# US 2014/0208409 A1 · Access to data stored in a cloud > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2014/0208409 A1 - Document ID: US20140208409A1 - Status: Published application - Kind: A1 - Application number: 14/124,728 - Filed: 2012-05-09 - Published: 2014-07-24 - Earliest claimed: 2011-06-08 - Assignees: Siemens Aktiengesellschaft - Inventors: Monika Maidl; Stefan Seltzsam - Web page: https://patentgrep.com/patent/US20140208409A1 ## CPC - H04L 63/0853: {using an additional device, e.g. smartcard, SIM or a different communication terminal (cryptographic mechanisms or cryptographic arrangements for entity authentication involving additional secure or trusted devices H04L9/3234)} - G06F 16/252: {between a Database Management System and a front-end application} - G06F 21/10: Protecting distributed programs or content, e.g. vending or licensing of copyrighted material (protection in video systems or pay television H04N7/16) {; Digital rights management [DRM]} - G06F 21/6218: {to a system of files or objects, e.g. local or distributed file system or database} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract It is proposed that known digital rights management (EDRM: Enterprise Digital Rights Management) be extended such that control over the access to data stored in a cloud remains with the user or originator of the data. This requires the access information to be coordinated between a rights application in the cloud and a rights server in the region of the user (that is to say outside the cloud). A rights policy can be used for fine-grained regulation of the access for users (user groups), computers (client, server) and validity periods. In this context, the access comprises a wide variety of actions which can be performed with the data. In particular, it is advantageous that a server application is provided with (temporally limited) access to a portion of the data in order to index said data, for example, without the server being able to access the complete contents of the data in the process. By way of example, the approach for works for document management and for databases that have been relocated in the cloud. The invention can be used for any type of distributed data processing in which the data are intended to be protected against unauthorized access operations. ## Claims ### Claim 1 A method for accessing data stored in a cloud, (a) in which a request for access to the data is transmitted from a rights application to a rights server, (b) in which the rights server checks, on the basis of the request from the rights application, whether access to the data is allowed, (c) in which, if access to the data is allowed, the rights server provides the rights application with an item of access information, (d) in which the rights application accesses the data. ### Claim 2 (depends on 1) The method as claimed in claim 1, in which, before step (a), a client application is authenticated with a server application. ### Claim 3 (depends on 2) The method as claimed in claim 2, in which the rights application accesses the data and forwards the latter to the server application. ### Claim 4 (depends on 2) The method as claimed in claim 2, in which the client application transfers an authentication token to the server application, which token is transmitted from the rights application to the rights server in order to gain access to the data. ### Claim 5 (depends on 2) The method as claimed in claim 2, in which the client application transfers a reference which is transmitted from the rights application of the server to the rights server, the rights server requesting and/or carrying out authentication on the basis of the reference. ### Claim 6 (depends on 5) The method as claimed in claim 5, in which the reference is a reference to a rights application of the client. ### Claim 7 (depends on 1) The method as claimed in claim 1, in which the rights application is a rights application in a first environment and/or a rights application in a second environment. ### Claim 8 (depends on 7) The method as claimed in claim 7, in which the rights server is provided in the first environment. ### Claim 9 (depends on 1) The method as claimed in claim 1, in which the request from the rights application comprises at least one of the following items of information: an item of user information, an item of computer information, in particular an identification of a computer, an item of information for identifying the data which are intended to be accessed. ### Claim 10 (depends on 1) The method as claimed in claim 1, in which the access information comprises: a rights policy; a key for decrypting the data. ### Claim 11 (depends on 10) The method as claimed in claim 10, in which the rights server checks, on the basis of the request from the rights application, whether access to the data is allowed by carrying out a comparison with the rights policy previously created for the data. ### Claim 12 (depends on 10) The method as claimed in claim 10, in which the rights policy comprises at least one of the following items of information: an item of user or computer information, an action which can be carried out by the user or computer, an action which cannot be carried out by the user or computer, a validity period. ### Claim 13 (depends on 1) The method as claimed in claim 1, in which communication between the rights server and the rights application is secure. ### Claim 14 (depends on 1) The method as claimed in claim 1, in which the rights server logs at least some of the requests. ### Claim 15 (depends on 1) The method as claimed in claim 1, in which the data comprise: at least one document; at least one application; at least one database entry, in particular a database. ### Claim 16 An apparatus for accessing data stored in a cloud, comprising a processing unit which is set up in such a manner that (a) a request for access to the data can be transmitted from a rights application to a rights server; (b) the rights server can check, on the basis of the request from the rights application, whether access to the data is allowed, (c) if access to the data is allowed, the rights server can provide the rights application with an item of access information, (d) the rights application can access the data.