Methods, apparatuses and computer program products for implementing unified data control policy in distributed and product-oriented computing platforms
Various examples herein described are directed to methods, apparatuses, and computer program products for implementing unified data control policies in a distributed and product-oriented computing platform that includes a plurality of distributed data service clusters and a centralized policy information repository. In some examples, the distributed data service cluster is associated with a distributed policy decision object and one or more distributed policy enforcement objects. In some examples, the distributed policy decision object generates control policy evaluation responses in response to control policy evaluation requests. Additional example embodiments provide, such as but not limited to, example methods for generating policy information objects.
1. An apparatus for implementing unified data control policies in a distributed and product-oriented computing platform that comprises a plurality of distributed data service clusters and a centralized policy information repository, the apparatus comprising at least one processor and at least one non-transitory memory comprising program code, the at least one non-transitory memory and the program code configured to, with the at least one processor, cause the apparatus to at least:
receive a data control policy generation request from a user computing device associated with a user profile;
generate a policy information object based at least in part on the data control policy generation request and the user profile, wherein the policy information object comprises policy application metadata and policy control metadata;
store the policy information object in the centralized policy information repository;
distribute the policy information object as a replicated policy information object to a distributed policy decision object associated with a distributed data service cluster of the plurality of distributed data service clusters;
receive a data object service request associated with the distributed data service cluster, wherein the distributed data service cluster is further associated with one or more distributed policy enforcement objects;
transmit a control policy evaluation request based at least in part on the data object service request to the distributed policy decision object, wherein the distributed policy decision object comprises a plurality of replicated policy information objects that are distributed from the centralized policy information repository;
receive a control policy evaluation response from the distributed policy decision object, wherein the control policy evaluation response indicates at least one replicated policy information object from the plurality of replicated policy information objects based at least in part on the data object service request; and
generate a data object service response based at least in part on the control policy evaluation response, wherein the data object service response comprises one or more of data permission metadata, data routing metadata, data transformation metadata, or data filter metadata.
2. The apparatus of claim 1 , wherein the data object service response comprises the data permission metadata, wherein the data permission metadata comprises one of an allowance indication, a denial indication, or an additional information request indication.
3. The apparatus of claim 1 , wherein the data object service response comprises the data routing metadata, wherein the data routing metadata comprises a network address indication.
4. The apparatus of claim 1 , wherein the data object service response comprises the data transformation metadata, wherein the data transformation metadata comprises a data encryption indication.
5. The apparatus of claim 1 , wherein the data object service response comprises the data filter metadata, wherein the data filter metadata comprises a data filter indication.
6. The apparatus of claim 1 , wherein, when generating the policy information object, the at least one non-transitory memory and the program code are configured to, with the at least one processor, cause the apparatus to:
determine that the data control policy generation request comprises a platform-wide policy indication and a plurality of internal staff identifiers; and
generate the policy application metadata that comprises a platform-wide application indication.
7. A computer-implemented method for implementing unified data control policies in a distributed and product-oriented computing platform that comprises a plurality of distributed data service clusters and a centralized policy information repository, the computer-implemented method comprising:
receiving a data control policy generation request from a user computing device associated with a user profile;
generating a policy information object based at least in part on the data control policy generation request and the user profile, wherein the policy information object comprises policy application metadata and policy control metadata;
storing the policy information object in the centralized policy information repository;
distributing the policy information object as a replicated policy information object to a distributed policy decision object associated with a distributed data service cluster of the plurality of distributed data service clusters;
receiving a data object service request associated with the distributed data service cluster, wherein the distributed data service cluster is further associated with one or more distributed policy enforcement objects;
transmitting a control policy evaluation request based at least in part on the data object service request to the distributed policy decision object, wherein the distributed policy decision object comprises a plurality of replicated policy information objects that are distributed from the centralized policy information repository;
receiving a control policy evaluation response from the distributed policy decision object, wherein the control policy evaluation response indicates at least one replicated policy information object from the plurality of replicated policy information objects based at least in part on the data object service request; and
generating a data object service response based at least in part on the control policy evaluation response, wherein the data object service response comprises one or more of data permission metadata, data routing metadata, data transformation metadata, or data filter metadata.
8. The computer-implemented method of claim 7 , wherein the data object service response comprises the data permission metadata, wherein the data permission metadata comprises one of an allowance indication, a denial indication, or an additional information request indication.
9. The computer-implemented method of claim 7 , wherein the data object service response comprises the data routing metadata, wherein the data routing metadata comprises a network address indication.
10. The computer-implemented method of claim 7 , wherein the data object service response comprises the data transformation metadata, wherein the data transformation metadata comprises a data encryption indication.
11. The computer-implemented method of claim 7 , wherein the data object service response comprises the data filter metadata, wherein the data filter metadata comprises a data filter indication.
12. The computer-implemented method of claim 7 , wherein, when generating the policy information object, the computer-implemented method comprises:
determining that the data control policy generation request comprises a platform-wide policy indication and a plurality of internal staff identifiers; and
generating the policy application metadata that comprises a platform-wide application indication.
13. A computer program product for implementing unified data control policies in a distributed and product-oriented computing platform that comprises a plurality of distributed data service clusters and a centralized policy information repository, the computer program product comprising at least one non-transitory computer-readable storage medium having computer-readable program code portions stored therein, the computer-readable program code portions comprising an executable portion configured to:
receive a data control policy generation request from a user computing device associated with a user profile;
generate a policy information object based at least in part on the data control policy generation request and the user profile, wherein the policy information object comprises policy application metadata and policy control metadata;
store the policy information object in the centralized policy information repository;
distribute the policy information object as a replicated policy information object to a distributed policy decision object associated with a distributed data service cluster of the plurality of distributed data service clusters;
receive a data object service request associated with the distributed data service cluster, wherein the distributed data service cluster is further associated with one or more distributed policy enforcement objects;
transmit a control policy evaluation request based at least in part on the data object service request to the distributed policy decision object, wherein the distributed policy decision object comprises a plurality of replicated policy information objects that are distributed from the centralized policy information repository;
receive a control policy evaluation response from the distributed policy decision object, wherein the control policy evaluation response indicates at least one replicated policy information object from the plurality of replicated policy information objects based at least in part on the data object service request; and
generate a data object service response based at least in part on the control policy evaluation response, wherein the data object service response comprises one or more of data permission metadata, data routing metadata, data transformation metadata, or data filter metadata.
14. The computer program product of claim 13 , wherein the data object service response comprises the data permission metadata, wherein the data permission metadata comprises one of an allowance indication, a denial indication, or an additional information request indication.
15. The computer program product of claim 13 , wherein the data object service response comprises the data routing metadata, wherein the data routing metadata comprises a network address indication.
16. The computer program product of claim 13 , wherein the data object service response comprises the data transformation metadata, wherein the data transformation metadata comprises a data encryption indication.
17. The computer program product of claim 13 , wherein the data object service response comprises the data filter metadata, wherein the data filter metadata comprises a data filter indication.