Data redaction policies
AssigneeBEA Systems, Inc.
InventorPaul Patrick
Life of this patent
Estimating the term…
Abstract
In accordance with one embodiment of the present invention, there are provided mechanisms and methods for controlling access to data. These mechanisms and methods for controlling access to data make it possible for systems to have improved control over accesses to information by redacting responses made by services accessible by the system based upon a determined current access policy. This ability of a system to redact responses to queries or requests for services in accordance with an access policy makes it possible to attain improved security in computing systems over conventional access control mechanisms that control based upon access privileges to a file, an account, a storage device or a machine upon which the information is stored.
Claims22
A method for controlling access to data, the method comprising:
- accessing at least one service on behalf of a requestor;
- receiving a result set from the at least one service;
- determining that an access policy has been changed to a now current access policy;
- and
- determining, based at least in part on the now current access policy, a subset of the result set which the requestor is permitted to access.
A computer-readable medium carrying one or more sequences of instructions for controlling access to data, which instructions, when executed by one or more processors, cause the one or more processors to carry out the steps of:
- accessing at least one service on behalf of a requester;
- receiving a result set from the at least one service;
- determining that an access policy has been changed to a now current access policy;
- and
- determining, based at least in part on the now current access policy, a subset of the result set which the requestor is permitted to access.
An apparatus for controlling access to data, the apparatus comprising:
- a processor;
- and
- one or more stored sequences of instructions which, when executed by the processor, cause the processor to carry out the steps of:
- accessing at least one service on behalf of a requester;
- receiving a result set from the at least one service;
- determining that an access policy has been changed to a now current access policy;
- and
- determining, based at least in part on the now current access policy, a subset of the result set which the requestor is permitted to access.
A method for receiving data under a controlled environment, the method comprising:
- sending a request to access a service to a server;
- receiving a portion of a result set of the service from the server, wherein the server has prepared the portion of the result set of the service according to the server's determination, based at least in part on a now current access policy, a subset of the result set which is permitted to be provided responsive to the request.
Dependencies are inferred from the claim text.