# US 10,454,970 B2 · Authorization of access to a data resource in addition to specific actions to be performed on the data resource based on an authorized context enforced by a use policy

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 10,454,970 B2
- Document ID: US10454970B2
- Status: Granted
- Kind: B2
- Application number: 15/230,424
- Filed: 2016-08-07
- Published: 2017-02-02
- Granted: 2019-10-22
- Earliest claimed: 2014-06-30
- Assignees: Vescel, LLC
- Applicants: CloudMode, LLC
- Inventors: Dhryl Anton; Michael McFall
- Web page: https://patentgrep.com/patent/US10454970B2

## CPC

- H04L 63/20: {for managing network security; network security policies in general (filtering policies H04L63/0227)}
- G06F 16/2219: {Large Object storage; Management thereof}
- G06F 21/6227: {where protection concerns the structure of data, e.g. records, types, queries}
- H04L 63/108: {when the policy decisions are valid for a limited amount of time}
- G06F 2221/2137: Time limited access, e.g. to a computer or data
- G06F 2221/2141: Access rights, e.g. capability lists, access control lists, access tables, access matrices
- G06F 2221/2149: Restricted operating environment
- H04L 63/062: {for key distribution, e.g. centrally by trusted party (cryptographic mechanisms or cryptographic arrangements for key distribution involving a central third party H04L9/0819)}
- H04L 63/0823: {using certificates (cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263)}
- H04L 63/101: {Access control lists [ACL]}
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)

## Abstract

Disclosed is a method, a device, and/or a system of authorization of access to a data resource in addition to specific actions to be performed on the data resource based on an authorized context enforced by a use policy. A computer-implemented method includes receiving a use request from a device to use a protected resource. The method extracts from a security node a use policy comprising defining an authorized context for use the protected resource. First, access to the protected resource is authorized when the use request conforms to the authorized context. Use keys are generated and returned to the device for redemption. Second, after the protected resource is streamed to the device, a process of the device monitors use of and enforce ephemerality of the protected resource by maintaining an active use ledger. A use policy update may generate new use terms that are pushed to the device, terminating use.

## Claims

### Claim 1

A computer-implemented method for authorizing and controlling use of a data resource, the method comprising:
receiving a use request from a device to use a protected resource stored in a data node of a non-hierarchical data structure within a datastore,
wherein the data node comprising an identifier whereby the data node is addressable within the datastore;
extracting from at least one of the data node and a security node having a referential attribute pointing to the data node a use policy comprising computer-readable instructions defining an authorized context for which the device can use the protected resource based on one or more contextual values;
initiating a use transaction that executes the computer-readable instructions of the use policy to gather the one or more contextual values and to determine whether the use request satisfies the authorized context for which the device can use the protected resource;
authorizing access to the protected resource by the device when it is determined that based on the contextual values that the use request conforms to the authorized context for which the device may use the protected resource;
generating a use terms from the computer-readable instructions defining the authorized context for the use request;
generating a set of one or more use keys and appending the identifier of the protected resource to each of the set of one or more use keys to form one or more key-identifier pairs;
associating an expiration condition with each of the one or more key-identifier pairs;
returning a first use key of the set of one or more use keys to the device;
receiving a redemption request from the device comprising the first use key and verifying the first use key;
extracting the identifier of the protected resource from a first key-identifier pair of the one or more key-identifier pairs and retrieving the protected resource with the identifier of the protected resource; and
streaming the protected resource to the device for use by the device.

### Claim 2 (depends on 1)

The method of claim 1,
maintaining an open transaction record of the use transaction and storing the one or more contextual values usable to determine the authorized context, the open transaction record associating the device with an active use of the protected resource; and
returning the use terms generated from the computer-readable instructions to the device,
wherein a process of the device operable to monitor use of and enforce ephemerality of the protected resource by maintaining a ledger comprising data identifying the protected resource that is in active use by the device and a corresponding instance of the use terms associated with the authorized use of the protected resource.

### Claim 3 (depends on 2)

The method of claim 2, further comprising:
processing a termination notice that at least one of: (i) the protected resource is no longer in active use by the device, (ii) a network connection to the device is lost, and (iii) use of the protected resource has been automatically terminated where the device performed an action outside of the use terms.

### Claim 4 (depends on 3)

The method of claim 3, further comprising:
receiving a policy update from a second user that alters the computer-readable instructions of the use policy defining the authorized context for use of the protected resource;
determining the open transaction record is associated with the protected resource and the device;
re-generating the use terms to an updated use terms based on at least one of the stored one or more contextual values and a new set of contextual values to form a new instance of the authorized context; and
pushing the updated use terms generated from the policy update to the device.

### Claim 5 (depends on 3)

The method of claim 3, wherein the termination notice including a termination report specifying the action outside the use terms.

### Claim 6 (depends on 3)

The method of claim 3, further comprising:
logging the result of the termination notice and closing the open transaction record.

### Claim 7 (depends on 1)

The method of claim 1, further comprising:
dividing data of the protected resource into two or more segments and attaching a segment identifier to each of the one or more key-identifier pairs,
wherein the data of the protected resource transmitted to the device is a first segment of the two or more segments,
wherein the data of the protected resource transmitted to the device includes a second use key of the one or more use keys; and
receiving a continued use request automatically generated by the device when the first segment of the data of the protected resource approaches an end of a memory buffer of the device, the continued use request comprising the second use key of the one or more use keys.

### Claim 8 (depends on 1)

The method of claim 1,
wherein the use request comprising a state dataset specifying a current state of the device, and
wherein at least one of the one or more contextual values are called from the state dataset specifying the current state of the device.

### Claim 9 (depends on 1)

The method of claim 1, further comprising:
conveying a redemption route and a dynamic protocol designation with the at least one of the set of one or more use keys returned to the device; and
terminating the first key-identifier pair after streaming the protected resource to the device irrespective of the expiration condition.

### Claim 10

A computer-implemented method for authorizing and controlling use of a data resource, the method comprising:
receiving a use request from a device to use a protected resource stored in a data node of a non-hierarchical data structure within a datastore,
extracting from at least one of the data node and a security node having a referential attribute pointing to the data node a use policy comprising computer-readable instructions defining an authorized context for which the device can use the protected resource based on one or more contextual values;
initiating a use transaction that executes the computer-readable instructions of the use policy to gather the one or more contextual values to determine whether the use request satisfies the authorized context for which the device can use the protected resource;
maintaining an open transaction record of the use transaction and storing the one or more contextual values usable to determine the authorized context, the open transaction record associating the device with an active use of the protected resource;
authorizing access to the protected resource by the device when it is determined that each of the one or more contextual values called by the use policy conforms to the authorized context for which the device may use the protected resource;
generating a use terms from the computer-readable instructions defining the authorized context for the use request;
returning to the device the use terms generated from the computer-readable instructions; and
streaming the protected resource to the device for use by the device, a process of the device operable to monitor use of and enforce ephemerality of the protected resource by maintaining a ledger comprising data identifying the protected resource that is in active use by the device and a corresponding instance of the use terms associated with the authorized use of the protected resource.

### Claim 11 (depends on 10)

The method of claim 10, further comprising
processing a termination notice that at least one of: (i) the protected resource is no longer in active use by the device, (ii) a network connection to the device is lost, and (iii) use of the protected resource has been automatically terminated where the device performed an action outside of the use terms; and
logging the result of the termination notice and closing the open transaction record.

### Claim 12 (depends on 10)

The method of claim 10,
wherein the use request comprising a state dataset specifying a current state of the device, and
wherein at least one of the one or more contextual values are extracted from the state dataset specifying the current state of the device.

### Claim 13 (depends on 10)

The method of claim 10, further comprising:
receiving from a second user a policy update that alters the computer-readable instructions of the use policy defining the authorized context for use of the protected resource;
determining the open transaction record is associated with the protected resource and the device;
re-generating the use terms to an updated use terms based on at least one of the stored one or more contextual values and a new set of contextual values form a new instance of the authorized context; and
pushing the updated use terms generated from the policy update to the device.

### Claim 14 (depends on 10)

The method of claim 10, further comprising:
generating a set of one or more use keys and appending the identifier of the protected resource to each of the set of one or more use keys to form one or more key-identifier pairs;
associating an expiration condition with each of the one or more key-identifier pairs;
returning a first use key of the set of one or more use keys to the device;
receiving a redemption request from the device comprising the first use key and verifying the first use key;
extracting the identifier of the protected resource from a first key-identifier pair of the one or more key-identifier pairs and retrieving the protected resource with the identifier of the protected resource; and
terminating the first key-identifier pair after streaming the protected resource to the device irrespective of the expiration condition.

### Claim 15 (depends on 14)

The method of claim 14, further comprising:
dividing data of the protected resource into two or more segments and attaching a segment identifier to each of the one or more key-identifier pairs,
wherein the data of the protected resource transmitted to the device is a first segment of the two or more segments,
wherein the data of the protected resource transmitted to the device includes a second use key of the one or more use keys; and
receiving a continued use request automatically generated by the device when the first segment of the data of the protected resource approaches an end of a memory buffer of the device, the continued use request comprising the second use key of the one or more use keys.

### Claim 16 (depends on 10)

The method of claim 10, further comprising:
conveying a redemption route and a dynamic protocol designation with the at least one of the set of one or more use keys returned to the device,
wherein the termination notice including a termination report specifying the action outside the use terms, and
wherein the data node comprising an identifier whereby the data node is addressable within the datastore.

### Claim 17

A system comprising:
one or more datastore servers, to:
store a security node comprising an identifier of the security node and a referential attribute pointing to a data node comprising a protected resource,
store the data node comprising the protected resource,
extract from at least one of the data node and the security node a use policy comprising computer-readable instructions defining an authorized context for which a device can use the protected resource based on one or more contextual values, and
transmit the protected resource to the device for use by the device upon receipt of an identifier of a protected resource;
a transaction engine, to:
initiate a use transaction that executes the computer-readable instructions of the use policy to gather the one or more contextual values to determine whether the use request satisfies the authorized context for which the device can use the protected resource;
a mediation server, to:
process the one or more contextual values,
authorize access to the protected resource by the device when it is determined that the use request based on the one or more contextual values gathered by the use policy conforms to the authorized context for which the device may use the protected resource, and
generate a use terms from the computer-readable instructions defining the authorized context for the use request; and
the device, to:
generate a redemption request comprising a first use key received by the device, and
to monitor use of and enforce ephemerality of the protected resource by maintaining a ledger comprising data identifying the protected resource that is in active use by the device and a corresponding instance of the use terms associated with the authorized use of the protected resource.

### Claim 18 (depends on 17)

The system of claim 17, further comprising:
the transaction engine, to:
maintain an open transaction record of the use transaction and store the one or more inputs usable to determine the authorized context, the open transaction record associating the device with an active use of the protected resource,
the mediation server, to:
return the use terms generated from the computer-readable instructions to the device.

### Claim 19 (depends on 18)

The system of claim 18, further comprising:
the mediation server, to:
generate a set of one or more use keys and append the identifier of the protected resource to each of the set of one or more use keys to form one or more key-identifier pairs,
associate an expiration condition with each of the one or more key-identifier pairs, and
return the first use key of the set of one or more use keys to the device; and
a key server, to:
to receive the redemption request of the device, and
extract the identifier of the protected resource from a first key-identifier pair of the one or more key-identifier pairs and retrieving the protected resource with the identifier of the protected resource.

### Claim 20 (depends on 19)

The system of claim 19, further comprising:
a profile server, to:
to receive an identity claim from the device comprising a device root hash computed by a hash function with inputs comprising a previous transaction record along with a penultimate hash of a hash history of the device, the hash history of the device referred to as a device hastory; and
the transaction engine, to:
process a termination notice that at least one of: (i) the protected resource is no longer in active use by the device, (ii) a network connection to the device is lost, and (iii) use of the protected resource has been automatically terminated where the device performed an action outside of the use terms.