Data sharing for network connected systems
The present application discloses a method, system, and computer system for providing access to data. The method includes receiving, by a data manager service from a data requesting service, a request using an identifier for a high-level data object to access a set of data associated with the high-level data object, determining, by the data manager service, low-level data object(s) corresponding to the set of data based on the identifier for the high-level data object, determining whether a user associated with the request has permission to access at least a subset of the low-level data object(s), and in response to determining that the user associated has permission to access the at least the subset of the low-level data object(s), generating, by the data manager service, a uniform resource locator (URL) via which the at least the subset of the one or more low-level data objects is accessible by the user.
1. A method comprising:
receiving a request to access a set of data associated with a high-level data object, wherein the high-level data object comprises one of a data table, a view, a database, or a model;
determining, using an identifier for the high-level data object, one or more low-level data objects corresponding to the high-level data object, wherein the one or more low-level data objects comprises one or more data files;
determining that a user associated with the request has permission to access a first subset of the low-level data objects that are a first subset of data files but does not have permission to access a second subset of the low-level data objects that are a second subset of data files; and
generating a uniform resource locator (URL) that provides access to the first subset of the low-level data objects is accessible by the user, but does not provide access to the second subset of the low-level data objects; and
returning the URL in response to the request.
2. The method of claim 1 , further comprising:
determining locations of the first subset of the low-level data objects and the second subset of the low-level data objects based on metadata associated with the high-level data object, the metadata indicating a mapping of the high-level data object to the one or more low-level data objects,
wherein the generated URL is directed to at least the determined locations of the first subset of the low-level data objects.
3. The method of claim 1 , wherein the URL includes an access key to access the first subset of low-level data objects but does not include an access key to access the second subset of low-level data objects.
4. The method of claim 3 , wherein the first subset of low-level data objects is encrypted using a first cryptographic key and the second subset of low-level data objects is encrypted using a second cryptographic key.
5. The method of claim 1 , wherein the URL is configured to expire after a predetermined amount of time.
6. The method of claim 1 , further comprising:
receiving a second request to access the set of data associated with the high-level data object;
determining that a user associated with the second request has permission to access the first subset of the low-level data objects and the second subset of the low-level data objects; and
generating a second URL that provides access to the first subset of the low-level data objects and the second subset of the low-level data objects; and
returning the second URL in response to the second request.
7. A system comprising:
one or more computer processors; and
one or more computer-readable mediums storing instructions that, when executed by the one or more computer processors, cause the system to perform operations comprising:
receiving a request to access a set of data associated with a high-level data object, wherein the high-level data object comprises one of a data table, a view, a database, or a model;
determining, using an identifier for the high-level data object, one or more low-level data objects corresponding to the high-level data object, wherein the one or more low-level data objects comprise one or more data files;
determining that a user associated with the request has permission to access a first subset of the low-level data objects that are a first subset of data files but does not have permission to access a second subset of the low-level data objects that are a second subset of data files; and
generating a uniform resource locator (URL) that provides access to the first subset of the low-level data objects is accessible by the user, but does not provide access to the second subset of the low-level data objects; and
returning the URL in response to the request.
8. The system of claim 7 , the operations further comprising:
determining locations of the first subset of the low-level data objects and the second subset of the low-level data objects based on metadata associated with the high-level data object, the metadata indicating a mapping of the high-level data object to the one or more low-level data objects,
wherein the generated URL is directed to at least the determined locations of the first subset of the low-level data objects.
9. The system of claim 7 , wherein the URL includes an access key to access the first subset of low-level data objects but does not include an access key to access the second subset of low-level data objects.
10. The system of claim 9 , wherein the first subset of low-level data objects is encrypted using a first cryptographic key and the second subset of low-level data objects is encrypted using a second cryptographic key.
11. The system of claim 7 , wherein the URL is configured to expire after a predetermined amount of time.
12. The system of claim 7 , the operations further comprising:
receiving a second request to access the set of data associated with the high-level data object;
determining that a user associated with the second request has permission to access the first subset of the low-level data objects and the second subset of the low-level data objects; and
generating a second URL that provides access to the first subset of the low-level data objects and the second subset of the low-level data objects; and
returning the second URL in response to the second request.
13. A non-transitory computer-readable medium storing instructions that, when executed by one or more computer processors of one or more computing devices, cause the one or more computing devices to perform operations comprising:
receiving a request to access a set of data associated with a high-level data object, wherein the high-level data object comprises one of a data table, a view, a database, or a model;
determining, using an identifier for the high-level data object, one or more low-level data objects corresponding to the high-level data object, wherein the one or more low-level data objects comprises one or more data files;
determining that a user associated with the request has permission to access a first subset of the low-level data objects that are a first subset of data files but does not have permission to access a second subset of the low-level data objects that are a second subset of data files; and
generating a uniform resource locator (URL) that provides access to the first subset of the low-level data objects is accessible by the user, but does not provide access to the second subset of the low-level data objects; and
returning the URL in response to the request.
14. The non-transitory computer-readable medium of claim 13 , the operations further comprising:
determining locations of the first subset of the low-level data objects and the second subset of the low-level data objects based on metadata associated with the high-level data object, the metadata indicating a mapping of the high-level data object to the one or more low-level data objects,
wherein the generated URL is directed to at least the determined locations of the first subset of the low-level data objects.
15. The non-transitory computer-readable medium of claim 13 , wherein the URL includes an access key to access the first subset of low-level data objects but does not include an access key to access the second subset of low-level data objects.
16. The non-transitory computer-readable medium of claim 15 , wherein the first subset of low-level data objects is encrypted using a first cryptographic key and the second subset of low-level data objects is encrypted using a second cryptographic key.
17. The non-transitory computer-readable medium of claim 13 , the operations further comprising:
receiving a second request to access the set of data associated with the high-level data object;
determining that a user associated with the second request has permission to access the first subset of the low-level data objects and the second subset of the low-level data objects; and
generating a second URL that provides access to the first subset of the low-level data objects and the second subset of the low-level data objects; and
returning the second URL in response to the second request.