US 2022/0067200 A1 · CHAINING, TRIGGERING, AND ENFORCING ENTITLEMENTS

Abstract

Embodiments are directed to techniques for chaining, triggering, and/or enforcing entitlements in a constrained environment. A constrained environment may be provided within with shielded assets are required to exist or execute. An entitlement may be granted on a variety of shielded assets, including datasets, computations scripts, data privacy pipelines, and intermediate datasets generated by an intermediate step of a data privacy pipeline. Thus, a beneficiary may use a granted entitlement as an input into other data privacy pipelines, without the need for the grantor to approve each specific downstream operation. The constrained environment may enforce an entitlement by fulfilling applicable constraints upon accessing the entitlement, restricting the output of the entitlement to the constrained environment, and fulfilling applicable policies when executing downstream operations. Data may be exported from the constrained environment when the data consumer seeking to export has sufficient ownership rights or export permission and applicable policies are fulfilled.

Claims20

Dependent claims

A data trustee environment comprising:

one or more computer storage media storing computer-useable instructions that, when used by one or more computing devices, cause the one or more computing devices to perform operations comprising:
storing a digitized representation of an entitlement granted by a grantor to a beneficiary to use a shielded asset of the grantor as an entitlement output that is required to exist or execute within the data trustee environment, subject to an entitlement constraint or an entitlement policy specified by the entitlement;
receiving, from the beneficiary, a configuration of a data privacy pipeline, the received configuration comprising a specification of:
(i) an input dataset into the data privacy pipeline, (ii) one or more computational steps of the data privacy pipeline, (iii) a specified use of the entitlement output, and (iv) an output dataset of the data privacy pipeline;
and
deploying the configuration of the data privacy pipeline in the data trustee environment without exposing the shielded asset, by enforcing the entitlement constraint upon accessing the shielded asset pursuant to the entitlement or by enforcing the entitlement policy on downstream use of the entitlement output by the data privacy pipeline.

3 more elements

One or more computer storage media storing computer-useable instructions that, when used by one or more computing devices, cause the one or more computing devices to perform operations comprising:

receiving a configuration of an entitlement granted by a grantor to a beneficiary to use an output of an intermediate step of a first data privacy pipeline as an intermediate dataset that is required to exist within the data trustee environment, subject to an entitlement constraint or an entitlement policy specified by the entitlement;
receiving, from the beneficiary, a configuration of a second data privacy pipeline, the received configuration comprising a specification of:
(i) an input dataset into the second data privacy pipeline, (ii) one or more computational steps of the second data privacy pipeline, (iii) a specified use of the intermediate dataset pursuant to the entitlement, and (iv) an output dataset of the second data privacy pipeline;
and
deploying the first data privacy pipeline and the second data privacy pipeline in the data trustee environment, without exposing the intermediate dataset, by enforcing the entitlement constraint upon generation of the intermediate dataset by the first data privacy pipeline or by enforcing the entitlement policy on downstream use of the intermediate dataset by the second data privacy pipeline.

2 more elements

A method comprising:

receiving a configuration of an entitlement granted by a grantor to a beneficiary to use a dataset of the grantor within a constrained environment, subject to an entitlement constraint or an entitlement policy specified by the entitlement;
receiving, from the beneficiary, a configuration of a data privacy pipeline, the received configuration comprising a specification of:
(i) an input dataset into the data privacy pipeline, (ii) one or more computational steps of the data privacy pipeline, (iii) a specified use of the dataset of the grantor, and (iv) an output dataset of the data privacy pipeline;
executing the data privacy pipeline in the constrained environment without exposing the dataset of the grantor, by enforcing the entitlement constraint upon accessing the dataset of the grantor or by enforcing the entitlement policy on operations of the data privacy pipeline that are downstream of the dataset of the grantor;
and
exporting the output dataset from the constrained environment.

3 more elements

Dependencies are inferred from the claim text.

Chaining, triggering, and enforcing entitlements

Life of this patent

Chaining, triggering, and enforcing entitlements

Life of this patent

Abstract

Claims20