# US 12,182,292 B1 · Data sharing for network connected systems > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 12,182,292 B1 - Document ID: US12182292B1 - Status: Granted - Kind: B1 - Application number: 18/162,353 - Filed: 2023-01-31 - Granted: 2024-12-31 - Earliest claimed: 2022-04-29 - Assignees: Databricks, Inc. - Applicants: Databricks, Inc. - Inventors: Matei Zaharia; Shixiong Zhu; Xiaotong Sun; Ramesh Chandra; Michael Paul Armbrust; Ali Ghodsi - Web page: https://patentgrep.com/patent/US12182292B1 ## CPC - G06F 21/6218: {to a system of files or objects, e.g. local or distributed file system or database} - G06F 21/602: {Providing cryptographic facilities or services} - G06F 21/604: {Tools and structures for managing or administering access control systems} - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract The present application discloses a method, system, and computer system for providing access to data. The method includes receiving, by a data manager service from a data requesting service, a request using an identifier for a high-level data object to access a set of data associated with the high-level data object, determining, by the data manager service, low-level data object(s) corresponding to the set of data based on the identifier for the high-level data object, determining whether a user associated with the request has permission to access at least a subset of the low-level data object(s), and in response to determining that the user associated has permission to access the at least the subset of the low-level data object(s), generating, by the data manager service, a uniform resource locator (URL) via which the at least the subset of the one or more low-level data objects is accessible by the user. ## Claims ### Claim 1 A method comprising: receiving a request to access a set of data associated with a high-level data object, wherein the high-level data object comprises one of a data table, a view, a database, or a model; determining, using an identifier for the high-level data object, one or more low-level data objects corresponding to the high-level data object, wherein the one or more low-level data objects comprises one or more data files; determining that a user associated with the request has permission to access a first subset of the low-level data objects that are a first subset of data files but does not have permission to access a second subset of the low-level data objects that are a second subset of data files; and generating a uniform resource locator (URL) that provides access to the first subset of the low-level data objects is accessible by the user, but does not provide access to the second subset of the low-level data objects; and returning the URL in response to the request. ### Claim 2 (depends on 1) The method of claim 1, further comprising: determining locations of the first subset of the low-level data objects and the second subset of the low-level data objects based on metadata associated with the high-level data object, the metadata indicating a mapping of the high-level data object to the one or more low-level data objects, wherein the generated URL is directed to at least the determined locations of the first subset of the low-level data objects. ### Claim 3 (depends on 1) The method of claim 1, wherein the URL includes an access key to access the first subset of low-level data objects but does not include an access key to access the second subset of low-level data objects. ### Claim 4 (depends on 3) The method of claim 3, wherein the first subset of low-level data objects is encrypted using a first cryptographic key and the second subset of low-level data objects is encrypted using a second cryptographic key. ### Claim 5 (depends on 1) The method of claim 1, wherein the URL is configured to expire after a predetermined amount of time. ### Claim 6 (depends on 1) The method of claim 1, further comprising: receiving a second request to access the set of data associated with the high-level data object; determining that a user associated with the second request has permission to access the first subset of the low-level data objects and the second subset of the low-level data objects; and generating a second URL that provides access to the first subset of the low-level data objects and the second subset of the low-level data objects; and returning the second URL in response to the second request. ### Claim 7 A system comprising: one or more computer processors; and one or more computer-readable mediums storing instructions that, when executed by the one or more computer processors, cause the system to perform operations comprising: receiving a request to access a set of data associated with a high-level data object, wherein the high-level data object comprises one of a data table, a view, a database, or a model; determining, using an identifier for the high-level data object, one or more low-level data objects corresponding to the high-level data object, wherein the one or more low-level data objects comprise one or more data files; determining that a user associated with the request has permission to access a first subset of the low-level data objects that are a first subset of data files but does not have permission to access a second subset of the low-level data objects that are a second subset of data files; and generating a uniform resource locator (URL) that provides access to the first subset of the low-level data objects is accessible by the user, but does not provide access to the second subset of the low-level data objects; and returning the URL in response to the request. ### Claim 8 (depends on 7) The system of claim 7, the operations further comprising: determining locations of the first subset of the low-level data objects and the second subset of the low-level data objects based on metadata associated with the high-level data object, the metadata indicating a mapping of the high-level data object to the one or more low-level data objects, wherein the generated URL is directed to at least the determined locations of the first subset of the low-level data objects. ### Claim 9 (depends on 7) The system of claim 7, wherein the URL includes an access key to access the first subset of low-level data objects but does not include an access key to access the second subset of low-level data objects. ### Claim 10 (depends on 9) The system of claim 9, wherein the first subset of low-level data objects is encrypted using a first cryptographic key and the second subset of low-level data objects is encrypted using a second cryptographic key. ### Claim 11 (depends on 7) The system of claim 7, wherein the URL is configured to expire after a predetermined amount of time. ### Claim 12 (depends on 7) The system of claim 7, the operations further comprising: receiving a second request to access the set of data associated with the high-level data object; determining that a user associated with the second request has permission to access the first subset of the low-level data objects and the second subset of the low-level data objects; and generating a second URL that provides access to the first subset of the low-level data objects and the second subset of the low-level data objects; and returning the second URL in response to the second request. ### Claim 13 A non-transitory computer-readable medium storing instructions that, when executed by one or more computer processors of one or more computing devices, cause the one or more computing devices to perform operations comprising: receiving a request to access a set of data associated with a high-level data object, wherein the high-level data object comprises one of a data table, a view, a database, or a model; determining, using an identifier for the high-level data object, one or more low-level data objects corresponding to the high-level data object, wherein the one or more low-level data objects comprises one or more data files; determining that a user associated with the request has permission to access a first subset of the low-level data objects that are a first subset of data files but does not have permission to access a second subset of the low-level data objects that are a second subset of data files; and generating a uniform resource locator (URL) that provides access to the first subset of the low-level data objects is accessible by the user, but does not provide access to the second subset of the low-level data objects; and returning the URL in response to the request. ### Claim 14 (depends on 13) The non-transitory computer-readable medium of claim 13, the operations further comprising: determining locations of the first subset of the low-level data objects and the second subset of the low-level data objects based on metadata associated with the high-level data object, the metadata indicating a mapping of the high-level data object to the one or more low-level data objects, wherein the generated URL is directed to at least the determined locations of the first subset of the low-level data objects. ### Claim 15 (depends on 13) The non-transitory computer-readable medium of claim 13, wherein the URL includes an access key to access the first subset of low-level data objects but does not include an access key to access the second subset of low-level data objects. ### Claim 16 (depends on 15) The non-transitory computer-readable medium of claim 15, wherein the first subset of low-level data objects is encrypted using a first cryptographic key and the second subset of low-level data objects is encrypted using a second cryptographic key. ### Claim 17 (depends on 13) The non-transitory computer-readable medium of claim 13, the operations further comprising: receiving a second request to access the set of data associated with the high-level data object; determining that a user associated with the second request has permission to access the first subset of the low-level data objects and the second subset of the low-level data objects; and generating a second URL that provides access to the first subset of the low-level data objects and the second subset of the low-level data objects; and returning the second URL in response to the second request.