Bluetalon, Inc.

Microsoft Technology Licensing, LLC

Rakesh Khanduja

Pratik Verma

Prasad Mujumdar

Pankaj Sharma

Vineet Mittal

Prerna Verma

A non-transitory computer readable storage medium has instructions executed by a processor to assign virtual identifiers to blocks of a file that contain identical information in different data sources. A distributed storage and distributed processing query statement is received. Real name attributes of the query statement are equated with selected virtual identifiers. Access control policies are applied to the selected virtual identifiers to obtain policy results. The policy results are applied to the real name attributes of the query statement to obtain query results.

Distributed storage and distributed processing policy enforcement utilizing virtual identifiers

Methods, systems, apparatuses, and computer program products are provided for controlling access to a database. A data processing application may receive, from a user, a request that includes a procedural language code block to access data elements stored in a distributed database. A procedural language code block analyzer may obtain an access control policy that indicates permissions to access the data elements. A control system may determine, based on the access control policy, that access to a restricted portion of the data elements is denied. A reconstruction system may generate a reconstructed code block that allows the user to access data elements that are not restricted, such as by modifying the request to remove the portion that seeks access to the restricted data elements. The reconstruction system may then provide the modified request to the distributed database to receive the data elements to which the user is permitted to access.

Fine grained access control on procedural language for databases based on accessed resources

Systems, computer program products and methods implementing access control for compound structures including subfields are described. A policy system receives a database schema and a data access policy. The database schema defines multiple subfields of a data column. The policy includes one or more rules limiting access to the subfields. A policy analyzer of the policy system creates an access control metadata that stores correspondence between the subfields and the rules. The policy analyzer represents the subfields in the access control metadata using relations between subfields and other components of the database. The policy analyzer provides the access control metadata to a policy enforcer for enforcing the policy on the subfields.

Access control for nested data fields

A non-transitory computer readable storage medium has instructions executed by a processor to receive a query statement. The query statement is one of many distributed storage and distributed processing query statements with unique data access methods. Token components are formed from the query statement. The token components are categorized as data components or logic components. Modified token components are formed from the token components in accordance with a policy. The query statement is reconstructed with the modified token components and original computational logic and control logic associated with the query statement.

Distributed storage and distributed processing query statement reconstruction in accordance with a policy

A non-transitory computer readable storage medium has instructions executed by a processor to intercept a query statement at a master machine. The query statement is an instruction from a client machine that specifies how data managed by a distributed storage system should be processed and provided back to the client. In the communication between the client and the master machine, tokens associated with the statement are evaluated to selectively identify a pattern match of one of connection pattern tokens, login pattern tokens or query pattern tokens. For the query pattern tokens, altered tokens for the query statement are formed in response to the pattern match to establish a revised statement. The revised statement is produced in response to application of a policy rule. The revised statement maintains computation, logic and procedure of the statement, but alters parameters of the statement as specified by the policy rule.

Distributed storage processing statement interception and modification

Systems, computer program products and methods implementing protocol-level mapping are described. An identity mapping system intercepts a request from a client device to a distributed computing system. The identity mapping system determines a first protocol of the request. The identity mapping system determines user credentials associated with the request. The identity mapping system authenticates the request based on the user credentials. The identity mapping system determines a service provided by the distributed computing system that the request accesses. The identity mapping system determines service credentials of that service. The identity mapping system translates the first protocol into a second protocol associated with the distributed computing system, including associating the service credentials with the request. The identity mapping system then submits the request to the distributed computing system.

Growing community of inventors

Hopkins, MN, United States of America

Rakesh Khanduja