Utilizing probability data structures to improve access control of documents across geographic regions
The present disclosure relates to systems, methods, and computer-readable media for utilizing a content access authorization system to determine user access control efficiently and flexibly for digital documents that are stored in different geographic regions. For instance, the content access authorization system can convert sensitive user information for digital documents stored in a first geographic region into a probabilistic data structure that does not include user information and share the probabilistic data structure with a second geographic region. The content access authorization system can then utilize the probabilistic data structure to efficiently pre-filter user document access control for digital documents requested by a user in the second geographic region that are stored in the first geographic region, which significantly saves on latency and computing resource usage by reducing the number of document control access queries needed to be made to the first geographic region.
1. A computer-implemented method of determining user access control information for digital documents comprising:
receiving a user request for a user in a first geographic region to access a digital document stored in a second geographic region;
determining, based on a shallow version of the digital document stored in the first geographic region, that a full version of the digital document is stored in the second geographic region;
determining whether the user has permission to access the full version of the digital document stored in the second geographic region by utilizing an access control probabilistic data structure that is stored in the first geographic region, wherein the access control probabilistic data structure removes user identities; and
granting or denying the user in the first geographic region access to the full version of the digital document stored in the second geographic region based on the determination from the access control probabilistic data structure.
2. The computer-implemented method of claim 1 , wherein:
determining whether the user has permission to access the full version of the digital document stored in the second geographic region comprises utilizing, within the first geographic region, the access control probabilistic data structure to determine that the user does not have permission to access the full version of the digital document stored in the second geographic region; and
granting or denying the user in the first geographic region access to the full version of the digital document stored in the second geographic region comprises denying the user in the first geographic region access to the full version of the digital document stored in the second geographic region based on determining that the user does not have permission to access the full version of the digital document stored in the second geographic region.
3. The computer-implemented method of claim 1 , wherein the second geographic region comprises a data handling standard that prevents a user identifier of the user from being stored outside of the second geographic region.
4. The computer-implemented method of claim 1 , further comprising utilizing the access control probabilistic data structure to determine that the user does not have permission to access the full version of the digital document stored in the second geographic region by:
encoding a user identifier for the user into a number that falls within a number range of the access control probabilistic data structure; and
determining that an entry in the access control probabilistic data structure corresponding to the number does not satisfy an access control threshold.
5. The computer-implemented method of claim 1 , wherein determining whether the user has permission to access the full version of the digital document stored in the second geographic region comprises utilizing, within the first geographic region, the access control probabilistic data structure to determine that the user satisfies an access control threshold.
6. The computer-implemented method of claim 5 , further comprising:
sending a query from the first geographic region to the second geographic region based on determining that the user satisfies an access control threshold with the access control probabilistic data structure in the first geographic region; and
receiving, from the second geographic region, an indication granting or denying the user in the first geographic region access to the full version of the digital document stored in the second geographic region.
7. The computer-implemented method of claim 6 , further comprising receiving, from the second geographic region and at the first geographic region, the access control probabilistic data structure, wherein the access control probabilistic data structure corresponds to permissions associated with the digital document, and wherein the access control probabilistic data structure does not include a user identifier of the user.
8. The computer-implemented method of claim 7 , wherein the second geographic region comprises an access control block associated with the digital document that includes the user identifier and corresponding user permission granting the user within the first geographic region access to the full version of the digital document stored in the second geographic region.
9. The computer-implemented method of claim 1 , wherein the access control probabilistic data structure comprises a bloom filter.
10. The computer-implemented method of claim 1 , wherein the access control probabilistic data structure comprises a cuckoo filter, a ribbon filter, or a xor filter.
11. The computer-implemented method of claim 1 , further comprising:
determining that the user belongs to a group; and
wherein determining whether the user has permission to access the full version of the digital document stored in the second geographic region comprises utilizing a label of the group with the access control probabilistic data structure to determine whether the user has permission to access the full version of the digital document stored in the second geographic region.
12. A computer-implemented method of determining user access control information for digital documents comprising:
receiving a user request for a user in a first geographic region to access a digital document stored in a second geographic region;
determining, based on a shallow version of the digital document stored in the first geographic region, that a full version of the digital document is stored in the second geographic region;
utilizing an access control probabilistic data structure that is stored in the first geographic region to determine that the user satisfies an access control threshold, wherein the access control probabilistic data structure removes user identities;
based on the determination that the user satisfies the access control threshold, sending a query from the first geographic region to the second geographic region for the user to access the full version of the digital document stored in the second geographic region;
receiving from the second geographic region, an indication denying the user in the first geographic region access to the full version of the digital document stored in the second geographic region; and
denying the user in the first geographic region access to the full version of the digital document stored in the second geographic region based on the indication received from the second geographic region.
13. The computer-implemented method of claim 12 , wherein the user request for the user in the first geographic region to access the full version of the digital document stored in the second geographic region comprises an access request query performed as a background process.
14. The computer-implemented method of claim 13 , wherein:
the background process comprises a plurality of access request queries requesting access to a plurality of digital documents stored in the second geographic region; and
one or more results of the plurality of access request queries are used to provide document insights to the user.
15. The computer-implemented method of claim 14 , wherein the plurality of access request queries corresponds to traversing a graph that comprises the plurality of digital documents.
16. The computer-implemented method of claim 13 , wherein the background process is an automation that is triggered based on a user visiting a webpage associated with the digital document.
17. The computer-implemented method of claim 12 , wherein the shallow version of the digital document stored in the first geographic region includes metadata of the digital document comprising activity data indicating modifications to the digital document performed in both the first geographic region and the second geographic region.
18. A system, comprising:
at least one processor; and
a non-transitory computer memory comprising instructions that, when executed by the at least one processor, cause the system to:
receive a user request for a user in a first geographic region to access a digital document stored in a second geographic region;
determining, based on a shallow version of the digital document stored in the first geographic region, that a full version of the digital document is stored in the second geographic region;
determining that the user does not have permission to access the full version of the digital document stored in the second geographic region by utilizing an access control probabilistic data structure that is stored in the first geographic region, wherein the access control probabilistic data structure removes user identities; and
denying the user in the first geographic region access to the full version of the digital document stored in the second geographic region based on the determination from the access control probabilistic data structure.
19. The system of claim 18 , wherein the access control probabilistic data structure comprises a bloom filter.
20. The system of claim 18 , wherein the user request for the user in the first geographic region to access the full version of the digital document stored in the second geographic region comprises an access request query performed as a background process.