Secure connections in an interactive analytic visualization infrastructure

Abstract

A method and system is described securely capturing up-to-date data and presenting the up-to-date data in an analytic visualization. An update server receives a data request from a container that can display the analytic visualization. The update server generates a data processing instruction and transmits it to a data server. The update server then receives a processed data set from the data server, generates a visualization update based on the processed data set, and transmits the visualization update to the container. The container can then display the analytic visualization with up-to-date data from the data server. Because the data processing is performed at the data server, the remaining data on the data server is never moved through the network and remains secure. The update server can also receive from the container, and transmit to the data server, an identifier whose permissions limit data access from the data server.

1 - 20 . (canceled) 
     
     
         21 . A method of securely providing analytic visualization data, the method comprising:
 storing a data source and update plugin instructions at a non-transitory computer-readable storage medium of a data server;   receiving a data processing instruction sent from an update server to the data server, the data processing instruction generated by the update server based on a data request from a container that renders an interactive analytic visualization for display by a viewer device;   receiving an identifier at the data server from the update server, the identifier associated with the viewer device;   executing the update plugin instructions by a processor of the data server, wherein execution of the update plugin instructions by the processor of the data server causes the data server to select a subset of the data source based on the data processing instruction and a permission setting associated with the identifier; and   transmitting the selected subset of the data source from the data server to the update server, wherein the subset of the data source is used by the update server and the container to update the interactive analytic visualization.   
     
     
         22 . The method of  claim 21 , wherein the identifier is one of an OAuth token, a browser cookie, a symmetric key, a public key, a temporary security token, a certificate signed by a certificate authority, a Lightweight Directory Access Protocol (LDAP) token, a Remote Authentication Dial In User Service (RADIUS) token, a Security Assertion Markup Language (SAML) token, an Active Directory token, an Extensible Markup Language (XML) based token. 
     
     
         23 . The method of  claim 21 , wherein the identifier includes information characterizing a user of the viewer device, wherein the information identifies at least one of a name, a username, a user account, a telephone number, an email address, a password, a personal identification number (PIN) code, a social security number, a driver's license number, an identification number, a biometric dataset, a user-specific code, a user-specific barcode, a user-specific icon, an image, or a personal trait characterizing the user. 
     
     
         24 . The method of  claim 21 , wherein the data request upon which the data processing instruction is based is generated by the viewer device through which the container is rendering the interactive analytic visualization. 
     
     
         25 . The method of  claim 21 , wherein the data request upon which the data processing instruction is based is generated by a container server hosting the container, wherein the viewer device views the interactive analytic visualization by retrieving the container from the container server via a network connection. 
     
     
         26 . The method of  claim 21 , wherein the permission setting associated with the identifier limits access to a disallowed portion of the data source, and wherein execution of the update plugin instructions by the processor of the data server causes the data server to select the subset of the data source so that the subset of the data source omits any of the disallowed portion of the data source. 
     
     
         27 . The method of  claim 21 , wherein the data processing instruction instructs the data server to filter out a filtered portion of the data source, and wherein execution of the update plugin instructions by the processor of the data server causes the data server to select the subset of the data source so that the subset of the data source omits any of the filtered portion of the data source. 
     
     
         28 . The method of  claim 21 , wherein a secondary portion of the data source is stored on a secondary server other than the data server, further comprising retrieving at least a subset of the secondary portion of the data source at the data server before transmitting the subset of the data source from the data server to the update server. 
     
     
         29 . The method of  claim 21 , further comprising retrieving the permission setting associated with the identifier at the data server from a security server storing the permission setting associated with the identifier. 
     
     
         30 . The method of  claim 21 , wherein transmitting the subset of the data source from the data server to the update server includes transmitting an updated version of the interactive analytic visualization to the update server, wherein execution of the update plugin instructions by the processor of the data server causes the data server to generate the updated version of the interactive analytic visualization. 
     
     
         31 . A system for securely providing analytic visualization data, the system comprising:
 a non-transitory computer-readable storage medium that stores a data source and update plugin instructions;   a network communication transceiver that receives a data processing instruction and an identifier from an update server, wherein the data processing instruction is generated by the update server based on a data request from a container that renders an interactive analytic visualization for display by a viewer device, and wherein the identifier is associated with the viewer device, and   a processor coupled to the non-transitory computer-readable storage medium, wherein execution of the update plugin instructions by the processor causes the processor to select a subset of the data source based on the data processing instruction and on a permission setting associated with the identifier;   wherein the network communication transceiver transmits a subset of the data source to the update server, wherein the subset of the data source is used by the update server and the container to update the interactive analytic visualization.   
     
     
         32 . The system of  claim 31 , wherein the identifier is one of an OAuth token, a browser cookie, a symmetric key, a public key, a temporary security token, a certificate signed by a certificate authority, a security token, a name of a user of the viewer device, a username associated with the user, a user account associated with the user, a telephone number associated with the user, an email address associated with the user, a password associated with the user, a personal identification number (PIN) code associated with the user, a social security number associated with the user, a driver's license number associated with the user, an identification number associated with the user, a biometric dataset associated with the user, a user-specific code associated with the user, a user-specific barcode associated with the user, a user-specific icon associated with the user, an image associated with the user, or a personal trait characterizing the user. 
     
     
         33 . The system of  claim 31 , wherein the data request upon which the data processing instruction is based is generated by the viewer device through which the container is rendering the interactive analytic visualization. 
     
     
         34 . The system of  claim 31 , wherein the data request upon which the data processing instruction is based is generated by a container server hosting the container, wherein the viewer device views the interactive analytic visualization by retrieving the container from the container server via a network connection. 
     
     
         35 . The system of  claim 31 , wherein the permission setting associated with the identifier limits access to a disallowed portion of the data source, and wherein execution of the update plugin instructions by the processor of the data server causes the data server to select the subset of the data source so that the subset of the data source omits any of the disallowed portion of the data source. 
     
     
         36 . The system of  claim 31 , wherein the data processing instruction instructs the data server to filter out a filtered portion of the data source, and wherein execution of the update plugin instructions by the processor of the data server causes the data server to select the subset of the data source so that the subset of the data source omits any of the filtered portion of the data source. 
     
     
         37 . The system of  claim 31 , wherein the network communication transceiver further retrieves the permission setting associated with the identifier from a security server storing the permission setting associated with the identifier. 
     
     
         38 . The system of  claim 31 , wherein transmitting the subset of the data source from the data server to the update server includes transmitting an updated version of the interactive analytic visualization to the update server, wherein execution of the update plugin instructions by the processor causes the processor to generate the updated version of the interactive analytic visualization. 
     
     
         39 . A method of securely providing analytic visualization data, the method comprising:
 storing a data source at a data server;   receiving a data processing instruction at the data server from an update server;   selecting, at the data server, a subset of the data source based on the data processing instruction; and   transmitting the subset of a data source to the update server.   
     
     
         40 . The method of  claim 39 , wherein selecting the subset of the data source based on both the data processing instruction and a permission setting associated with an identifier, further comprising receiving the identifier at the data server from the update server.