# US 12,182,278 B2 · Just-in-time data object permission restriction

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 12,182,278 B2
- Document ID: US12182278B2
- Status: Granted
- Kind: B2
- Application number: 17/569,442
- Filed: 2022-01-05
- Published: 2023-06-29
- Granted: 2024-12-31
- Earliest claimed: 2021-12-23
- Assignees: Oracle International Corporation
- Applicants: Oracle International Corporation
- Inventors: John Michael Harres; Darren James Moffat; Mark Leroy Shellenbaum
- Web page: https://patentgrep.com/patent/US12182278B2

## CPC

- G06F 21/604: {Tools and structures for managing or administering access control systems}
- G06F 21/6209: {to a single file or object, e.g. in a secure envelope, encrypted and accessed using a key, or with access control rules appended to the object itself}
- G06F 21/6218: {to a system of files or objects, e.g. local or distributed file system or database}
- G06F 2221/2125: Just-in-time application of countermeasures, e.g., on-the-fly decryption, just-in-time obfuscation or de-obfuscation
- G06F 2221/2137: Time limited access, e.g. to a computer or data
- G06F 2221/2141: Access rights, e.g. capability lists, access control lists, access tables, access matrices
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)

## Abstract

Using a computer system, an instruction is received to define or modify a permission constraint corresponding to one or more files. A permission-instruction data set representing the permission constraint is stored in a data store. Subsequent to storing the permission-instruction data, a user request to access a particular file is intercepted. The data store is queried to determine whether any pending permission-instruction data set corresponds to the particular file. In response to the query, it is determined that the permission-instruction data set corresponds to the particular file. A permission constraint of the particular file is added or modified based on the permission-instruction data set. Based on the modified or added permission constraint, it is determined whether and/or an extent to which the user request is authorized. A response to the user request based on the determination as to whether and/or an extent to which the user request is authorized.

## Claims

### Claim 1

A method comprising:
receiving, using a computer system, an instruction to define or modify a permission constraint corresponding to a file;
determining a time period during which the defined or modified permission constraint corresponding to the file is to apply;
storing, in a data store, a permission-instruction data set representing the defined or modified permission constraint as a pending permission constraint without committing the pending permission constraint to the file before receiving a user request to access the file, wherein storing the permission-instruction data set in the data store does not include locating the file and does not include modifying one or more permissions of the located file, wherein the permission-instruction data set includes data indicative of the time period;
postponing committing the pending permission constraint to the file based on the permission-instruction data set until a user request to access the file is received;
receiving a particular user request to access the file within the time period;
in response to the particular user request within the time period, committing the pending permission constraint to the file at least in part by locating the file and modifying one or more permissions of the file.

### Claim 2 (depends on 1)

The method of claim 1, wherein committing the pending permission constraint to the file includes adding a permission constraint that disallows modification to content of the file and that disallows deleting the file, and wherein the method further includes granting, in response to the particular user request, access to a read-only version of the file.

### Claim 3 (depends on 1)

The method of claim 1, further comprising:
upon detecting the particular user request, determining that a current time is within the time period.

### Claim 4 (depends on 1)

The method of claim 1, wherein the particular user request was received at the computer system from a user device, wherein the computer system at least partly controls a set of files that are remote from the user device, and wherein the set of files includes the file.

### Claim 5 (depends on 1)

The method of claim 1, wherein determining a time period during which the defined or modified permission constraint corresponding to the file is to apply includes determining that the defined or modified permission constraint is to apply indefinitely.

### Claim 6 (depends on 1)

The method of claim 1, further comprising:
defining a filter that identifies the file, wherein the filter is configured to intercept a request for the file before the request is processed.

### Claim 7

A system comprising:
one or more data processors; and
a non-transitory computer readable storage medium containing instructions which, when executed on the one or more data processors, cause the one or more data processors to perform a set of actions including:
receiving, using a computer system, an instruction to define or modify a permission constraint corresponding to a file;
determining a time period during which the defined or modified permission constraint corresponding to the file is to apply;
storing, in a data store, a permission-instruction data set representing the defined or modified permission constraint as a pending permission constraint without committing the pending permission constraint to the file before receiving a user request to access the file, wherein storing the permission-instruction data set in the data store does not include locating the file and does not include modifying one or more permissions of the located file, wherein the permission-instruction data set includes data indicative of the time period;
postponing committing the pending permission constraint to the file based on the permission-instruction data set until a user request to access the file is received;
receiving a particular user request to access the file within the time period;
in response to the particular user request within the time period, committing the pending permission constraint to the file at least in part by locating the file and modifying one or more permissions of the file.

### Claim 8 (depends on 7)

The system of claim 7, wherein committing the pending permission constraint to the file includes adding a permission constraint that disallows modification to content of the file and that disallows deleting the file, and wherein the set of actions further includes granting, in response to the particular user request, access to a read-only version of the file.

### Claim 9 (depends on 7)

The system of claim 7, wherein the set of actions further includes:
upon detecting the particular user request, determining that a current time is within the time period.

### Claim 10 (depends on 7)

The system of claim 7, wherein the particular user request was received at the computer system from a user device, wherein the computer system at least partly controls a set of files that are remote from the user device, and wherein the set of files includes the file.

### Claim 11 (depends on 7)

The system of claim 7, wherein determining a time period during which the defined or modified permission constraint corresponding to the file is to apply includes determining that the defined or modified permission constraint is to apply indefinitely.

### Claim 12 (depends on 7)

The system of claim 7, wherein the set of actions further includes:
defining a filter that identifies the file, wherein the filter is configured to intercept a request for the file before the request is processed.

### Claim 13

A computer-program product tangibly embodied in a non-transitory machine-readable storage medium, including instructions configured to cause one or more data processors to perform a set of actions including:
receiving, using a computer system, an instruction to define or modify a permission constraint corresponding to a file;
determining a time period during which the defined or modified permission constraint corresponding to the file is to apply;
storing, in a data store, a permission-instruction data set representing the defined or modified permission constraint as a pending permission constraint without committing the pending permission constraint to the file before receiving a user request to access the file, wherein storing the permission-instruction data set in the data store does not include locating the file and does not include modifying one or more permissions of the located file, wherein the permission-instruction data set includes data indicative of the time period;
postponing committing the pending permission constraint to the file based on the permission-instruction data set until a user request to access the file is received;
receiving a particular user request to access the file within the time period;
in response to the particular user request within the time period, committing the pending permission constraint to the file at least in part by locating the file and modifying one or more permissions of the file.

### Claim 14 (depends on 13)

The computer-program product of claim 13, wherein committing the pending permission constraint to the file includes adding a permission constraint that disallows modification to content of the file and that disallows deleting the file, and wherein the set of actions further includes granting, in response to the particular user request, access to a read-only version of the file.

### Claim 15 (depends on 13)

The computer-program product of claim 13, wherein the set of actions further includes:
upon detecting the particular user request, determining that a current time is within the time period.

### Claim 16 (depends on 13)

The computer-program product of claim 13, wherein the particular user request was received at the computer system from a user device, wherein the computer system at least partly controls a set of files that are remote from the user device, and wherein the set of files includes the file.

### Claim 17 (depends on 13)

The computer-program product of claim 13, wherein determining a time period during which the defined or modified permission constraint corresponding to the file is to apply includes determining that the defined or modified permission constraint is to apply indefinitely.

### Claim 18 (depends on 13)

The computer-program product of claim 13, wherein the set of actions further includes:
defining a filter that identifies the file, wherein the filter is configured to intercept a request for the file before the request is processed.