Enforcing granular access control policy

Patent metadata

Field	Value
Publication number	US-12063218-B2
Application number	US-202318238871-A
Country	US
Kind code	B2
Filing date	Aug 28, 2023
Priority date	Jul 24, 2019
Publication date	Aug 13, 2024
Grant date	Aug 13, 2024

Abstract

An example method of enforcing granular access policy for embedded artifacts comprises: detecting an association of an embedded artifact with a resource container; associating the embedded artifact with at least a subset of an access control policy associated with the resource container; and responsive to receiving an access request to access the embedded artifact, applying the access control policy associated with the resource container for determining whether the access request is grantable.

First claim

What is claimed is:

1. A method for providing granular access control, comprising:
receiving an association of an embedded artifact with a resource container;
associating the embedded artifact with a subset of an access control policy of the resource container, wherein the subset of the access control policy of the resource container includes an intersection of the access control policy of the resource container and an initial access control policy of the embedded artifact;
receiving an access request to access the embedded artifact;
applying the subset of the access control policy to determine whether the access request is grantable; and
in response to determining that the access request is grantable, granting the access request;
wherein the method is performed using one or more processors.

2. The method of claim 1 , further comprising:
receiving the embedded artifact, the embedded artifact including the initial access control policy.

3. The method of claim 1 , wherein the initial access control policy is retrieved based on an access control policy pointer in metadata of the embedded artifact.

4. The method of claim 1 , wherein the embedded artifact is provided by one of: a file or a second resource container.

5. The method of claim 1 , wherein the embedded artifact comprises a first part associated with a first subset of the access control policy and a second part associated with a second subset of the access control policy.

6. The method of claim 1 , wherein the applying the subset of the access control policy further comprises:
identifying a permission associated, by the access control policy, with a user group associated with a user that initiated the access request; and
determining whether the permission matches an access type specified by the access request.

7. The method of claim 1 , further comprising:
creating a copy of the subset of the access control policy;
associating the embedded artifact with the copy of the subset of the access control policy; and
disassociating the embedded artifact from the resource container.

8. The method of claim 1 , further comprising:
creating a restrictive version of the access control policy;
associating the embedded artifact with the restrictive version of the access control policy;
redacting the embedded artifact to the redacted embedded artifact based on the restrictive version of the access control policy; and
sharing the redacted embedded artifact with a user that is authorized to access the embedded artifact based on the restrictive version of the access control policy.

9. A system for providing granular access control, comprising:
one or more memories comprising instructions stored thereon; and
one or more processors configured to execute the instructions and perform operations comprising:
receiving an association of an embedded artifact with a resource container;
associating the embedded artifact with a subset of an access control policy of the resource container, wherein the subset of the access control policy of the resource container includes an intersection of the access control policy of the resource container and an initial access control policy of the embedded artifact;
receiving an access request to access the embedded artifact;
applying the subset of the access control policy to determine whether the access request is grantable; and
in response to determining that the access request is grantable, granting the access request.

10. The system of claim 9 , wherein the operations further comprise:
receiving the embedded artifact, the embedded artifact including the initial access control policy.

11. The system of claim 9 , wherein the initial access control policy is retrieved based on an access control policy pointer in metadata of the embedded artifact.

12. The system of claim 9 , wherein the embedded artifact is provided by one of: a file or a second resource container.

13. The system of claim 9 , wherein the embedded artifact comprises a first part associated with a first subset of the access control policy and a second part associated with a second subset of the access control policy.

14. The system of claim 9 , wherein the applying the subset of the access control policy further comprises:
identifying a permission associated, by the access control policy, with a user group associated with a user that initiated the access request; and
determining whether the permission matches an access type specified by the access request.

15. The system of claim 9 , wherein the operations further comprise:
creating a copy of the subset of the access control policy;
associating the embedded artifact with the copy of the subset of the access control policy; and
disassociating the embedded artifact from the resource container.

16. The system of claim 9 , wherein the operations further comprise:
creating a restrictive version of the access control policy;
associating the embedded artifact with the restrictive version of the access control policy;
redacting the embedded artifact to the redacted embedded artifact based on the restrictive version of the access control policy; and
sharing the redacted embedded artifact with a user that is authorized to access the embedded artifact based on the restrictive version of the access control policy.

17. A non-transitory computer readable storage medium comprising executable instructions for providing granular access control that, when executed by one or more processors, cause the one or more processors to perform operations comprising:
receiving an association of an embedded artifact with a resource container;
associating the embedded artifact with a subset of an access control policy of the resource container, wherein the subset of the access control policy of the resource container includes an intersection of the access control policy of the resource container and an initial access control policy of the embedded artifact, the initial access control policy retrieved based on an access control policy pointer in metadata of the embedded artifact;
receiving an access request to access the embedded artifact;
applying the subset of the access control policy to determine whether the access request is grantable; and
in response to determining that the access request is grantable, granting the access request.

18. The non-transitory computer readable storage medium of claim 17 , wherein the embedded artifact comprises a first part associated with a first subset of the access control policy and a second part associated with a second subset of the access control policy.

19. The non-transitory computer readable storage medium of claim 17 , wherein the applying the subset of the access control policy further comprises:
identifying a permission associated, by the access control policy, with a user group associated with a user that initiated the access request; and
determining whether the permission matches an access type specified by the access request.

20. The non-transitory computer readable storage medium of claim 17 , wherein the operations further comprise:
creating a copy of the subset of the access control policy;
associating the embedded artifact with the copy of the subset of the access control policy; and
disassociating the embedded artifact from the resource container.

Assignees

• Palantir Technologies Inc

Inventors

• Wilczynski Peter
• Bogomolov Arseny
• Mark Alexander
• Hadzhiganeva Teofana
• Ng Kevin
• Klein Nathaniel
• Hao Sharon

Classifications

• G06F2221/2145

  Inheriting rights or properties, e.g., propagation of permissions or restrictions within a hierarchy · CPC title

• H04L63/104 Primary

  Grouping of entities · CPC title

• G06F21/6227 Primary

  where protection concerns the structure of data, e.g. records, types, queries · CPC title