# US 12,192,205 B2 · Utilizing probability data structures to improve access control of documents across geographic regions > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 12,192,205 B2 - Document ID: US12192205B2 - Status: Granted - Kind: B2 - Application number: 17/848,896 - Filed: 2022-06-24 - Published: 2023-12-28 - Granted: 2025-01-07 - Earliest claimed: 2022-06-24 - Assignees: Microsoft Technology Licensing, LLC - Applicants: Microsoft Technology Licensing, LLC - Inventors: Charitha Herath Daskon Herath Mudiyanselage; Kaare Koehler Hoevik; Åge Andre Kvalnes; Tor Kreutzer; Mohamed Azmil Macksood - Web page: https://patentgrep.com/patent/US12192205B2 ## CPC - H04L 63/101: {Access control lists [ACL]} - G06N 7/01: Probabilistic graphical models, e.g. probabilistic networks - H04L 63/107: {wherein the security policies are location-dependent, e.g. entities privileges depend on current location or allowing specific operations only from locally connected terminals} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - G06N: COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS ## Abstract The present disclosure relates to systems, methods, and computer-readable media for utilizing a content access authorization system to determine user access control efficiently and flexibly for digital documents that are stored in different geographic regions. For instance, the content access authorization system can convert sensitive user information for digital documents stored in a first geographic region into a probabilistic data structure that does not include user information and share the probabilistic data structure with a second geographic region. The content access authorization system can then utilize the probabilistic data structure to efficiently pre-filter user document access control for digital documents requested by a user in the second geographic region that are stored in the first geographic region, which significantly saves on latency and computing resource usage by reducing the number of document control access queries needed to be made to the first geographic region. ## Claims ### Claim 1 A computer-implemented method of determining user access control information for digital documents comprising: receiving a user request for a user in a first geographic region to access a digital document stored in a second geographic region; determining, based on a shallow version of the digital document stored in the first geographic region, that a full version of the digital document is stored in the second geographic region; determining whether the user has permission to access the full version of the digital document stored in the second geographic region by utilizing an access control probabilistic data structure that is stored in the first geographic region, wherein the access control probabilistic data structure removes user identities; and granting or denying the user in the first geographic region access to the full version of the digital document stored in the second geographic region based on the determination from the access control probabilistic data structure. ### Claim 2 (depends on 1) The computer-implemented method of claim 1, wherein: determining whether the user has permission to access the full version of the digital document stored in the second geographic region comprises utilizing, within the first geographic region, the access control probabilistic data structure to determine that the user does not have permission to access the full version of the digital document stored in the second geographic region; and granting or denying the user in the first geographic region access to the full version of the digital document stored in the second geographic region comprises denying the user in the first geographic region access to the full version of the digital document stored in the second geographic region based on determining that the user does not have permission to access the full version of the digital document stored in the second geographic region. ### Claim 3 (depends on 1) The computer-implemented method of claim 1, wherein the second geographic region comprises a data handling standard that prevents a user identifier of the user from being stored outside of the second geographic region. ### Claim 4 (depends on 1) The computer-implemented method of claim 1, further comprising utilizing the access control probabilistic data structure to determine that the user does not have permission to access the full version of the digital document stored in the second geographic region by: encoding a user identifier for the user into a number that falls within a number range of the access control probabilistic data structure; and determining that an entry in the access control probabilistic data structure corresponding to the number does not satisfy an access control threshold. ### Claim 5 (depends on 1) The computer-implemented method of claim 1, wherein determining whether the user has permission to access the full version of the digital document stored in the second geographic region comprises utilizing, within the first geographic region, the access control probabilistic data structure to determine that the user satisfies an access control threshold. ### Claim 6 (depends on 5) The computer-implemented method of claim 5, further comprising: sending a query from the first geographic region to the second geographic region based on determining that the user satisfies an access control threshold with the access control probabilistic data structure in the first geographic region; and receiving, from the second geographic region, an indication granting or denying the user in the first geographic region access to the full version of the digital document stored in the second geographic region. ### Claim 7 (depends on 6) The computer-implemented method of claim 6, further comprising receiving, from the second geographic region and at the first geographic region, the access control probabilistic data structure, wherein the access control probabilistic data structure corresponds to permissions associated with the digital document, and wherein the access control probabilistic data structure does not include a user identifier of the user. ### Claim 8 (depends on 7) The computer-implemented method of claim 7, wherein the second geographic region comprises an access control block associated with the digital document that includes the user identifier and corresponding user permission granting the user within the first geographic region access to the full version of the digital document stored in the second geographic region. ### Claim 9 (depends on 1) The computer-implemented method of claim 1, wherein the access control probabilistic data structure comprises a bloom filter. ### Claim 10 (depends on 1) The computer-implemented method of claim 1, wherein the access control probabilistic data structure comprises a cuckoo filter, a ribbon filter, or a xor filter. ### Claim 11 (depends on 1) The computer-implemented method of claim 1, further comprising: determining that the user belongs to a group; and wherein determining whether the user has permission to access the full version of the digital document stored in the second geographic region comprises utilizing a label of the group with the access control probabilistic data structure to determine whether the user has permission to access the full version of the digital document stored in the second geographic region. ### Claim 12 A computer-implemented method of determining user access control information for digital documents comprising: receiving a user request for a user in a first geographic region to access a digital document stored in a second geographic region; determining, based on a shallow version of the digital document stored in the first geographic region, that a full version of the digital document is stored in the second geographic region; utilizing an access control probabilistic data structure that is stored in the first geographic region to determine that the user satisfies an access control threshold, wherein the access control probabilistic data structure removes user identities; based on the determination that the user satisfies the access control threshold, sending a query from the first geographic region to the second geographic region for the user to access the full version of the digital document stored in the second geographic region; receiving from the second geographic region, an indication denying the user in the first geographic region access to the full version of the digital document stored in the second geographic region; and denying the user in the first geographic region access to the full version of the digital document stored in the second geographic region based on the indication received from the second geographic region. ### Claim 13 (depends on 12) The computer-implemented method of claim 12, wherein the user request for the user in the first geographic region to access the full version of the digital document stored in the second geographic region comprises an access request query performed as a background process. ### Claim 14 (depends on 13) The computer-implemented method of claim 13, wherein: the background process comprises a plurality of access request queries requesting access to a plurality of digital documents stored in the second geographic region; and one or more results of the plurality of access request queries are used to provide document insights to the user. ### Claim 15 (depends on 14) The computer-implemented method of claim 14, wherein the plurality of access request queries corresponds to traversing a graph that comprises the plurality of digital documents. ### Claim 16 (depends on 13) The computer-implemented method of claim 13, wherein the background process is an automation that is triggered based on a user visiting a webpage associated with the digital document. ### Claim 17 (depends on 12) The computer-implemented method of claim 12, wherein the shallow version of the digital document stored in the first geographic region includes metadata of the digital document comprising activity data indicating modifications to the digital document performed in both the first geographic region and the second geographic region. ### Claim 18 A system, comprising: at least one processor; and a non-transitory computer memory comprising instructions that, when executed by the at least one processor, cause the system to: receive a user request for a user in a first geographic region to access a digital document stored in a second geographic region; determining, based on a shallow version of the digital document stored in the first geographic region, that a full version of the digital document is stored in the second geographic region; determining that the user does not have permission to access the full version of the digital document stored in the second geographic region by utilizing an access control probabilistic data structure that is stored in the first geographic region, wherein the access control probabilistic data structure removes user identities; and denying the user in the first geographic region access to the full version of the digital document stored in the second geographic region based on the determination from the access control probabilistic data structure. ### Claim 19 (depends on 18) The system of claim 18, wherein the access control probabilistic data structure comprises a bloom filter. ### Claim 20 (depends on 18) The system of claim 18, wherein the user request for the user in the first geographic region to access the full version of the digital document stored in the second geographic region comprises an access request query performed as a background process.