Granted Patent B2

US 12,632,582 · App. 18/592,792 · Granted May 19, 2026

Inventors: Bo Wen (Chappaqua, NY); Nigel Hinds (Great Barrington, MA); Jeffrey L. Rogers (Briarcliff Manor, NY)

Assignee: International Business Machines Corporation

G06F21/6218

Abstract

Claims (67)

1 . A method of controlling access and usage of data comprising:

generating, via at least one processor, a data usage configuration from a document specifying requirements for a dataset in a natural language,

wherein the data usage configuration indicates:

access rules, and

a plurality of types of obfuscation on the dataset, wherein at least one of the plurality of types of obfuscation on the dataset is based on an access level of a user of a plurality of users;

retrieving, via the at least one processor, at least a portion of the dataset from a data storage unit in accordance with the data usage configuration;

controlling, via the at least one processor, operations performed on the dataset based on the data usage configuration; and

providing, via the at least one processor, obfuscated data, according to the at least one of the plurality of types of obfuscation, and in response to a request associated with the user.

2 . The method of claim 1 , wherein the data usage configuration is collocated with the dataset, and wherein controlling the operations performed on the dataset comprises:

controlling the operations performed on the dataset in a remote computing environment.

3 . The method of claim 1 , wherein the data usage configuration is generated based on metadata.

4 . The method of claim 1 , wherein controlling the operations performed on the dataset comprises:

controlling the operations performed on the dataset in a remote computing environment that accesses the data usage configuration for the dataset.

5 . The method of claim 1 , further comprising: performing, via the at least one processor, actions upon expiration of the data usage configuration including sequestering or deleting copies of the dataset.

6 . The method of claim 1 , wherein generating the data usage configuration from the document comprises:

processing the document via a Large Language Model (LLM) to extract metadata for the data usage configuration based on a prompt including instructions for the LLM in a natural language; and

generating the data usage configuration based on the extracted metadata.

7 . The method of claim 6 , wherein generating the data usage configuration based on the extracted metadata comprises:

generating a database schema representing the data usage configuration based on the extracted metadata.

8 . The method of claim 1 , wherein generating the data usage configuration from the document comprises:

extracting information from the document for the data usage configuration, wherein the information includes: owner and provider information, duration of the data usage configuration, conditions for early termination, actions upon termination of the data usage configuration, organization members permitted access, restrictions on sub-licensing, a data dictionary, a summary of the dataset, a purpose, restriction on data copies, owner classification of the dataset, authority classification, physical handling restrictions, environment requirements, reporting requirements for a breach, a value of the dataset associated with a breach, rights to derived data, and training requirements.

9 . A system for controlling access and usage of data comprising:

one or more memories; and

at least one processor coupled to the one or more memories and configured to:

generate a data usage configuration from a document specifying requirements for a dataset in a natural language,

wherein the data usage configuration indicates;

access rules, and

a plurality of types of obfuscation on the dataset, wherein at least one of the plurality of types of obfuscation on the dataset is based on an access level of a user of a plurality of users;

retrieve at least a portion of the dataset from a data storage unit in accordance with the data usage configuration;

control operations performed on the dataset based on the data usage configuration; and

provide obfuscated data, according to the at least one of the plurality of types of obfuscation, and in response to a request associated with the user.

10 . The system of claim 9 , wherein the data usage configuration is collocated with the dataset, and wherein controlling the operations performed on the dataset comprises:

controlling the operations performed on the dataset in a remote computing environment.

11 . The system of claim 9 , wherein the data usage configuration is generated based on metadata.

12 . The system of claim 9 , wherein controlling the operations performed on the dataset comprises:

controlling the operations performed on the dataset in a remote computing environment that accesses the data usage configuration for the dataset.

13 . The system of claim 9 , wherein the at least one processor is further configured to:

perform actions upon expiration of the data usage configuration including sequestering or deleting copies of the dataset.

14 . The system of claim 9 , wherein generating the data usage configuration from the document comprises:

processing the document via a Large Language Model (LLM) to extract metadata for the data usage configuration based on a prompt including instructions for the LLM in a natural language; and

generating the data usage configuration based on the extracted metadata.

15 . The system of claim 14 , wherein generating the data usage configuration based on the extracted metadata comprises:

generating a database schema representing the data usage configuration based on the extracted metadata.

16 . The system of claim 9 , wherein generating the data usage configuration from the document comprises:

extracting information from the document for the data usage configuration, wherein the information includes: owner and provider information, duration of the data usage configuration, conditions for early termination, actions upon termination of the data usage configuration, organization members permitted access, restrictions on sub-licensing, a data dictionary, a summary of the dataset, a purpose, restriction on data copies, owner classification of the dataset, authority classification, physical handling restrictions, environment requirements, reporting requirements for a breach, a value of the dataset associated with a breach, rights to derived data, and training requirements.

17 . A computer program product for controlling access and usage of data, the computer program product comprising one or more computer readable storage media having program instructions collectively stored on the one or more computer readable storage media, the program instructions executable by at least one processor to cause the at least one processor to:

generate a data usage configuration from a document specifying requirements for a dataset in a natural language,

wherein the data usage configuration indicates:

access rules, and

a plurality of types of obfuscation on the dataset, wherein at least one of the plurality of types of obfuscation on the dataset is based on an access level of a user of a plurality of users;

retrieve at least a portion of the dataset from a data storage unit in accordance with the data usage configuration;

control operations performed on the dataset based on the data usage configuration; and

provide obfuscated data, according to the at least one of the plurality of types of obfuscation, and in response to a request associated with the user.

18 . The computer program product of claim 17 , wherein the data usage configuration is collocated with the dataset, and wherein controlling the operations performed on the dataset comprises:

controlling the operations performed on the dataset in a remote computing environment.

19 . The computer program product of claim 17 , wherein the data usage configuration is generated based on metadata.

20 . The computer program product of claim 17 , wherein controlling the operations performed on the dataset comprises:

controlling the operations performed on the dataset in a remote computing environment that accesses the data usage configuration for the dataset.

21 . The computer program product of claim 17 , wherein the program instructions further cause the at least one processor to:

perform actions upon expiration of the data usage configuration including sequestering or deleting copies of the dataset.

22 . The computer program product of claim 17 , wherein generating the data usage configuration from the document comprises:

processing the document via a Large Language Model (LLM) to extract metadata for the data usage configuration based on a prompt including instructions for the LLM in a natural language; and

generating the data usage configuration based on the extracted metadata.

23 . The computer program product of claim 22 , wherein generating the data usage configuration based on the extracted metadata comprises:

generating a database schema representing the data usage configuration based on the extracted metadata.

24 . The computer program product of claim 17 , wherein generating the data usage configuration from the document comprises:

extracting information from the document for the data usage configuration, wherein the information includes: owner and provider information, duration of the data usage configuration, conditions for early termination, actions upon termination of the data usage configuration, organization members permitted access, restrictions on sub-licensing, a data dictionary, a summary of the dataset, a purpose, restriction on data copies, owner classification of the dataset, authority classification, physical handling restrictions, environment requirements, reporting requirements for a breach, a value of the dataset associated with a breach, rights to derived data, and training requirements.

Assignments (1)

Continuity (1)

References Cited (10)