Context-based data access control

Patent metadata

Field	Value
Publication number	US-10608997-B1
Application number	US-201514751022-A
Country	US
Kind code	B1
Filing date	Jun 25, 2015
Priority date	Jun 25, 2015
Publication date	Mar 31, 2020
Grant date	Mar 31, 2020

Abstract

The current document describes systems and methods that provide access controls in a system of interconnected services such as an online service platform. In various implementations, the system maintains contextual information associated with tokenized data. In additional implementations, data brokers authorize access to detokenized data by comparing the context of the data to the context of the service requesting the data. In yet additional implementations, the system maintains contextual information associated with requests that are processed within the system. When a request is made to a particular service, the particular service can use the identity of the requester, the context of the request, and the context of the data to determine whether the request is authorized. In some implementations, the integrity of contextual information is protected using a digital signature.

First claim

What is claimed is:

1. A computer-implemented method to facilitate sharing of online services by multiple client-facing service, the method comprising:
obtaining, by an online service, personal information from a client;
obtaining by a backend entity from the online service the personal information and a data context for the personal information, wherein the data context is signed by the online service;
storing, by the backend entity, the personal information and the data context;
providing, by the backend entity to the online service, a data token for the personal information and the data context;
obtaining, by the backend entity, a request from the online service, the request including:
a request context that is signed by the online service; and
the data token that is detokenizable to return the personal information, and

validating integrity of the request, at least in part by cryptographically verifying the request context and the data context;
determining that the request is authorized by, at least in part, a determination that the request context and the data context match; and
as a result of determining that the request is authorized, providing a response to the request that includes the personal information.

2. The computer-implemented method of claim 1 ,
wherein the response further includes a response token value, a response context, and a response signature.

3. The computer-implemented method of claim 1 , wherein:
the request further includes an intermediate request context, wherein the intermediate request context is signed by a service that relayed the request; and
the request is further authorized based at least in part on the intermediate request context matching the data context.

4. The computer-implemented method of claim 1 , further comprising:
obtaining from a different online service a different request that includes the data token and a different request context, wherein the different request is for the personal information; and
as a result of the different request context not matching the data context, deny the different request.

5. A system to facilitate sharing of online services, the system comprising at least one computing device implementing one or more services, wherein the one or more services at least:
receive personal information;
obtain by a backend entity from an online service, a data context for the personal information wherein the data context is signed by the online service and provides an identification of the online service;
store the personal information;
provide by the backend service to the online service a data token for the personal information and the data context;
receive, by the backend entity, a request, the request including:
a request context signed by the online service, and
the data token, the data token detokenizable to return the personal information,

determine that the request is authorized based at least in part on a determination that the data context and the request context match; and
as a result of determining that the request is authorized, provide a response that includes the personal information.

6. The system of claim 5 , wherein:
the request context is a GUM contained within a request data structure; and
the data context is prepended to the data token as a string.

7. The system of claim 5 , wherein:
the request includes a request cryptographic authenticator; and
the one or more services cryptographically verify the request using the cryptographic authenticator based at least in part on the request context.

8. The system of claim 5 , wherein:
the request includes a data cryptographic authenticator; and
the one or more services further cryptographically verify the request using data cryptographic authenticator based at least in part on the data token and the data context.

9. The system of claim 5 , wherein the one or more services further determine that the request is authorized based at least in part on an identity of a requester.

10. The system of claim 5 , wherein the one or more services determine that the request is authorized based at least in part on determining that the combination of the request context with the data context is represented within access control information in an access control module.

11. The system of claim 5 , wherein the one or more services fulfill the request at least in part by encapsulating the request context in a subordinate request and providing the subordinate request to another system.

12. The system of claim 5 , wherein:
the response includes a response context; and
the response includes a digital signature of the response context.

13. A non-transitory computer-readable storage medium having stored thereon executable instructions that, as a result of being executed by one or more processors of a computer system, cause the computer system to at least:
receive personal information;
obtain by a backend entity from an online service a data context for the personal information, wherein the data context is signed by the online service, wherein the online service provided the personal information;
store the personal information;
provide by the backend entity to the online service a data token for the personal information and the data context;
receive by the backend entity a request, the request including:
an encapsulated-request-context that is signed by the online service,
the data token, the data token detokenizable to return the personal information, and
an encapsulated-request-context cryptographic authenticator;

validate the encapsulated request context with the encapsulated-request-context cryptographic authenticator;
determine that the request is authorized based at least in part on a determination that the data context and the encapsulated request context match; and
as a result of determining that the request s authorized, provide a response that includes the personal information.

14. The non-transitory computer-readable storage medium of claim 13 , wherein the instructions further comprise instructions that, as a result of being executed by the one or more processors, cause the computer system to fulfill the request by:
encapsulating the request in a subordinate request having a subordinate request cortex
applying a cryptographic authenticator to the subordinate request; and
providing the subordinate request to a service provider.

15. The non-transitory computer-readable storage medium of claim 13 , wherein:
the request further includes a data token context; and
wherein the request is determined to be authorized based at least in part on the data token context.

16. The non-transitory computer-readable storage medium of claim 13 , wherein:
the request further includes an encapsulated data token and an encapsulated data token context; and
the instructions further comprise instructions that, as a result of being executed by the one or more processors, cause the computer system to determine that the request is authorized based at least in part on the encapsulated data token context.

17. The non-transitory computer-readable storage medium of claim 13 , wherein the instructions further comprise instructions that, as a result of being executed by the one or more processors, cause the computer system to return a response with a signed response context to a requester.

18. The non-transitory computer-readable storage medium of claim 13 , wherein the instructions further comprise instructions that, as a result of being executed by the one or more processors, cause the computer system

Assignees

• Amazon Tech Inc

Inventors

• Sethi Tushaar
• Mcclintock Jon Arron

Classifications

• H04L63/123 Primary

  received data contents, e.g. message integrity · CPC title

• H04L63/0428 Primary

  wherein the data content is protected, e.g. by encrypting or encapsulating the payload · CPC title