Granted Patent B2

US 12,619,752 · App. 18/125,707 · Granted May 5, 2026

Inventors: Eric Swenson (Soquel, CA); Harbinder Singh Hayer (Menlo Park, CA)

Assignee: Intertrust Technologies Corporation

G06F21/6218G06F16/2455H04L63/0853

Abstract

Claims (30)

1 . A method for managing access to a governed object performed by a data management system comprising at least one processor and at least one non-transitory computer-readable medium storing instructions that, when executed by the at least one processor, cause the data management system to perform the method, the method comprising:

receiving, by a security service of the data management system, an access control request, the access control request comprising an indication of a subject associated with a validated access token, an indication of a specified data set associated with the access control request, and an indication of at least one requested access privilege associated with the request;

accessing, by the security service, a directory database to identify:

at least a first governed object in the directory database, the at least a first governed object corresponding with the specified data set associated with the access control request,

at least a first rule set in the directory database, the at least a first rule set being associated with the at least a first governed object in the directory database, the at least a first rule set comprising at least a first rule specifying a depth associated with the at least a first rule, the at least a first rule set being attached to at least a second governed object located above the at least a first governed object in a root path of a directory tree in the directory database, the at least a second governed object being located above the at least a first governed object within the depth specified in the at least a first rule, and

at least a first role in the directory database, the at least a first role being associated with the indication of the subject associated with the access token;

determining, by the security service, based on the at least a first rule, the at least a first role, and the access control request, that the access control request should be granted, wherein determining that the access control request should be granted comprises:

comparing the indication of the subject associated with the access token, the at least a first role, the indication of the specified data set, and the indication of the at least one requested access privilege with the at least a first rule, and

determining, based on the comparison, that the subject associated with the access token is permitted the at least one requested access privilege to the at least a first governed object associated with the specified data set;

issuing, to a service originating the access control request by the security service, an access control response granting access to the specified data set based on determining that the access control request should be granted.

2 . The method of claim 1 , wherein the access control request is received from a data service of the data management service.

3 . The method of claim 2 , wherein the access control response is issued by the security service to the data service.

4 . The method of claim 2 , wherein the access token is validated by the data service.

5 . The method of claim 1 , wherein the access token is validated by an authentication service of the data management service.

6 . The method of claim 1 , wherein the access token is validated by a remote authentication service.

7 . The method of claim 1 , wherein the validated access token comprises an access token that is not expired.

8 . The method of claim 1 , wherein the validated access token comprises an access token issued by an authentication service of the data management service based on determining that authentication credentials provided to the authentication service in connection with an access token request are associated with a valid account.

9 . The method of claim 1 , wherein the directory database is managed by a directory service of the data management system.

10 . The method of claim 1 , wherein the service originating the access control request comprises a data service of the data management system and the method further comprises:

retrieving, by the data service based on the access control response, the specified data set from a data store; and

transmitting, by the data service, a data access response to a requesting client system based on the retrieved specified data set.

11 . The method of claim 10 , wherein the data store comprises a local data store of the data management system.

12 . The method of claim 10 , wherein the data store comprises a remote data store.

13 . The method of claim 10 , wherein the access control response comprises at least one restriction, and wherein retrieving the specified data set from the data store comprises retrieving the specified data set in accordance with the at least one restriction.

14 . The method of claim 13 , wherein retrieving the specified data set in accordance with the at least one restriction comprises transmitting at least one data retrieval request issued to the data store in accordance with the at least one restriction.

15 . The method of claim 1 , wherein the at least a second governed object comprises an object associated with an organization.

16 . The method of claim 1 , wherein the method further comprises:

identifying, by the security service, at least a second rule set in the directory database, the at least a second rule set being associated with the at least a first governed object in the directory database, the at least a second rule set comprising at least a second rule; and

determining, by the security service, that the first rule set has a higher indicated priority than the second rule set.

17 . The method of claim 1 , wherein the subject associated with the access token comprises an account associated with the validated access token.

Assignments (2)

Continuity (3)

References Cited (105)