Granted Patent B2

US 12,326,949 · App. 17/542,017 · Granted Jun 10, 2025

Inventor: Michael Emanuel Mainer (Woodinville, WA)

Assignee: Microsoft Technology Licensing, LLC

G06F21/6218

Abstract

Claims (91)

1. A method for privacy data management in a distributed computing system configured to provide the computing resources as computing services via a computer network, the method comprising:

receiving, via the computer network, a request from a data consumer for privacy information stored as digital objects in the distributed computing system, each of the digital objects being logically structured according to a data schema defining:

a property that is configured to contain a property value representing user information; and

an annotation to the property, the annotation being configured to contain data representing a privacy classification of the property value contained in the property; and

in response to receiving the request for the privacy information,

inspecting the data schema of the digital objects to identify the privacy classification of the property; and

transmitting, via the computer network, the identified privacy classification of the property to the data consumer, the transmitted privacy classification enables the data consumer to configure an application to process the property values of the property in the digital objects according to a corresponding processing requirement in one or more jurisdictions and execute the configured application to generate output data from the data in compliance to the corresponding processing requirement in one or more jurisdictions.

2. The method of claim 1 wherein:

the data schema further includes another annotation containing data representing one or more privacy data categories included in the digital objects; and

the method further includes, in response to receiving the request for the privacy information,

inspecting the data schema of the digital objects to identify the data representing the one or more privacy data categories included in the digital objects; and

transmitting, via the computer network, the identified data representing the one or more privacy data categories included in the digital objects to the data consumer along with the identified privacy classification of the property value contained in the property of the digital objects.

3. The method of claim 1 , further comprising storing the generated output data along with the received privacy classification of the property in the digital objects.

4. The method of claim 1 , further comprising:

storing the generated output data along with the received privacy classification of the property in the digital objects; and

processing, with another application in the distributed computing system, the stored output data according to the privacy classification of the property stored along with the output data from the application.

5. The method of claim 1 wherein:

storing the generated output data along with the received privacy classification of the property in the digital objects;

querying the output data for a set of one or more property values according to a preset value of the privacy classification; and

processing the queried one or more property values according to the corresponding organizational, legal, or regulatory processing requirement in the one or more jurisdictions.

6. The method of claim 1 , further comprising:

receiving a user input to modify the data representing the privacy classification contained in the annotation; and

in response to receiving the user input, modifying the data schema according to the received user input to modify the data representing the privacy classification contained in the annotation without modifying the user object.

7. A method for privacy data management in a distributed computing system configured to provide the computing resources as computing services via a computer network, the method comprising:

receiving, via the computer network, a request from a data consumer for privacy information of data objects in the distributed computing system, the data objects being logically structured according to a data schema defining:

a property that is configured to contain a property value representing user information; and

an annotation to the property, the annotation being configured to contain data representing a privacy classification of the property value contained in the property; and

in response to receiving the request for the privacy information,

inspecting the data schema of the data objects to identify the privacy classification of the property value contained in the property of the data objects; and

transmitting, via the computer network, the identified privacy classification of the property value contained in the property of the data objects to the data consumer, thereby enabling the data consumer to configure an application to process the property value of the property in the data objects according to a corresponding organizational, legal, or regulatory processing requirement in one or more jurisdictions.

8. The method of claim 7 wherein:

the data schema further includes another annotation to the data objects containing data representing one or more privacy data categories included in the data objects; and

the method further includes, in response to receiving the request for the privacy information,

inspecting the data schema of the data objects to identify the data representing the one or more privacy data categories included in the data objects; and

transmitting, via the computer network, the identified data representing the one or more privacy data categories included in the data objects to the data consumer along with the identified privacy classification of the property value contained in the property of the data objects.

9. The method of claim 7 wherein:

the application is configured by the data consumer to:

process the property value of the property in the data objects to generate output data according to the corresponding organizational, legal, or regulatory processing requirement in the one or more jurisdictions; and

store the output data along with the received privacy classification of the property value contained in the property of the data objects.

10. The method of claim 7 wherein:

the application is configured by the data consumer to:

process the property value of the property in the data objects to generate output data according to the corresponding organizational, legal, or regulatory processing requirement in the one or more jurisdictions; and

store the output data along with the received privacy classification of the property value contained in the property of the data objects; and

the method further includes processing, with another application in the distributed computing system, the stored output data according to the privacy classification of the property value contained in the property of the data objects stored along with the output data from the application.

11. The method of claim 7 wherein:

the application is configured by the data consumer to:

process the property value of the property in the data objects to generate output data according to the corresponding organizational, legal, or regulatory processing requirement in the one or more jurisdictions; and

store the output data along with the received privacy classification of the property value contained in the property of the data objects; and

the method further includes:

processing, with another application in the distributed computing system, the stored output data to generate another output data according to the privacy classification of the property value contained in the property of the data objects stored along with the output data; and

storing the generated another output data along with the privacy classification of the property value contained in the property of the data objects.

12. The method of claim 7 wherein:

the application is configured by the data consumer to:

process the property value of the property in the data objects to generate output data according to the corresponding organizational, legal, or regulatory processing requirement in the one or more jurisdictions; and

store the output data along with the received privacy classification of the property value contained in the property of the data objects; and

the method further includes processing, with another application in the distributed computing system,

querying the output data for a set of one or more property values according to a preset value of the privacy classification; and

processing the queried one or more property values according to the corresponding organizational, legal, or regulatory processing requirement in the one or more jurisdictions.

13. The method of claim 7 wherein:

the application is configured by the data consumer to:

process the property value of the property in the data objects to generate output data according to the corresponding organizational, legal, or regulatory processing requirement in the one or more jurisdictions; and

store the output data along with the received privacy classification of the property value contained in the property of the data objects; and

the method further includes processing, with another application in the distributed computing system,

querying the data and the output data for a set of one or more property values according to a preset value of the privacy classification; and

processing the queried one or more property values in the data and the output data according to the corresponding organizational, legal, or regulatory processing requirement in the one or more jurisdictions.

14. The method of claim 7 wherein the privacy classification of the property value contained in the property includes multiple levels of privacy classes each having a corresponding organizational, legal, or regulatory processing requirement in the one or more jurisdictions.

15. The method of claim 7 , further comprising:

receiving a user input to modify the data representing the privacy classification contained in the annotation; and

in response to receiving the user input, modifying the data schema according to the received user input to modify the data representing the privacy classification contained in the annotation without modifying the user object.

16. A computing device in a distributed computing system configured to provide computing resources of the distributed computing system as computing services to users via a computer network, the computing device comprising:

a processor; and

a memory operatively coupled to the processor, the memory containing instructions executable by the processor to cause the computing device to:

receive, via the computer network, a request from a data consumer for privacy information of data objects in the distributed computing system, the data objects being logically structured according to a data schema defining:

multiple properties individually configured to contain a property value representing user information; and

multiple annotations individually corresponding to one of the multiple properties, the multiple annotations individually containing data representing a privacy classification of the one of the multiple properties; and

in response to receiving the request for the privacy information,

inspect the data schema of the data objects to identify the privacy classification of the multiple properties of the data objects; and

transmit, via the computer network, the identified privacy classification of the multiple properties of the data objects to the data consumer, thereby enabling the data consumer to configure an application to process values of the multiple properties in the data objects according to the transmitted privacy classification.

17. The computing device of claim 16 wherein:

the data schema further includes another annotation to the data objects containing data representing one or more privacy data categories included in the data object; and

the memory includes additional instructions executable by the processor to cause the computing device to, in response to receiving the request for the privacy information,

inspect the data schema of the data object to identify the data representing the one or more privacy data categories included in the data objects; and

transmit, via the computer network, the identified data representing the one or more privacy data categories included in the data objects to the data consumer along with the identified privacy classification of the multiple properties of the data objects.

18. The computing device of claim 16 wherein:

the application is configured by the data consumer to:

process the property value of the property in the data objects to generate output data according to the corresponding organizational, legal, or regulatory processing requirement in the one or more jurisdictions; and

store the output data along with the received privacy classification of the multiple properties of the data objects.

19. The computing device of claim 16 wherein the privacy classification of the multiple properties includes multiple levels of privacy classes each having a corresponding organizational, legal, or regulatory processing requirement in the one or more jurisdictions.

20. The computing device of claim 16 wherein the memory includes additional instructions executable by the processor to cause the computing device to:

receive a user input to modify the data representing the privacy classification contained in the annotation; and

in response to receiving the user input, modify the data schema according to the received user input to modify the data representing the privacy classification contained in the annotation without modifying the user object.

Assignments (1)

Continuity (2)

References Cited (200)