# US 2008/0189758 A1 · Providing Security for Queries to Electronic Product Code Information Services > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2008/0189758 A1 - Document ID: US20080189758A1 - Status: Published application - Kind: A1 - Application number: 11/670,245 - Filed: 2007-02-01 - Published: 2008-08-07 - Earliest claimed: 2007-02-01 - Assignees: International Business Machines Corporation - Inventors: Umair Akeel; Steven P. Beier; Valer-Alin Crisan; Gautham B. Pai; Ralf Rantzau - Web page: https://patentgrep.com/patent/US20080189758A1 ## CPC - G06F 21/6227: {where protection concerns the structure of data, e.g. records, types, queries} - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract Methods and apparatus, including computer program products, implementing and using techniques for protecting data residing in a repository of an electronic product code information service against undesired data disclosure. One or more disclosure policies are defined for an item tagged with an electronic product code. The item has associated data stored in the repository. The disclosure policies describe one or more of: who is permitted to query the repository for information, what type of information is permitted to be obtained from the repository in response to a query, and under what condition the repository can be queried. The disclosure policies are enforced in response to a received query from a party by only disclosing a subset of the data from the repository, the subset being determined in accordance with the defined one or more disclosure policies. A web-based tool for defining disclosure policies is also described. ## Claims ### Claim 1 A computer-implemented method for protecting data residing in a repository of an electronic product code information service against undesired data disclosure, the method comprising: defining one or more disclosure policies for an item tagged with an electronic product code, the item having associated data stored in the repository, the one or more disclosure policies describing one or more of: who is permitted to query the repository for information, what type of information is permitted to be obtained from the repository in response to a query, and under what condition the repository can be queried; and enforcing the one or more disclosure policies in response to a received query from a party by only disclosing a subset of the data from the repository, the subset being determined in accordance with the defined one or more disclosure policies. ### Claim 2 (depends on 1) The method of claim 1, wherein the one or more disclosure policies are based on master data for the item, the master data describing one or more aspects of a business vocabulary for the item, including one or more of: business entities, terminology, definitions and classifications used to describe business information. ### Claim 3 (depends on 1) The method of claim 1, wherein enforcing the one or more disclosure policies includes refusing to respond to the received query. ### Claim 4 (depends on 1) The method of claim 1, wherein enforcing the one or more disclosure policies includes responding to the received query with less information than specified in the query. ### Claim 5 (depends on 1) The method of claim 1, wherein defining one or more disclosure policies includes: defining a role to be associated with one or more querying parties; and associating one or more disclosure policies with the role. ### Claim 6 (depends on 1) The method of claim 1, wherein defining one or more disclosure policies includes: defining the one or more disclosure policies on an entity object level, wherein each entity object includes a pre-defined mapping to data attributes in the repository. ### Claim 7 (depends on 1) The method of claim 1, wherein enforcing the one or more disclosure policies is done transparently without the querying party being aware that the one or more disclosure policies is applied to the query. ### Claim 8 (depends on 1) The method of claim 1, further comprising: receiving a query from a party, the query pertaining to data associated with an item and stored in the repository; rewriting the received query to create a database view of the repository that is in accordance with the defined one or more disclosure policies; and returning data defined by the database view to the querying party. ### Claim 9 (depends on 1) The method of claim 1, further comprising: providing an option for a disclosure policy administrator to selectively enable or disable individual disclosure policies. ### Claim 10 A computer program product for protecting data residing in a repository of an electronic product code information service against undesired data disclosure, comprising a computer useable medium including a computer readable program, wherein the computer readable program when executed on a computer causes the computer to: define one or more disclosure policies for an item tagged with an electronic product code, the item having associated data stored in the repository, the one or more disclosure policies describing one or more of: who is permitted to query the repository for information, what type of information is permitted to be obtained from the repository in response to a query, and under what condition the repository can be queried; and enforce the one or more disclosure policies in response to a received query from a party by only disclosing a subset of the data from the repository, the subset being determined in accordance with the defined one or more disclosure policies. ### Claim 11 (depends on 10) The computer program product of claim 10, wherein the one or more disclosure policies are based on master data for the item, the master data describing one or more aspects of a business vocabulary for the item, including one or more of: business entities, terminology, definitions and classifications used to describe business information. ### Claim 12 (depends on 10) The computer program product of claim 10, wherein the computer readable program when executed on a computer further causes the computer to: receive a query from a party, the query pertaining to data associated with an item and stored in the repository; rewrite the received query to create a database view of the repository that is in accordance with the defined one or more disclosure policies; and return data defined by the database view to the querying party. ### Claim 13 A computer program product for defining disclosure policies for data residing in a repository of an electronic product code information service, comprising a computer useable medium including a computer readable program, wherein the computer readable program when executed on a computer causes the computer to: present a user interface through which a user can define one or more disclosure policies for the data residing in the repository; receive user input defining the one or more disclosure policies; and apply the defined disclosure policies to the data residing in the repository. ### Claim 14 (depends on 13) The computer program product of claim 13, wherein the user input defining the one or more disclosure policies includes user input describing one or more of: who is permitted to query the repository for information, what type of information is permitted to be obtained from the repository in response to a query, and under what condition the repository can be queried. ### Claim 15 (depends on 13) The computer program product of claim 13, wherein the one or more disclosure policies are based on master data, the master data describing one or more aspects of a business vocabulary for the item, including one or more of: business entities, terminology, definitions and classifications used to describe business information. ### Claim 16 (depends on 13) The computer program product of claim 13, wherein the user input includes a definition of an action to be taken in response to a query, the action including one or more of: responding with all the requested information, responding with less information than requested, and not responding to the query. ### Claim 17 (depends on 13) The computer program product of claim 13, wherein the user input includes: a definition of a role to be associated with one or more querying parties; and an association of one or more disclosure policies with the role. ### Claim 18 (depends on 13) The computer program product of claim 13, further comprising instructions causing the computer to: receive user input selectively enabling or disabling individual disclosure policies. ### Claim 19 (depends on 13) The computer program product of claim 13, wherein the one or more disclosure policies are defined on an entity object level, wherein each entity object includes a pre-defined mapping to data attributes in the repository. ### Claim 20 (depends on 13) The computer program product of claim 13, wherein the user interface is a web-based user interface.