Data interaction platforms utilizing security environments

There is a need for solutions for efficiently and reliably maintain data security policies. This need can be addressed by, for example, solutions for performing dynamic security enforcement in a data interaction platform. In one example, a method includes determining a security profile for a data object; receiving a data access request associated with the data object, wherein the data access request is associated with one or more runtime parameters associated with the data access request; determining, based at least in part on the one or more runtime parameters; determining, based at least in part on the selected security environment and the security profile, a selected access level of the plurality of access levels for the data object; and processing the data access request based at least in part on the selected access level.

BACKGROUND

Various embodiments of the present invention address technical challenges related to data security. Existing data modeling solutions are ill-suited to efficiently and reliably maintain data security policies. Various embodiments of the present invention address the shortcomings of noted data modeling solutions and disclose various techniques for efficiently and reliably maintaining data security policies in data modeling solutions.

BRIEF SUMMARY

In general, embodiments of the present invention provide methods, apparatus, systems, computing devices, computing entities, and/or the like efficiently and reliably maintaining data security policies. Certain embodiments utilize systems, methods, and computer program products that maintain data security policies using at least one of security environments, security profiles, security features, and security model extrapolation spaces.

In accordance with one aspect, a method is provided. In one embodiment, the method comprises: determining a security profile for a data object, wherein: (i) the security profile defines one or more access criteria for the data object, and (ii) each access criterion of the plurality of access criteria relates an access level of one or more access levels for the data object to a security environment of one or more security environments associated with a data interaction platform computing entity; receiving a data access request associated with the data object, wherein the data access request is associated with one or more runtime parameters associated with the data access request; determining, based at least in part on the one or more runtime parameters, a selected security environment for the data access request, wherein the selected security environment is selected from the plurality of security environments associated with the data interaction platform computing entity; determining, based at least in part on the selected security environment and the security profile, a selected access level of the plurality of access levels for the data object; and processing the data access request based at least in part on the selected access level by generating a refined version of the data object in accordance with the selected access level and providing the refined version to a client computing entity associated with the data access request.

In accordance with another aspect, a computer program product is provided. The computer program product may comprise at least one computer-readable storage medium having computer-readable program code portions stored therein, the computer-readable program code portions comprising executable portions configured to: determine a security profile for a data object, wherein: (i) the security profile defines one or more access criteria for the data object, and (ii) each access criterion of the plurality of access criteria relates an access level of one or more access levels for the data object to a security environment of one or more security environments associated with a data interaction platform computing entity; receive a data access request associated with the data object, wherein the data access request is associated with one or more runtime parameters associated with the data access request; determine, based at least in part on the one or more runtime parameters, a selected security environment for the data access request, wherein the selected security environment is selected from the plurality of security environments associated with the data interaction platform computing entity; determine, based at least in part on the selected security environment and the security profile, a selected access level of the plurality of access levels for the data object; and process the data access request based at least in part on the selected access level by generating a refined version of the data object in accordance with the selected access level and providing the refined version to a client computing entity associated with the data access request.

In accordance with yet another aspect, an apparatus comprising at least one processor and at least one memory including computer program code is provided. In one embodiment, the at least one memory and the computer program code may be configured to, with the processor, cause the apparatus to: determine a security profile for a data object, wherein: (i) the security profile defines one or more access criteria for the data object, and (ii) each access criterion of the plurality of access criteria relates an access level of one or more access levels for the data object to a security environment of one or more security environments associated with a data interaction platform computing entity; receive a data access request associated with the data object, wherein the data access request is associated with one or more runtime parameters associated with the data access request; determine, based at least in part on the one or more runtime parameters, a selected security environment for the data access request, wherein the selected security environment is selected from the plurality of security environments associated with the data interaction platform computing entity; determine, based at least in part on the selected security environment and the security profile, a selected access level of the plurality of access levels for the data object; and process the data access request based at least in part on the selected access level by generating a refined version of the data object in accordance with the selected access level and providing the refined version to a client computing entity associated with the data access request.

DETAILED DESCRIPTION

Various embodiments of the present invention address problems associated with reliably enforcing security protocols in data interaction platforms given runtime considerations. Existing data interaction platforms typically define security protocols in static terms. For example, whether and how much can a particular user access particular data is in most cases a function of whether a privileged user has given corresponding access rights to the particular user. Such a rigid and static definition of security parameters ignores the relevance of runtime environmental conditions in defining and maintaining security protocols. For example, an administrator user profile may need to take into account location-based or temporal considerations in enabling or disabling access to particular data by a particular user profile. As another example, an administrator user profile may need to take into account dynamic and temporally-adjusted relational awareness scores between data associated with a particular user profile and target data in determining whether the particular user profile should be granted access to the particular data. Existing data interaction platforms do not provide mechanism for defining and enforcing such runtime-dynamic security protocols. In this way, the noted existing data interaction platforms fail to provide reliable and appropriately use flexible solutions for enforcing security protocols in data interaction platform.

Various embodiments of the present invention address the noted challenges associated with the reliability of security enforcement in data interaction platform by enabling, defining and adjusting access privileges based on runtime parameters. For example, various embodiments of the present invention enable defining security profiles for data objects that relate access levels associated with the data objects with runtime parameters of data access request sessions. In doing so, various embodiments of the present invention provide efficient and reliable mechanisms for dynamic security enforcement based on run-time parameters that eliminate the hurdles associated with static non-dynamic enforcement solutions employed in various existing data interaction applications. As another example, various embodiments of the present invention enable defining security profiles that limit data gathering from user devices based on runtime parameters associated with the user device, such as jurisdictional runtime parameters associated with the user profiles. In doing so, various embodiments of the present invention provide efficient and reliable mechanisms for defining and maintaining run-time controls on data gathering operations that enhance user privacy and compliance with applicable data privacy regulations.

Moreover, various embodiments of the present invention address technical shortcomings of traditional graph-based databases. For example, various embodiments of the present invention introduce innovative data models that process relationships between data objects not as static associations that are recorded independent of those data objects, but as dynamic associations that are recorded and absorbed by the data objects according to various attributes of those data objects. According to some aspects, a data object has relational awareness scores with respect to each of its associated data object relationships. This allows the data object to have an independent recognition of various data object relationships, including data object relationships that are typically modeled indirect data object relationships in traditional graph models, while being able to distinguish between more significant data object relationships (e.g., data object relationships having higher respective relational awareness scores) and less significant data object relationships (e.g., data object relationships having lower respective relational awareness scores).

II. DEFINITIONS OF CERTAIN TERMS

The term “security profile” may refer to data that indicate guidelines and rules for accessing the data object given one or more runtime parameters that are dominant at a time associated with a requesting for accessing the data object. In some embodiments, a data object may be associated with a universal security profile that governs rules and guidelines for accessing the data object by any of the user profiles associated with a data interaction platform computing entity. In some embodiments, a data object may be associated with one or more qualified security profiles that each governs rules and guidelines for accessing the data object by a subset of the user profiles associated with a data interaction platform computing entity.

The term “access level” may refer to data that indicate a subset of the data associated with the particular data object, including any empty subset of such data and a subset of the data associated with the particular data object that includes all of the data associated with the particular data object. For example, given a data object that includes data fields F1-F10, a first access level may include data fields F1-F2, a second access level may include data fields F2, F4, and F6, and/or the like.

The term “security environment” may refer to data that indicate one or more runtime parameter value ranges for one or more runtime parameters associated with a data access session by a user profile which may affect the ability of the user profile to access particular data objects. For example, a particular security environment may be defined by at least one of a location-based runtime parameter value indicating a particular geographic area (e.g., a particular geographic area corresponding to a particular office of a particular company), a temporal runtime parameter value indicating a particular range of time within a week (e.g., every weekday between 9 AM and 5 PM), a network connection-based runtime parameter indicating a particular network connection used to connect to the data interaction platform computing entity (e.g., a particular virtual private network (VPN) associated with a company), an environment-selection runtime parameter indicating an environment state selected by a user of the data interaction platform computing entity106(e.g., an environment state associated with work or leisure), a jurisdictional runtime parameter indicating a legal and/or regulatory jurisdiction of a user profile associated with the data access request, and/or the like.

The term “security feature” may refer to data that indicate any property of the data object that can be used to extrapolate the security profile of the data object. In some embodiments, at least some of the security features of a data object are determined based on features of the data object used to model the data object in a data modeling framework. For example, at least some of the security features of a data object may be determined based on absorption scores and/or relational awareness scores associated with a data object. As another example, at least some of the security features of a data object may be determined based on a hierarchical position of a data object vis-à-vis other data objects within a hierarchical data object scheme. As yet another example, at least some of the security features of a data object may be determined based on a relational position of a data object vis-à-vis other data objects within a relational data object scheme. As a further example, at least some of the security features of a data object may be determined based on a position of a data object within an object graph in a graph-based data modeling scheme.

The term “runtime parameter” may refer to data that indicate any property of a request session during which the data access request is generated and/or received. For example, a location-based runtime parameter may describe a location of a request session. As another example, a temporal runtime parameter may describe a time of a request session. As yet another example, a network-connection-based runtime parameter may describe a network connection used to transmit the data access request during the request session. As a further example, an environment-selection runtime parameter may describe a user selected an environment state. In general, a runtime parameter may describe any dynamic property of a data access request that cannot be determined before runtime of a computer-implemented procedure used to generate and transmit the data access request.

The “security model extrapolation space” may refer to data that indicate any mapping of two or more data objects based on at least some of the security features of the two or more data objects. In some embodiments, distances between mappings of the data objects in the security model extrapolation space can be used to infer security profiles for the mapped data objects. For example, the mapped data objects can be divided into one or more object clusters based on the distances between mappings of the mapped data objects using one or more clustering algorithms. In some embodiments, the security profile of a particular data object in a particular cluster may be determined based on the security profiles of at least some of the mapped data objects in the same cluster as the particular data object. As another example, the security profile of a particular data object may be determined based on the security profiles of other mapped objects associated with the security model extrapolation space as well as distances between the mapping of the particular data object and the mappings of the other mapped data objects associated with the security model extrapolation space.

The term “activation status” may refer to data that indicate whether a data object is accessible at all by an associated set of user profiles associated with a data interaction platform computing entity. For example, a particular data object may be inaccessible by lower-level user profiles associated with the data interaction platform computing entity. As another example, a particular data object may be inaccessible by all of the user profiles associated with the data interaction platform computing entity. Examples of inactive data objects may include data objects associated with deceased individuals, former employees, past events, completed projects, and/or the like.

The term “individual absorption score” may refer to data that indicate an estimated relational awareness tendency of a particular data object given one or more individual attributes of the particular data object. For example, based at least in part on an example model for inferring individual absorption scores, a data object associated with a particular individual person having a high educational degree may be deemed to have a high absorption score. As another example, based at least in part on another example model for generating individual absorption scores, a data object associated with a particular individual person having a particular physical profile (e.g., age, height, weight, and/or the like) may be deemed to have a high absorption score.

The term “hierarchical absorption score” may refer to data that indicate an estimated relational awareness tendency of a particular data object given one or more individual attributes of a parent data object of the particular data object. In some embodiments, the hierarchical absorption score for the data object is determined based at least in part on each individual absorption score for a parent data object that is a hierarchical parent of the data object. In some embodiments, the one or more parent data objects for a particular data object include a hierarchical meta-type of the particular data object, where the hierarchical meta-type of the particular data object indicates whether the particular data object is comprising one or more related hierarchical meta-type designations of a plurality of predefined hierarchical meta-type designations. In some embodiments, the plurality of predefined hierarchical meta-type designations include: a first predefined hierarchical meta-type designation associated with living real-world entities, a second predefined hierarchical meta-type designation associated with non-living-object real-world entities, a third predefined hierarchical meta-type designation associated with location-defining real-world entities, a fourth predefined hierarchical meta-type designation associated with time-defining real-world entities, a fifth predefined hierarchical meta-type designation associated with communication-defining entities, a sixth predefined hierarchical meta-type designation associated with group-defining entities, and a seventh predefined hierarchical meta-type designation associated with knowledge-defining entities.

The term “operational absorption score” may refer to data that indicate an estimated relational awareness tendency of a particular data object given one or more individual attributes of at least one data object that is deemed to be operationally related to (e.g., have a sufficiently strong relationship with) the particular data object. In some embodiments, the operational absorption score for the data object is determined based at least in part on each individual absorption score for a related data object that is operationally related to the particular data object. In some embodiments, a related data object is deemed related to a particular data object if there is a non-hierarchical relationship between the two data objects. In some embodiments, the one or more related data objects for a particular data object of include one or more user-defining objects associated with the particular data object and one or more access-defining data objects associated with the particular data object. In some embodiments, the one or more user-defining objects associated with the particular data object include one or more primary user-defining objects associated with the particular data object and one or more collaborator user-defining objects associated with the particular data object. In some embodiments, the one or more access-defining data objects associated with the particular data object include one or more sharing space data objects associated with the particular data object (e.g., a public sharing space data object, a collaborator space object, a shared space object, and/or the like).

The term “environment state” may refer to data that indicate an inferred user purpose and/or an indicated user purpose behind usage of a software environment such as a data interaction platform at a particular time. Environment states may be generated based at least in part on user-supplied information and/or by performing machine learning analysis of the usages of data at different time intervals and/or in different locations. For example, a data interaction platform computing entity may infer based at least in part on user interaction data that the user uses separate groups of data objects at different time intervals and thus conclude that the separate groups of data objects belong to different environments. Moreover, selection of one or more environment states for a particular usage session may be performed based at least in part on explicit user selection and/or based at least in part on detecting that the user is at a time-of-day and/or at a location associated with a particular environment state. For example, a data interaction platform computing entity may infer a “working” environment state for a particular usage session by a user during working hours and/or while the user is located at a geographic location of the user's office. As further discussed below, an innovative aspect of the present invention relates to utilizing relational awareness signals provided by the environment states for usage of a data interaction platform to generate relational awareness scores for particular data objects. In some embodiments, the environment state of a data interaction platform is selected from a plurality of candidate environment states of the data interaction platform. In some of those embodiments, the plurality of candidate environment states of the data interaction platform indicates at least one of the following: one or more private environment states, one or more professional environment states, one or more leisure environment state, and one or more public environment states.

The term “relational awareness score” may refer to data that indicate an estimated and/or predicted significance of a relationship associated with a particular data object to modeling real-world and/or virtual relationships of the particular data object which a data model seeks to model. In some embodiments, relational awareness score for a relationship indicates an estimated and/or predicted priority of a relationship associated with a particular data object when performing data retrieval and/or data search of data associated with the particular data object. According to some aspects of the present invention, a data object has relational awareness score with respect to each of its associated data object relationships. This allows the data object to have an independent recognition of various data object relationships, including data object relationships that are typically modeled indirect data object relationships in traditional graph models, while being able to distinguish between more significant data object relationships (e.g., data object relationships having higher respective relational awareness scores) and less significant data object relationships (e.g., data object relationships having lower respective relational awareness scores).

III. COMPUTER PROGRAM PRODUCTS, METHODS, AND COMPUTING ENTITIES

IV. EXEMPLARY SYSTEM ARCHITECTURE

FIG. 1is a schematic diagram of an example architecture100for dynamic security enforcement with respect to a data interaction platform. The architecture100includes one or more client computing entities102and a data interaction platform computing entity106. The data interaction platform computing entity106may be configured to communicate with at least one of the client computing entities102over a communication network (not shown). The communication network may include any wired or wireless communication network including, for example, a wired or wireless local area network (LAN), personal area network (PAN), metropolitan area network (MAN), wide area network (WAN), or the like, as well as any hardware, software and/or firmware required to implement it (such as, e.g., network routers, and/or the like). While not depicted inFIG. 1, the data interaction platform computing entity106may retrieve input data from one or more external computing entities, such as one or more external information server computing entities.

A client computing entity102may be configured to provide data access requests to the data interaction platform computing entity106. The data interaction platform computing entity106may be configured to process the data access requests and provide corresponding outputs to the client computing entity102. The data interaction platform computing entity106includes a security profile determination engine111, a request processing engine112, and a security profile enforcement engine113. The security profile determination engine111is configured to determine security profiles for data objects. The request processing engine112is configured to obtain data access requests from the client computing entities102, determine security environments associated with the data access requests, and provide outputs corresponding to the data access requests to the client computing entities102. The security profile enforcement engine113is configured to select access levels for data access requests based on the security profiles for data objects and the security environments for data access requests as well as enforce the selected access levels.

The storage subsystem108may be configured to store target data, security profiles, and security environments. The storage subsystem108may include one or more storage units, such as multiple distributed storage units that are connected through a computer network. Each storage unit in the storage subsystem108may store at least one of one or more data assets and/or one or more data about the computed properties of one or more data assets. Moreover, each storage unit in the storage subsystem108may include one or more non-volatile storage or memory media including but not limited to hard disks, ROM, PROM, EPROM, EEPROM, flash memory, MMCs, SD memory cards, Memory Sticks, CBRAM, PRAM, FeRAM, NVRAM, MRAM, RRAM, SONOS, FJG RAM, Millipede memory, racetrack memory, and/or the like.

Exemplary Data Interaction Platform Computing Entity

As indicated, in one embodiment, the data interaction platform computing entity106may also include one or more communications interfaces220for communicating with various computing entities, such as by communicating data, content, information, and/or similar terms used herein interchangeably that can be transmitted, received, operated on, processed, displayed, stored, and/or the like. In some embodiments, the data interaction platform computing entity106may be configured to perform one or more edge computing capabilities.

In one embodiment, the data interaction platform computing entity106may further include or be in communication with non-volatile media (also referred to as non-volatile storage, memory, memory storage, memory circuitry and/or similar terms used herein interchangeably). In one embodiment, the non-volatile storage or memory may include one or more non-volatile storage or memory media210, including but not limited to hard disks, ROM, PROM, EPROM, EEPROM, flash memory, MMCs, SD memory cards, Memory Sticks, CBRAM, PRAM, FeRAM, NVRAM, MRAM, RRAM, SONOS, FJG RAM, Millipede memory, racetrack memory, and/or the like. As will be recognized, the non-volatile storage or memory media may store databases, database instances, database management systems, data, applications, programs, program modules, scripts, source code, object code, byte code, compiled code, interpreted code, machine code, executable instructions, and/or the like. The term database, database instance, database management system, and/or similar terms used herein interchangeably may refer to a collection of records or data that is stored in a computer-readable storage medium using one or more database models, such as a hierarchical database model, network model, relational model, entity-relationship model, object model, document model, semantic model, graph model, and/or the like.

Exemplary Client Computing Entity

FIG. 3provides an illustrative schematic representative of a client computing entity102that can be used in conjunction with embodiments of the present invention. In general, the terms device, system, computing entity, entity, and/or similar words used herein interchangeably may refer to, for example, one or more computers, computing entities, desktops, mobile phones, tablets, phablets, notebooks, laptops, distributed systems, kiosks, input terminals, servers or server networks, blades, gateways, switches, processing devices, processing entities, set-top boxes, relays, routers, network access points, base stations, the like, and/or any combination of devices or entities adapted to perform the functions, operations, and/or processes described herein. Client computing entities102can be operated by various parties. As shown inFIG. 3, the client computing entity102can include an antenna312, a transmitter304(e.g., radio), a receiver306(e.g., radio), and a processing element308(e.g., CPLDs, microprocessors, multi-core processors, coprocessing entities, ASIPs, microcontrollers, and/or controllers) that provides signals to and receives signals from the transmitter304and receiver306, correspondingly.

The signals provided to and received from the transmitter304and the receiver306, correspondingly, may include signaling information/data in accordance with air interface standards of applicable wireless systems. In this regard, the client computing entity102may be capable of operating with one or more air interface standards, communication protocols, modulation types, and access types. More particularly, the client computing entity102may operate in accordance with any of a number of wireless communication standards and protocols, such as those described above with regard to the data interaction platform computing entity106. In a particular embodiment, the client computing entity102may operate in accordance with multiple wireless communication standards and protocols, such as UMTS, CDMA2000, 1×RTT, WCDMA, GSM, EDGE, TD-SCDMA, LTE, E-UTRAN, EVDO, HSPA, HSDPA, Wi-Fi, Wi-Fi Direct, WiMAX, UWB, IR, NFC, Bluetooth, USB, and/or the like. Similarly, the client computing entity102may operate in accordance with multiple wired communication standards and protocols, such as those described above with regard to the data interaction platform computing entity106via a network interface320.

Via these communication standards and protocols, the client computing entity102can communicate with various other entities using concepts such as Unstructured Supplementary Service Data (USSD), Short Message Service (SMS), Multimedia Messaging Service (MIMS), Dual-Tone Multi-Frequency Signaling (DTMF), and/or Subscriber Identity Module Dialer (SIM dialer). The client computing entity102can also download changes, add-ons, and updates, for instance, to its firmware, software (e.g., including executable instructions, applications, program modules), and operating system.

The client computing entity102may also comprise a user interface (that can include a display316coupled to a processing element308) and/or a user input interface (coupled to a processing element308). For example, the user interface may be a user application, browser, user interface, and/or similar words used herein interchangeably executing on and/or accessible via the client computing entity102to interact with and/or cause display of information/data from the data interaction platform computing entity106, as described herein. The user input interface can comprise any of a number of devices or interfaces allowing the client computing entity102to receive data, such as a keypad318(hard or soft), a touch display, voice/speech or motion interfaces, or other input device. In embodiments including a keypad318, the keypad318can include (or cause display of) the conventional numeric (0-9) and related keys (#, *), and other keys used for operating the client computing entity102and may include a full set of alphabetic keys or set of keys that may be activated to provide a full set of alphanumeric keys. In addition to providing input, the user input interface can be used, for example, to activate or deactivate certain functions, such as screen savers and/or sleep modes.

In another embodiment, the client computing entity102may include one or more components or functionality that are the same or similar to those of the data interaction platform computing entity106, as described in greater detail above. As will be recognized, these architectures and descriptions are provided for exemplary purposes only and are not limiting to the various embodiments.

V. EXEMPLARY SYSTEM OPERATIONS

Various embodiments of the present invention address the challenges associated with the reliability of security enforcement in data interaction platform by enabling defining and adjusting access privileges based on runtime parameters. For example, various embodiments of the present invention enable defining security profiles for data objects that relate access levels associated with portions of the data objects with security environments defined based on runtime parameters. In doing so, various embodiments of the present invention provide efficient and reliable mechanisms for run-time dynamic security enforcement in data interaction applications that eliminate the hurdles associated with static security enforcement solutions employed in various existing data interaction applications. As another example, various embodiments of the present invention enable defining security profiles that limit data gathering from user devices based on runtime parameters associated with the user device, such as jurisdictional runtime parameters associated with the user profiles. In doing so, various embodiments of the present invention provide efficient and reliable mechanisms for defining and maintaining run-time controls on data gathering operations that enhance user privacy and compliance with applicable data privacy regulations.

Exemplary Data Interaction Platform

FIG. 4provides an operational example of a user interface400for a data interaction platform that may be generated by the data interaction platform computing entity106and that may utilize at least some of the dynamic relational awareness concepts, the data visualization concepts, and the external integration concepts discussed in the present document. The user interface400includes user interface elements401-408as well as user interface element410. The user interface elements401-408each correspond to a hierarchical meta-type designation characterizing root nodes of a hierarchical dependency structure between data objects utilized by the data interaction platform. As further described below, the data interaction platform maintains a hierarchy of data objects, where each child data object hierarchically depends from one or more parent data objects. For example, a data object corresponding to a particular person who is an employee of a particular company and a graduate of a particular university may be a hierarchical dependent of a data object associated with employees of the particular company and a data object associated with graduates of the particular university. The data object associated with the employees of the particular company may in turn be a hierarchical dependent of a data object associated with working adults, while the data object associated with graduates of the particular university may in turn be a hierarchical dependent of a data object associated with university graduates. As further discussed below, an innovative aspect of the present invention relates to utilizing relational awareness signals provided at each level of a hierarchical dependency structure between data objects (e.g., absorption scores of each parent data object for a particular data object) to generate relational awareness scores for particular data objects.

In some embodiments, the hierarchical dependency structure relates each data object to at least one of various preconfigured hierarchical meta-type designations, where each hierarchical meta-type designation may relate to foundational properties of the data object that give a universal meaning to its relationship with other data objects. As described above, the preconfigured hierarchical meta-type designations may server as root nodes of a hierarchical dependency structure between data objects utilized by the data interaction platform. Various approaches may be adapted to define such preconfigured hierarchical meta-type designations, where each approach may utilize different foundational properties of data objects to define preconfigured hierarchical meta-type designations and/or maintain different levels of granularity for defining preconfigured hierarchical meta-type designations. In the exemplary approach depicted in the user interface400ofFIG. 4, the preconfigured hierarchical meta-type designations are defined based on primary and potentially secondary characteristics/classifications to include a “living” designation associated with the user interface element401, a “places” designation associated with the user interface element402, a “things” designation associated with the user interface element403, a “time” designation associated with the user interface element404, an “actions” designation associated with the user interface element405, a “communications” designation associated with the user interface element406, a “groupings” designation associated with the user interface element407, and a “knowledge” designation associated with the user interface element408. However, a person of ordinary skill in the relevant technology will recognize that other formulations of the various preconfigured hierarchical meta-type designations are feasible and may confer particular advantages in various implementations and use cases.

Depending on system semantics, the “living” hierarchical meta-type designation may relate to data objects describing people, contacts, animals, plants, and/or the like. An operational example of a user interface depicting visual relationships of particular “living” data objects that may be generated in response to user selection of user interface element401is presented inFIG. 5. The user interface depicted inFIG. 5includes a visualization of various target “living” data objects, such as the “living” data object corresponding to the individual named “Pooya Shoghi,” whose visual representation is depicted using the user interface element501in the user interface ofFIG. 5. As depicted in the user interface ofFIG. 6, a user selection of the user interface element501depicts data objects that are related to the selected “living” data object, where the data objects are in turn organized by the preconfigured hierarchical meta-type designations discussed above in relation to user interface elements401-408, here associated with the user interface elements601-608respectively. The user interface depicted inFIG. 5further enables adding new data objects that are related to the selected “living” data object by selecting a designation for a new data object via the user interface element610and selecting the user interface element611, which in turn leads to display of the user interface depicted inFIG. 7, which includes a form for entering attributes of the new data object (such as a company name attribute name that can be entered using user interface element701, a company industry sector attribute name that can be entered using user interface element702, and company address attributes that can be entered using user interface elements703).

Depending on system semantics, the “places” hierarchical meta-type designation may relate to data objects describing locations, cities, regions, countries, continents, and/or the like. A “places” data object may have relationships with data objects of other hierarchical meta-type designations. For example, a “places” data object may have a “was born in” relationship with a “living” data object. As another example, a “places” data object may have a “will be performed in” relationship with an “action” data object. As yet another example, a “places” data object may have a “is located in” relationship with a “things” data object. As a further example, a “places” data object may have “occurred in” relationship with a “communications” data object.

Depending on system semantics, the “things” hierarchical meta-type designation may relate to data objects describing buildings, products, inanimate objects, equipment, inventory, and/or the like. A “things” data object may have relationships with data objects of other hierarchical meta-type designations. For example, a “things” data object may have a “purchased” relationship with a “living” data object. As another example, a “things” data object may have a “is generated using” relationship with an “action” data object. As yet another example, a “things” data object may have a “is located in” relationship with a “places” data object. As a further example, a “things” data object may have “was a subject of” relationship with a “communications” data object. In some embodiments, the “things” data objects may be selected via files of preconfigured formats which are configured to generate visualizations of the noted “things” data objects, for example a file that describe a visualization of a building or a product using relational awareness modeling data associated with the building or the product.FIG. 12provides an operational example of a file selection user interface that may be generated in response to user selection of user interface element403in order to enable a user to select a file with a preconfigured format that describe a visualization of a “things” data object.

Depending on system semantics, a “time” hierarchical meta-type designation may relate to data objects describing seconds, minutes, hours, dates, and/or the like. A “time” data object may have relationships with data objects of other hierarchical meta-type designations. For example, a “time” data object may have a “was born on” relationship with a “living” data object. As another example, a “time” data object may have a “will be performed on” relationship with an “action” data object. As yet another example, a “time” data object may have a “was purchased on” relationship with a “things” data object. As a further example, a “time” data object may have “occurred on” relationship with a “communications” data object. In some embodiments, a time data object may be a category of particular events. In some embodiments, a time data object may be used in linear and non-linear manners and may be deemed related to an action data object. A time data object may also be used to describe “active” and “inactive” statuses, such as a person being considered “active” during periods that fall within their life span and inactive after their period of death.

Depending on system semantics, an “actions” hierarchical meta-type designation may relate to data objects describing events, tasks, projects, performances, concerts, and/or the like. An “actions” data object may have relationships with data objects of other hierarchical meta-type designations. For example, an “actions” data object may have a “was performed by” relationship with a “living” data object. As another example, an “actions” data object may have a “will be performed on” relationship with a “time” data object. As yet another example, an “actions” data object may have a “can be performed by” relationship with a “things” data object. As a further example, an “actions” data object may have “was processed using” relationship with a “communications” data object. In some embodiments, the “actions” hierarchical meta-type designation may have two child data objects, a “tasks” child data object and a “projects” child data object.FIG. 9provides an operational example of a user interface that may be generated in response to user interface of user interface element405associated with the “actions” hierarchical meta-type designation (a second operational example is presented inFIG. 30). As depicted inFIG. 9, the depicted user interface includes user interface elements901-902, which correspond to the “tasks” data object and “projects” data object respectively. As further depicted in the user interface ofFIG. 10, selection of the user interface element901associated with the “tasks” data object relates to depicting various target data objects depending from the “tasks” data object, including the “Install ViZZ” data object associated with the user interface element901. As further depicted in the user interface ofFIG. 11, selection of user interface element901data objects that are related to the selected “tasks” data object, where the data objects are in turn organized by the preconfigured hierarchical meta-type designations discussed above in relation to user interface elements401-408.

Depending on system semantics, the “communications” hierarchical meta-type designation may relate to data objects describing emails, phone calls, text messages, pager messages, meetings, and/or the like. A “communications” data object may have relationships with data objects of other hierarchical meta-type designations. For example, a “communications” data object may have a “was received by” relationship with a “living” data object. As another example, a “communications” data object may have a “includes guidelines for” relationship with an “action” data object. As yet another example, a “communications” data object may have a “discusses price of” relationship with a “things” data object. As a further example, a “communications” data object may have “occurred in” relationship with a “time” data object.

Depending on system semantics, the “groupings” hierarchical meta-type designation may relate to data objects describing companies, teams, organizations, email lists, and/or the like. A “groupings” data object may have relationships with data objects of other hierarchical meta-type designations. For example, a “groupings” data object may have a “is a participant in” relationship with a “living” data object. As another example, a “groupings” data object may have a “is expected to perform” relationship with an “action” data object. As yet another example, a “groupings” data object may have a “is owner of” relationship with a “things” data object. As a further example, a “groupings” data object may have “was formed in” relationship with a “time” data object. In some embodiments, a groupings data object may signify a relationship between the data objects in each group, for example a collection of people may be represented by a group data object of a company, thereby creating a relationship, via that company, of those contacts.

Depending on system semantics, the “knowledge” hierarchical meta-type designation may relate to data objects describing files, documents, books, articles, and/or the like. A “knowledge” data object may have relationships with data objects of other hierarchical meta-type designations. For example, a “knowledge” data object may have a “is authored by” relationship with a “living” data object. As another example, a “knowledge” data object may have a “describes how to perform” relationship with an “action” data object. As yet another example, a “knowledge” data object may have a “includes information about” relationship with a “things” data object. As a further example, a “knowledge” data object may have “was authored in” relationship with a “time” data object. In some embodiments, the “knowledge” hierarchical meta-type designation may have two child data objects, a “files” child data object and a “documents” child data object.FIG. 11provides an operational example of a user interface that may be generated in response to user interface of user interface element408associated with the “knowledge” hierarchical meta-type designation. As depicted inFIG. 11, the depicted user interface includes user interface elements1101-1102, which correspond to the “files” data object and the “documents” data object respectively. A knowledge data object may also have “is related to” information within the same characteristic class of knowledge items to other information on the same subject matter

Returning toFIG. 4, the user interface400further includes the user interface element410which enables user selection of one or more environment states for the data interaction platform. An environment state of a data interaction platform may indicate an inferred user purpose and/or an indicated user purpose behind usage of the data interaction platform at a particular time. Environment states may be generated based at least in part on user-supplied information and/or by performing machine learning analysis of the usages of data at different time intervals and/or in different locations. For example, the data interaction platform computing entity106may infer based at least in part on user interaction data that the user uses separate groups of data objects at different time intervals and thus conclude that the separate groups of data objects belong to different environments. Moreover, selection of one or more environment states for a particular usage session may be performed based at least in part on explicit user selection and/or based at least in part on detecting that the user is at a time-of-day and/or at a location associated with a particular environment state. For example, the data interaction platform computing entity106may infer a “working” environment state for a particular usage session by a user during working hours and/or while the user is located at a geographic location of the user's office. As further discussed below, an innovative aspect of the present invention relates to utilizing relational awareness signals provided by the environment states for usage of a data interaction platform to generate relational awareness scores for particular data objects.

FIG. 13provides an operational example of a user interface that enables user selection of environment states. As depicted in the user interface ofFIG. 13, the defined environment states are divided into four meta-type designations: a “live” designation1301(e.g., related to private or personal environment states) that includes the environment state “Pooya's Private Workspace”1311, a “work” designation1302(e.g., related to professional environment states), a “play” designation1303(e.g., related to entertainment-related or leisure-related environment states) that includes the environment state “Pooya's Fun”1313, and a “global” designation1304(e.g., related to general or public environment states) that includes the environment state “Global Public”1314. A user can select an environment state by placing a checkmark next to the user interface element associated with the environment state and selecting the submit button. Selection or deselection of environment states can affect visualizations of retrieved data item. For example, as depicted in the user interface ofFIG. 14relative to the user interface ofFIG. 5, after selection of the environment state “Global Public”1314, selection of the user interface element401leads to generation and display of a more crowded visualization with a greater number of depicted data objects compared to prior to selection of the environment state “Global Public”1314. In some embodiments, environments can be utilized to define security parameters for accessing particular data objects and/or particular inter-object relationships.

The example data interaction platform depicted and described herein usingFIGS. 4-14can be utilized to process data retrieval queries and generate responsive query outputs, where a data retrieval query is any request to retrieve one or more data objects that correspond to particular data retrieval query criteria, e.g., one or more filtering criteria, one or more search criteria, and/or the like. For example,FIG. 15provides an operational example of a user interface1500for processing data retrieval queries using the noted data interaction platform (a second operational example is presented inFIG. 29). As depicted inFIG. 15, the user interface1500includes user interface elements1501for specifying data retrieval query criteria, user interface elements1502for specifying visualization parameters defining a desired visualization of data, and user interface elements1503depicting search results. As further depicted in the user interface1600ofFIG. 16, query outputs can be saved as sessions1601-1602and visualization results1603may include relationships between retrieved data objects. Processing data retrieval queries using a proposed data interaction platform will be described in greater detail below.

To provide the data modeling, data visualization, external integration, and query processing functionalities discussed herein, a data interaction platform utilizing dynamic relational awareness needs to utilize a robust logical data model that enables both relational awareness modeling aspects as well as dynamic user interaction aspects of the noted functionalities. An example of such a logical data model1700for a data interaction system is provided inFIG. 17. As depicted inFIG. 17, a user node1701is associated with a user profile object1702, which uniquely identifies the user node1701within the data interaction platform, encodes attributes and relationships of the user node1701in relation to the data interaction platform, and enables the user node1701to interact with other user nodes1701within the data interaction platform. The user profile object1702manages various data objects, such as a collaboration space1703of user profile objects whose access to the data interaction platform is controlled by the user node1701, a shared space1704of data objects that were shared by the user node1701with other user profile objects within the data interaction platform and which may include primary data objects such as primary data object1741or other shared spaces such as shared space1742, a team object1705that enables the user node1701to manage access to its data on a group level, environment objects1706each identifying an environment state associated with the user node1701, and environment classes1707each identifying a meta-type designation of environment states associated with the user node1701.

As further depicted in the logical data model1700ofFIG. 17, user profile object1702owns a space object1708which may act as container of multiple data objects and which may include one or more space objects such as space object1781, one or more primary data objects such as primary data object1782, and one or more secondary data objects such as secondary data object1783. Moreover, user profile object1702owns a primary data object1709which may act as a primary data node and which may include one or more space objects such as space object1791, one or more primary data objects such as primary data object1792, and one or more secondary data objects such as secondary data object1794. In some embodiments, a secondary data object is a data object that is defined by association with another data object such that it will be deleted upon deletion of the other data object. An example of a secondary data object is a phone number data object for an individual person data object. In some embodiments, at least some of the data objects depicted in the logical data model1700ofFIG. 17are “default” data objects, meaning that they are automatically created upon creation of a user profile object. In some embodiments, the default data objects include one or more of the team object1705, the collaborator space1703, and the shared space1704.

Dynamic Security Enforcement

FIG. 18is a flowchart diagram of an example process1800for performing dynamic access security enforcement with respect to a data object stored on the data interaction platform computing entity106. Via the various steps/operations of process1800, various components of the data interaction platform computing entity106can establish and enforce security protocols for data objects in an efficient and effective manner by monitoring runtime environments of data access requests in order to infer security environments associated with the noted data access requests.

The process1800begins at step/operation1801when the security profile determination engine111of the data interaction platform computing entity106determines a security profile for the data object. In some embodiments, a security profile for a data object refers to data that indicate guidelines and rules for accessing the data object given one or more runtime parameters that are dominant at a time associated with a requesting for accessing the data object. In some embodiments, a data object may be associated with a universal security profile that governs rules and guidelines for accessing the data object by any of the user profiles associated with the data interaction platform computing entity106. In some embodiments, a data object may be associated with one or more qualified security profiles that each governs rules and guidelines for accessing the data object by a subset of the user profiles associated with the data interaction platform computing entity106.

For example, a particular data object may be associated with a universal access profile that indicates that the particular data object is accessible at all times by any of the user profiles associated with the data interaction platform computing entity106. As another example, a particular data object may be associated with a universal access profile that indicates that the particular data object is accessible at all times by any of the user profiles associated with the data interaction platform computing entity106so long as the user profiles are estimated to be in a particular location. As yet another example, a particular data object may be associated with a universal access profile that indicates that the particular data object is accessible at all times by any of the user profiles associated with the data interaction platform computing entity106so long as the user profiles are estimated to be at a first location during a first time of day or at a second location during a second time of day.

As a further example, a particular data object may be associated with: (i) a first qualified security profile for a first set of one or more user profiles that indicates that the first set of user profiles can access the particular data object at all times and at all locations, (ii) a second qualified security profile for a second set of one or more user profiles that indicates that the second set of user profiles can access the particular data object at all times while at a first location, and (iii) a third qualified security profile for a third set of one or more user profiles that indicates that the third set of user profiles can access the particular data object at a first location during a first time of day or at a second location during a second time of day.

In some embodiments, the security profile for the particular data object profile defines one or more access criteria for the data object, where each access criterion of the plurality of access criteria may relate an access level of one or more access levels for the data object to a security environment of one or more security environments associated with the data interaction platform computing entity. In some embodiments, a security profile for the data object may indicate what the access level of each of one or more user profiles associated with the security profile is to the data associated with the data object given the security environment of the user profile at a time associated with a data access request by the user profile to access the data associated with the data object.

In some embodiments, an access level of the particular data object may be defined by a subset of the data associated with the particular data object, including any empty subset of such data and a subset of the data associated with the particular data object that includes all of the data associated with the particular data object. For example, given a data object that includes data fields F1-F10, a first access level may include data fields F1-F2, a second access level may include data fields F2, F4, and F6, and/or the like. In some embodiments, a security environment may be defined by one or more runtime parameter value ranges for one or more runtime parameters. For example, a particular security environment may be defined by at least one of a location-based runtime parameter value indicating a particular geographic area (e.g., a particular geographic area corresponding to a particular office of a particular company), a temporal runtime parameter value indicating a particular range of time within a week (e.g., every weekday between 9 AM and 5 PM), a network connection-based runtime parameter indicating a particular network connection used to connect to the data interaction platform computing entity106(e.g., a particular virtual private network (VPN) associated with a company), an environment-selection runtime parameter indicating an environment state selected by a user of the data interaction platform computing entity106(e.g., an environment state associated with work or leisure), a jurisdictional runtime parameter indicating a legal jurisdiction governing a user profile associated with the data access request, and/or the like.

In some embodiments, step/operation1801may be performed in accordance with the steps/operations ofFIG. 19. The process depicted inFIG. 19begins at step/operation1901when the security profile determination engine111determines one or more security features for each data object of a plurality of data objects, where plurality of data objects include a primary data object and one or more secondary data objects, and where each of the plurality of secondary data objects is associated with a security profile. In some embodiments, a security feature for a data object is any property of the data object that can be used to extrapolate the security profile of the data object. In some embodiments, at least some of the security features of a data object are determined based on features of the data object used to model the data object in a data modeling framework. For example, at least some of the security features of a data object may be determined based on absorption scores and/or relational awareness scores associated with a data object. As another example, at least some of the security features of a data object may be determined based on a hierarchical position of a data object vis-à-vis other data objects within a hierarchical data object scheme. As yet another example, at least some of the security features of a data object may be determined based on a relational position of a data object vis-à-vis other data objects within a relational data object scheme. As a further example, at least some of the security features of a data object may be determined based on a position of a data object within an object graph in a graph-based data modeling scheme.

In some embodiments, step/operation1901may be performed in accordance with the steps/operations depicted inFIG. 20. The process depicted inFIG. 20begins at step/operation2001when the security profile determination engine111generates an individual absorption score for a particular data object. In some embodiments, the individual absorption score of the particular data object indicates an estimated relational awareness tendency of the particular data object given one or more individual attributes of the particular data object. For example, based at least in part on an example model for inferring individual absorption scores, a data object associated with a particular individual person having a high educational degree may be deemed to have a high absorption score. As another example, based at least in part on another example model for generating individual absorption scores, a data object a data object associated with a particular individual person having a particular physical profile (e.g., age, height, weight, and/or the like) may be deemed to have a high absorption score.

In some embodiments, step/operation2001can be performed in accordance with the process depicted inFIG. 20, which is a flowchart diagram of an example process for generating an individual absorption score for a particular data object. The process depicted inFIG. 20begins at step/operation2001when the security profile determination engine111obtains one or more individual attributes for the particular data object.

At step/operation2002, the security profile determination engine111generates a hierarchical absorption score for the particular data object. For example, the hierarchical absorption score for a particular data object that has a hierarchical parents P1, P2, and P3may be determined based at least in part on individual absorption scores of P1, P2, and P3. In some embodiments, the hierarchical absorption score for the data object is determined based at least in part on each individual absorption score for a parent data object that is a hierarchical parent of the data object. In some embodiments, the one or more parent data objects for a particular data object include a hierarchical meta-type of the particular data object, where the hierarchical meta-type of the particular data object indicates whether the particular data object is comprising one or more related hierarchical meta-type designations of a plurality of predefined hierarchical meta-type designations.

In some embodiments, the plurality of predefined hierarchical meta-type designations include: a first predefined hierarchical meta-type designation associated with living real-world entities, a second predefined hierarchical meta-type designation associated with non-living-object real-world entities, a third predefined hierarchical meta-type designation associated with location-defining real-world entities, a fourth predefined hierarchical meta-type designation associated with time-defining real-world entities, a fifth predefined hierarchical meta-type designation associated with communication-defining entities, a sixth predefined hierarchical meta-type designation associated with group-defining entities, and a seventh predefined hierarchical meta-type designation associated with knowledge-defining entities.

At step/operation2003, the security profile determination engine111generates an operational absorption score for the particular data object. In some embodiments, the operational absorption score for the data object is determined based at least in part on each individual absorption score for a related data object that is operationally related to the particular data object. In some embodiments, a related data object is deemed related to a particular data object if there is a non-hierarchical relationship between the two data objects. In some embodiments, the one or more related data objects for a particular data object of include one or more user-defining objects associated with the particular data object and one or more access-defining data objects associated with the particular data object. In some embodiments, the one or more user-defining objects associated with the particular data object include one or more primary user-defining objects associated with the particular data object and one or more collaborator user-defining objects associated with the particular data object. In some embodiments, the one or more access-defining data objects associated with the particular data object include one or more sharing space data objects associated with the particular data object (e.g., a public sharing space data object, a collaborator space object, a shared space object, and/or the like).

At step/operation2004, the security profile determination engine111generates an attribute-based absorption score for the particular data object. In some embodiments, the attribute-based absorption score for the particular data object is performed based at least in part on each individual absorption score for a similar data object whose respective individual attributes are determined to be sufficiently similar to the one or more object attributes of the particular data object. In some embodiments, the security profile determination engine111generates a distance measure between each pair of data objects and determines particular pairs of data objects whose distance measure exceeds a threshold distance measure. In some of those embodiments, the security profile determination engine111generates an attribute-based absorption score for a particular data object based at least in part on any data object that is member of a particular pair of data objects that also includes the particular data object.

At step/operation2005, the security profile determination engine111generates the relational awareness score for the particular data object based at least in part on the individual absorption score for the particular data object, the hierarchical absorption score for the particular data object, the operational absorption score for the particular data object, and the attribute absorption score for the particular data object. In some embodiments, to generate the relational awareness score for the particular data object, the security profile determination engine111applies a parameter to each of the individual absorption score for the particular data object, the hierarchical absorption score for the particular data object, the operational absorption score for the particular data object, and the attribute absorption score for the particular data object, where each parameter may be determined using a preconfigured absorption score generation model such as a generalized linear model and/or using a supervised machine learning algorithm for determining absorption scores.

At step/operation2006, the security profile determination engine111generates the security features for the particular data object based on the relational awareness score for the particular data object. In some embodiments, the security features for the particular data object include at least one of the relational awareness score for the particular data object, the individual absorption score for the particular data object, the hierarchical absorption score for the particular data object, the operational absorption score for the particular data object, and the attribute-based absorption score for the particular data object. In some embodiments, to generate the security features for the particular data object, the security profile determination engine111maps at least one of the relational awareness score for the particular data object, the individual absorption score for the particular data object, the hierarchical absorption score for the particular data object, the operational absorption score for the particular data object, and the attribute-based absorption score for the particular data object into a multi-dimensional space configured to extrapolate at least some of the security features for the particular object based on a position of the particular data object in the multi-dimensional space. In some embodiments, the noted extrapolation may be performed using one or more unsupervised machine learning techniques.

Returning toFIG. 19, at step/operation1902, the security profile determination engine111generates a security model extrapolation space based on each security features for a data object of the plurality of data objects. In some embodiments, a security model extrapolation space is any mapping of two or more data objects based on at least some of the security features of the two or more data objects. In some embodiments, distances between mappings of the data objects in the security model extrapolation space can be used to infer security profiles for the mapped data objects. For example, the mapped data objects can be divided into one or more object clusters based on the distances between mappings of the mapped data objects using one or more clustering algorithms. In some embodiments, the security profile of a particular data object in a particular cluster may be determined based on the security profiles of at least some of the mapped data objects in the same cluster as the particular data object. As another example, the security profile of a particular data object may be determined based on the security profiles of other mapped objects associated with the security model extrapolation space as well as distances between the mapping of the particular data object and the mappings of the other mapped data objects associated with the security model extrapolation space.

An operational example of a security model extrapolation space2100is presented inFIG. 21. As depicted inFIG. 21, the security model extrapolation space2100includes a mapping2111for a primary data object and mappings2112-2116for secondary data objects. The mappings2111-2116included in the security model extrapolation space2100are each defined based on a first mapping value associated with the security feature A which is modeled using the horizontal dimension2101of the security model extrapolation space2100as well as a second mapping value associated with the security feature B which is modeled using the vertical dimension2102of the security model extrapolation space2100. Moreover, the mappings2111-2116included in the security model extrapolation space2100are divided into two object clusters2121-2122based on distances between the noted mappings2111-2116. The two object clusters2121-2122include object cluster2121which includes mappings2111-2113and object cluster2122which includes mappings2114-2116.

Returning toFIG. 19, at step/operation1903, the security profile determination engine111determines the security model for the primary data object based on the security model extrapolation space. In some embodiments, to determine the security model for the primary data object based on the security model extrapolation space, the security profile determination engine111determines one or more related modeled data objects of the one or more modeled data objects based at least in part on the security model extrapolation space and subsequently determines the security profile for the data object based at least in part on each modeled security profile for a related modeled data object of the one or more related modeled data objects.

In some embodiments, the security profile determination engine111may divide the plurality of data objects into one or more object clusters based on the distances between mappings of the mapped data objects in the security profile extrapolation space and by using one or more clustering algorithms. In some embodiments, the security profile determination engine111may determine that the secondary data objects that are in the same object cluster as the primary data object according to the security profile extrapolation space are deemed to be related to the primary data object. In some of those embodiments, the security profile determination engine111may determine the security profile for the primary data object based on the security profiles of the secondary data objects that are in the same object cluster as the primary data object (e.g., the secondary data objects2112-2113that are in the same object cluster2121as the primary object cluster2121in the exemplary security profile extrapolation space2100ofFIG. 21). In some embodiments, the security profile determination engine111may determine the security profile for the primary data object based on the security profiles of each of the secondary data objects when adjusted by the distances between the mapping of the primary data object and the mapping of each of the secondary data objects.

Returning toFIG. 18, step/operation1801may be performed in accordance with the steps/operations depicted inFIG. 22. The process depicted inFIG. 22begins at step/operation2201when the security profile determination engine111determines an activation status for the data object. In some embodiments, the activation status for the data object indicates whether the data object is accessible at all by an associated set of user profiles associated with the data interaction platform computing entity106. For example, a particular data object may be inaccessible by lower-level user profiles associated with the data interaction platform computing entity106. As another example, a particular data object may be inaccessible by all of the user profiles associated with the data interaction platform computing entity106. Examples of inactive data objects may include data objects associated with deceased individuals, former employees, past events, completed projects, and/or the like.

At step/operation2202, the security profile determination engine111determines whether the activation status indicates an active status or an inactive status. If the activation status indicates an inactive status: (i) at step/operation2203, the security profile determination engine111determines a denied access criterion that prevents access of the data object by user profiles associated with the activation status, and (ii) at step/operation2204, the security profile determination engine111determines the security profile for the data object with respect to the user profiles associated with the activation status based on the denied access criterion. However, if the activation status indicates an active status: (i) at step/operation2205, the security profile determination engine111determines a qualified access criterion that enables access of at least some of the data associated with the data object by user profiles associated with the activation status, and (ii) at step/operation2206, the security profile determination engine111determines the security profile for the data object with respect to the user profiles associated with the activation status based on the qualified access criterion.

Returning toFIG. 18, at step/operation1802, the request processing engine112of the data interaction platform computing entity106receives a data access request associated with the data object, where the data access request is associated with one or more runtime parameters associated with the data access request. In some embodiments, a runtime parameter associated with a data access request is any property of a request session during which the data access request is generated and/or received. For example, a location-based runtime parameter may describe a location of a request session. As another example, a temporal runtime parameter may describe a time of a request session. As yet another example, a network-connection-based runtime parameter may describe a network connection used to transmit the data access request during the request session. As a further example, an environment-selection runtime parameter may describe a user selected environment state (e.g., an environment state selected using the environment selection user interface410ofFIG. 13). In general, a runtime parameter may describe any dynamic property of a data access request that cannot be determined before runtime of a computer-implemented procedure used to generate and transmit the data access request.

In some embodiments, the data access request is generated in accordance with a first end user attempt share data with a second end user using a content sharing message, e.g., a content sharing message using an external communication means (e.g., an external email communication means) that is external to a data interaction platform associated with the data interaction platform computing entity106and/or an using an internal communication means that is within a data interaction platform associated with the data interaction platform computing entity106. In some embodiments, the data access request is generated in accordance with a first end user attempt to communicate data to a second end user, e.g., a content sharing message using an external communication means (e.g., an external email communication means) that is external to a data interaction platform associated with the data interaction platform computing entity106and/or an using an internal communication means that is within a data interaction platform associated with the data interaction platform computing entity106. Performing dynamic security enforcement with respect to data sharing and data communication is performed in greater detail below with reference toFIGS. 23-28.

At step/operation1803, the request processing engine112determines a selected security environment for the data access request, wherein the selected security environment based at least in part on the one or more runtime parameters. In some embodiments, the request processing engine112determines the selected security environment from a group of security environments associated with the data interaction platform computing entity106. In some embodiments, the request processing engine112determines the selected security environment based on at least one of a location-based runtime parameter value indicating a particular geographic area (e.g., a particular geographic area corresponding to a particular office of a particular company), a temporal runtime parameter value indicating a particular range of time within a week (e.g., every weekday between 9 AM and 5 PM), a network connection-based runtime parameter indicating a particular network connection used to connect to the data interaction platform computing entity106(e.g., a particular virtual private network (VPN) associated with a company), an environment-selection runtime parameter indicating an environment state selected by a user of the data interaction platform computing entity106(e.g., an environment state associated with work or leisure), and/or the like.

In some embodiments, the request processing engine112selects a selected security environment for the data access request based on one or more security environment selection guidelines. The security environment selection guidelines may define at least one of a priority order between the runtime parameters as well as equations for combining runtime parameters to determine relevance scores for each of the group of security environments associated with the data interaction platform computing entity106given the runtime parameters. For example, in some embodiments, security environment selection guidelines may indicate that, given an environment-selection runtime parameter, the selected security environment may be determined based on the environment selection runtime parameter unless a threshold amount of time has passed since a time associated with the generation of the environment-selection runtime parameter (e.g., unless the environment-selection runtime parameter has expired). As another example, in some embodiments, security environment selection guidelines may indicate that a location-based runtime parameter is twice more important than a temporal runtime parameter in determining a selected security environment for a data access request.

In some embodiments, at least some of the runtime parameters associated with a data access request are supplied to a machine learning model (e.g., a supervised machine learning model and/or an unsupervised machine learning model), where the machine learning model is configured to generate a selected security environment associated with a data access request. In some embodiments, at least some of the runtime parameters associated with a data access request are supplied to a machine learning model (e.g., a supervised machine learning model and/or an unsupervised machine learning model), where the machine learning model is configured to generate a probability score for each security environment in the group of security environments associated with the data interaction platform computing entity106, and where the request processing engine112is configured to determine the selected security environment from the group of security environments associated with the data interaction platform computing entity106based on the probability scores generated by the machine learning model for each security environment in the group of security environments associated with the data interaction platform computing entity106.

At step/operation1804, the security profile enforcement engine113determines a selected access level for the data object based on the security profile for the data object and the selected security environment for the data access request. In some embodiments, the security profile enforcement engine113identifies an access criterion associated with the security profile that corresponds to the selected security environment, identifies the access level associated with the access criterion, and adopts the identified access level as the selected access level associated with the data access request.

In some embodiments, the security profile enforcement engine113determines, based on the selected security environment, one or more future security environments of the data access request at temporal units near a current temporal unit and adopts an access level that satisfies the selected security environment as well as the one or more future security environments. For example, if the security profile enforcement engine113determines that a user profile associated with a data access request is currently at a work location but is about to leave the work location, the security profile enforcement engine113may determine that the data access request should be associated with a non-work-related access level rather than a work-related access level. As another example, if the security profile enforcement engine113is expected to be in China in a number of days, the security profile enforcement engine113may determine a selected access level for China even if the jurisdictional runtime parameter of the end user does not currently correspond to China.

At step/operation1805, the security profile enforcement engine113processes the data access request based on the selected access level. In some embodiments, to process the data access request based on the selected access level, the security profile enforcement engine113ensures any communication of data between the data interaction platform computing entity106and a client computing entity102associated with the data access request is in accordance with the selected access level. In some embodiments, processing the data access request based at least in part on the selected access level includes generating a refined version of the data object in accordance with the selected access level and providing the refined version to a client computing entity associated with the data access request.

In some embodiments, the selected access level controls, in addition to and/or instead of the level of access of the client computing entity102associated with the data access request to the data associated with the data object, the level of access of the data interaction platform computing entity106to the data associated with client computing entity102. For example, in some embodiments, a jurisdictional runtime parameter may be used to determine a selected security environment and a selected access level that prevents the data interaction platform computing entity106from gathering personal data (e.g., Hyper-Text Transfer Protocol (HTTP) cookie data) associated with a client computing entity102and/or a user profile associated with the client computing entity102. In some embodiments, when an end user in Europe, selection of security environments and access levels may be performed in a manner that limits the ability of the data interaction platform computing entity106from gathering browsing data associated with an end user in accordance with European data privacy regulations.

Runtime-Dynamic Data Sharing and Data Communication

The dynamic security enforcement concepts discussed herein can be utilized to enhance data security in any data interaction applications. Examples of such data interaction applications including data sharing applications and data communication applications. A data sharing application (e.g., a collaboration document management application and/or a collaborative data management application) may enable user profiles to share data with one another and/or with user profiles outside the data sharing application. A data communication application (e.g., a messaging application and/or an email application) may enable user profiles to communicate with one another and/or with user profiles outside the data communication application.

An operational example of performing dynamic security enforcement with respect to data sharing is presented inFIGS. 23-26.FIG. 23depicts a data object hierarchy2300for a data object A2301A. As depicted in the data object hierarchy2300, the data object is a parent of data object B2301, which in turn is a parent of data objects D-E2301D-E; as well as data object C2301C. The dynamic security enforcement concepts discussed herein enable defining various access levels with respect to the data object hierarchy2300, such as the access levels AL1-AL4whose respective access privileges are depicted in the access level definition data2400ofFIG. 24. As depicted in the access level definition data2400, access level AL1is associated with data objects A-E2301A-E, access level AL2is associated with data objects A-B2301A-B as well as data objects D-E2301D-E, access level AL3is associated with data objects A-C2301A-C, and access level AL4is associated with the data objects A-B2301A-B.

The dynamic security enforcement concepts discussed herein further enable defining various security environments based on combinations of runtime parameter value ranges. For example, as depicted in the security environment definition data2500ofFIG. 25, security environment SE1is associated with the value L1for the location-based runtime parameter and the value T1for the temporal runtime parameter, security environment SE2is associated with the value L1for the location-based runtime parameter and the value T2for the temporal runtime parameter, security environment SE3is associated with the value L2for the location-based runtime parameter and the value T1for the temporal runtime parameter, and security environment SE4is associated with the value L2for the location-based runtime parameter and the value T2for the temporal runtime parameter.

The dynamic security enforcement concepts discussed herein further enable defining security profiles for accessing the data object A2301A based on associating access levels AL1-AL4and security environments SE1-SE4. For example, as depicted in the security profile definition data2600ofFIG. 26, the defined security profiles includes the following access criterions: access criterion AC1which associates security environment SE1with the access level AL1, access criterion AC2which associates security environment SE2with the access level AL2, access criterion AC3which associates security environment SE3with the access level AL3, and access criterion AC4which associates security environment SE4with the access level AL4. The defined security profile can now be utilized to share the data associated with the data object A2301A in a manner that has both static sharing properties and dynamic runtime sharing properties. Such dynamic definition of sharing parameters can enhance security and efficiency of data sharing applications.

An operational example of performing dynamic security enforcement with respect to data communication is presented inFIGS. 27-28.FIG. 27depicts cross-user access privilege data2700for a shared communication2701having seven parts2702, where an initiating user profile intends to share different partitions of the seven shared communication parts2702with different user groups2703. For example, the shared communication2701may include meeting notes for different individuals who have attended a meeting, where only particular portions of the meeting notes are relevant to particular users. To accomplish the noted goal of partitioned communication of the shared communication parts2702between the user groups2703, an initiating user profile may define access levels each associated with a different combination of the shared communication parts2701, define security environments based on user groups and/or runtime parameters, and define a security profile for the shared communication2701based on associating access levels and security environments. The defined security profile may then be used to generate partitioned communications having the structure defined by the cross-user communication partition user interface2800ofFIG. 28, where each user group is allowed to access particular parts of the shared communication2701.

Thus, particular embodiments of the subject matter have been described. Other embodiments are within the scope of the following claims. In some cases, the actions recited in the claims can be performed in a different order and still achieve desirable results. In addition, the processes depicted in the accompanying figures do not necessarily require the particular order shown, or sequential order, to achieve desirable results, unless described otherwise. In certain implementations, multitasking and parallel processing may be advantageous. Many modifications and other embodiments will come to mind to one skilled in the art to which this disclosure pertains having the benefit of the teachings presented in the foregoing descriptions and the associated drawings. Therefore, it is to be understood that the disclosure is not to be limited to the specific embodiments disclosed and that modifications and other embodiments are intended to be included within the scope of the appended claims. Although specific terms are employed herein, they are used in a generic and descriptive sense only and not for purposes of limitation.