# US 2019/0319947 A1 · Access to Data Stored in a cloud > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2019/0319947 A1 - Document ID: US20190319947A1 - Status: Published application - Kind: A1 - Application number: 16/397,740 - Filed: 2019-04-29 - Published: 2019-10-17 - Earliest claimed: 2011-06-08 - Assignees: ServiceNow, Inc. - Applicants: ServiceNow, Inc. - Inventors: Monika Maidl; Stefan Seltzsam - Web page: https://patentgrep.com/patent/US20190319947A1 ## CPC - H04L 63/0853: {using an additional device, e.g. smartcard, SIM or a different communication terminal (cryptographic mechanisms or cryptographic arrangements for entity authentication involving additional secure or trusted devices H04L9/3234)} - G06F 16/252: {between a Database Management System and a front-end application} - G06F 21/10: Protecting distributed programs or content, e.g. vending or licensing of copyrighted material (protection in video systems or pay television H04N7/16) {; Digital rights management [DRM]} - G06F 21/6218: {to a system of files or objects, e.g. local or distributed file system or database} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract Digital rights management is extended such that control over the access to data stored in a cloud remains with the originator of the data. The access information is coordinated between a rights application in the cloud and a rights server outside the cloud. A rights policy is used for fine-grained regulation of the access for users (user groups), computers (client, server) and validity periods. The access limits actions that can be performed with the data, such as a server application being provided with access to index said data without being able to access the complete contents of the data in the process. The access extension may be used for any type of distributed data processing in which the data are intended to be protected against unauthorized access operations. ## Claims ### Claim 1 A method for accessing data stored in a cloud, the method comprising: inquiring a rights application about whether access to the data by an accessing entity is allowed, the data stored by a provider of the cloud, the accessing entity comprising at least one of a client application, a server application, or a user wishing to access the data using the client application, the server application or the client application and the server application; informing, by the rights application, a rights server of the inquired access, the rights server not subject to control of the cloud provider and comprising a rights policy that defines at least one of the following access rights: (i) access rights of users, user groups, or the users and the user groups, where the access rights of a user on a local computer on which the client application runs and the access rights on an application server on which the server application runs are distinct, and/or (ii) access rights of both the client and server applications where the client application is allocated different access rights than the server application; providing, by the rights server, an item of the access information that is configured to be used to determine whether the access is allowed according to the access rights of the accessing entity according to the rights policy; and accessing the data only when access is allowed according to the access information, the data not being able to be viewed without the item of access information, the access being different on the local computer than on the application server because of the distinction between the access rights. ### Claim 2 (depends on 1) The method as claimed in claim 1, further comprising authenticating the client application with the server application prior to the inquiring. ### Claim 3 (depends on 1) The method as claimed in claim 1, wherein the rights application accesses the data and forwards the data to the server application. ### Claim 4 (depends on 1) The method as claimed in claim 1, wherein the client application transfers an authentication token to the server application, wherein the token is transmitted from the rights application to the rights server in order to gain access to the data. ### Claim 5 (depends on 1) The method as claimed in claim 1, wherein the client application transfers a reference that is transmitted from the rights application of the application server to the rights server, the rights server requesting, carrying out, or requesting and carrying out authentication on the basis of the reference. ### Claim 6 (depends on 5) The method as claimed in claim 5, wherein the reference is a reference to a rights application of a client. ### Claim 7 (depends on 1) The method as claimed in claim 1, wherein inquiring comprises inquiring for at least one of the following items of information: an item of user information; an item of computer information; and an item of information for identifying the data to be accessed. ### Claim 8 (depends on 1) The method as claimed in claim 1, wherein the access information comprises: the rights policy; and a key for decrypting the data. ### Claim 9 (depends on 1) The method as claimed in claim 1, wherein the rights server checks, based on the inquiry from the rights application, whether access to the data is allowed by carrying out a comparison with the rights policy previously created for the data. ### Claim 10 (depends on 1) The method as claimed in claim 1, wherein the rights policy comprises at least one of the following items of information: an item of user or computer information; an action that is configured to be carried out by the user or a computer; an action that cannot be carried out by the user or the computer and-a validity period. ### Claim 11 (depends on 1) The method as claimed in claim 1, wherein communication between the rights server and the rights application is secured. ### Claim 12 (depends on 1) The method as claimed in claim 1, wherein the rights server logs at least one inquiry. ### Claim 13 (depends on 1) The method as claimed in claim 1, wherein the data are in the form of at least one of the following: at least one document; at least one application; at least one database; at least one data record in a database; and at least one database entry. ### Claim 14 (depends on 1) The method as claimed in claim 1, wherein access is allowed according to the access rights when the access information is provided by the rights server. ### Claim 15 (depends on 1) The method as claimed in claim 1, wherein the access information comprises the access rights of the accessing entity. ### Claim 16 (depends on 1) The method as claimed in claim 1, wherein the access information comprises a reference to an application to be used to check the access rights. ### Claim 17 (depends on 1) The method as claimed in claim 1, wherein access is enabled according to the access information when access is allowed by a referenced application upon request. ### Claim 18 (depends on 1) The method as claimed in claim 1, wherein the access rights are limited to part of the data. ### Claim 19 (depends on 18) The method as claimed in claim 18, wherein the part of the data is in the form of a keyword part of a document or an attribute, tuple, object or combinations thereof in a database. ### Claim 20 (depends on 1) The method as claimed in claim 1, wherein the access rights have a time limit. ### Claim 21 (depends on 1) The method as claimed in claim 1, wherein the data are stored in encrypted form and the access information is required to decrypt said data. ### Claim 22 (depends on 1) The method as claimed in claim 1, wherein data stored in encrypted form are decrypted by the rights application. ### Claim 23 (depends on 1) The method as claimed in claim 1, wherein the rights application is part of the client application or the server application. ### Claim 24 (depends on 1) The method as claimed in claim 1, wherein the rights application is assigned to the client application and another rights application is assigned to the server application. ### Claim 25 (depends on 24) The method as claimed in claim 24, wherein the server application and the assigned rights application are arranged in an environment controlled by the cloud provider. ### Claim 26 (depends on 1) The method as claimed in claim 1, wherein the rights server is controlled by the accessing entity that accesses the data in the cloud. ### Claim 27 (depends on 1) The method as claimed in claim 1, wherein the access rights of the client application are a different combination of a right to view, a right to change, and a right to print the data than the access rights of the server application, the data comprising a document or database. ### Claim 28 (depends on 1) The method as claimed in claim 1, wherein at least one of a right for editing, a right for converting a document, a right for search indexing, and a right for checking for viruses is allocated to the server application. ### Claim 29 (depends on 1) The method as claimed in claim 1, wherein a right for printing is not allocated to the server application. ### Claim 30 A system for accessing data stored in a cloud, the system comprising: a provider of the cloud comprising a computer network storing the data; an entity that accesses the data, the entity comprising at least one of a client application, a server application, or a user wishing to access the data using the client application, the server application or the client application and the server application; at least one rights application; and a rights server not subject to the control of the cloud provider and comprising a rights policy that is configured to define at least one of the following access rights: (a) access rights of users, user groups or the users and the user groups, the access rights of one of the users on a local computer on which the client application runs being different than the access rights of an application server on which the server application runs, and/or (b) access rights of the client and server applications, the access rights of the client application different than the access rights of the server application, wherein the access rights are for operating on the data stored in the computer network of the provider of the cloud; wherein the rights application is configured to be inquired about whether access to the data by a accessing entity is allowed and to inform the rights server of the inquired access; wherein the rights server is configured to be provided an item of access information that is configured to be used to determine whether the access is allowed according to the access rights of the accessing entity, where the access differs for the client application from the access for the server application due to the difference in the access rights; and wherein the cloud is configured to provide access to the data of the computer network only when access is allowed according to the access information. ### Claim 31 A rights server for accessing data stored in a cloud, the rights server comprising: a memory configured to store a rights policy configured to define at least one of the following access rights: (a) access rights of users, user groups, or the users and the user groups, the access rights of a user on a client computer on which a client application runs being different than the access rights of an application server on which the server application runs, and/or (b) access rights of a client application and the server application, the access rights of the client application different than the access rights of the server application; and a processor configured to be provided an item of access information that is configured to be used to determine whether the access is allowed according to the access rights of an accessing entity, the processor configured to inquire a rights application about whether the access to the data is allowed such that the cloud is configured to provide access to the data only when access is allowed according to the access information, the provided access for the client application being different than for the server application due to the difference in the access rights; wherein the rights server is not subject to the control of a provider of the cloud.