US 12,461,947 B2
Access authorization for report data in a multi-tenancy data management system
Zhebin Zhang, San Jose, CA (US); Hao Wu, Mountain View, CA (US); Kevin Mu, Saratoga, CA (US); and Xiang Xu, Foster City, CA (US)
Assigned to Rubrik, Inc., Palo Alto, CA (US)
Filed by Rubrik, Inc., Palo Alto, CA (US)
Filed on Jan. 27, 2023, as Appl. No. 18/102,315.
Prior Publication US 2024/0256575 A1, Aug. 1, 2024
Int. Cl. G06F 16/28 (2019.01)
CPC G06F 16/287 (2019.01) [G06F 16/282 (2019.01)] 17 Claims
OG exemplary drawing
 
1. A method, comprising:
generating, by a data management system, report data associated with a first set of one or more computing objects of the data management system, wherein the data management system is operable to provide protection for data sources associated with a plurality of tenants of the data management system, and wherein computing objects of the data management system are organized as a hierarchy of computing objects;
storing, at the data management system based at least in part on the generating, the report data for the first set of one or more computing objects and a mapping between the report data and one or more first object identifiers for the first set of one or more computing objects associated with the report data;
receiving, by the data management system, a request for the report data associated with the first set of one or more computing objects;
identifying context information for a log-in session associated with the request to access the report data, wherein the context information for the log-in session comprises a tenant identifier for a tenant associated with the request, the tenant included in the plurality of tenants;
accessing, based at least in part on the tenant identifier of the tenant associated with the request, a database comprising hierarchical information associated with the hierarchy of computing objects;
identifying, based at least in part on the hierarchical information, a mapping between the tenant identifier of the tenant and one or more second object identifiers of a second set of one or more computing objects to which the tenant associated with the request has access within the hierarchy of computing objects;
applying a filter to identify, from among the first set of one or more computing objects associated with the requested report data, at least one computing object that is included in both the first set of one or more computing objects associated with the requested report data and the second set of one or more computing objects to which the tenant associated with the request has access, wherein the filter is based at least in part on the mapping between the report data and the one or more first object identifiers for the first set of one or more computing objects and is further based at least in part on the mapping between the tenant identifier of the tenant and the one or more second object identifiers of the second set of one or more computing objects to which the tenant associated with the request has access within the hierarchy of computing objects; and
outputting, in response to applying the filter, a portion of the report data that is associated with the at least one computing object of the first set of one or more computing objects based at least in part on the at least one computing object being included in both the first set of one or more computing objects and the second set of one or more computing objects.