewers, and a decision may be received. At 909, the case status may change to Ready for Approval 8013.
An input may be received at 911, indicating if the initial case is approved.
If yes, the initial case may be closed at 930, and the case object may be saved as a major version, e.g., v1.0.
If the case is not approved, the decision may be displayed at 913.
The user may open v0.1 of the saved object of the initial case, and corrected or supplement information may be received and saved at 915. Instead of overwriting v0.1 of the case object, the present invention allows the user to save the updated data as a new version of the case object, e.g., v0.2, while keeping the original case object v0.1 intact, so that the case version history 800 may include all versions of the case object.
At 917, the case status may change to medial review 8014 when the button 1020 is clicked on. A second medical review may be performed by appropriate medical reviewers, and a second decision may be received. At 919, the case status may change to Ready for Approval 8015. 911-919 may be repeated to create and review more minor versions (e.g., v0.3, and v0.4) until the case is approved.
If the user selects an existing case at 903, the process may proceed to 941, a user interface may be displayed so that the user can select to enter a follow-up of the case when the latest major version of the case (e.g., v1.0 or v2.0) is closed, or a parallel follow-up of the case when the latest major version of the case (e.g. v1.0 or v2.0) is still pending.
If follow-up is selected, a user interface may display the latest version of the case object (e.g., v1.0) to receive updates for the first follow-up at 943, and the case status may change to follow-up entry 8021. The user interface for receiving updates may be similar to the user interface 1000, and have a number of fields with data received before for defining the latest major version of the case object (e.g., v1.0).
The user may request for medical review after finishing entering updates for the first follow-up. At 945, an object may be created for the updated case, which may include the latest version of the case object updated with the first follow-up, in the content management system 600 and saved as v1.1 of the case. Instead of overwriting v1.0 of the case object, the present invention allows the user to save the updated data as a new version of the case object, e.g., v1.1, while keeping the original case object v1.0 intact, so that the case version history 800 may include all versions of the case object.
At 847, the case status may change to medial review 8022. A third medical review may be performed by medical reviewers, and a decision may be received. At 949, the case status may change to Ready for Approval 8023.
An input may be received at 951, indicating if the case is approved.
If yes, the case may be closed at 960, and the latest version of the case object v1.1, which includes the latest major version of the case object v1.0 updated with the first follow-up, may be saved as a new major version, e.g., v2.0.
If the case is not approved, the decision may be displayed at 953.
The user may open v1.1 of the saved object of the case, and corrected or supplement information may be received and saved at 955.
At 957, the case status may change to medial review 8024. The medical review may be performed by medical reviewers, and a decision may be received. At 959, the case status may change to Ready for Approval 8025. 951-959 may be repeated to create and review more minor versions (e.g., v1.3, and v1.4) for medical review until the first follow-up case is approved.
More follow-ups may be made to v1.0 of the case object.
If the user selects a parallel follow-up at 941, the process may proceed to 971. A user interface may display the latest major version of the case object, e.g., v2.0, to receive updates, and the case status may change to parallel follow-up entry 8031. The user interface for receiving updates for the parallel follow-up may be similar to the user interface 1000, and have a number of fields with data received before for defining the latest major version of the case object, e.g., v2.0.
The user may request for medical review after finishing entering updates for the parallel follow-up. At 973, an object may be created for the parallel follow-up, which may include the latest major version of the case object (e.g., v2.0) updated with the updates for the parallel follow-up, in the content management system 600 and saved as v2.1 of the case. Instead of overwriting v2.0 of the case object, the present invention allows the user to save the updated data as a new version of the case object, e.g., v2.1, while keeping the latest major version of the case object (e.g., v2.0) intact, so that the case version history 800 may include all versions of the case object.
At 975, the case status may change to medial review 8032. The medical review may be performed by medical reviewer, and a decision may be received. At 977, the case status may change to Ready for Approval 8033.
An input may be received at 979, indicating if the case is approved.
If yes, the case may be closed at 990, and the latest version of case object (e.g., v2.1) may be saved as a new major version, e.g., v3.0.
If the case is not approved, the decision may be displayed at 983.
The user may open v2.1 of the saved case object, and corrected and/or supplement information may be received and saved at 985.
At 987, the case status may change to medial review 8034. The medical review may be performed by medical reviewers, and a decision may be received. At 989, the case status may change to Ready for Approval 8035. 979-989 may be repeated until the parallel follow-up case is approved.
Although the parallel follow-up is described as a follow-up to v2.0 of the case object, it should be understood that it may be a follow-up to v1.0 of the case object if v1.0 has not been submitted yet. In addition, the system 600 may start to process the parallel follow-up anytime at the user's request, and at any point between 901 and 919, or 941 and 959.
The method of the present invention comprises: displaying a first user interface for receiving a selection of an existing case or a new case; receiving a selection of a new case on the first user interface; displaying a data entry user interface for receiving data of an initial version of an object of the new case; receiving a request for a first review; generating a first minor version of the object of the new case and saving the first minor version of the object of the new case in the content management system; receiving an input which indicates that the first minor version of the object of the new case is not approved; displaying a copy of the first minor version of the object of the new case, receiving a first update to it, and saving the first minor version of the object of the new case with the first update as a second minor version of the object of the new case while keeping the first minor version of the object of the new case in the content management system; receiving a request for a second review; receiving an input which indicates that the second minor version of the object of the new case is approved; and saving the second minor version of the object of the new case as a first major version of the object of the new case.
The above-described features and applications can be implemented as software processes that are specified as a set of instructions recorded on a computer readable storage medium (also referred to as computer readable medium). When these instructions are executed by one or more processing unit(s) (e.g., one or more processors, cores of processors, or other processing units), they cause the processing unit(s) to perform the actions indicated in the instructions. Examples of computer readable media include, but are not limited to, CD-ROMs, flash drives, RAM chips, hard drives, EPROMs, etc. The computer readable media does not include carrier waves and electronic signals passing wirelessly or over wired connections.
These functions described above can be implemented in digital electronic circuitry, in computer software, firmware or hardware. The techniques can be implemented using one or more computer program products. Programmable processors and computers can be included in or packaged as mobile devices. The processes and logic flows can be performed by one or more programmable processors and by one or more programmable logic circuitry. General and special purpose computing devices and storage devices can be interconnected through communication networks.
In this specification, the term “software” is meant to include firmware residing in read-only memory or applications stored in magnetic storage, which can be read into memory for processing by a processor. Also, in some implementations, multiple software technologies can be implemented as sub-parts of a larger program while remaining distinct software technologies. In some implementations, multiple software technologies can also be implemented as separate programs. Finally, any combination of separate programs that together implement a software technology described here is within the scope of the subject technology. In some implementations, the software programs, when installed to operate on one or more electronic systems, define one or more specific machine implementations that execute and perform the operations of the software programs. Examples of computer programs or computer code include machine code, for example is produced by a compiler, and files including higher-level code that are executed by a computer, an electronic component, or a microprocessor using an interpreter.
A computer program (also known as a program, software, software application, script, or code) can be written in any form of programming language, including compiled or interpreted languages, declarative or procedural languages, and it can be deployed in any form, including as a stand alone program or as a module, component, subroutine, object, or other unit suitable for use in a computing environment. A computer program may, but need not, correspond to a file in a file system. A program can be stored in a portion of a file that holds other programs or data (e.g., one or more scripts stored in a markup language document), in a single file dedicated to the program in question, or in multiple coordinated files (e.g., files that store one or more modules, sub programs, or portions of code). A computer program can be deployed to be executed on one computer or on multiple computers that are located at one site or distributed across multiple sites and interconnected by a communication network.
As used in this specification and any claims of this application, the terms “computer”, “server”, “processor”, and “memory” all refer to electronic or other technological devices. These terms exclude people or groups of people. For the purposes of the specification, the terms display or displaying means displaying on an electronic device. As used in this specification and any claims of this application, the terms “computer readable medium” and “computer readable media” are entirely restricted to tangible, physical objects that store information in a form that is readable by a computer. These terms exclude any wireless signals, wired download signals, and any other ephemeral signals.
It is understood that any specific order or hierarchy of steps in the processes disclosed is an illustration of example approaches. Based upon design preferences, it is understood that the specific order or hierarchy of steps in the processes may be rearranged, or that all illustrated steps be performed. Some of the steps may be performed simultaneously. For example, in certain circumstances, multitasking and parallel processing may be advantageous. Moreover, the separation of various system components illustrated above should not be understood as requiring such separation, and it should be understood that the described program components and systems can generally be integrated together in a single software product or packaged into multiple software products.
Various modifications to these aspects will be readily apparent, and the generic principles defined herein may be applied to other aspects. Thus, the claims are not intended to be limited to the aspects shown herein, but is to be accorded the full scope consistent with the language claims, where reference to an element in the singular is not intended to mean “one and only one” unless specifically so stated, but rather “one or more.” Unless specifically stated otherwise, the term “some” refers to one or more.
The present application is a continuation-in-part application of U.S. nonprovisional patent application Ser. No. 15/811,470, filed on Nov. 13, 2017, entitled User Programmatic Interface for Supporting Data Access Control in a Database System, and a continuation-in-part application of U.S. nonprovisional patent application Ser. No. 16/264,471, filed on Jan. 31, 2019, entitled Case Management in a Content Management System, which are hereby incorporated by reference herein for all purposes.
Number | Name | Date | Kind |
---|---|---|---|
6810259 | Zhang | Oct 2004 | B1 |
9092137 | Gassner et al. | Jul 2015 | B2 |
9430229 | Zijst et al. | Aug 2016 | B1 |
9779063 | Dykema | Oct 2017 | B1 |
9902299 | Muller | Feb 2018 | B2 |
20040230892 | Horton | Nov 2004 | A1 |
20050289111 | Tribble et al. | Dec 2005 | A1 |
20060206510 | Moulhaud et al. | Sep 2006 | A1 |
20070073688 | Fry | Mar 2007 | A1 |
20070150447 | Shah et al. | Jun 2007 | A1 |
20070294318 | Arora | Dec 2007 | A1 |
20080005287 | Harvey et al. | Jan 2008 | A1 |
20080147647 | Reeb | Jun 2008 | A1 |
20090276471 | Baer et al. | Nov 2009 | A1 |
20090287628 | Indeck et al. | Nov 2009 | A1 |
20100088317 | Bone | Apr 2010 | A1 |
20120150685 | Hinojosa et al. | Jun 2012 | A1 |
20120254090 | Burris | Oct 2012 | A1 |
20120278786 | Ruiz | Nov 2012 | A1 |
20130086039 | Salch | Apr 2013 | A1 |
20130117313 | Miao et al. | May 2013 | A1 |
20140122523 | Aggarwal et al. | May 2014 | A1 |
20150220659 | Rissanen | Aug 2015 | A1 |
20150254456 | Jacquin | Sep 2015 | A1 |
20150363468 | Alvey et al. | Dec 2015 | A1 |
20160119380 | Gutesman et al. | Apr 2016 | A1 |
20160189321 | Halpern et al. | Jun 2016 | A1 |
20160246802 | Regni et al. | Aug 2016 | A1 |
20160255082 | Rathod | Sep 2016 | A1 |
20160359920 | Abuelsaad | Dec 2016 | A1 |
20160366183 | Smith et al. | Dec 2016 | A1 |
20170337391 | Chang et al. | Nov 2017 | A1 |
20180234462 | Kruse | Aug 2018 | A1 |
20190392068 | Wen | Dec 2019 | A1 |
Number | Date | Country |
---|---|---|
3579241 | Dec 2019 | EP |
Entry |
---|
Aleksy, Using JDOSecure to Introduce Role-Based Permissions to Java Data Objects-based Applications, Sep. 2006. |
Asghar et al., Supporting Complex Queries and Access Policies for Multi-user Encrypted Databases, ACM. 2013. |
Bartel et al., Static Analysis for Extracting Permission Checks of a Large Scale Framework—The Challenges and Solutions for Analyzing Android, IEEE Transactions of Software Engineering, Jun. 2014, vol. 40 No 6. |
Sekar et al., Avoidance of Security Breach through Selective Permissions in Android Operating System, 2012, vol. 37 No. 12, ACM SIGSOFT Software Engineering Notes. |
Number | Date | Country | |
---|---|---|---|
Parent | 15811470 | Nov 2017 | US |
Child | 16863956 | US |