US 10,257,197 B2Granted

Private data access controls in mobile applications

AssigneeSap SE

InventorsMark Stephen James White, Jyothi Krothapalli, David Clegg

Life of this patent

Estimating the term…

Loading patent…

Abstract

In an example embodiment, a request for data is received from an end-user device, the request including one or more contextual attributes of the end-user device. The request is forwarded to a data provider. Data is then received from the data provider. It is determined if the data includes tagged sensitive data. If so, then the tagged sensitive data and the one or more contextual attributes are sent to a data access platform. Then policy constraints corresponding to the data are received from the data access platform. The sensitive data is encrypted in a manner that a data privacy module on the end-user device only decrypts the sensitive data when one or more contextual attributes of the end-user device meet one or more requirements identified in the policy constraints, and then the encrypted sensitive data and the policy are sent to the data privacy module.

Claims20

Dependent claims

A system comprising:

a mobile services cloud platform comprising one or more processors configured to:
receive, from an end-user device, a request for data, the request including one or more contextual attributes of the end-user device;
forward the request for data to a data provider;
receive the data from the data provider;
determine if the data from the data provider includes tagged sensitive data, wherein the tagged sensitive data is data that has been labeled as sensitive;
in response to a determination that the data from the data provider includes tagged sensitive data:
send the tagged sensitive data and the one or more contextual attributes of the end-user device to a data access platform;
receive, from the data access platform, policy constraints corresponding to the tagged sensitive data;
encrypt the tagged sensitive data in a manner that a data privacy module on the end-user device only decrypts the tagged sensitive data when one or more contextual attributes of the end-user device meet one or more requirements identified in the policy constraints;
and
send the encrypted tagged sensitive data and the policy constraints to the data privacy module on the end-user device.

8 more elements

A non-transitory machine-readable storage medium comprising instructions which, when implemented by one or more machines, cause the one or more machines to perform operations comprising:

receiving, from an end-user device, a request for data, the request including one or more contextual attributes of the end-user device;
forwarding the request for data to a data provider;
receiving the data from the data provider;
determining if the data from the data provider includes tagged sensitive data, the wherein tagged sensitive data is data that has been labeled as sensitive;
in response to a determination that the data from the data provider includes tagged sensitive data;
sending the tagged sensitive data and the one or more contextual attributes of the end-user device to a data access platform;
receiving, from the data access platform, policy constraints corresponding to the tagged sensitive data;
encrypting the tagged sensitive data in a manner that a data privacy module on the end-user device only decrypts the tagged sensitive data when one or more contextual attributes of the end-user device meet one or more requirements identified in the policy constraints;
and
sending the encrypted tagged sensitive data and the policy constraints to the data privacy module on the end-user device.

7 more elements

Dependencies are inferred from the claim text.

Facts

Application: 15/210,429Filed 14 Jul 2016
Published: US 2018/0020001 A118 Jan 2018
Granted: 9 Apr 2019
Term ends: Not estimatedThe source records don’t support an estimate.

Classification8 codes

H04L 63/10
Network architectures or network communication protocols for network security: for controlling access to devices or network resources
G06F 21/602
Protecting data: providing cryptographic facilities or services
G06F 21/604
Protecting data: tools and structures for managing or administering access control systems
G06F 21/6245
To a system of files or objects, e.g. local or distributed file system or database: protecting personal data, e.g. for financial or medical purposes