Apparatuses, methods, and computer program products for programmatically parsing, classifying, and labeling data objects
View Patent ↗Methods, apparatuses, or computer program products are disclosed providing for the dynamic data classification of data objects. Examples enable prediction of candidate data classification labels for data objects associated with one or more applications, services, or computing devices. Examples enable the assignment of one or more data classification labels to a data object for transmission to one or more computing devices. Examples enable the interactive and progressive application of machine learning techniques to data classification systems to assign data classification labels with probable certainty. Examples enable the tracking, monitoring, storage, sorting, and retrieval of labeled data objects. Examples provide for access control configuration of services to restrict or allow access to data objects based on data classifications and other service parameters.
1. An apparatus for data object request authorization, the apparatus comprising at least one processor and at least one memory including program code that with the at least one processor, cause the apparatus to:
receive a validation request interaction input, wherein the validation request interaction input defines at least a data object identifier, a first service identifier, and a second service identifier;
in response to receiving the validation request interaction input, retrieve an access control configuration;
determine a data object based on the data object identifier, wherein the data object is associated with one or more data classification labels;
determine a first service based on the first service identifier;
determine a second service based on the second service identifier;
determine that the first service is authorized to communicate with the second service based on at least the retrieved access control configuration, wherein determining that the first service is authorized to communicate with the second service comprises determining that a service-to-service transmission is authorized between the first service and the second service;
determine that the data object is authorized for transmission to the second service based on at least the one or more data classification labels; and
approve the validation request interaction input.
2. The apparatus according to claim 1 , wherein the at least one processor and the at least one memory including the program code with the at least one processor, further cause the apparatus to:
output at least the data object identifier and a target recipient identifier to a permission interface;
receive a permission selection indication in response to outputting at least the data object identifier and the target recipient identifier to the permission interface; and
determine to restrict accessibility to a labeled data object associated with the data object identifier by a target recipient associated with the target recipient identifier based on the permission selection indication.
3. The apparatus according to claim 1 , wherein the at least one processor and the at least one memory including the program code with the at least one processor, further cause the apparatus to:
determine a first application programming interface based on the first service identifier;
determine a second application programming interface based on the second service identifier; and
determine that the first application programming interface is authorized to communicate with the second application programming interface based on at least the access control configuration.
4. The apparatus according to claim 1 , wherein the access control configuration is generated based on one or more predefined access parameters comprising one or more of the data object identifier, an origin identifier, the one or more data classification labels, one or more service identifiers, or one or more application programming interfaces, and wherein the access control configuration comprises one or more rules to instruct at least a service proxy to allow or restrict access to a labeled data object based on the one or more predefined access parameters.
5. The apparatus according to claim 1 , wherein the validation request interaction input further defines a request to transmit the data object of the data object identifier from the first service of the first service identifier to the second service of the second service identifier without relaying the data object through the apparatus.
6. The apparatus according to claim 5 , wherein approving the validation request interaction input comprises approving the request to transmit the data object, and wherein the at least one processor and the at least one memory including the program code with the at least one processor, further cause the apparatus to:
transmit the data object from the first service to the second service via a communication interface, wherein the communication interface is between a first service proxy of the first service and a second service proxy of the second service.
7. The apparatus according to claim 1 , wherein determining that the data object is authorized for transmission to the second service comprises:
determining that the second service is authorized to access one or more first constituent data elements of the data object; and
determining that the second service is not authorized to access one or more second constituent data elements of the data object,
wherein the at least one processor and the at least one memory including the program code with the at least one processor, further cause the apparatus to encrypt or delete the one or more second constituent data elements.
8. A non-transitory computer readable storage medium comprising instructions for data object request authorization, when executed by a processor, cause an apparatus comprising at least one processor and at least one memory to:
receive a validation request interaction input, wherein the validation request interaction input defines at least a data object identifier, a first service identifier, and a second service identifier;
in response to receiving the validation request interaction input, retrieve an access control configuration;
determine a data object based on the data object identifier, wherein the data object is associated with one or more data classification labels;
determine a first service based on the first service identifier;
determine a second service based on the second service identifier;
determine that the first service is authorized to communicate with the second service based on at least the retrieved access control configuration, wherein determining that the first service is authorized to communicate with the second service comprises determining that a service-to-service transmission is authorized between the first service and the second service;
determine that the data object is authorized for transmission to the second service based on at least the one or more data classification labels; and
approve the validation request interaction input.
9. The non-transitory computer readable storage medium according to claim 8 , wherein when executed by the processor, further causes the apparatus comprising the at least one processor and the at least one memory to:
output at least the data object identifier and a target recipient identifier to a permission interface;
receive a permission selection indication in response to outputting at least the data object identifier and the target recipient identifier to the permission interface; and
determine to restrict accessibility to a labeled data object associated with the data object identifier by a target recipient associated with the target recipient identifier based on the permission selection indication.
10. The non-transitory computer readable storage medium according to claim 8 , wherein when executed by the processor, further causes the apparatus comprising the at least one processor and the at least one memory to:
determine a first application programming interface based on the first service identifier;
determine a second application programming interface based on the second service identifier; and
determine that the first application programming interface is authorized to communicate with the second application programming interface based on at least the access control configuration.
11. The non-transitory computer readable storage medium according to claim 8 , wherein the access control configuration is generated based on one or more predefined access parameters comprising one or more of the data object identifier, an origin identifier, the one or more data classification labels, one or more service identifiers, or one or more application programming interfaces, and wherein the access control configuration comprises one or more rules to instruct at least a service proxy to allow or restrict access to a labeled data object based on the one or more predefined access parameters.
12. The non-transitory computer readable storage medium according to claim 8 , wherein the validation request interaction input further defines a request to transmit the data object of the data object identifier from the first service of the first service identifier to the second service of the second service identifier without relaying the data object through the processor.
13. The non-transitory computer readable storage medium according to claim 12 , wherein approving the validation request interaction input comprises approving the request to transmit the data object, and wherein when executed by the processor, further causes the apparatus comprising the at least one processor and the at least one memory to:
transmit the data object from the first service to the second service via a communication interface, wherein the communication interface is between a first service proxy of the first service and a second service proxy of the second service.
14. A computer implemented method for data object request authorization, when executed by a processor, comprising:
receiving a validation request interaction input, wherein the validation request interaction input defines at least a data object identifier, a first service identifier, and a second service identifier;
in response to receiving the validation request interaction input, retrieving an access control configuration;
determining a data object based on the data object identifier, wherein the data object is associated with one or more data classification labels;
determining a first service based on the first service identifier;
determining a second service based on the second service identifier;
determining that the first service is authorized to communicate with the second service based on at least the retrieved access control configuration, wherein determining that the first service is authorized to communicate with the second service comprises determining that a service-to-service transmission is authorized between the first service and the second service;
determining that the data object is authorized for transmission to the second service based on at least the one or more data classification labels; and
approving the validation request interaction input.
15. The computer implemented method according to claim 14 , further comprising:
outputting at least the data object identifier and a target recipient identifier to a permission interface;
receiving a permission selection indication in response to outputting at least the data object identifier and the target recipient identifier to the permission interface; and
determining to restrict accessibility to a labeled data object associated with the data object identifier by a target recipient associated with the target recipient identifier based on the permission selection indication.
16. The computer implemented method according to claim 14 , further comprising:
determining a first application programming interface based on the first service identifier;
determining a second application programming interface based on the second service identifier; and
determining that the first application programming interface is authorized to communicate with the second application programming interface based on at least the access control configuration.
17. The computer implemented method according to claim 14 , wherein the access control configuration is generated based on one or more predefined access parameters comprising one or more of the data object identifier, an origin identifier, the one or more data classification labels, one or more service identifiers, or one or more application programming interfaces, and wherein the access control configuration comprises one or more rules to instruct at least a service proxy to allow or restrict access to a labeled data object based on the one or more predefined access parameters.
18. The computer implemented method according to claim 14 , wherein the validation request interaction input further defines a request to transmit the data object of the data object identifier from the first service of the first service identifier to the second service of the second service identifier without relaying the data object through the processor.
19. The computer implemented method according to claim 18 , wherein approving the validation request interaction input comprises approving the request to transmit the data object, the method further comprising:
transmitting the data object from the first service to the second service via a communication interface, wherein the communication interface is between a first service proxy of the first service and a second service proxy of the second service without relaying the data object through the processor.