Distributed attribute based access control as means of data protection and collaboration in sensitive (personal) digital record and activity trail investigations

1. A distributed system in a communication network for attribute based access control providing a principal access to a resource comprising sensitive data, comprising:

a plurality of computer-based micro-services in communication with an authorization engine executing on one or more hardware processors and memory, via the communication network, wherein each of the computer-based micro-services executes a resource provider application program interface (API) on the one or more hardware processors configured to:

receive from the principal a resource action request to access the resource;

determine an authorization request context for the resource action request to access the resource, the authorization request context comprising metadata regarding the principal and an action by the principal associated with the resource action request; and

transmit to the authorization engine an authorization request comprising the authorization request context; and

the authorization engine comprising a database of policies comprising principals, resources, actions upon resources, and conditions, each condition comprising a logical expression operating upon one or more attributes of the principals and actions upon resources, the authorization engine configured to:

receive the authorization request;

resolve the authorization request context against a plurality of the pre-defined conditions to determine an authorization response selected from the group of allow, deny, and allow-with-conditions by:

searching the database for a policy with conditions matching the authorization request context;

selecting an authorization response of “deny” when no matching policy is found;

selecting an authorization response of “allow” when all found conditions are matching; and

selecting an authorization response of “allow-with-conditions” when one or more found matching policy has further restrictions to be resolved by the resource provider API and all other found conditions are matching;

record the authorization request, the authorization response, and a timestamp in an access audit log; and

transmit the authorization response to the resource provider API,

wherein the principal comprises an entity having a recognized identity used in an authorization process.

2. The system of claim 1 , wherein resolving the authorization request context further comprises accessing the access audit log comprising metadata regarding previous attempts to access the sensitive data.

3. The system of claim 1 , wherein the resource provider API is further configured to:

receive, from the authorization engine, the allow-with-conditions authorization response comprising a condition of the plurality of pre-defined conditions;

resolve the condition; and

provide the principal access to the resource.

4. The system of claim 1 , wherein the resource provider API is further configured to:

receive, from the authorization engine the allow-with-conditions authorization response comprising a condition of the plurality of pre-defined conditions;

fail to resolve the condition; and

deny the principal access to the resource.

5. A computer-based method by an authorization engine executing on one or more hardware processors and memory, in communication with a computer-based micro-service resource that executes a resource provider application program interface (API) on the one or more hardware processors via a communication network for controlling attribute based access by a principal to a resource comprising sensitive data, the authorization engine comprising a database of policies comprising principals, resources, actions upon resources, and conditions, each condition comprising a logical expression operating upon one or more attributes of the principals and actions upon resources, the method comprising:

receiving an authorization request from the resource provider API comprising an authorization request context for the request for the resource;

resolving the authorization request context against a plurality of pre-defined conditions associated with the resource to determine an authorization response selected from the group of allow, deny, and allow-with-conditions by:

searching the database for a policy with conditions matching the authorization request context;

selecting an authorization response of “deny” when no matching policy is found;

selecting an authorization response of “allow” when all found conditions are matching; and

selecting an authorization response of “allow-with-conditions” when one or more found matching policy has further restrictions to be resolved by the resource provider API and all other found conditions are matching;

recording the authorization request, the authorization response, and a timestamp in an access audit log; and

transmitting to the resource provider API an authorization response of the group consisting of allow, deny, and allow-with-conditions,

wherein the principal comprises an entity having a recognized identity used in an authorization process, the authorization request context for the request for the resource comprises metadata regarding a plurality of attributes of the principal and an action by the principal associated with the authorization request, and each of the plurality of conditions comprises a logical expression operating upon one or more attributes of the plurality of attributes.

6. The method of claim 5 , wherein the allow-with-conditions authorization response comprises a condition of the plurality of pre-defined conditions that the authorization engine did not resolve.

7. The method of claim 5 , wherein resolving the authorization request context further comprises accessing the access audit log.

8. The method of claim 5 , wherein the authorization response comprises privileges providing access to the resource.