DATA SHARING FOR NETWORK CONNECTED SYSTEMS
The present application discloses a method, system, and computer system for providing access to data. The method includes receiving, by a data manager service from a data requesting service, a request using an identifier for a high-level data object to access a set of data associated with the high-level data object, determining, by the data manager service, low-level data object(s) corresponding to the set of data based on the identifier for the high-level data object, determining whether a user associated with the request has permission to access at least a subset of the low-level data object(s), and in response to determining that the user associated has permission to access the at least the subset of the low-level data object(s), generating, by the data manager service, a uniform resource locator (URL) via which the at least the subset of the one or more low-level data objects is accessible by the user.
1 . (canceled)
2 . A method comprising:
receiving a request to access data included in a high-level data object, the high-level data object being mapped to a set of low-level data objects;
determining that an entity corresponding to the request has permission to access a first subset of the low-level data objects but does not have permission to access a second subset of the low-level data objects;
generating a uniform resource locator (URL) that provides access to the first subset of the low-level data objects that the entity has permission to access, but does not provide access to the second subset of the low-level data objects that the entity does not have permission to access; and
returning the URL in response to the request.
3 . The method of claim 2 , wherein the entity is one of a user, an account, and a data requesting service.
4 . The method of claim 2 , wherein determining that the entity associated with the request has permission to access the first subset of the low-level data objects but does not have permission to access the second subset of the low-level data objects comprises:
determining, based on access requirements for the first subset of the low-level data objects, that the entity has permission to access the first subset of the low-level data objects; and
determining, based on access requirements for the second subset of the low-level data objects, that the entity does not have permission to access the second subset of the low-level data objects.
5 . The method of claim 2 , wherein determining that the entity associated with the request has permission to access the first subset of the low-level data objects but does not have permission to access the second subset of the low-level data objects comprises:
accessing metadata stored in connection with the set of low-level data objects, the metadata indicating a mapping of permissions of the high-level data object to the set of low-level data objects; and
determining, based on the mapping of permissions, that the entity associated with the request has permission to access the first subset of the low-level data objects but does not have permission to access the second subset of the low-level data objects.
6 . The method of claim 2 , wherein determining that the entity associated with the request has permission to access the first subset of the low-level data objects but does not have permission to access the second subset of the low-level data objects comprises:
transmitting a query to an authentication service, the query including metadata describing the entity and the data included in the high-level data object; and
receiving, from the authentication service, a response to the query, the response indicating that the entity associated with the request has permission to access the first subset of the low-level data objects but does not have permission to access the second subset of the low-level data objects.
7 . The method of claim 2 , wherein the URL includes an access key to access the first subset of the low-level data objects but does not include an access key to access the second subset of the low-level data objects.
8 . The method of claim 2 , wherein the URL is configured to expire after a predetermined amount of time.
9 . A system comprising:
one or more computer processors; and
one or more computer-readable mediums storing instructions that, when executed by the one or more computer processors, cause the system to perform operations comprising:
receiving a request to access data included in a high-level data object, the high-level data object being mapped to a set of low-level data objects;
determining that an entity corresponding to the request has permission to access a first subset of the low-level data objects but does not have permission to access a second subset of the low-level data objects;
generating a uniform resource locator (URL) that provides access to the first subset of the low-level data objects that the entity has permission to access, but does not provide access to the second subset of the low-level data objects that the entity does not have permission to access; and
returning the URL in response to the request.
10 . The system of claim 9 , wherein the entity is one of a user, an account, and a data requesting service.
11 . The system of claim 9 , wherein determining that the entity associated with the request has permission to access the first subset of the low-level data objects but does not have permission to access the second subset of the low-level data objects comprises:
determining, based on access requirements for the first subset of the low-level data objects, that the entity has permission to access the first subset of the low-level data objects; and
determining, based on access requirements for the second subset of the low-level data objects, that the entity does not have permission to access the second subset of the low-level data objects.
12 . The system of claim 9 , wherein determining that the entity associated with the request has permission to access the first subset of the low-level data objects but does not have permission to access the second subset of the low-level data objects comprises:
accessing metadata stored in connection with the set of low-level data objects, the metadata indicating a mapping of permissions of the high-level data object to the set of low-level data objects; and
determining, based on the mapping of permissions, that the entity associated with the request has permission to access the first subset of the low-level data objects but does not have permission to access the second subset of the low-level data objects.
13 . The system of claim 9 , wherein determining that the entity associated with the request has permission to access the first subset of the low-level data objects but does not have permission to access the second subset of the low-level data objects comprises:
transmitting a query to an authentication service, the query including metadata describing the entity and the data included in the high-level data object; and
receiving, from the authentication service, a response to the query, the response indicating that the entity associated with the request has permission to access the first subset of the low-level data objects but does not have permission to access the second subset of the low-level data objects.
14 . The system of claim 9 , wherein the URL includes an access key to access the first subset of the low-level data objects but does not include an access key to access the second subset of the low-level data objects.
15 . The system of claim 9 , wherein the URL is configured to expire after a predetermined amount of time.
16 . A non-transitory computer-readable medium storing instructions that, when executed by one or more computer processors of a computing system, cause the computing system to perform operations comprising:
receiving a request to access data included in a high-level data object, the high-level data object being mapped to a set of low-level data objects;
determining that an entity corresponding to the request has permission to access a first subset of the low-level data objects but does not have permission to access a second subset of the low-level data objects;
generating a uniform resource locator (URL) that provides access to the first subset of the low-level data objects that the entity has permission to access, but does not provide access to the second subset of the low-level data objects that the entity does not have permission to access; and
returning the URL in response to the request.
17 . The non-transitory computer-readable medium of claim 16 , wherein the entity is one of a user, an account, and a data requesting service.
18 . The non-transitory computer-readable medium of claim 16 , wherein determining that the entity associated with the request has permission to access the first subset of the low-level data objects but does not have permission to access the second subset of the low-level data objects comprises:
determining, based on access requirements for the first subset of the low-level data objects, that the entity has permission to access the first subset of the low-level data objects; and
determining, based on access requirements for the second subset of the low-level data objects, that the entity does not have permission to access the second subset of the low-level data objects.
19 . The non-transitory computer-readable medium of claim 16 , wherein determining that the entity associated with the request has permission to access the first subset of the low-level data objects but does not have permission to access the second subset of the low-level data objects comprises:
accessing metadata stored in connection with the set of low-level data objects, the metadata indicating a mapping of permissions of the high-level data object to the set of low-level data objects; and
determining, based on the mapping of permissions, that the entity associated with the request has permission to access the first subset of the low-level data objects but does not have permission to access the second subset of the low-level data objects.
20 . The non-transitory computer-readable medium of claim 16 , wherein determining that the entity associated with the request has permission to access the first subset of the low-level data objects but does not have permission to access the second subset of the low-level data objects comprises:
transmitting a query to an authentication service, the query including metadata describing the entity and the data included in the high-level data object; and
receiving, from the authentication service, a response to the query, the response indicating that the entity associated with the request has permission to access the first subset of the low-level data objects but does not have permission to access the second subset of the low-level data objects.
21 . The non-transitory computer-readable medium of claim 16 , wherein the URL includes an access key to access the first subset of the low-level data objects but does not include an access key to access the second subset of the low-level data objects.