Patent ID: 7228307

Claim:
A system for managing access to data stored in data repositories, comprising a memory and at least one processor that cooperate to provide: a data abstraction model, wherein the data abstraction model comprises a plurality of logical fields used to compose an abstract query; and for each logical field, providing an access method specifying at least a method for accessing the data; a security model wherein at least one of the plurality of logical fields identifies a security domain associated with the logical field, wherein the security domain defines a collection of security accounts associated with a specific security domain and wherein data stored in the data repositories is associated with a security account; a query engine configured to: (i) resolve an abstract query into a query consistent with a particular physical data representation of the data stored in at least one of the data repositories, (ii) to modify the query to identify the security account associated with the data retrieved by the query, and (iii) to execute the query against the data repositories, and (iv) to retrieve a set of query result data; a security component configured (i) to replace query result data associated with a security account with an indication of the query result data, (ii) to determine whether an entity submitting an abstract query may access the query result data corresponding to a particular abstract query; and (iii) to maintain a security matrix that records which security accounts and security domains associated with the query result data are accessed by an entity submitting an abstract query.