Data masking
AssigneePalo Alto Networks, Inc.
InventorsOfer Ben-Noon, Ohad Bobrov, Omri Bushari
Life of this patent
Estimating the term…
Abstract
A method of controlling access to a digital resource of a group of digital resources, the method comprising: receiving a request from a user via a computer browser for access to a digital resource of a group of digital resources; determining if the user has authorization to access a first portion of the resource but not a second portion of the resource; and configuring the browser to redact the resource by locally masking or deleting the second portion at a user interface of the computer which presents the resource to the user without affecting data defining the resource at a source from which the resource is downloaded to provide the requested access.
Claims20
A method of controlling access to a resource of a group of digital resources, the method comprising:
- receiving a request from a user via a browser for access to a digital resource of a group of digital resources;
- determining whether the user has authorization to access a first portion of the resource but not a second portion of the resource;
- and
- configuring the browser to, when the user is determined not to have authorization to access the second portion,
- redact the resource by locally masking or deleting the second portion at a user interface of the browser which presents the resource to the user without affecting data defining the resource at a source from which the resource is downloaded to provide the requested access;
- receive a request from the user to access the second portion;
- vet the request, wherein vetting the request comprises,
- determining a first current assessment of a confidentiality level for material in the second portion at a time of the vetting;
- determining a second current assessment of a clearance level of the user at the time of the vetting;
- determining a magnitude of change to the first current assessment and the second current assessment compared to previous assessments that would allow the user access to the second portion;
- and
- determining whether to undo the redaction responsive to the magnitude of the changes;
- and
- based on successful vetting, undo the redaction.
A non-transitory machine-readable medium having program code stored thereon, the program code comprising instructions to control access to a resource of a group of digital resources, wherein the instructions to control access to the resource of the group of digital resources comprise instructions to:
- receive a request from a user via a browser for access to a digital resource of a group of digital resources;
- determine whether the user has authorization to access a first portion of the resource but not a second portion of the resource;
- and
- configure the browser to, when the user is determined not to have authorization to access the second portion,
- redact the resource by locally masking or deleting the second portion at a user interface of the browser which presents the resource to the user without affecting data defining the resource at a source from which the resource is downloaded to provide the requested access;
- receive a request from the user to access the second portion;
- vet the request, wherein the instructions to vet the request comprise instructions to,
- determining a first current assessment of a confidentiality level for material in the second portion at a time of the vetting;
- determining a second current assessment of a clearance level of the user at the time of the vetting;
- determining a magnitude of changes to the first current assessment and the second current assessment compared to previous assessments that would allow the user access to the second portion;
- and
- determining whether to undo the redaction responsive to the magnitude of the changes;
- and
- based on successful vetting, undo the redaction.
An apparatus comprising:
- a processor;
- and
- a machine-readable medium having instructions stored thereon that are executable by the processor to cause the apparatus to control access to a resource of a group of digital resources, wherein the instructions to control access to the resource of the group of digital resources comprise instructions executable by the processor to cause the apparatus to,
- receive a request from a user via a browser for access to a digital resource of a group of digital resources;
- determine whether the user has authorization to access a first portion of the resource but not a second portion of the resource;
- and
- configure the browser to, when the user is determined not to have authorization to access the second portion,
- redact the resource by locally masking or deleting the second portion at a user interface of the browser which presents the resource to the user without affecting data defining the resource at a source from which the resource is downloaded to provide the requested access;
- receive a request from the user to access the second portion;
- vet the request, wherein the instructions to vet the request comprise instructions executable by the processor to cause the apparatus to,
- determine a first current assessment of a confidentiality level for material in the second portion at a time of the vetting;
- determine a second current assessment of a clearance level of the user at the time of the vetting;
- determine a magnitude of changes to the first current assessment and the second current assessment compared to previous assessments that would allow the user access to the second portion;
- and
- determine whether to undo the redaction responsive to the magnitude of the changes;
- and
- based on successful vetting, undo the redaction.
Dependencies are inferred from the claim text.