# US 2019/0243979 A1 · Controlling access to data requested from an electronic information system > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2019/0243979 A1 - Document ID: US20190243979A1 - Status: Published application - Kind: A1 - Application number: 15/888,278 - Filed: 2018-02-05 - Published: 2019-08-08 - Earliest claimed: 2018-02-05 - Assignees: International Business Machines Corporation - Applicants: International Business Machines Corporation - Inventors: Rossella De Gaetano; Paolo Ottaviano; Gianluca Perreca; Antonio Bagarolo - Web page: https://patentgrep.com/patent/US20190243979A1 ## CPC - G06F 21/604: {Tools and structures for managing or administering access control systems} - G06F 9/547: {Remote procedure calls [RPC]; Web services} - G06F 21/31: User authentication - G06F 21/6218: {to a system of files or objects, e.g. local or distributed file system or database} - G06N 20/00: Machine learning - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - G06N: COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS ## Abstract An access control method for controlling access to data requested from an electronic information system. The method comprises receiving a request for the data, determining a user identity associated with the request; gathering the requested data from one or more data sources by an orchestrator for input to a cognitive engine; analyzing the requested data; based on results of analyzing the requested data, deciding on whether the user identity can be allowed to access the requested data; providing feedback by the user identity; and updating a learning module based on the feedback. ## Claims ### Claim 1 An access control method for controlling access to data requested from an electronic information system, the method comprising: receiving a request for the data; determining a user identity associated with the request; gathering the requested data from one or more data sources by an orchestrator for input to a cognitive engine; analyzing the requested data; based on results of analyzing the requested data, determining whether the user identity is allowed to access the requested data; providing feedback by the user identity; and updating a learning module based on the feedback. ### Claim 2 (depends on 1) The method according to claim 1, wherein the method further comprises determining a scope of the requested data, and wherein deciding whether the user identity is allowed to access the requested data is based on the scope of the requested data. ### Claim 3 (depends on 2) The method according to claim 2, wherein the scope of the requested data includes information on whether the requested data is public data. ### Claim 4 (depends on 1) The method according to claim 1, wherein gathering data from one or more data sources comprises performing, by the orchestrator, a method comprising: forwarding the request to the one or more data sources; collecting responses to the request, wherein the responses are generated by the data sources; and merging the responses to a merged set of requested data. ### Claim 5 (depends on 1) The method according to claim 1, further comprising interacting with the user in natural language using a bot comprising an authentication system. ### Claim 6 (depends on 5) The method according to claim 5, further comprising receiving, at the orchestrator and from the bot, information identifying which tools and data sources to use. ### Claim 7 (depends on 1) The method according to claim 1, further comprising forwarding the request to an external service using an application programming interface (API) layer as a bridge. ### Claim 8 (depends on 7) The method according to claim 7, further comprising transmitting, by a cognitive engine, data obtained using the API layer. ### Claim 9 (depends on 8) The method according to claim 8, wherein the cognitive engine is configured to perform natural language processing. ### Claim 10 (depends on 9) The method according to claim 9, wherein the request is classified according to an entity and at least one intent defined in the cognitive engine. ### Claim 11 (depends on 1) The method according to claim 1, wherein determining whether the user identity is allowed to access the requested data is based, at least in part, on a security controller configured to federate different data sources and unstructured data. ### Claim 12 (depends on 1) The method according to claim 1, further comprising learning, using a learning module configured for cognitive computing, user interaction based on user feedback. ### Claim 13 (depends on 1) The method according to claim 1, wherein gathering the requested data further comprises: identifying information from public sources; calling the orchestrator to retrieve data using multiple tools; and providing additional cognitive corpora. ### Claim 14 (depends on 1) The method according to claim 1, wherein the orchestrator is configured to identify at least one tool to be used based on information from a classifier and information received from a bot interfacing with the user identity. ### Claim 15 (depends on 1) The method according to claim 1, wherein the orchestrator is configured to use querying tools for determining permissions associated with the user identity. ### Claim 16 (depends on 1) The method according to claim 1, further comprising caching the requested data. ### Claim 17 (depends on 1) The method according to claim 1, further comprising: determining the user identity is not allowed to access the requested data; providing a notification to the user identity indicating the user identity is not allowed to access the requested data; and providing, with the notification, instructions for requesting appropriate authorization for accessing the requested data. ### Claim 18 (depends on 17) The method according to claim 17, further comprising: providing, with the notification, and in response to determining the user identity is not allowed to access the requested data, at least a portion of the requested data in response to determining, using cognitive computing, the at least a portion of the requested data is secure for viewing by the user identity. ### Claim 19 A computer program product for controlling access to data requested from an electronic information system, the computer program product comprising a computer readable storage medium having program instructions embodied therewith, the program instructions executable by a computer system to cause the computer system to perform a method comprising: receiving a request for the data; determining a user identity associated with the request; gathering the requested data from one or more data sources by an orchestrator for input to a cognitive engine; analyzing the requested data; based on results of analyzing the requested data, determining whether the user identity is allowed to access the requested data; providing feedback by the user identity; and updating a learning module based on the feedback. ### Claim 20 A system for controlling access to data requested from an electronic information system, the system comprising at least: a bot configured for receiving a request for the data; a cognitive engine configured for determining a user identity associated with the request and analyzing the requested data; an orchestrator configured for gathering the requested data from one or more data sources for input to the cognitive engine; an API layer configured for calling service functions; services configured for routing functions and data; and a learning module for being updated based on feedback by the user identity.