Access control rights assignment capabilities utilizing a new context-based hierarchy of data based on new forms of metadata

Patent metadata

Field	Value
Publication number	US-11797702-B2
Application number	US-202117198734-A
Country	US
Kind code	B2
Filing date	Mar 11, 2021
Priority date	Mar 11, 2021
Publication date	Oct 24, 2023
Grant date	Oct 24, 2023

Abstract

One example method includes extracting content metadata from data, storing the content metadata in a data catalogue, receiving at the data catalogue, from a user, a request to access the data, transmitting, by the data catalogue to a security service provider, an access request that includes the extracted content metadata and metadata relating to the access request, accessing, by the security service provider, identity metadata concerning an identity of the user, and a data access policy, and transmitting, by the security service provider to the data catalogue, a decision as to whether or not access can be granted to the data, and the decision is based on the data access policy, the identity metadata, and the metadata in the access request.

First claim

What is claimed is:

1. A method, comprising:
extracting content metadata from data;
storing the content metadata in, or in a location accessible to, a data catalogue;
receiving at the data catalogue, from a user, a request to access the data;
transmitting, by the data catalogue to a security service provider, an access request that includes the extracted content metadata and metadata relating to the access request;
accessing, by the security service provider, identity metadata concerning an identity of the user, and a data access policy; and
transmitting, by the security service provider to the data catalogue, a decision as to whether or not access can be granted to the data, and the decision is based on the data access policy, the identity metadata, and the metadata in the access request.

2. The method as recited in claim 1 , wherein the identity metadata is received by the security service provider from an identity server.

3. The method as recited in claim 1 , wherein the data access policy is automatically modified, without manual intervention by a human, in response to a change to the data.

4. The method as recited in claim 1 , wherein the extracted content metadata comprises metadata about one or more attributes of the data.

5. The method as recited in claim 1 , wherein the data access policy defines a hierarchy of multiple metadata attributes.

6. The method as recited in claim 1 , wherein the data access policy is enforceable with respect to the data regardless of the physical location of the data.

7. The method as recited in claim 1 , wherein the data access policy is enforceable with respect to the data regardless of the entity that generated the data, how the data was generated, or when the data was generated.

8. The method as recited in claim 1 , wherein the data access policy is immediately and automatically applied to newly added data.

9. The method as recited in claim 1 , wherein an alert is automatically generated when data is detected that is not covered by the data access policy.

10. The method as recited in claim 1 , wherein the data access policy defines a timeframe, or amount of time, that the user is permitted to access the data.

11. A non-transitory computer readable storage medium having stored therein instructions that are executable by one or more hardware processors to perform operations comprising:
extracting content metadata from data;
storing the content metadata in, or in a location accessible to, a data catalogue;
receiving at the data catalogue, from a user, a request to access the data;
transmitting, by the data catalogue to a security service provider, an access request that includes the extracted content metadata and metadata relating to the access request;
accessing, by the security service provider, identity metadata concerning an identity of the user, and a data access policy; and
transmitting, by the security service provider to the data catalogue, a decision as to whether or not access can be granted to the data, and the decision is based on the data access policy, the identity metadata, and the metadata in the access request.

12. The non-transitory computer readable storage medium as recited in claim 11 , wherein the identity metadata is received by the security service provider from an identity server.

13. The non-transitory computer readable storage medium as recited in claim 11 , wherein the data access policy is automatically modified, without manual intervention by a human, in response to a change to the data.

14. The non-transitory computer readable storage medium as recited in claim 11 , wherein the extracted content metadata comprises metadata about one or more attributes of the data.

15. The non-transitory computer readable storage medium as recited in claim 11 , wherein the data access policy defines a hierarchy of multiple metadata attributes.

16. The non-transitory computer readable storage medium as recited in claim 11 , wherein the data access policy is enforceable with respect to the data regardless of the physical location of the data.

17. The non-transitory computer readable storage medium as recited in claim 11 , wherein the data access policy is enforceable with respect to the data regardless of the entity that generated the data, how the data was generated, or when the data was generated.

18. The non-transitory computer readable storage medium as recited in claim 11 , wherein the data access policy is immediately and automatically applied to newly added data.

19. The non-transitory computer readable storage medium as recited in claim 11 , wherein an alert is automatically generated when data is detected that is not covered by the data access policy.

20. The non-transitory computer readable storage medium as recited in claim 11 , wherein the data access policy defines a timeframe, or amount of time, that the user is permitted to access the data.

Assignees

• Emc Ip Holding Co Llc

Inventors

• Reineke Nicole
• Yehuda Hanna
• Abdul Aal Omar
• Shafik Farida
• Christner Joel
• Beshara Shary
• El Rouby Ahmad Refaat Abdel Fadeel Ahmad

Classifications

• G06F21/6218 Primary

  to a system of files or objects, e.g. local or distributed file system or database · CPC title

• G06F16/2379

  Updates performed during online database operations; commit processing · CPC title

• G06F16/252

  between a Database Management System and a front-end application · CPC title

• G06F16/2228

  Indexing structures · CPC title