ENFORCING SECURITY WITHIN A DATA PLATFORM

Computing systems and methods are provided for defining, within a data platform, a segment having constraints at a level of the segment, implementing the constraints or the classification rules within the segment while insulating resources within the segment from inheriting the constraints, and controlling an ingestion of an external resource into the segment based on the constraints.

FIELD OF THE INVENTION

This disclosure relates to approaches of defining and enforcing data security in a data platform. For example, data security constraints may be enforced with a particular segment of the platform, and a manner of propagation of the data security constraints may be implemented throughout the platform.

BACKGROUND

As data proliferation has skyrocketed, the safeguarding of data from inadvertent or unauthorized disclosure has become increasingly crucial. Conventional approaches of maintaining data security within a data platform include implementing data controls to resources within the data platform, in order to enforce data governance. For example, certain resources may be classified as “top secret” and/or accessible only by certain users. However, in such approaches, certain implementation details may not be well-defined. In addition, such approaches may also fail to address defining and implementing data controls within individual segments or portions of the data platform.

SUMMARY

Various embodiments of the present disclosure can include computing systems, methods, and non-transitory computer readable media configured to implement security controls within a data platform. The computing systems may include one or more processors and memory storing instructions that, when executed by the one or more processors, cause the system to implement security controls within a data platform and a particular segment of the data platform.

The computing systems, methods, and non-transitory computer readable media may perform: defining, within the data platform, a segment having constraints at a level of the segment; implementing the constraints within the segment while insulating resources within the segment from inheriting the constraints or the classification rules; and controlling an ingestion of an external resource into the segment based on the constraints.

In some embodiments, the constraints include a maximum classification level defined within the segment. The maximum classification level indicates that ingesting a particular resource into the segment which exceeds the maximum classification level violates the constraints.

In some embodiments, the implementation of the constraints includes defining a mirrored user constraint based on the maximum classification level. The mirrored user constraint requires a user attempting to access a resource within the segment to have at least a clearance level corresponding to the maximum classification level.

In some embodiments, even if the resource within the segment has a classification level at or below a corresponding clearance level of the user, the mirrored user constraint prohibits the user from accessing the resource.

In some embodiments, the constraints further comprise a maximum classification that includes categories. The maximum classification defines a highest permitted level corresponding to each of the categories in order for a resource to conform with or satisfy the constraints.

In some embodiments, the categories include a general classification level, a dissemination control, and a release control. The controlling of an ingestion of an external resource into the segment includes: determining whether a corresponding general classification level of the external resource satisfies the general classification level indicated by the constraints; determining whether a corresponding dissemination control of the external resource satisfies the dissemination control indicated by the constraints; and determining whether a corresponding release control of the external resource satisfies the release control indicated by the constraints. In response to determining that the corresponding general classification level, the corresponding dissemination control, and the corresponding release control of the external resource satisfies the general classification level, the dissemination control, and the release control indicated by the constraints, the computing system may permit the ingestion of the external resource into the segment.

In some embodiments, the controlling of an ingestion of an external resource into the segment includes determining, for each of the categories, whether a corresponding level of the external resource, as indicated by one or more markings of the external resource, satisfies the highest permitted level indicated by the constraints. In response to determining that the corresponding level of the external resource satisfies the highest permitted level indicated by the constraints for each of the categories, the computing system permits the ingestion of the external resource into the segment.

In some embodiments, the controlling of an ingestion of an external resource into the segment includes: determining, for each of the categories, whether a corresponding level of the external resource, as indicated by one or more markings of the external resource, satisfies the highest permitted level indicated by the constraints. In response to determining that the corresponding level of the external resource fails to satisfy the highest permitted level indicated by the constraints for one of the categories, the computing system either: permits the ingestion of the external resource into the segment while issuing a flag indicating a category of which the corresponding level of the external resource exceeded the highest permitted level indicated by the constraints, or prohibits the ingestion of the external resource into the segment.

In some embodiments, the constraints include a conjunctive classification rule and a disjunctive classification rule. The implementation of the constraints comprises expanding the conjunctive classification rule to include implied hierarchical relationships among different levels associated with the conjunctive classification rule and enforcing the disjunctive classification rule conjunctively such that, a resource that includes only some but not all disjunctive features indicated in the disjunctive classification rule is deemed to fail to satisfy the constraints.

In some embodiments, the implementation of the constraints within the segment includes determining whether to propagate a change in a classification level of an upstream resource to the downstream resource within the segment, depending on whether the upstream resource is stored within the segment or within an other segment. The determination of whether to propagate may include: if the upstream resource is stored within the segment, propagating the change in the classification level to the upstream resource if a changed classification level complies with the constraints; and if the upstream resource is stored in an other segment, propagating the change in the classification level to the upstream resource if a changed classification level complies with the constraints and is compatible with a classification level of the downstream resource.

In some embodiments, the controlling of the ingestion of the external resource into the segment is based on a comparison between markings of the external resource and the constraints at the level of the segment; and in response to the external resource being unmarked (e.g., lacking any markings), determining that the external resource satisfies the constraints and permitting the ingestion of the external resource into the segment.

DETAILED DESCRIPTION

Conventional approaches of maintaining data security within a data platform may not have well-defined implementation details in certain aspects. For example, such approaches may be unable to implement different data security policies or constraints in different segments or portions of the data platform. Additionally, a manner in which data security controls or constraints are propagated from a given resource and/or from a given segment of the data platform may not be well-defined. Moreover, data security controls or constraints may currently be applied inconsistently across different segments or portions that include related datasets. Furthermore, certain other implementation details, such as, in scenarios where the data controls include both conjunctive and disjunctive constraints, may also lack well-defined procedures.

To address such shortcomings, a new approach includes, defining data security controls, including constraints and/or classification levels, within a segment, portion, subset, compartment, project, or a subspace (hereinafter “segment”) of a data platform. In some embodiments, herein, constraints may also be construed as including classification levels, such as maximum classification levels, defined or permitted within a segment. Constraints may further refer to particular types or contents of data (e.g., resources) permitted within a segment, and particular designations or markings that are required, permitted, or prohibited for data within that segment. Additionally, constraints may refer to restrictions in addition to the classification levels, such as dissemination and release controls with that segment. Furthermore, constraints may refer to a clearance level and/or access privileges that a user has to satisfy in order to access data with that segment. The foregoing describes specific examples of constraints solely to elucidate concepts, but these examples are nonlimiting, and the specific constraints, such as dissemination, releasability, and classifications, may be flexibly configurable. One exemplary type of constraint may include the segment being particularly tailored to or restricted to store data of a particular type and/or for a particular purpose, such as, for cancer research. A computing system may coordinate the transfer or distribution of data to and from the segment in order to enforce, or ensure compliance with, the constraints and/or classification levels. For example, the computing system may include logic to ensure that a dataset would conform to the constraints and/or classification levels within the segment before permitting or authorizing the ingestion of the dataset into the segment. In another exemplary manifestation of such coordination, the computing system may include logic to determine whether, and/or to what degree, an entity (e.g., user) requesting access to a particular dataset within the segment is actually authorized to do so. As alluded to, the constraints and/or the classification levels may be set or defined on an individual segment, meaning that other segments, portions, or subspaces of the data platform external to the segment of the data platform may have different defined constraints and/or classification levels. The constraints and/or the classification levels at the segment may be insulated from resources within the segment, and/or downstream resources derived from the resources. Thus, the constraints and/or the classification levels at the segment may not propagate to or be inherited by the resources or the downstream resources. Herein, resources may refer to any data, datasets, data object(s), platforms (e.g., analysis platforms), repositories, logs, workbooks, spreadsheets, and/or a portion or subset thereof, within the data platform. The data may be manifested as a file, document, or other data entity.

FIG.1illustrates an example environment100, in accordance with various embodiments, of a computing system that implements data security controls in a data platform and portions or segments of the data platform. The example environment100can include at least a computing system102and at least one computing device120. The computing system102and the computing device120can each include one or more processors and memory. The processors can be configured to perform various operations by interpreting machine-readable instructions, for example, from a machine-readable storage media112. The processors can include one or more hardware processors103of the computing system102that include logic which can be configured to define data security controls such as constraints and/or classifications in a segment140of one or more data platforms130, and enforce the defined data security controls. Although one segment140is shown for purposes of simplicity, the one or more data platforms130may be understood to include multiple segments. Operations within each of the segments may be simultaneously coordinated and/or managed by the hardware processors in a same or similar manner as described with reference to the segment140.

The data platform130may be divided into segments, such as the segment140. The demarcation of resources in the data platform130into segments, such as the segment140, provides clear delineations of classification levels and/or constraints of each of the segments. As a nonlimiting example, one segment may have a classification level of “confidential,” while another segment may have a classification level of “top secret.” A classification level of a segment may indicate or define a maximum classification level of resources that are permitted within the segment. In particular, if one segment has a classification level of “confidential,” then resources classified up to and including, or, at or below a level of, “confidential” may be permitted to be ingested into the segment while resources classified at a level higher than “confidential” may be blocked or restricted from being ingested into the segment. Additionally or alternatively, each segment may be particularly tailored to or restricted to storage and management of resources having a particular purpose and/or of a particular subject matter. As an illustrative example, the segment140may include resources of cancer research subject matter. The segment140may further include sub-segments that individually include lymphoma and leukemia subject matter. Such a merging of lymphoma and leukemia resources within the segment140may be desirable, for example, in collaborative scenarios. Alternatively, the segment140may include lymphoma resources, while another segment includes leukemia resources. Such segregation of lymphoma and leukemia resources in different segments may be desirable in scenarios in which access to, dissemination, and/or release of lymphoma resources are to be determined and managed separately from those of leukemia resources.

As shown inFIG.1, the one or more hardware processors103can include a process engine104which may include and carry out the logic of the hardware processors103. The process engine104may include a definition engine106and an enforcement engine108. The process engine104may be executed by the hardware processors103of the computing system102to perform various operations including those operations described in reference to the definition engine106and the enforcement engine108. In general, the process engine104may be implemented, in whole or in part, as software that is capable of running on one or more computing devices or systems. In one example, the process engine104may be implemented as or within a software application running on one or more computing devices (e.g., user or client devices) and/or one or more servers (e.g., network servers or cloud servers). In some instances, various aspects of the definition engine106and the enforcement engine108may be implemented in one or more computing systems and/or devices. In general, the definition engine106may include instructions or logic to properly set constraints and/or classification levels within the segment140. In some embodiments, the definition engine106may receive an input of constraints and/or classification levels, evaluate and/or validate the input to determine whether the input matches existing stored constraints and/or classification levels (e.g., if the input is “top top secret,” such an input is not validated because “top top secret” is not stored as a possible classification level), and set the constraints and/or classification levels according to the input. In some embodiments, the definition engine106may generate, with or without input, constraints and/or classification levels of the segment140based on previous constraints and/or classification levels of other similar or related segments, for example, of similar subject matter and/or types of resources. For example, if the segment140includes resources of medical data such as lung cancer data, the definition engine106may generate constraints and/or classification levels of the segment140to be same or similar as those in other segments that include resources of other medical data such as pancreatic cancer data. The generated constraints and/or classification levels of the segment140may be modified.

Meanwhile, the enforcement engine108may include instructions or logic to ensure that a request to ingest a resource into the segment140is proper and conforms to the constraints and/or classification levels defined by the definition engine106. In some embodiments, the enforcement engine108may ensure that a resource would conform to the constraints and/or classification levels within the segment140before permitting or authorizing the ingestion of the resource into the segment140. Although much of the foregoing description focuses on prohibiting the import or ingestion of data into the segment140that violates the constraints and/or classification levels defined for the segment140, in some embodiments, the enforcement engine108may still permit the ingestion of a resource that violates such constraints and/or classification levels, but rather, outputs a warning or flag. Thus, in the subsequent FIGURES, any embodiment that refers to prohibiting or not permitting the ingestion of a resource into the segment140may alternatively be implemented to still permit the ingestion of a resource into the segment140, but rather, output a warning or flag.

Additionally, the enforcement engine108may ensure that a user requesting the ingestion of a resource has appropriate editing permissions or authorization on that resource. In another exemplary manifestation of such instructions or logic, the enforcement engine108may determine whether, and/or to what degree, an entity (e.g., a user) requesting access to a particular resource within the segment is actually authorized to do so. For example, the enforcement engine108may determine that even though a user satisfies a clearance level corresponding to a classification of the segment140, as defined by the definition engine106, the user may not satisfy a dissemination or release control. In such a scenario, the enforcement engine108may restrict the user from accessing the segment140. Such restriction may be manifested as prohibiting the user from viewing or editing contents of resources within the segment140, prohibiting the user from viewing an existence of resources within the segment140, and/or generating tearlines to purge contents of resource portions that fail to satisfy a dissemination or release control. Further details and examples will be described with respect to the subsequent FIGURES below.

In some embodiments, the computing system102may further include a database or other storage (hereinafter “database”)114associated with the hardware processors103. In some embodiments, the database114may be integrated internally with the hardware processors103. In other embodiments, the database114may be separate from but communicatively connected to the hardware processors103. The database114may store information such as commands, protocols, or rules regarding constraints and/or classification levels so that the definition engine106may properly identify, set, and/or define constraints and/or classification levels, to be enforced by the enforcement engine108. For example, the database114may store information of or regarding a hierarchy of classification levels, dissemination controls, and release controls. As an illustrative example, the database114may store information indicating that “top secret” is a highest level of classification, followed successively by “secret,” “confidential,” and “unclassified.” As a further example, the database114may store information indicating degrees of restriction of the dissemination and/or release controls, and any dissemination and/or release controls which may be wholly encompassed by other dissemination and/or release controls. For instance, a release control or restriction stipulating that a segment can only be released to an entity that satisfies a particular experience level may wholly encompass (e.g., automatically include) a dissemination control stipulating that distribution may only be done with approval of an authorized official. In such a scenario, a protocol or rule, as stored in the database114, may have specified that a determination of whether an entity satisfies a particular experience level can only be done by an authorized official. Thus, identifying both of the aforementioned dissemination controls may be redundant. The database114may further store information indicating how a classification level, dissemination, and/or release controls are determined in scenarios of commingling of data at a portion level (e.g., only a portion of a dataset), and precedence rules at a banner level (e.g., the entire dataset) if the dataset includes portions that have different classification levels, dissemination, and/or release controls. The database114may further include rules or logic to infer classification levels on unmarked resources, or resources which do not have a marked classification level, based on one or more sources of the unmarked resources. The database114may further include rules or logic to determine a classification level and constraints of a reference or a link to a different resource on a different segment, or to the different segment itself. Such a classification level and constraints may be determined by the classification level and constraints of the different resource, or that of the different segment itself. The database114may further store information of constraints and classification levels of each segment, including the segment140, of the data platform130, and/or log an evolution or history of the constraints and classification levels of each segment along with resources with each segment. For example, a change in the maximum classification level of the segment140from “secret” to “top secret” may be logged in the database114.

In general, an entity or a user operating a computing device120can interact with the computing system102over the network150, for example, through one or more graphical user interfaces and/or application programming interfaces. In some instances, one or more of the definition engine106and the enforcement engine108may be combined or integrated into a single processor, and some or all functions performed by one or more of the aforementioned engines may not be spatially separated, but instead may be performed by a common processor. Any functions attributed to the definition engine106are not to be strictly interpreted as limited to being performed by the definition engine106, but may also be performed by the enforcement engine108. Likewise, any functions attributed to the enforcement engine108are not to be strictly interpreted as limited to being performed by the enforcement engine108, but may also be performed by the definition engine106.

The process engine104can be configured to define, implement, and/or modify the ingestion and access of resources within the data platform130, based at least in part on access controls such as classification levels, markings, and further dissemination and/or release protocols or controls of resources. In some embodiments, the process engine104(more particularly, the enforcement engine108) may process requests received from the computing device120according to the access controls and further dissemination and/or release protocols or controls as defined by the definition engine106. For example, the requests may be generated based on operations performed by a user operating the computing device120or from a software application or embedded machine running on the computing device120. In various embodiments, such requests may include requests to ingest, analyze, access, view, and/or process resources using the data platform130. Such requests may also include requests to change security control settings, such as existing access controls, constraints and/or classification levels, in the data platform130. In some embodiments, such requests may be confined to a particular segment, such as the segment140. For example, a user may request access to a particular type or category of resources such as leukemia data, and the enforcement engine108may determine which segment the user may have access to. In particular, the enforcement engine108may determine, to what extent, the user has access to the leukemia data in a particular segment, such as the segment140, that stores the leukemia data. The enforcement engine108may also restrict the user from accessing other segments. Such restriction may be based, for example, on a clearance or classification level or other classification attribute of the user, such as, whether the user is particularly designated or approved for a particular purpose or project. As another example, a user may directly request access to a particular segment, such as the segment140, and the enforcement engine108may determine to what extent the user has access to the segment140. As another example, a user may request an import or ingestion of a resource into the segment140. The enforcement engine108may validate that the user has appropriate edit permissions on that resource and that the resource satisfies the constraints and classification levels of the segment140.

FIG.2illustrates an exemplary operation of the definition engine106. The definition engine106may define, configure, or set data security controls and access controls, such as constraints and/or classification levels, within the segment140. At least some of the constraints and classification levels may be in accordance with Classification Based Access Controls (CBAC). The constraints and/or classification levels may be inputted, defined, and/or modified, by a user, for example, of the computing device120, using an editing window or window (hereinafter “window”)201. The window201may include exemplary categories, to be populated using fields, corresponding to a classification string204, a classification level214, compartments234, dissemination controls244, release controls254, and allowed markings264. Some or all of the aforementioned fields may correspond to a different category or type of constraints or classification levels. The aforementioned categories and fields are not to be construed as limiting; other categories or fields may additionally be defined. In particular, the specific populated fields, such as “Dialysis” for compartments234, “authorized official” for dissemination controls244, and “experience level” for release controls254, are not limited to the ones shown inFIG.2and other subsequent FIGURES, and may be flexibly configurable. In some embodiments, a subset (e.g., some or all) of the fields may be set or defined either during a creation or introduction of the segment140or after the creation or introduction of the segment140. In some embodiments, the allowed markings264may not be set or defined during the creation or introduction of the segment140, but only through a separate process following the creation or introduction of the segment140. Each of the corresponding fields may include a drop-down menu, a combo box, a list box, an editable field, a natural language interface, a question-and-answer interface, or a form-fill interface to receive selections and/or inputs. The classification string204may indicate a manner or format in which a classification level, dissemination controls, and release controls are designated, either as a portion marking or a banner marking. For example, the classification string204may indicate delimiters, such as one or more slashes, used to separate an indication of a classification level from an indication of a dissemination control or release control. In some embodiments, the classification level214, the dissemination controls244, and/or the release controls254may all be defined in terms of, and/or part of, a maximum classification of the segment140, such that only resources at or below each of the levels set according to the classification level214, the dissemination controls244, and/or the release controls254may be permitted or ingested into the segment140. Herein, a maximum classification or classification may be understood to encompass any or all of a classification level (e.g.,214), dissemination controls (e.g.,244), and release controls (e.g.,254), whereas a classification level may refer solely to a general classification alone (e.g., the classification level214, such as “secret”) without the dissemination controls and release controls. The maximum classification may include additional categories not shown inFIG.2or in subsequentFIGS.3-13, and may be configurable. The maximum classification, and other constraints of the segment140, may not apply to a scenario of exporting or moving resources out of the segment140. Such a function may be controlled by a permission of a user seeking to perform such a function along with constraints and classification levels of a destination segment to which the resources are being exported. If the resources fail to comply with defined constraints and classification levels of the destination segment, then the enforcement engine108may output a prompt or interface that the destination segment is invalid, or may prohibit export to the destination segment by blocking or preventing a selection of the destination segment.

As previously alluded to, the classification level214may include a maximum classification level, which may also be known as a general classification. The maximum classification level may specify that resources up to and including that classification level are permitted in the segment140, while resources exceeding the maximum classification level are not permitted in the segment140. As shown inFIG.2, the classification level214may include options of a “top secret,” “secret,” “confidential,” and “unclassified” maximum classification level. The maximum classification level may be conjunctive in nature. For example, a maximum classification level of “secret” may be expanded to include “secret,” “confidential,” or unclassified” as permitted classification levels, but exclude “top secret.”

In some embodiments, when a maximum classification (e.g., including the general classification, dissemination controls, and release controls) is defined, the definition engine106may additionally define a mirrored user constraint. For example, the mirrored user constraint may include a requirement or restriction that a user has at least a clearance level corresponding to the maximum classification in order to access the segment140. Thus, a mirrored user constraint may include a classification level, dissemination controls and release controls. In a particular scenario in which the maximum classification level for a resource to exist within the segment140is “secret,” only users having a clearance level of “secret” or “top secret” are permitted to access the segment140, but users having a clearance level of “confidential” are entirely precluded from accessing the segment140. A user may be permitted to access a segment having a maximum classification level at or below the clearance level of that user, but prohibited from accessing a segment having a maximum classification level above the clearance level of that user. Thus, the mirrored user constraint results in a user sometimes being precluded from a segment even if that user is requesting access to an individual resource within the segment that is at or below the clearance level of that user. For example, if the maximum classification level for the segment is “secret,” a user having a clearance level of “confidential” or “unclassified” would still be unable to access a particular resource having a classification level of “unclassified” if that particular resource exists within the segment140.

In other embodiments, a corresponding user constraint may be set to be higher than the maximum classification. For example, in a particular scenario in which the maximum classification level for a resource to exist within the segment140is “secret,” only users having a clearance level of “top secret” may be permitted to access the segment140. In some embodiments, additionally or alternatively, the definition engine106may receive an input from an other user regarding which users or types of users may access the segment140. Herein, accessing a resource may refer to seeing an existence of the resource and/or viewing contents of the resource.

A mirrored user constraint may or may not apply to a scenario of a user requesting an import or ingestion of a resource into the segment140. In some embodiments, resources that cannot be imported or ingested into the segment140may be greyed out so that a user would be unable to select those resources to be ingested into the segment140. A resource, or the segment140, being greyed out, may refer to functions, such as selection, import, or access, being unavailable, disabled, or inactive.

The enforcement engine108may determine which resources cannot be imported or ingested into the segment140based on classification levels and constraints of, or associated with, those resources, a classification level of a user, and/or editing privileges of a user on those resources. In a scenario in which a user has a classification level (e.g., “confidential”) below the classification level corresponding to the mirrored user constraint (e.g., “secret” or “top secret”), that user may, or may not, still request an import or ingestion of that resource into the segment140. In some embodiments, that user may be blocked or prohibited from edit access or privileges to the segment140. In some examples, that user may not even see an existence of the segment140due to the classification level of the user (e.g., “confidential”) being below the classification level corresponding to the mirrored user constraint.

The compartments234may indicate further demarcations of resources within the segment140. In some embodiments, if the segment140contains resources of, or pertaining to, a particular field, each of the compartments234may include sub-fields, or specialties, within the particular field. As a non-limiting example, as illustrated inFIG.2, if the segment140includes resources of or pertaining to kidneys, the compartments234may include resources of or pertaining to dialysis, disease diagnosis, or disease treatment. Additionally or alternatively, the compartments234may be used to store resources having a more specific classification level, dissemination controls, and/or release controls than those defined more generally for the segment140. For example, if the classification level214in the segment140is “top secret,” indicating that resources having a classification level of or including “top secret” is permitted within the segment140, then one of the compartments234may be restricted to only including resources having a “top secret” classification level. Other compartments may be restricted only to resources having one particular classification level. In other embodiments, the compartments234may store resources that have special processing and/or storage requirements, such as resources containing sensitive data. The specific labels (e.g., “dialysis”) within the compartments234may be flexibly configurable and are not limited to the ones shown inFIG.2.

Next, the dissemination controls244may include restrictions on what types of resources are permitted into the segment140, based on the dissemination rules or policies of the resources. The dissemination rules or policies of a particular resource may indicate expansions or limitations on distribution of the particular resource, in addition to a classification level of that resource. In some embodiments, the dissemination rules or policies may include criteria of specific categories or types of entities authorized to access the particular resource, and/or a manner or protocol of determining which entities are authorized to access the particular resource. As a non-limiting example, the dissemination rules or policies may indicate or stipulate that dissemination of a particular resource is to be regulated by, or require approval from, an authorized official. Other possible non-limiting dissemination rules or policies may include restricting the dissemination of a particular resource to research purposes, treatment purposes, or academic purposes. Thus, the dissemination controls244may permit only certain resources having particular dissemination rules or policies, or resources having no dissemination rules or policies beyond the classification level214, to be ingested into the segment140. For example, the dissemination controls244may indicate that only resources having, and/or being marked as having, particular dissemination rules or policies, or any less restrictive dissemination rules or policies compared to the particular dissemination rules or policies, may be ingested into the segment140. The specific labels (e.g., “authorized official”) within the dissemination controls244are not limited to the ones shown inFIG.2and may be flexibly configurable.

As illustrated inFIG.2, a selection of “authorized official” as a dissemination control may mean that, in order for a particular resource to be permitted into the segment140, the particular resource requires a marking that indicates dissemination of that resource requires authorization from an official. In some examples, any resource having a less restrictive dissemination rule or policy, or a rule or policy that requires either authorization from an official or some other authorization, or no dissemination rule or policy, may also be permitted into the segment140. As another illustrative example relating toFIG.2, a selection of “research purposes” as a dissemination control may mean that, in order for a particular resource to be permitted into the segment140, the particular resource requires a marking that indicates dissemination of that resource is limited to research purposes. In some examples, any resource having a less restrictive dissemination rule or policy, or no dissemination rule or policy, may also be permitted into the segment140. For example, a resource marked to indicate that it may be disseminated for research or clinical purposes would be a less restrictive dissemination rule or policy, and would be permitted into the segment140.

The release controls254may include further restrictions on what types of resources are permitted into the segment140, based on the rules or policies associated with release of the resources. The release rules or policies of a particular resource may indicate expansions or limitations on release of the particular resource, in addition to the classification level and dissemination rules or policies of that resource. In some embodiments, the release rules or policies may include criteria of specific types of entities to which the particular resource may be released. For example, the release rules or policies may indicate or stipulate that dissemination of a particular resource is permitted for, or limited to, either enumerated entities, or particular types of categories of entities, such as, entities having a particular level or amount of experience, entities within a particular geographic location, or entities affiliated or associated with a particular organization. Thus, the release controls254may permit only certain resources having particular release rules or policies, or resources having release rules or policies that are no more restrictive than the particular release rules or policies, to be ingested into the segment140. For example, the release controls254may indicate that only resources having, and/or being marked as having, particular release rules or policies, or any less restrictive release rules or policies compared to the particular release rules or policies, may be ingested into the segment140. As illustrated inFIG.2, a selection of “experience level” as a release control may mean that, in order for a particular resource to be permitted into the segment140, the particular resource requires a marking that indicates release of that resource is limited to entities having a certain experience level or amount of experience (e.g., releasable to entities having at least 5 years). In some examples, any resource having a less restrictive release rule or policy (e.g., releasable to entities having at least 3 years of experience), or no release rule or policy, may also be permitted into the segment140. As another illustrative example relating toFIG.2, a selection of “geographic location” as a release control may mean that, in order for a particular resource to be permitted into the segment140, the particular resource requires a marking that indicates dissemination of that resource is limited to entities within a particular geographic location (e.g., releasable to the Midwest). In some examples, any resource having a less restrictive release rule or policy (e.g., releasable to either the Midwest or the Mid-Atlantic), or no release rule or policy, may also be permitted into the segment140. Thus, the dissemination controls244and release controls254further restrict which resources may be permitted into the segment140. In some embodiments, any or all of the dissemination controls244and release controls254may be defined in a disjunctive manner, and may be evaluated or enforced conjunctively, as will be further described with respect toFIGS.5-6. The specific labels (e.g., “geographic location”) within the release controls254are not limited to the ones shown inFIG.2and may be flexibly configurable.

The allowed markings264may indicate markings that are allowed or permitted in order for a resource to be permitted in the segment140. Markings may refer to identifiers of a resource that indicate a subject matter or attribute of the resource. One example of an allowed marking may be “Personally Identifiable Information (PII).” If PII is the only allowed marking, then a resource marked with PII, or no marking at all, may be permitted into the segment140. However, a resource that has another marking besides “PII” would not be permitted into the segment140. As illustrated inFIG.2, the allowed markings264may also include sub-markings. For example, upon selecting “Patient Data,” further sub-markings may include “Kidney Research” and “Kidney Patient Group.” Thus, in some examples, if “Patient Data” and “Kidney Research” were selected, then a resource would have to have “Patient Data” in conjunction with “Kidney Research” markings, or no marking at all, in order to be permitted into the segment140. If a resource only has a “Patient Data” marking, that resource would not be permitted into the segment140. In other examples, if “Patient Data” and “Kidney Research” were selected, then a resource could have either “Patient Data,” “Patient Data” in conjunction with “Kidney Research,” or no marking at all, to be permitted into the segment140. In some embodiments, if the allowed markings264are enabled but no specific marking is defined for the segment140, then only unmarked resources are permitted into the segment140. The specific labels (e.g.,“Patient Data”) within the allowed markings264are not limited to the ones shown inFIG.2and may be flexibly configurable.

In some embodiments, additionally or alternatively, the window201may further include a selection of required markings and prohibited markings that indicate markings that are required or prohibited on a resource in order for that resource to be permitted in the segment140. Examples of prohibited markings may include, prohibiting any resource marked with PII, or marked with (PII or Beta), from being ingested into the segment140. Herein, Beta may refer to a placeholder name. Examples of required markings may include, requiring that any resource in the segment be marked with PII, or marked with (PII or Beta). In some embodiments, the required, allowed and prohibited markings are defined such that unmarked resources would also satisfy any constraints corresponding to the required, allowed and prohibited markings. For example, even an unmarked resource would satisfy constraints that define required markings, such as, a constraint requiring a resource to have a marking of “PII.” Herein, an unmarked resource may refer to a resource lacking both identifiers and a classification level.

The constraints and/or classification levels as defined in the window201may be insulated from resources within the segment140, and/or downstream resources derived from the resources within the segment140. Thus, the constraints and/or the classification levels at the level of the segment140may be prevented from propagating to or being inherited by the resources or the downstream resources. Herein, a downstream resource of a resource (e.g., resource A) may refer to a modified or processed resource generated from the resource A, or a result of an analysis carried out on the resource A. For example, a modified or processed resource may be generated by removing and/or reformatting certain entries from the resource A.

To elucidate this separation or insulation between the classification level at a perspective of the segment140compared to a classification level at a perspective of a resource, if the segment140has a maximum defined classification level of “secret,” the resources within the segment140do not necessary need to be classified at a “secret” level, nor would resources derived from the resources necessarily need to be classified at a “secret” level. Such separation or insulation would prevent overclassification. The same principle holds true for other constraints such as dissemination controls and release controls.

FIG.2further illustrates a panel202that manifests or indicates a configuration of the constraints and classification levels of the segment140, as configured or defined in the window201. The panel202may be generated or populated, in response to the definition engine106receiving a selection or input of the constraints and classification levels from the window201. The panel202may be manifested as an interface, such as a tooltip, pop-out menu, popup window, or a hover box. The panel202, or information from the panel202, may be accessed or accessible from either a perspective of the segment140or at a perspective of a resource in the segment140. Thus, information from the panel202may be visible or accessible either upon selection of the segment140or a selection of a resource within the segment140. In some embodiments, a full configuration of all the constraints and classification levels of the segment140may not be visible to certain users viewing the panel202.

The panel202may include an indication of whether the segment140has a maximum permitted classification level, and a number (e.g. count) of allowed markings, permitted markings, and/or prohibited markings. The panel202may further indicate a number of constraints and classification levels that a particular user may be unable to view. In particular, the panel202may indicate that a maximum classification level212is “secret.” The panel202may further indicate that a permitted or maximum level of dissemination controls242is that dissemination of a resource is to be limited to research purposes. Thus, in some embodiments, any resource ingested into the segment140is required to have a dissemination status or restriction such that dissemination of that resource is limited to research purposes. In other embodiments, any resource ingested into the segment140may have the aforementioned dissemination restriction or any less restrictive dissemination restriction, in which scenario a resource having no dissemination restrictions would also be permitted into the segment140. The specific fields populated in the panel202are not limited to those shown inFIG.2and are flexibly configurable.

Alternatively, assume that “authorized official” were selected in the dissemination controls244of the window201. In such a scenario, the panel202may further indicate that a permitted or maximum level of dissemination controls242is that dissemination of a resource is to be approved by an authorized official. Thus, in some embodiments, any resource ingested into the segment140is required to have a dissemination status or restriction such that dissemination of that resource needs to be approved by an authorized official. In other embodiments, any resource ingested into the segment140may have the aforementioned dissemination status or any less restrictive dissemination status or restriction, in which scenario a resource having no dissemination restrictions would also be permitted into the segment140.

The panel202may further indicate that a permitted or maximum level of release controls252is that release of a resource is dependent or based on an experience level of an entity requesting that resource. In the specific implementation ofFIG.2, the experience level is five years. Thus, in some embodiments, any resource ingested into the segment140is required to have a release restriction such that release of that resource is limited to entities having at least five years of experience. In other embodiments, any resource ingested into the segment140may have the aforementioned release restriction or any less restrictive release restriction, in which scenario a resource having a release restriction that limits its release to entities having four, three, two, one, or no years of experience (e.g., anywhere between zero and five years of experience) would also be permitted into the segment140. The panel202may further indicate that the allowed markings262on a resource that is ingested into the segment140are limited to “patient data: kidney research” and “patient data: kidney patient group.” In some embodiments, a resource is required to have both of the allowed markings “patient data: kidney research” and “patient data: kidney patient group,” or no marking at all, in order to be permitted into the segment140. In other embodiments, a resource is required to have either one of the allowed markings, both of the allowed markings, or no marking at all to be permitted into the segment140.

FIG.3illustrates an implementation of the enforcement engine108to enforce or implement data security controls and access controls such as constraints and classification levels defined by the definition engine106according to the window201and the panel202ofFIG.2. InFIG.3, the enforcement engine108may determine whether or not a resource302,312,322is permitted to be ingested into the segment140based on its individual constraints or classifications. In some embodiments, an entity may have requested that the resource302,312,322be ingested into the segment140, either from another segment or as a newly created resource.

In particular, the enforcement engine108may determine or validate whether a resource satisfies a maximum classification (e.g., a general classification, dissemination controls, and release controls) defined for the segment140, along with other constraints such as allowed, prohibited, and/or mandatory markings, to determine whether that resource may be ingested into the segment140. For example, the enforcement engine108may split up the classification levels and constraints by category (e.g., general classification, dissemination controls, and release control) and by constraint type on both the segment140and the resource. For each category, the enforcement engine108may expand any implied relationships within the classification levels and constraints on both the segment140and the resource. For example, implied relationships may include hierarchical relationships, such as, a maximum classification level of “top secret” would be expanded to include “top secret,” “secret,” “confidential,” and “unclassified.” The enforcement engine108may then regroup or recombine the classification levels and constraints by categories, on both the segment140and the resource. Each category on the segment140may be compared to each respective category on the resource. If each category on the resource satisfies a corresponding constraint or classification level of the respective category on the segment140, then the resource may be successfully validated to be ingested into the segment140. In some embodiments, if a resource is unmarked, or lacks a marking indicating a classification level of that resource, the enforcement engine108may infer a classification level of that resource based on one or more sources from which that resource was generated. In some embodiments, the enforcement engine108may query a user to confirm the inferred classification level. If the inferred classification level is confirmed, the enforcement engine108may determine whether that resource may be ingested into the segment140based at least in part on the inferred classification level. As described below and inFIGS.3,4,6, and7, particular examples of determining whether a resource satisfies all constraints and classification levels defined for the segment140are provided.

The resource302may include portion markings304,306indicating constraints and classification levels of respective portions305,307of the resource302. The constraints and classification levels may be in accordance with CBAC. In particular, the portion marking304may indicate that the portion305is classified at a level of “secret”. In other embodiments, the portion marking304may further indicate a different classification level of the portion305. Referring back toFIG.3, the portion marking304may further indicate that an authorized official is required to approve any dissemination of the portion305, and that the portion305has been marked or tagged with an identifier “Patient Data: Kidney Research.”

The portion marking306may indicate that the portion307is classified at a level of “confidential”, that an authorized official is required to approve any dissemination of the portion307, and that the portion307has been marked or tagged with an identifier “Patient Data: Kidney Research.” The enforcement engine108may generate a banner marking308that provides overall constraints or classifications of the entire resource302by integrating individual portion markings304,306of each of the portions305,307.

To briefly describe a concept of banner markings, in some embodiments, the banner marking308includes most restrictive constraints or classifications out of all portions of the resource302, may be determined based on precedence of classification levels and constraints and/or includes controls or classifications that overlap across all portions of the resource302. In some examples, the banner marking corresponding to dissemination controls would be determined according to logic, protocols, or rules stored in the database114. In particular, if the logic specifies that “research purposes” is more restrictive than “authorized official” because “research purposes” automatically requires an authorized official to determine that a resource is actually being used for research purposes, then the banner marking would indicate “research purposes.” However, if the logic fails to specify a hierarchical relationship between “research purposes and “authorized official” (e.g., no definition that one is more restrictive than the other and/or entirely encompassed within the other), then other rules of precedence and/or nomenclature may be used to determine what the banner marking would indicate. For example, in that scenario, the banner marking may indicate both aforementioned dissemination controls, one of the aforementioned dissemination controls, or a different dissemination control that may encompass both aforementioned dissemination controls. Assume, hereinafter, for the sake of example, that according to logic stored in the database114, “research purposes” is more restrictive than “authorized official.”

The banner marking308here may indicate that the resource302has an overall classification level of “secret”, that dissemination is to be authorized by an authorized official, and that the resource302is marked or tagged with “Patient Data: Kidney Research.”

To determine whether the resource302is permitted to be ingested into the segment140, the enforcement engine108may compare the banner marking308to the permitted constraints and classification levels indicated in the panel202and as defined, for example, via the window201. Because the classification level of the resource302matches the maximum permitted classification level212indicated in the panel202, the dissemination control of “authorized official” is less restrictive than the maximum permitted dissemination control242of “research purposes,” and the marking of the resource302matches one of the allowed markings262, the resource302may be permitted to be ingested into the segment140. Herein, the dissemination controls242are to be construed as the maximum permitted level of dissemination controls. However, in some scenarios, the dissemination controls242may be construed as limited to only specific enumerated dissemination controls, meaning that even less restrictive dissemination controls in a resource would disqualify that resource from ingestion into the segment140. In that scenario, the resource302would not be permitted to be ingested into the segment140because “authorized official” does not match “research purposes.”

The enforcement engine108may determine whether or not the resources312,322are permitted to be ingested into the segment140using a same or similar manner as described above with respect to the resource302. The resource312may include portion markings314,316indicating constraints and classification levels of respective portions315,317of the resource312. In particular, the portion marking314may indicate that the portion315is classified at a level of “secret”. The portion marking314may further indicate that any dissemination of the portion315is limited to research purposes, and that the portion315has been marked or tagged with an identifier “Patient Data: Kidney Research.” The portion marking316may indicate that the portion317is classified at a level of “confidential,” that any dissemination of the portion317requires approval by an authorized official, and that the portion317has been marked or tagged with an identifier “Patient Data: Kidney Research.” The enforcement engine108may generate a banner marking318to indicate that an overall constraint or classification of the entire resource312includes a classification level of “secret”, that any dissemination of the resource312is limited to research purposes, and that the resource312has been marked or tagged with an identifier “Patient Data: Kidney Research.” The enforcement engine108may determine that the classification level of the resource312satisfies the maximum permitted classification level212as indicated in the panel201and prohibit the ingestion of the resource312into the segment140. However, any other resource that has a “top secret” classification level would exceed the maximum permitted classification level212and be prohibited from ingestion into the segment140.

The resource322may include portion markings324,326indicating constraints and classification levels of respective portions325,327of the resource322. In particular, the portion marking324may indicate that the portion325is classified at a level of “secret”. The portion marking324may further indicate that any dissemination of the portion325is limited to research purposes, and that the portion325has been marked or tagged with an identifier “Patient Data: Kidney Research.” The portion marking326may indicate that the portion327is classified at a level of “confidential”, that any dissemination of the portion327requires approval by an authorized official, and that the portion327has been marked or tagged with an identifier “Patient Data.” The enforcement engine108may generate a banner marking328to indicate that an overall constraint or classification level of the entire resource322includes a classification level of “secret” , that any dissemination of the resource322is limited to research purposes, and that the resource322has been marked or tagged with an identifier “Patient Data: Kidney Research.” The enforcement engine108may determine that “Patient Data: Kidney Research” is the more specific mark out of the two different marks in the portions325and327, and set that more specific mark as part of the banner marking328.

The enforcement engine108may determine that the classification level of the resource322matches the maximum permitted classification level212as indicated in the panel201.

The enforcement engine108may determine that the dissemination control of the resource322, “research purposes,” matches the maximum permitted dissemination control242of “research purposes,” and the marking of the resource302, “Patient Data: Kidney Research,” matches one of the allowed markings262. Thus, the enforcement engine108may permit ingestion of the resource322into the segment140. Herein, the allowed markings262are construed to also permit less specific markings that entirely encompass the allowed markings262. For example, if the allowed markings262include sub-markings or child markings, which may indicate a subtype of data, such as “Patient Data: Kidney Research,” the parent markings which may indicate a corresponding type that is more general than the subtype, such as “Patient Data,” may also be permitted. However, in some embodiments, the allowed markings262are exclusive and limiting such that no other markings, such as “Patient Data,” are permitted. In that scenario, any resource having a marking of “Patient Data” would not be permitted to be ingested into the segment140.

FIG.4illustrates an implementation of the enforcement engine108to enforce or implement constraints and classification levels defined by the definition engine106according to the window201and the panel202ofFIG.2.FIG.4illustrates scenarios in which the enforcement engine108determines that resources fail to satisfy the constraints and classification levels defined by the definition engine106. Thus, the enforcement engine108would not permit the resources to be ingested into the segment140. Relevant principles described with respect toFIG.3may also apply in the scenarios ofFIG.4. InFIG.4, the enforcement engine108may individually determine whether or not a resource402,412is permitted to be ingested into the segment140based on its individual constraints or classifications. In some embodiments, an entity may have requested that the resource402,412be ingested into the segment140, either from another segment or as a newly created resource.

The resource402may include portion markings404,406indicating constraints and classification levels of respective portions405,407of the resource402. The constraints and classification levels may be in accordance with CBAC. In particular, the portion marking404may indicate that the portion405is classified at a level of “unclassified.” Meanwhile, the portion marking404may further indicate that the dissemination of the portion405is limited to treatment purposes and the portion405is releasable only to entities having an experience level of at least two years. The portion marking406may indicate that the portion407is classified at a level of “unclassified,” that any dissemination of the portion407is limited or restricted to research purposes, and that the portion407is releasable only to entities having an experience level of at least three years. The enforcement engine108may generate a banner marking408that provides overall constraints or classifications of the entire resource402. The banner marking408may indicate that the resource402is classified at a level of “unclassified,” that any dissemination of the resource402is limited or restricted to purposes that are categorized under, or satisfy both, treatment and research purposes, and that the resource402is only releasable to entities having an experience level of at least three years. Thus, the banner marking408captures either the most restrictive control, constraint, or classification level in a scenario of overlapping controls, constraints, or classification levels (e.g., experience level at least two years and at least three years), and cumulatively captures all controls, constraints, or classification levels that are non-overlapping. Here, the dissemination restrictions that the resource be used only for treatment purposes and only for research purposes may be non-overlapping or disjunctive. The enforcement engine108may determine that although both the “unclassified” classification and the experience level release restriction indicated in the banner marking408both satisfy corresponding constraints defined by the definition engine106, the dissemination control of requiring purposes that are categorized under, or satisfy both, treatment and research purposes, does not satisfy, and is more restrictive than, a maximum permitted dissemination control of “research purposes” as defined by the definition engine106. Thus, the enforcement engine108may determine that the resource402is not permitted to be ingested into the segment140. However, in other embodiments, the enforcement engine108may determine that despite the dissemination control of the resource402that requires purposes that are categorized under, or satisfy both, treatment and research purposes, an overall classification level or constraint of the resource402may still satisfy the maximum permitted constraints or dissemination controls defined by the definition engine106. For example, in that scenario, the enforcement engine108may have determined that an equivalent classification level that encompasses both “treatment purposes” and “research purposes” is simply one classification level higher. In other words, including both “treatment purposes” and “research purposes” as dissemination controls causes a single level increase in the classification level. Such a determination may be based on logic in the database114. Thus, a “confidential” classification level with no additional dissemination controls may be equivalent to an “unclassified” classification level with additional dissemination controls that require purposes categorized under, or satisfying both, treatment and research purposes. In that scenario, the enforcement engine108would permit the ingestion of the resource402into the segment140.

As another example, the resource412may include portion markings414,416indicating constraints and classification levels of respective portions415,417of the resource412. The constraints and classification levels may be in accordance with CBAC. In particular, the portion marking414may indicate that the portion415is classified at a level of “unclassified.” Meanwhile, the portion marking414may further indicate that the dissemination of the portion415is limited to research purposes and the portion415is releasable only to entities having an experience level of at least two years. The portion marking416may indicate that the portion417is classified at a level of “unclassified,” that any dissemination of the portion417is limited or restricted to research purposes, and that the portion417is releasable only to entities in a particular geographic location or region. The enforcement engine108may generate a banner marking418that provides overall constraints or classifications of the entire resource412. The banner marking418may indicate that the resource412is classified at a level of “unclassified,” that any dissemination of the resource412is limited or restricted to purposes that are categorized under, or satisfy, research purposes, and that the resource412is only releasable to entities satisfying both conditions of being within a particular geographic location and having at least two years of experience. Thus, the banner marking418captures either the most restrictive control, constraint, or classification level in a scenario of overlapping controls, constraints, or classification levels, and cumulatively captures all controls, constraints, or classification levels that are non-overlapping. Here, the release restrictions that an entity is within a particular geographic location and having at least two years of experience may be non-overlapping.

The enforcement engine108may determine that although both the “unclassified” classification and the “research purposes” dissemination restriction indicated in the banner marking418both satisfy corresponding constraints defined by the definition engine106, the release restriction that requires an entity be in a particular geographic location does not satisfy the corresponding constraints defined by the definition engine106. Thus, the enforcement engine108may determine that the resource412is not permitted to be ingested into the segment140. However, in other embodiments, the enforcement engine108may determine that despite the release control of the resource412that requires an entity to satisfy both an experience level and a geographic location restriction, an overall classification level or constraint of the resource412may still satisfy the maximum permitted constraints or dissemination controls defined by the definition engine106. For example, in that scenario, the enforcement engine108may have determined that an equivalent classification level that encompasses both geographic location and experience level of an entity is simply one classification level higher. In other words, including both “geographic location” and “experience level” as release controls causes a single level increase in the classification level). Thus, a “confidential” classification level with no additional release controls may be equivalent to an “unclassified” classification level with additional release controls that require an entity to satisfy both an experience level (e.g., at least two years of experience) and a geographic location. In that scenario, the enforcement engine108would permit the ingestion of the resource412into the segment140.

FIG.5illustrates an implementation of the definition engine106to define disjunctive constraints, in addition to the constraints and classification levels defined inFIG.2. InFIG.5, a panel501may include release controls554. No other fields are shown inFIG.5for simplicity, and to highlight a concept of disjunctive constraints. However, any other aspects of constraints and classification levels not shown in the panel501may also be implemented as the panel201. Thus, other fields corresponding to the classification string204, the classification level214, the compartments234, the dissemination controls244, and the allowed markings264, may also be present in the panel501. The release controls554may include criteria of release based on an experience level, a geographic location560of an entity, and/or an organization of or associated with an entity. As shown inFIG.5, options for defining a criteria in the segment140based on the geographic location560of an entity may include any one or any disjunctive combination of distinct, non-overlapping regions, for example, in the United States. The regions may include the Northeast561, the West562, the Southwest563, the Midwest564, the South565, and the Mid-Atlantic566. Selecting any of the aforementioned regions means that the maximum, or most restrictive, release controls would permit release to entities in any of the selected regions. For example, if the Northeast561and the West562were selected, then the maximum release controls would permit release of a resource to entities in both the Northeast561and the West562, as indicated in a field504of a window502. A resource being releasable to any enumerated locations (e.g., the Northeast561or the West562) may be construed as that resource being releasable only to those locations or regions, but not releasable to other locations or regions that are not specifically enumerated. If no release controls associated with geographic locations are specified for a resource, then that resource may be releasable to any locations, as long as they are in conformance with other constraints and classification restrictions of that resource. Thus, any resource in the segment140cannot have release controls or constraints that exceed, or are more restrictive than, the maximum release controls defined for the segment140, which is specified in the field as being releasable to both the Northeast561and the West562. For example, if a resource were releasable to the Northeast, that resource would be prohibited from being ingested into the segment140, because being releasable only to the Northeast is more restrictive than being releasable to both the Northeast and the West.

FIG.6illustrates an implementation of the enforcement engine108to enforce disjunctive constraints, according to the constraints defined as shown in the window502ofFIG.5. InFIG.6, the enforcement engine108may determine whether or not a resource602,612,622is permitted to be ingested into the segment140based on its individual constraints or classifications. In some embodiments, an entity may have requested that the resource602,612,622be ingested into the segment140, either from another segment or as a newly created resource.

The resource602may include portion markings604,606indicating release controls or constraints of respective portions605,607of the resource602. In particular, the portion marking604may indicate that the portion605is releasable to the Northeast, the West, the Southwest, and the Midwest. The portion marking606may indicate that the portion607is releasable to the Northeast, the West, and the Southwest. The enforcement engine108may generate a banner marking608that provides overall release controls or constraints of the entire resource602by integrating individual portion markings604,606of each of the portions605,607. In some embodiments, the banner marking608includes most restrictive release controls or constraints out of all portions of the resource602, and/or includes release controls or constraints that overlap across all portions of the resource602. Here, the banner marking608indicates that the release controls or constraints of the resource602is defined as releasable to the Northeast, the West, and the Southwest. Because only the portion607may be releasable to the Midwest and only the portion607may be releasable to the Southwest, the entire resource602would not be releasable to either the Midwest of the Southwest. Meanwhile, in some embodiments, an individual portion (e.g.,605,607) may have multiple portion markings indicating release controls or constraints commingled within that portion. In such a scenario, the enforcement engine108may determine an overall portion marking using a same or similar principle as that described above for the banner marking608, but just applied on a scale of a portion rather than an entire resource.

To determine whether the resource602is permitted to be ingested into the segment140, the enforcement engine108may compare the banner marking608to the maximum level of permitted release controls or constraints indicated in the panel502and as defined, for example, via the window501. Because the release controls or constraints of the resource602are less restrictive than the maximum permitted release controls or constraints, which specify that a resource may be releasable to the Northeast and the West, the enforcement engine108may permit the ingestion of the resource602into the segment140. The resource602is releasable to the Northeast, the West, and the Southwest, meaning that the resource602is releasable to all locations specified in the panel502, along with an additional location of the Southwest. In other words, the resource602is not restricted to only being releasable to the Northeast and the West, but is also releasable to the Southwest. In such a manner, the enforcement engine108may evaluate disjunctive controls or constraints, such as those specifying particular locations or regions to which a resource may be released, conjunctively (e.g., that each of the individual disjunctive controls or constraints need to be included or satisfied).

The enforcement engine108may determine whether or not the resources612,622are permitted to be ingested into the segment140using a same or similar manner as described above with respect to the resource602. The resource612may include portion markings614,616indicating release controls or constraints of respective portions615,617of the resource612. In particular, the portion marking614may indicate that the portion615is releasable to both the Northeast and to the West. The portion marking616may indicate that the portion617is releasable to both the Northeast and to the Southwest. The enforcement engine108may generate a banner marking618that provides overall release controls or constraints of the entire resource612by integrating individual portion markings614,616of each of the portions615,617. In some embodiments, the banner marking618includes most restrictive release controls or constraints out of all portions of the resource612, and/or includes release controls or constraints that overlap across all portions of the resource612. Here, the banner marking618indicates that the release controls or constraints of the resource612is defined as releasable to the Northeast, the only overlapping region between the portions615and617. Because only the portion615may be releasable to the West and only the portion617may be releasable to the Southwest, the entire resource612would not be releasable to either the West or the Southwest.

To determine whether the resource612is permitted to be ingested into the segment140, the enforcement engine108may compare the banner marking618to the maximum level of permitted release controls or constraints indicated in the panel502and as defined, for example, via the window501. Because the release controls or constraints of the resource612are more restrictive than the maximum permitted release controls or constraints, which specify that a resource must be releasable to at least both the Northeast and the West, the enforcement engine108may prohibit the ingestion of the resource612into the segment140. The resource612may be releasable to only the Northeast, meaning that the resource612has release controls or constraints that are more restrictive than the maximum permitted release controls or constraints of the segment140. In other words, the resource612is not permitted to be released to the West because only the portion615is releasable to the West, but the portion617is not permitted to be released to the West.

Meanwhile, the resource622may include portion markings624,626indicating release controls or constraints of respective portions625,627of the resource622. In particular, the portion markings624,626may indicate that the portions625,627are releasable to the entire United States. The enforcement engine108may generate a banner marking628that provides overall release controls or constraints of the entire resource622by expanding an implied definition or connotation of the entire United States into an equivalent definition or connotation that includes all six enumerated locations or regions enumerated in the window501. Thus, the entire United States may be expanded to include the Northeast, the West, the Southwest, the Midwest, the South, or the Mid-Atlantic.

To determine whether the resource622is permitted to be ingested into the segment140, the enforcement engine108may compare the banner marking628to the maximum level of permitted release controls or constraints indicated in the panel502and as defined, for example, via the window501. Because the release controls or constraints of the resource622are less restrictive than the maximum permitted release controls or constraints, which specify that a resource needs to be releasable to the Northeast and the West, the enforcement engine108may permit the ingestion of the resource622into the segment140. The resource612is releasable to any six regions, which is less restrictive than if the resource were only releasable to the Northeast and the West.

FIG.7illustrates an exemplary implementation of the definition engine106and the enforcement engine108, in a scenario in which a request to change or redefine one or more constraints or classification levels of the segment140is received and validated. In particular, the constraints and classification levels of the segment140may already have been defined, for example, in a same or similar manner as described with respect toFIG.2and/orFIG.5. InFIG.7, a panel701includes an option to change a classification level714, which may indicate a maximum classification level for a resource to be permitted in the segment140. For example, a user may select one of the enumerated classification levels in order to request a change in the maximum classification level. In this particular scenario illustrated inFIG.7, a user may have requested a change to the classification level714from “secret,” as illustrated inFIG.2andFIG.5, to “confidential.” In some embodiments, the definition engine106may prevent a request to change a classification level or a constraint of the segment140if such a change would violate, or cause noncompliance with, a classification level or a constraint of a particular resource within the segment140. For example, if a resource in the segment140had a classification level of “secret,” then a change to the classification714from “secret” to “confidential” would not be permitted. Buttons or selections corresponding to these unpermitted changes may be greyed out or invisible. In other embodiments, the definition engine106may still permit any request to change a classification level or a constraint of the segment140, but that request would be validated by the enforcement engine108, as will be described below. Although only a change to the classification level714is described, any other fields, such as the compartments234, the dissemination controls244, the release controls254, or the allowed markings264, as illustrated in the panel201or the panel501, may be changed in a similar or same manner as described herein inFIG.7.

Additionally, the panel701may include rules or privileges774, which define entities, or users, that have administrative and/or ownership privileges within the segment140, as well as the exact privileges encompassed by the administrative and/or ownership privileges. For example, users that have administrative and/or ownership privileges may have the ability to change or redefine certain or all constraints and classification levels within the segment104. In particular, users that have administrative and/or ownership privileges may be able to change the maximum classification level in certain manners. The rules or privileges774may be modified or managed. Other features of the panel701, although not shown for purposes of simplicity, may be implemented as the panel201and/or the panel501.

Once the definition engine106receives a request to change the classification level to “confidential,” the enforcement engine108may analyze and validate the request to determine whether such a request is permitted, based on constraints and/or classification levels of resources within the segment140. For example, the enforcement engine108may determine that such a change conflicts with classification levels of some resources that are at classification levels of “secret.” Depending on a specific implementation, the enforcement engine108may reject or block the requested change, or alternatively, permit the requested change while making other modifications, for example, to resources that would violate or fail to satisfy the constraints and classification levels resulting from the requested change. The enforcement engine108may then display any or all of windows702,703,704. The windows702,703,704may be manifested as interfaces, such as tooltips, pop-out menus, popup windows, or hover boxes. The window702may indicate that such a requested change is not permitted. The window703may more specifically indicate particular resources that would exceed or violate the requested classification level and/or a reason that those particular resources would exceed or violate the requested classification level. The window704may indicate that the requested change in classification level to “confidential” is permitted but render resources that violate or fail to satisfy the new classification level (e.g., that exceed the new maximum classification level defined in the segment140of “confidential”). In some embodiments, the enforcement engine108may prevent access (e.g., viewing contents and/or modifications) to resources that violate or fail to satisfy the new classification level, but may still keep those resources in a visible state. For example, a user accessing the segment140following the changed constraints and classification levels would be able to see that those resources exist but not view contents of those resources. In some embodiments, the enforcement engine108may render invisible the resources that violate or fail to satisfy the new classification level, such that even an existence of those resources is no longer visible.

FIG.8illustrates an exemplary embodiment that illustrates a concept of classification by aggregation or classification by compilation, in which two or more resources, when integrated (e.g., aggregated, compiled, joined, or merged), have a higher classification level compared to when each of the resources exist individually. This higher classification level may stem from an additional association being revealed or inferred as a result of the resources being integrated. For example, this additional association may be between two entities, one of which is described in a first resource and another of which is described in a second resource, when the first resource and the second resource are integrated. Additionally, when two or more resources are integrated, other constraints such as dissemination controls or release controls may be different compared to when each of the resources exist individually.

InFIG.8, resources802,812, and822may have respective banner markings804,814, and824indicating a “confidential” classification level, and that they are releasable to the Northeast and West. In the scenario ofFIG.8, the resource822is already be in the segment140. The resources802and812have been requested to be ingested into the segment140while being integrated with each other and/or with the resource822, and the enforcement engine108determines whether such action is permitted. Assume that constraints and classification levels for ingestion into the segment140here are enforced according to the panel502ofFIG.5and the panel202ofFIG.2. Individually, each of the resources802,812may satisfy the maximum permitted constraints or controls as indicated in the panel502ofFIG.5and the panel202ofFIG.2. However, when the resources802,812are combined with each other, and/or with the resource822, the resulting classification level, and/or other constraints may change. Thus, upon receiving or processing a request to integrate any of the resources802,812,822, the enforcement engine108may determine whether classification by compilation or aggregation is applicable, and if so, how a resulting classification level or other constraints of an integrated resource would be different from the classification level and constraints of each of the individual resources802,812,822. In some embodiments, the enforcement engine108may transmit a query to a user regarding whether a resulting classification level or other constraints from integrating resources802,812, and/or822would change, and if so, what they would change to. In some embodiments, the enforcement engine108may extract keywords and/or markings from each of the resources802,812, and/or822requested to be integrated. The enforcement engine108may infer whether any additional associations of entities would arise based on the extracted keywords and/or markings. In some examples, the enforcement engine108may, additionally or alternatively, transmit a query to a user regarding whether additional associations of entities would arise, and how these additional associations would affect a classification level or other constraints resulting from an integrated resource. For example, if the enforcement engine108determines that integrating the resources802,812, and822would result in a classification level being raised to “secret” or “top secret”, then a resulting integrated resource would be prohibited from being ingested into the segment140.

In some embodiments, the definition engine106may set additional constraints to account for classification by compilation or aggregation. In particular, the definition engine106may permit otherwise qualifying resources, which individually satisfy the maximum constraints and classification levels of the segment140, but may establish rules to restrict a subset (e.g., some or all) of the otherwise qualifying resources from being integrated with one another and/or with another resource already in the segment140, based on whether such an integration would result in a higher classification level or constraint, and/or whether that higher classification level or constraint still satisfies the maximum constraints and classification levels of the segment140. The enforcement engine108may then enforce such rules.

FIG.9illustrates an implementation in which a resource, tool or platform142(hereinafter “platform”), such as an analysis resource, tool or platform, is ingested into, exists within, or is embedded within the segment140. Assume that in the segment140ofFIG.9, the constraints and classification levels may be defined as they were in any or all of applicable previous FIGURES, such as in the panel202ofFIG.2and/or the panel502ofFIG.5(e.g., the maximum classification level of the segment140is “secret”). Therefore, the enforcement engine108would prohibit, from ingestion into the segment140, a resource902having a banner marking904that indicates a “top secret” classification level because the “top secret” classification level of the resource902exceeds a maximum permitted classification level of “secret” in the segment140. Meanwhile, the platform142may either be unmarked or itself have constraints and a classification level that satisfies the constraints and classification levels defined for the segment140. For example, the platform142may be unmarked, or have a “confidential” or “secret” classification level. In addition, import or ingestion of an other resource into the platform142would also need to be regulated or enforced. In some embodiments, the constraints and classification levels defined to regulate data import into the segment140would need to be carried over to, or inherited by, the platform142, which is distinct from the classification level and constraints of the platform142itself. In such a manner, the platform142itself and/or the enforcement engine108would prohibit ingestion or import of an other embedded or nested resource, such as the resource902, that fails to satisfy the constraints and classification levels defined for the segment140. Such a scenario may exist, for example, if the platform142is a data analysis platform within the segment140and the resource902is a dataset on which data analysis is to be performed. Therefore, ingestion or importation of the resource902directly into the platform142would also be enforced or regulated based on the constraints and classification levels defined for the segment140, at least some of which may be based on CBAC.

In some embodiments, import or ingestion of the resource902into the platform142, along with other resources that violate the constraints and classification levels defined for the segment140, may be avoided by requiring that any resource being ingested into the platform142or into the segment140be marked in accordance with CBAC and/or custom markings. In some embodiments, the enforcement engine108may require that any resource, or a subset of resources, compatible with or specifically equipped for the platform142be marked in accordance with CBAC and/or custom markings. In some embodiments, if the resource902were accidentally or mistakenly imported into the platform142, a title or other identifier of the resource902may be visible to a user accessing the platform142, even if that user has a lower classification level compared to that of the resource902. However, if the title is changed by another user who actually requested the import of the resource902into the platform142, then the title would be invisible to a user having a lower classification level compared to that of the resource902.

FIG.10illustrates an implementation in which an issue, annotation, or log is created on, or corresponding to, a resource within the segment140, or within the platform142. Assume that in the segment140, the constraints and classification levels may be defined as they were in any or all of applicable previous FIGURES, such as in the panel202ofFIG.2and/or the panel502ofFIG.5(e.g., the maximum classification level of the segment140is “secret”). A resource1002having a banner marking1004indicating a classification level of “secret” may be permitted to be ingested into the segment140. The resource1002may either inherit the “secret” classification level from an upstream resource or have the “secret” classification level originated with the resource1002itself (e.g., not inherited from any other resource). Meanwhile, the enforcement engine108may determine whether an issue, annotation, or log1006that is created on the resource1002satisfies the constraints and classification levels defined for the segment140. If the issue, annotation, or log1006fails to satisfy the constraints and classification levels defined for the segment140, then the enforcement engine108would prohibit the issue, annotation, or log1006from being created or appearing in the segment140. A classification level, dissemination controls, and/or release controls of the issue, annotation, or log1006may be set by a user upon a prompt, in some embodiments. If no classification level, dissemination controls, and/or release controls of the issue, annotation, or log1006has been set, the issue, annotation, or log1006may inherit a classification level, dissemination controls, and/or release controls from its corresponding parent resource, along with permissions. In some embodiments, a classification level, dissemination controls, and/or release controls of an issue may also be edited. In some examples, an issue may include a request for data.

In addition, import or ingestion of an other resource into the issue, annotation, or log1006would also need to be regulated or enforced. In some embodiments, the constraints and classification levels defined to regulate data import into the segment140would need to be carried over to, or inherited by, the issue, annotation, or log1006, which is distinct from the classification level and constraints of the issue, annotation, or log1006itself. In such a manner, the issue, annotation, or log1006itself and/or the enforcement engine108would prohibit ingestion or import of an other embedded or nested resource, such as the resource902, that fails to satisfy the constraints and classification levels defined for the segment140. Such a scenario may exist, for example, if the issue, annotation, or log1006itself contained a resource (e.g., dataset). Therefore, ingestion or importation of resources directly into the issue, annotation, or log1006would also be enforced or regulated based on the constraints and classification levels defined for the segment140, at least some of which may be based on CBAC.

FIG.11illustrates an implementation in which proposed or potential modifications to constraints or a classification level of an upstream resource are evaluated and validated based on constraints and classification levels defined for the segment140. Assume that in the segment140, the constraints and classification levels may be defined as they were in any or all of applicable previous FIGURES, such as in the panel202ofFIG.2and/or the panel502ofFIG.5(e.g., the maximum classification level of the segment140is “secret”). In some embodiments, a window, such as a window1201ofFIG.12, may further include an option1284to view any downstream resources within the segment140that were derived from an upstream resource also within the segment140. In some embodiments, such an option may be selected using, for example, a toggle bar or a selection bar. The ability to view any downstream resources may be predicated or based upon a privilege to view resources within the segment140. Referring back to the example ofFIG.11, the segment140may contain an upstream resource1102having a banner marking1104indicating a classification level of “secret,” and a downstream resource1112that inherits the classification level of “secret” from the upstream resource1102, as shown in a banner marking1114. A classification level of the upstream resource1102may be changed to be higher or lower, as long as the changed classification level satisfies the constraints and classification levels defined for the segment140. The downstream resource1112may inherit any change in the classification level of the upstream resource1102. The upstream resource1102may not be permitted to be reclassified to a classification level of “top secret” because such action would violate the maximum classification level of the segment140. However, as shown inFIG.11, the upstream resource1102may be reclassified to a classification level of “confidential,” as shown in the banner marking1105, and the downstream resource1112would inherit the classification level of “confidential, as shown in a banner marking1115.

FIG.13illustrates an implementation in which proposed or potential modifications to constraints or a classification level of an upstream resource are evaluated and validated. Assume that in the segment140, the constraints and classification levels may be defined as they were in any or all of applicable previous FIGURES, such as in the panel202ofFIG.2and/or the panel502ofFIG.5(e.g., the maximum classification level of the segment140is “secret”). InFIG.13, an upstream resource1302may be stored in a different segment (e.g., a second segment160) than the segment140. The upstream resource1302may include a banner marking1304that indicates a classification level of “confidential.” A downstream resource1312may be stored in the segment140and inherit the “confidential” classification level of the upstream resource1312, as indicated in a banner marking1314. In some embodiments, any change in a classification level of the upstream resource1302is required or constrained to be compatible with or consistent with the classification level of the downstream resource1312, and with the constraints and classification level defined for the segment140(e.g., a segment that stores the downstream resource1312). For example, a reclassification of the upstream resource1302to a level of “secret” may violate such a constraint because “secret” would not match a classification level of the downstream resource1312, “confidential,” even though “secret” would satisfy the constraints and classification level defined for the segment140. Such a reattempted classification may fail to synchronize with the downstream resource1312. In such a scenario, the downstream resource1312may still exist within the segment140without being deleted. A user that has a classification level of at least “secret” (which, assuming mirrored user constraints, would hold true for every user accessing the segment140) may still have at least partial access to the downstream resource1312, but certain aspects of the downstream resource1312may not be fully enabled. For example, specific portions of the downstream resource1312that correspond to portions of the upstream resource1302that caused or resulted in the classification level change to “secret” may not be fully visible or enabled. Additionally, a user of the downstream resource1312that has a classification level of “secret” may be able to access a reason that the downstream resource1312failed to synchronize. A user of the downstream resource1312that has a classification level lower than “secret” may be unable to access such a reason.

Similarly, a reclassification of the upstream resource1302to a level of “top secret,” may be incompatible with the downstream resource1312because “top secret” would not match a classification level of the downstream resource1312, “confidential.” Additionally, “top secret” would fail to satisfy the constraints and classification level defined for the segment140. In such a scenario, the downstream resource1312may still exist within the segment140without being deleted. A user that has a classification level of at least “ top secret” may still have at least partial access to the downstream resource1312, but certain aspects of the downstream resource1312may not be fully enabled. For example, specific portions of the downstream resource1312that correspond to portions of the upstream resource1302that caused or resulted in the classification level change to “top secret” may not be visible or enabled. Additionally, a user that has a classification level of “secret” may lose access to, or be unable to access, a portion or an entirely of the downstream resource1312. Moreover, only a user of the downstream resource1312that has a classification level of “top secret” may be able to access a reason that the downstream resource1312failed to synchronize. A user of the downstream resource1312that has a lower classification level than “top secret” would be unable to access such a reason. Similarly, assume for the sake of example that the maximum classification level of the segment140is “top secret”, and the upstream resource1302originally has a classification level of “secret,” which is inherited by the downstream resource1312. A change in a classification level of the upstream resource1302to “top secret” would be incompatible with the downstream resource1312because “top secret” would be incompatible with the “secret” classification level of the downstream resource1312, although “top secret” complies with the maximum classification level of the segment140. In such a scenario, only a user of the downstream resource1312that has a classification level of “top secret” may be able to access a reason that the downstream resource1312failed to synchronize. A user of the downstream resource1312that has a lower classification level than “top secret” would be unable to access such a reason.

FIG.14illustrates an exemplary flowchart, according to various embodiments of the present disclosure. A method described in the flowchart may be implemented in various environments including, for example, the environment100ofFIG.1. The operations of method1400presented below are intended to be illustrative. Depending on the implementation, the example method1400may include additional, fewer, or alternative steps performed in various orders or in parallel. The example method1400may be implemented in various computing systems or devices including one or more processors, in particular, the hardware processor(s)103, using a set of machine-readable/machine-executable instructions within machine-readable storage media1401that, when executed, cause the hardware processor(s)103to define and/or implement data security features within a particular segment of a data platform. In step1402, the hardware processor(s)103may execute machine-readable/machine-executable instructions stored in the machine-readable storage media1401to define, within a data platform, a segment having constraints at a level of the segment. In some embodiments, the constraints may include, without limit, various categories of controls such as general classification levels (e.g., “top secret,” “secret,” “confidential,” or “unclassified”), dissemination controls, release controls, and particular markings that are permitted, required, or prohibited. Examples of constraints were described with reference toFIG.2andFIG.5, and particular configurations of constraints were shown in the panel202ofFIG.2and the panel502ofFIG.5. In step1404, the hardware processor(s)103may execute machine-readable/machine-executable instructions stored in the machine-readable storage media1401to implement the constraints within the segment while insulating resources within the segment from inheriting the constraints. For example, if the constraints indicate a maximum permitted classification level that a resource could have in order to satisfy the constraints of the segment140, some resources within the segment140may be classified at a lower level compared to the maximum permitted classification level. Additionally, downstream resources, either within the segment140or outside of the segment140, would be insulated or prevented from inheriting the maximum permitted classification level. In step1406, the hardware processor(s)103may execute machine-readable/machine-executable instructions stored in the machine-readable storage media1401to control an ingestion of an external resource into the segment based on the constraints. For example, the controlling may be based on a comparison between markings of the external resource and the constraints. In a particular scenario, if the external resource is unmarked (e.g., lacking any markings), the external resource is deemed to satisfy the constraints and permitted to be ingested into the segment.

Hardware Implementation

Computing device(s) are generally controlled and coordinated by operating system software. Operating systems control and schedule computer processes for execution, perform memory management, provide file system, networking, I/O services, and provide a user interface functionality, such as a graphical user interface (“GUI”), among other things.

FIG.15is a block diagram that illustrates a computer system1501500upon which any of the embodiments described herein may be implemented. The computer system1500includes a bus1502or other communication mechanism for communicating information, one or more hardware processors1504coupled with bus1502for processing information. Hardware processor(s)1504may be, for example, one or more general purpose microprocessors.

The computer system1500also includes a main memory1506, such as a random access memory (RAM), cache and/or other dynamic storage devices, coupled to bus1502for storing information and instructions to be executed by processor1504. Main memory1506also may be used for storing temporary variables or other intermediate information during execution of instructions to be executed by processor1504. Such instructions, when stored in storage media accessible to processor1504, render computer system1500into a special-purpose machine that is customized to perform the operations specified in the instructions.

The computer system1500further includes a read only memory (ROM)1508or other static storage device coupled to bus1502for storing static information and instructions for processor1504. A storage device1510, such as a magnetic disk, optical disk, or USB thumb drive (Flash drive), etc., is provided and coupled to bus1502for storing information and instructions.

The computer system1500may be coupled via bus1502to a display1512, such as a cathode ray tube (CRT) or LCD display (or touch screen), for displaying information to a computer user. An input device1514, including alphanumeric and other keys, is coupled to bus1502for communicating information and command selections to processor1504. Another type of user input device is cursor control1516, such as a mouse, a trackball, or cursor direction keys for communicating direction information and command selections to processor1504and for controlling cursor movement on display1512. This input device typically has two degrees of freedom in two axes, a first axis (e.g., x) and a second axis (e.g., y), that allows the device to specify positions in a plane. In some embodiments, the same direction information and command selections as cursor control may be implemented via receiving touches on a touch screen without a cursor.

The computer system1500may implement the techniques described herein using customized hard-wired logic, one or more ASICs or FPGAs, firmware and/or program logic which in combination with the computer system causes or programs computer system1500to be a special-purpose machine. According to one embodiment, the techniques herein are performed by computer system1500in response to processor(s)1504executing one or more sequences of one or more instructions contained in main memory1506. Such instructions may be read into main memory1506from another storage medium, such as storage device1510. Execution of the sequences of instructions contained in main memory1506causes processor(s)1504to perform the process steps described herein. In alternative embodiments, hard-wired circuitry may be used in place of or in combination with software instructions.

Various forms of media may be involved in carrying one or more sequences of one or more instructions to processor1504for execution. For example, the instructions may initially be carried on a magnetic disk or solid state drive of a remote computer. The remote computer can load the instructions into its dynamic memory and send the instructions over a telephone line using a modem. A modem local to computer system1500can receive the data on the telephone line and use an infra-red transmitter to convert the data to an infra-red signal. An infra-red detector can receive the data carried in the infra-red signal and appropriate circuitry can place the data on bus1502. Bus1502carries the data to main memory1506, from which processor1504retrieves and executes the instructions. The instructions received by main memory1506may retrieves and executes the instructions. The instructions received by main memory1506may optionally be stored on storage device1510either before or after execution by processor1504.

The computer system1500also includes a communication interface1518coupled to bus1502. Communication interface1518provides a two-way data communication coupling to one or more network links that are connected to one or more local networks. For example, communication interface1518may be an integrated services digital network (ISDN) card, cable modem, satellite modem, or a modem to provide a data communication connection to a corresponding type of telephone line. As another example, communication interface1518may be a local area network (LAN) card to provide a data communication connection to a compatible LAN (or WAN component to communicated with a WAN). Wireless links may also be implemented. In any such implementation, communication interface1518sends and receives electrical, electromagnetic or optical signals that carry digital data streams representing various types of information.

The computer system1500can send messages and receive data, including program code, through the network(s), network link and communication interface1518. In the Internet example, a server might transmit a requested code for an application program through the Internet, the ISP, the local network and the communication interface1518.

The received code may be executed by processor1504as it is received, and/or stored in storage device1510, or other non-volatile storage for later execution.

Language

It will be appreciated that an “engine,” “system,” “data store,” and/or “database” may comprise software, hardware, firmware, and/or circuitry. In one example, one or more software programs comprising instructions capable of being executable by a processor may perform one or more of the functions of the engines, data stores, databases, or systems described herein. In another example, circuitry may perform the same or similar functions. Alternative embodiments may comprise more, less, or functionally equivalent engines, systems, data stores, or databases, and still be within the scope of present embodiments. For example, the functionality of the various systems, engines, data stores, and/or databases may be combined or divided differently.

“Open source” software is defined herein to be source code that allows distribution as source code as well as compiled form, with a well-publicized and indexed means of obtaining the source, optionally with a license that allows modifications and derived works.

The phrases “at least one of,” “at least one selected from the group of,” or “at least one selected from the group consisting of,” and the like are to be interpreted in the disjunctive (e.g., not to be interpreted as at least one of A and at least one of B).