US 11,381,567 B2Granted

Execution of an application within a scope of user-granted permission

AssigneeMicrosoft Technology Licensing, LLC

InventorsBrandon Murdoch, Daniel James Buchner, Ankur Patel

Life of this patent

Estimating the term…

Loading patent…

Abstract

Executing an application within a scope of user-granted permission in a decentralized network that implements a distributed edger. First, receiving a request from an entity for using data stored in a data storage that is associated with a DID owner as one or more inputs of an application associated with the entity to generate one or more results. Next, one or more characteristics of the application associated with the entity is identified. Based on identified one or more characteristics, a scope of permission to access the requested data that is to be granted to the entity is determined. Then, the scope of permission is granted to the entity to use the data as the one or more inputs of the application associated with the entity. Finally, the one or more results from the application is received.

Claims20

Dependent claims

A computing system comprising:

one or more processors;
and
one or more computer-readable hardware storage media having thereon computer-executable instructions that are structured such that, when executed by the one or more processors, cause the computing system to:
provide a decentralized storage service to owners of decentralized identifiers (DIDs), the decentralized storage service using a distributed ledger to authorize or authenticate owners of DIDs;
store data associated with an owner of a first DID at the decentralized storage service;
receive a request from an entity computing system for using the data associated with an owner of a first DID as one or more input(s) of an application provided by the entity computing system to generate one or more result(s), wherein the entity computing system is an owner of a second DID;
obtain a DID document associated with the second DID based on data recorded on the distributed ledger, the DID document containing information related to the second DID and one or more characteristics of the application provided by the entity computing system;
identify the one or more characteristics of the application provided by the entity computing system based on information contained in the DID document, the one or more characteristics of the application including at least an identity of the entity computing system and a purpose of the application;
based on the identified one or more characteristics of the application provided by the entity computing system and permission rules associated with the first DID, determine a scope of permission to access the requested data that is to be granted to the entity computing system;
grant the scope of permission to the entity computing system to use the data stored at the decentralized storage service that is associated with the owner of the first DID as the one or more input(s) of the application provided by the entity computing system, wherein granting the scope of permission to the entity computing system includes granting the second DID the scope of permission;
and
receive the one or more result(s) from the application provided by the entity computing system.

9 more elements

In a computing system that is implemented in a decentralized network that implements a distributed ledger, the distributed ledger being configured to back one or more decentralized identities (DID) for one or more users of the computing system, a method for executing an application within a scope of user-granted permission, the method comprising:

providing a decentralized storage service to owners of decentralized identifiers (DIDs), the decentralized storage service using a distributed ledger to authorize or authenticate owners of DIDs;
storing data associated with an owner of a first DID at the decentralized storage service;
receiving a request from an entity computing system for using the data associated with an owner of a first DID as one or more input(s) of an application provided by the entity computing system to generate one or more result(s), wherein the entity computing system is an owner of a second DID;
obtaining a DID document associated with the second DID based on data recorded on the distributed ledger, the DID document containing information related to the second DID and one or more characteristics of the application provided by the entity computing system;
identifying the one or more characteristics of the application provided by the entity computing system based on information contained in the DID document, the one or more characteristics of the application including at least an identity of the entity computing system and a purpose of the application;
based on the identified one or more characteristics of the application provided by the entity computing system and permission rules associated with the first DID, determining a scope of permission to access the requested data that is to be granted to the entity computing system;
granting the scope of permission to the entity computing system to use the data stored at the decentralized storage service that is associated with the owner of the first DID as the one or more input(s) of the application provided by the entity computing system, wherein granting the scope of permission to the entity computing system includes granting the second DID the scope of permission;
and
receiving the one or more result(s) from the application provided by the entity computing system.

6 more elements

A computer implemented process for executing an application within a scope of user-granted permission, the process comprising:

providing a decentralized storage service to owners of decentralized identifiers (DIDs), the decentralized storage service using a distributed ledger to authorize or authenticate owners of DIDs;
storing data associated with an owner of a first DID at the decentralized storage service;
receiving a request from an entity computing system for using the data associated with an owner of a first DID as one or more input(s) of an application provided by the entity computing system to generate one or more result(s), wherein the entity computing system is an owner of a second DID;
obtaining a DID document associated with the second DID based on data recorded on the distributed ledger, the DID document containing information related to the second DID and one or more characteristics of the application provided by the entity computing system;
identifying the one or more characteristics of the application provided by the entity computing system based on information contained in the DID document, the one or more characteristics of the application including at least an identity of the entity computing system and a purpose of the application;
based on the identified one or more characteristics of the application provided by the entity computing system and permission rules associated with the first DID, determining a scope of permission to access the requested data that is to be granted to the entity computing system;
granting the scope of permission to the entity computing system to use the data stored at the decentralized storage service that is associated with the owner of the first DID as the one or more input(s) of the application provided by the entity computing system, wherein granting the scope of permission to the entity computing system includes granting the second DID the scope of permission;
and
receiving the one or more result(s) from the application provided by the entity computing system.

6 more elements

Dependencies are inferred from the claim text.

Facts

Application: 16/397,765Filed 29 Apr 2019
Published: US 2020/0344237 A129 Oct 2020
Granted: 5 Jul 2022
Term ends: Not estimatedThe source records don’t support an estimate.

Classification10 codes

H04L 63/102
For controlling access to devices or network resources: entity profiles
H04L 63/105
For controlling access to devices or network resources: multiple levels of security
G06F 21/62
Protecting data: protecting access to data via a platform, e.g. using keys or access control rules
H04L 9/3239
Using cryptographic hash functions: involving non-keyed hash functions, e.g. modification detection codes [MDCs], MD5, SHA or RIPEMD