Patent Description:
A security policy adopted by an organization may require restricting users' access to various documents, software programs, etc. The organization may implement the security policy by imposing access control policies with respect to various computing resources, such as folders, data and executable files, databases, libraries, etc..

<CIT> discloses access control techniques for shared computing resources in a hierarchical system. An effective access control list for a computing resource is determined after a request is received from a user to access the resource. When resources are shared, access control policies are created and stored in association with the shared resource but are not stored in association with hierarchically related lower-level resources. When an access request for a resource is received, access control policies are collected for levels of a computing resource hierarchy that are higher than the hierarchy level of the resource. An effective access control list is determined based on permissions specified in the collected access control policies. The effective access control list represents an effective propagation of access control policies of higher hierarchy levels to the computing resource.

<CIT> discloses a computer system storing electronic objects being defined by metadata items. Access rights are derived from one or more security components originating from respective metadata items of at least one object, and the effective access rights for the object are determined by means of the security components. It is further disclosed that access rights for an object may be determined by means of one or more pseudo-users.

Due account shall be taken of any element which is equivalent to an element specified in the claims.

The present disclosure will be understood more fully from the detailed description given below and from the accompanying drawings of various implementations thereof, which, however, should not be taken to limit the present disclosure to the specific implementations, but are for explanation and understanding only.

The following description sets forth numerous specific details such as examples of specific systems, components, methods, and so forth, in order to provide a good understanding of several implementations of the present disclosure. It will be apparent to one skilled in the art, however, that at least some implementations of the present disclosure may be practiced without these specific details. In other instances, well-known components or methods are not described in detail or are presented in simple block diagram format in order to avoid unnecessarily obscuring the present disclosure. Thus, the specific details set forth are merely exemplary. Particular implementations may vary from these exemplary details and still be contemplated to be within the scope of the present disclosure.

Aspects of the present disclosure are directed to enforcing granular access control policies. In an illustrative example, an access control policy associated with one or more computing resources ("artifacts") may include one or more access control rules, such that each access control rule specifies an actor (e.g., a user or a user group) and an action which the specified actor is authorized to perform with respect to the computing resources.

While implementing access control with respect to common types of computing resources, such as files, folders, databases, libraries, etc., conventional resource access control methods typically offer no specific support for composite computing resources, such as computing resources that are embedded into resource containers or computing resources having multi-part structure, in which every part of a resource may require a distinct set of access control rules and/or a set of access control rules that depends on access control policies associated with other parts of the composite resource and/or access control policies associated with related resources.

Aspects of the present disclosure address the above-noted and other deficiencies of conventional access control methods by providing granular access control policies suitable for heterogeneous computing resources, such as composite computing resources, as well as providing access control policies that explicitly depend upon access control policies of related computing resources. Access control methods of the present disclosure may associate, with an artifact, an access control policy that includes a set of access control rules specifying the actions that may be performed with respect to the artifact by certain actors (e.g., users and/or user groups). For example, an access control rule may specify a user group and an action that the members of that user group are authorized to perform with respect to the artifact.

Various applications, such as applications hosted by the application platform <NUM> of <FIG>, may employ composite computing resources, also referred to as "resource containers" herein. A resource container is a resource that incorporates (including incorporation by reference) other resources. Such incorporated resources are referred to as "embedded resources" or "embedded artifacts" herein. For example, a container may be represented by a project (such as an investigation), while the investigation data items (e.g., investigation state information and the associated graphs and maps) may be referred to as the embedded objects. The relationship between a resource container and its embedded resources may, for illustrative purposes, be referred to herein as a "parent-child" relationship.

A container, like any other resource, may be associated with an access control policy. In some implementations, an embedded artifact may inherit the access control policy of the corresponding resource container. For example, the inheritance mechanism may be implemented by initializing the access control policy identifier of an embedded artifact to reference the access control policy of its container. Thus, when the container's access control policy changes, the embedded artifact's access control policy would change automatically, unless the parent-child relationship is explicitly destroyed (e.g., by performing an operation that removes the embedded artifact from the container).

In some implementations, the access control policy of the container may be further restricted for an embedded artifact. In other words, the access control policy of an embedded artifact may be the same or more restrictive than the access control policy of its container. For example, the restricted version of the access control policy of the container may be implemented by the embedded artifact referencing a subset of the access control policy of the container, rather than full access control policy of the container.

A new artifact created within a container may automatically inherit the access control policy of the container. Conversely, when an existing artifact is copied or moved into a container, the artifact's access control policy may be modified to comply with the access control policy of the container, in order to satisfy the general rule requiring that the access control policy of an embedded artifact be the same or more restrictive than the access control policy of its container. The resulting access control policy of the embedded artifact may be represented by a subset of the access control policy of the container, such that the subset is equal to the intersection of the access control policy of the container and the initial (pre-embedded) access control policy of the artifact. The access control policy identifier of the embedded artifact may be modified to reference the subset of the access control policy of the container.

An embedded artifact may in turn act as a container with respect to one or more artifacts, thus yielding a multi-level nested container structure. In such a structure, the access control policy of the inner (embedded) container may be the same or more restrictive than that of the outer container, while the access control policy of the artifacts embedded by the inner container may be the same or more restrictive than that of the inner (embedded) container.

In some implementations, an artifact (such as a container or an embedded artifact) may have a multi-part structure (e.g., a map may include multiple layers), in which at least one part is associated with an access control policy that is more restrictive than the access control policy of the other parts of the artifact, thus simulating a paper document with one or more "tear lines" that divide the document into two or more parts with different security classifications. For an embedded artifact having a multi-part structure, at least one part may be associated with an access control policy that is more restrictive than the access control policy of the other parts of the embedded artifact (and, therefore, is more restrictive than the access control policy of the container hosting the embedded artifact).

When a multi-part artifact is shared with a user, some portions of the artifact may be automatically redacted based on the user's associations with one or more user groups and applicable access control policies. For example, if an access control policy requires that a user be a member of the user group G<NUM> in order to access one part of the artifact and a member of the user groups G<NUM> and G<NUM> in order to access another part of the artifact, a user who is only a member of the user group G<NUM> shall be granted access to the first part of the artifact but not the second part of the artifact (i.e., the user is denied access to the second part of the artifact).

As noted above, the parent-child relationship of an embedded artifact and its container may be explicitly destroyed (e.g., by performing an operation that removes the embedded artifact from the container). Destroying the parent-child relationship may result in creating a copy of at least a subset of the access control policy of the container and associating the copy with the artifact. Accordingly, upon destroying the parent-child relationship, the artifact's access control policy may no longer track the changes of the container's access control policy.

As noted above, various conventional access control methods are designed for providing object-level security, and thus may not be adaptable for composite resources, such as embedded artifacts, including the embedded artifacts having a multi-part structure, described herein. Conversely, the systems and methods described herein overcome various deficiencies of conventional access control methods by providing granular access control policies which are suitable for embedded artifacts and artifacts having a multi-part structure, and thus improve the functioning of various computing systems, as described in more detail herein below.

The methods described herein may be implemented by hardware (e.g., general purpose and/or specialized processing devices, and/or other devices and associated circuitry), software (e.g., instructions executable by a processing device), or a combination thereof.

<FIG> schematically illustrates an example composite resource including a container and its embedded artifacts, implemented in accordance with one or more aspects of the present disclosure. As shown in <FIG>, container <NUM> may host one or more embedded artifacts 110A-110N. Container <NUM> may be associated, by access control policy pointer <NUM>, with access control policy <NUM>. Access control policy pointer <NUM> may be stored in the metadata of container <NUM>.

Access control policy <NUM> may include the default access control rule that denies all types of access to all users, and may further include one or more access control rules 140A-<NUM>, such that each access control rule <NUM> includes an identifier of a user group <NUM> and a corresponding set of access permissions <NUM>, thus indicating that a member of user group <NUM> is authorized to perform, with respect to one or more resources associated with access control policy <NUM>, the actions identified by access permissions <NUM>. For example, such actions may include reading the resource, writing to the resource, executing the resource, and/or deleting the resource.

As noted above, an embedded artifact may inherit the access control policy of its container. Thus, in the illustrative example of <FIG>, each of embedded artifacts 110A-110N inherits access control policy <NUM> of container <NUM>. The association of an embedded artifact <NUM> with access control policy <NUM> of container <NUM> may be expressed by the corresponding access control policy pointer <NUM>, which may be a part of the metadata of the embedded artifact <NUM>. Changes to access control policy <NUM> of container <NUM> may be automatically tracked by respective access control policies of embedded artifacts 110A-110N, unless the parent-child relationship is explicitly destroyed for one or more embedded artifacts 110A-110N. The parent-child association of an embedded artifact <NUM> and container <NUM> may be destroyed by moving the embedded artifact <NUM> out of container <NUM> (e.g., to another container).

As noted above, the access control policy of an embedded artifact <NUM> may be the same or more restrictive than the access control policy of its container <NUM>. <FIG> schematically illustrates an example of restricting the container's access control policy for its embedded artifact, in accordance with one or more aspects of the present disclosure. The restricted version of the access control policy of the container may be implemented by embedded artifact <NUM> referencing, by its access control policy pointer <NUM>, a subset <NUM> of access control policy <NUM> of container <NUM>. Similarly to the example of <FIG>, container <NUM>, which hosts embedded artifact <NUM>, is associated, by access control policy pointer <NUM>, with access control policy <NUM>. The latter includes one or more access control rules, such that each access control rule includes an identifier of a user group <NUM> and a corresponding set of access permissions <NUM>, thus indicating that a member of the user group <NUM> is authorized to perform, with respect to one or more resources associated with access control policy <NUM>, the actions identified by access permissions <NUM>.

In an illustrative example, embedded artifact <NUM> may need to be shared with one or more users whose group affiliations do not allow them to access the whole content of embedded artifact <NUM> based on the access control policy <NUM>. In order to share embedded artifact <NUM> with such users, a restrictive version <NUM> of access control policy <NUM> may be created. For example, the restrictive version <NUM> of the access control policy <NUM> may be represented by a subset of the access control policy <NUM>, such that the subset only includes the access control rules that reference one or more user groups of the user with whom the embedded artifact is to be shared, thus ensuring that the target user population would in fact have the requisite access rights. One or more parts of embedded artifact <NUM> may be redacted based on the restrictive version <NUM> of access control policy <NUM>, thus producing embedded artifact <NUM>. For example, the parts that are redacted may include the parts that are associated with one or more access control rules that are present in the access control policy <NUM>, but were removed from the restrictive version <NUM> of the access control policy <NUM>. Upon associating embedded artifact <NUM> with the restrictive version <NUM> of access control policy <NUM>, embedded artifact <NUM> may be shared with one or more users that are authorized to access the embedded artifact based on the restrictive version <NUM> of access control policy <NUM>.

<FIG> schematically illustrates an example of modifying access control policy of an artifact upon its association with a container, in accordance with one or more aspects of the present disclosure. As shown, a new artifact 310A created within container <NUM> automatically inherits access control policy <NUM> of container <NUM> (e.g., by initializing access control policy pointer <NUM> of embedded artifact 310A to reference access control policy <NUM> of container <NUM>). Conversely, when an existing artifact <NUM> is copied or moved into container <NUM>, thus becoming embedded artifact 310B, access control policy <NUM> that was previously associated with artifact <NUM> (e.g., by access control policy pointer <NUM>) is modified to comply with access control policy <NUM> of container <NUM>, in order to satisfy the general rule requiring that the access control policy of an embedded artifact be the same or more restrictive than the access control policy of its container. In the illustrative example of <FIG>, such a modification involves identifying a subset <NUM> of access control policy <NUM> which is equal to the intersection of access control policy <NUM> and access control policy <NUM>, and associating embedded artifact 310B with the identified subset <NUM> of access control policy <NUM> of container <NUM> (e.g., by pointer 350B referencing the identified subset of the access control policy of the container). Similarly to the example of <FIG>, container <NUM>, which hosts the embedded artifacts 310A-310B, is associated, by access control policy pointer <NUM>, with access control policy <NUM>. The latter includes one or more access control rules, such that each access control rule includes an identifier of a user group <NUM> and a corresponding set of access permissions <NUM>, thus indicating that a member of user group <NUM> is authorized to perform, with respect to one or more resources associated with access control policy <NUM>, the actions identified by access permissions <NUM>.

As noted herein above, the parent-child association of an embedded artifact and its container may be explicitly destroyed (e.g., by performing an operation that removes the embedded artifact from the container). In the illustrative example of <FIG>, the parent-child association of embedded artifact 310A and container <NUM> may be destroyed by moving embedded artifact 310A out of container <NUM>, such that embedded artifact 310A would become artifact <NUM>. Destroying the parent-child association may require creating a copy <NUM> of access control policy <NUM> of container <NUM> and associating, by access control policy pointer <NUM>, the newly created access control policy <NUM> with artifact <NUM>. Accordingly, upon destroying the parent-child association, the changes of the container's access control policy <NUM> would no longer be tracked by the access control policy of artifact <NUM>.

<FIG> schematically illustrates an example multi-level nested container structure implemented in accordance with one or more aspects of the present disclosure. As shown, embedded artifact <NUM> may act as a container with respect to one or more embedded artifacts 415A-415B, thus yielding a multi-level nested container structure. In such a structure, the access control policy of the inner (embedded) container may be the same or more restrictive than that of the outer container, while the access control policy of the artifacts embedded by the inner container may be the same or more restrictive than that of the inner (embedded) container. In the illustrative example of <FIG>, outer container <NUM>, which hosts inner container <NUM>, is associated, by access control policy pointer <NUM>, with access control policy <NUM>. In turn, inner container <NUM>, which hosts embedded artifacts 415A-415B, is associated, by access control policy pointer <NUM>, with access control policy <NUM> of the container <NUM>. Finally, embedded artifact 415A is associated, by access control policy pointer 418A, with access control policy <NUM>, which represents a subset of access control policy <NUM> of outer container <NUM>, while embedded artifact 415A, is associated, by access control policy pointer 418B, with access control policy <NUM> of outer container <NUM>. Similarly to the illustrative example of <FIG>, access control policy <NUM> includes one or more access control rules, such that each access control rule includes an identifier of a user group <NUM> and a corresponding set of access permissions <NUM>, thus indicating that a member of user group <NUM> is authorized to perform, with respect to one or more resources associated with access control policy <NUM>, the actions identified by access permissions <NUM>.

As noted above, an artifact (such as a container or an embedded artifact) may have a multi-part structure, in which at least one part is associated with an access control policy which is more restrictive than the access control policy of the other parts of the artifact, thus simulating a paper document with one or more "tear lines" that divide the document into two or more parts with different security classifications. Referring now to <FIG>, which schematically illustrates an example multi-part artifact structure implemented in accordance with one or more aspects of the present disclosure, container <NUM> may host one or more embedded artifacts 510A-510B. Container <NUM> may be associated, by access control policy pointer <NUM>, with access control policy <NUM>.

Container <NUM> may include two or more parts 502A-502B, such that at least one part 502B is associated, by access control policy pointer <NUM>, with a subset <NUM> of access control policy <NUM> of the container. Similarly to the illustrative example of <FIG>, access control policy <NUM> includes one or more access control rules 540A-<NUM>, such that each access control rule <NUM> includes an identifier of a user group <NUM> and a corresponding set of access permissions <NUM>, thus indicating that a member of user group <NUM> is authorized to perform, with respect to one or more resources associated with access control policy <NUM>, the actions identified by access permissions <NUM>.

For an embedded artifact having a multi-part structure, at least one part is associated with an access control policy which is more restrictive than the access control policy of the other parts of the embedded artifact (and, therefore, is more restrictive than the access control policy of the container hosting the embedded artifact). Accordingly, embedded artifact 510B, which is hosted by part 502B of container <NUM>, may include two or more parts 512A-512B, such that part 512B is associated, by access control policy pointer <NUM>, with subset <NUM> of access control policy <NUM> of container part 502B, while part 512A is associated, by access control policy pointer <NUM>, with access control policy <NUM> of container part 502B.

When a multi-part artifact is shared with a user, some portions of the artifact may be automatically redacted based on the user's associations with one or more user groups and applicable access control policies. Accordingly, in the illustrative example of <FIG>, access control policy <NUM> associated with embedded artifact 510B requires that a user be a member of the user group G<NUM> in order to be granted read access to the artifact, while the more restrictive access control policy <NUM> requires that the user be a member of the user groups G<NUM> and G<NUM> in order to be granted read access to the restricted part 512A of artifact 510B. Therefore, a user who is only a member of the user group G<NUM> will be granted access to part 512A of artifact 510B, while access to part 512B of artifact 510B will be denied to the user.

<FIG> is a block diagram illustrating a distributed computing system in which the systems and method described herein may operate. Distributed computing system <NUM> may include one or more client devices <NUM> and an application platform <NUM>, which may communicate with each other via network <NUM>. Computer system <NUM> of <FIG> may be one example of any of client devices <NUM> or a server(s) in the application platform <NUM>. Network <NUM> may include, for example, the Internet, intranets, extranets, wide area networks (WANs), local area networks (LANs), wired networks, wireless networks, or other suitable networks, etc., or any combination of two or more such networks.

Client devices <NUM> may include computer systems embodied in the form of desktop computers, laptop computers, personal digital assistants, cellular telephones, smartphones, set-top boxes, music players, web pads, tablet computer systems, game consoles, electronic book readers, or other devices with similar capability.

Application platform <NUM> may include, for example, one or more server computers or any other system providing computing capability. Alternatively, application platform <NUM> may employ a plurality of computing devices that may be arranged, for example, in one or more clusters or other arrangements. Such computing devices may be positioned in a single location or may be distributed among many different geographical locations. For example, application platform <NUM> may include a plurality of computing devices that together may comprise a hosted computing resource, a grid computing resource and/or any other distributed computing arrangement. In some cases, application platform <NUM> may correspond to an elastic computing resource where the allotted capacity of processing, network, storage, or other computing-related resources may vary over time.

In some implementations, application platform <NUM> may include one or more application servers <NUM>, datastore <NUM> storing the enterprise data, enterprise directory <NUM>, authentication server <NUM>, and access control server <NUM>. Various other functional and/or infrastructure components, such as presentation layer servers, load balancers, firewalls, routers, switches, etc. are omitted from <FIG> for clarity and conciseness. Application servers <NUM> may be employed to deliver functionality of various business applications, as described in more detail herein below with reference to <FIG>.

Datastore <NUM> may include one or more mass storage devices which may include, for example, flash memory, magnetic or optical disks, or tape drives; read-only memory (ROM); random-access memory (RAM); erasable programmable memory (e.g., EPROM and EEPROM); flash memory; or any other type of storage medium. Datastore <NUM> may include structured and/or unstructured sets of data that may be divided/extracted for provisioning when needed by one or more components of application platform <NUM>. Datastore <NUM> may include one or more datasets which may be stored in one or more databases, such as a relational database.

Enterprise directory <NUM> may be designed to provide distributed directory information services by querying an organized set of records representing various entities, including users, user groups, organizations, etc. In an illustrative example, enterprise directory <NUM> may include a set of user records, such that each record is uniquely identified by a user identifier and includes the user authentication credentials (or their derivative forms) and a list of user groups associated with the user. In some implementations, enterprise server <NUM> may implement Lightweight Directory Access Protocol (LDAP).

Authentication server <NUM> may perform user authentication based on the user credentials (e.g., a user identifier and a user password) supplied by the user via client device <NUM>. In some implementations, responsive to successfully authenticating a user, authentication server <NUM> may issue a ticket that client device <NUM> may then present to access control server <NUM> in order to get access to one or more application servers <NUM>. In some implementations, authentication server <NUM> may support multi-factor user authentication (e.g., based on the knowledge factor and the possession factor). While in some implementations, authentication server <NUM> and access control server <NUM> may implement Kerberos protocol, in other implementations, authentication server <NUM> and access control server <NUM> may implement another strong authentication protocol that facilitates acquiring authentication assertions and deriving secondary credentials for gaining access to specific applications. Access control server <NUM> may implement granular access control policies that are described in more detail above with reference to <FIG>.

In an illustrative example, client device <NUM> may prompt the user to supply the authentication credentials (e.g., a user identifier, a password, and a short-lived alphanumeric nonce) and may transmit an authentication request based on the user's input to authentication server <NUM>. Responsive to successfully authenticating the user based on the authentication credentials, authentication server <NUM> may issue an authentication ticket, which may be presented, by client device <NUM>, to access control server <NUM> in order to gain access to various resources of application platform <NUM>. Access control server <NUM> may verify the user's entitlement to access the requested resource. In some implementations, the user's entitlement verification involves matching the groups associated with the user to the user groups specified by the access control policy that is associated with the requested resource. The resource may be represented by a resource container, an embedded resource, or a multi-part resource, as described in more detail herein above.

Responsive to determining that the access control policy allows the requesting access type (e.g., reading the resource, writing to the resource, executing the resource, and/or deleting the resource) to at least one user group associated with the user, access control server <NUM> may allow the user to access the requested resource; otherwise, the access request may be denied and an error message may be displayed to the user.

In some implementations, the user may choose to act based on a subset of their access rights, rather than the full set of rights. In some implementations, the user may select a subset of their user groups in order to gain access to the requested resource resource based on the access rights associated with the selected subset of user groups.

<FIG> schematically illustrates the main screen of the browser application which may be hosted by application platform <NUM> of <FIG>, in accordance with one or more aspects of the present disclosure. The browser application is a virtual dossier associated with one or more artifacts (e.g., projects, interactive maps, or any other sets of a hierarchically organized data object). The artifacts may include containers, embedded artifacts, and/or multi-part artifacts associated with granular access control policies, as described in more detail above with reference to <FIG>. The browser application may be used to view detailed information on one or more artifacts or their embedded objects, edit object properties, add notes, and view a history of changes that were made to the object. Additionally, the user may set up triggers and feeds to monitor changes or messages related to one or more objects. The browser application may include various graphical user interface (GUI) controls, e.g., browser tabs <NUM> for switching between artifacts (e.g., documents) and folders. The browser toolbar <NUM> may include various icons associated with tasks that may be performed in the artifacts. Browser panel <NUM> may include a list of objects in the currently selected folders. The browser subtabs <NUM> may be utilized to view and modify the currently selected objects.

<FIG> schematically illustrates the main screen of the object explorer application which may be hosted by application platform <NUM> of <FIG>, in accordance with one or more aspects of the present disclosure. The object explorer application allows the user to view the entire data set, filter the data by using the visualization, and perform targeted actions on the resulting object. The objects of the data set may include containers, embedded artifacts, and/or multi-part artifacts associated with granular access control policies, as described in more detail above with reference to <FIG>. The object explorer application may include various graphical user interface (GUI) controls, e.g., the formula panel <NUM> for creating and working with formulas and object sets. The instrument panel <NUM> allows the user to specify display options for the visualization of the data set. The visualization panel <NUM> allows the user to review the selected objects. The preview panel <NUM> allows the user to derive new object sets and produce histograms from the selected data.

<FIG> schematically illustrates the main screen of the summary application which may be hosted by application platform <NUM> of <FIG>, in accordance with one or more aspects of the present disclosure. The summary application allows the user to prepare a presentation from a set of thumbnails that show actions in a project over time, select which history slides to include, specify a title and description of each slide, and save the presentation in a chosen format (e.g., HTML). The objects manipulated by the summary application may include containers, embedded artifacts, and/or multi-part artifacts associated with granular access control policies, as described in more detail above with reference to <FIG>. The summary application may include various graphical user interface (GUI) controls, e.g., the information summary panel <NUM> for modifying the project title and/or description. The history slides panel allows the user to select slide for export. The selected slides may be reviewed in the preview panel <NUM>. The export button <NUM> activates exporting of the selected slide to a specified format.

<FIG> schematically illustrates the main screen of the collaboration application which may be hosted by application platform <NUM> of <FIG>, in accordance with one or more aspects of the present disclosure. The collaboration application allows the user to build discussion communities, form teams, exchange messages, share media rich links to various objects, and send notifications of shared objects. The objects manipulated by the collaboration application may include containers, embedded artifacts, and/or multi-part artifacts associated with granular access control policies, as described in more detail above with reference to <FIG>. The collaboration application may include various graphical user interface (GUI) controls, e.g., the sidebar <NUM> to create and manage teams, or select a team to view messages. The message panel <NUM> allows the user to send messages to individual users or teams. The team message panel <NUM> displays the team messages.

<FIG> depicts a flowchart of an example method of providing access control policy for embedded artifacts, in accordance with one or more aspects of the present disclosure. Method <NUM> and/or each of its individual functions, routines, subroutines, or operations may be performed by one or more processors of the computer system (e.g., the example computer system <NUM> of <FIG>) implementing the method. In certain implementations, method <NUM> may be performed by a single processing thread. Alternatively, method <NUM> may be performed by two or more processing threads, each thread executing one or more individual functions, routines, subroutines, or operations of the method. In an illustrative example, the processing threads implementing method <NUM> may be synchronized (e.g., using semaphores, critical sections, and/or other thread synchronization mechanisms). Alternatively, the processing threads implementing method <NUM> may be executed asynchronously with respect to each other.

At block <NUM>, a computer system implementing the method may detect an association of an embedded artifact with a resource container. For example, an existing artifact may be copied or moved into the resource container. In another example, a new artifact may be created within the resource container, as described in more detail above with references to <FIG>.

At block <NUM>, the computer system may associate the embedded artifact with at least a subset of the access control policy of the resource container. As noted above, the access control policy of the embedded artifact may be the same or more restrictive than the access control policy of its container. Accordingly, the restricted version of the access control policy of the container may be implemented as a subset of the access control policy of the container, as described in more detail above with references to <FIG>.

At block <NUM>, the computer system may receive an access request to access the embedded artifact. The access request may specify the identifier of the user that has initiated the access request and the type of access that is requested (e.g., reading the embedded artifact, writing to the embedded artifact, executing the embedded artifact, and/or deleting the embedded artifact) as described in more detail above with references to <FIG>.

At block <NUM>, the computer system may apply the access control policy associated with the resource container for determining whether the access request is grantable. For example, the computer system may query the user directory for a list of user groups associated with the user that initiated the access request. The computer system may then traverse the access control policy associated with the embedded artifact while attempting to match the user group of each access control rule of the access control policy to each of the user groups on the list of the user groups associated with the user that initiated the access request. Should a match be found, the computer system may determine whether the matching access control rule allows the type of access specified by the access request. If the type of access specified by the rule does matches the type of access specified by the access request, the computer system may, at block <NUM>, grant the access request; otherwise, the computer system may continue traversing the access control policy until a matching rule is found. If no matching rules are found, the computer system may, at block <NUM>, deny the access request, and the method may terminate.

<FIG> depicts a flowchart of an example method of disassociating an embedded artifact from its container, in accordance with one or more aspects of the present disclosure. Method <NUM> and/or each of its individual functions, routines, subroutines, or operations may be performed by one or more processors of the computer system (e.g., the example computer system <NUM> of <FIG>) implementing the method. In certain implementations, method <NUM> may be performed by a single processing thread. Alternatively, method <NUM> may be performed by two or more processing threads, each thread executing one or more individual functions, routines, subroutines, or operations of the method. In an illustrative example, the processing threads implementing method <NUM> may be synchronized (e.g., using semaphores, critical sections, and/or other thread synchronization mechanisms). Alternatively, the processing threads implementing method <NUM> may be executed asynchronously with respect to each other.

At block <NUM>, a computer system implementing the method may create a copy of the access control policy associated with an embedded artifact, as described in more detail above with reference to <FIG>.

At block <NUM>, the computer system may associate the embedded artifact with the copy of the access control policy. The association of the embedded artifact with the copy of the access control policy may be expressed by the access control policy pointer, which may be a part of the metadata of the embedded artifact, as described in more detail above with reference to <FIG>.

At block <NUM>, the computer system may disassociate the embedded artifact from its container. For example, the parent-child association of the embedded artifact and its container may be destroyed by moving the embedded artifact out of its container (e.g., to another container), as described in more detail above with reference to <FIG>. Upon completing the operations of block <NUM>, the method may terminate.

<FIG> depicts a flowchart of an example method of sharing an embedded artifact with a user, in accordance with one or more aspects of the present disclosure. Method <NUM> and/or each of its individual functions, routines, subroutines, or operations may be performed by one or more processors of the computer system (e.g., the example computer system <NUM> of <FIG>) implementing the method. In certain implementations, method <NUM> may be performed by a single processing thread. Alternatively, method <NUM> may be performed by two or more processing threads, each thread executing one or more individual functions, routines, subroutines, or operations of the method. In an illustrative example, the processing threads implementing method <NUM> may be synchronized (e.g., using semaphores, critical sections, and/or other thread synchronization mechanisms). Alternatively, the processing threads implementing method <NUM> may be executed asynchronously with respect to each other.

At block <NUM>, a computer system implementing the method may create a restrictive version of the access control policy associated with an embedded artifact. For example, the restrictive version of the access control policy may be represented by a subset of the access control policy, such that the subset only includes the access control rules that reference one or more user groups of the user with whom the embedded artifact is to be shared, as described in more detail above with reference to <FIG>.

At block <NUM>, the computer system may associate the embedded artifact with the restrictive version of the access control policy. The association of the embedded artifact with the copy of the access control policy may be expressed by the access control policy pointer, which may be a part of the metadata of the embedded artifact, as described in more detail above with reference to <FIG>.

At block <NUM>, the computer system may redact one or more parts of the embedded artifact based on the restrictive version of the access control policy. In an illustrative example, the parts that are redacted may include the parts that are associated with the access control rules that are present in the unrestricted version of the access control policy of the embedded artifact, but were removed from the restrictive version of the access control policy, as described in more detail herein above with reference to <FIG>.

At block <NUM>, the computer system may share the embedded artifact with the user, as described in more detail above with reference to <FIG>. Upon completing the operations of block <NUM>, the method may terminate.

<FIG> illustrates a diagrammatic representation of a machine in the exemplary form of a computer system <NUM> within which a set of instructions, for causing the machine to perform any one or more of the methodologies discussed herein, may be executed. In alternative implementations, the machine may be connected (e.g., networked) to other machines in a local area network (LAN), an intranet, an extranet, or the Internet. The machine may operate in the capacity of a server or a client machine in a client-server distributed computing system, or as a peer machine in a peer-to-peer (or distributed) distributed computing system. The machine may be a personal computer (PC), a tablet PC, a set-top box (STB), a Personal Digital Assistant (PDA), a cellular telephone, a web appliance, a server, a network router, switch or bridge, or any machine capable of executing a set of instructions (sequential or otherwise) that specify actions to be taken by that machine. Further, while only a single machine is illustrated, the term "machine" shall also be taken to include any collection of machines that individually or jointly execute a set (or multiple sets) of instructions to perform any one or more of the methodologies discussed herein. In one implementation, computer system <NUM> may be representative of a computing device, such as a server of application platform <NUM> running rules-based dataset cleaning system <NUM> or a client computing system <NUM>.

The exemplary computer system <NUM> includes a processing device <NUM>, a main memory <NUM> (e.g., read-only memory (ROM), flash memory, dynamic random access memory (DRAM) (such as synchronous DRAM (SDRAM) or Rambus DRAM (RDRAM), etc.), a static memory <NUM> (e.g., flash memory, static random access memory (SRAM), etc.), and a data storage device <NUM>, which communicate with each other via a bus <NUM>. Any of the signals provided over various buses described herein may be time multiplexed with other signals and provided over one or more common buses. Additionally, the interconnection between circuit components or blocks may be shown as buses or as single signal lines. Each of the buses may alternatively be one or more single signal lines and each of the single signal lines may alternatively be buses.

Processing device <NUM> represents one or more general-purpose processing devices such as a microprocessor, central processing unit, or the like. More particularly, the processing device may be complex instruction set computing (CISC) microprocessor, reduced instruction set computer (RISC) microprocessor, very long instruction word (VLIW) microprocessor, or processor implementing other instruction sets, or processors implementing a combination of instruction sets. Processing device <NUM> may also be one or more special-purpose processing devices such as an application specific integrated circuit (ASIC), a field programmable gate array (FPGA), a digital signal processor (DSP), network processor, or the like. The processing device <NUM> is conFig. d to execute processing logic <NUM> for performing the operations and steps discussed herein.

The computer system <NUM> may further include a network interface device <NUM>. The computer system <NUM> also may include a video display unit <NUM> (e.g., a liquid crystal display (LCD) or a cathode ray tube (CRT)), an alphanumeric input device <NUM> (e.g., a keyboard), a cursor control device <NUM> (e.g., a mouse), and a signal generation device <NUM> (e.g., a speaker).

The data storage device <NUM> may include a machine-accessible storage medium <NUM>, on which is stored one or more set of instructions <NUM> (e.g., software) embodying any one or more of the methodologies of functions described herein. The instructions <NUM> may also reside, completely or at least partially, within the main memory <NUM> and/or within the processing device <NUM> during execution thereof by the computer system <NUM>; the main memory <NUM> and the processing device <NUM> also constituting machine-accessible storage media. The instructions <NUM> may further be transmitted or received over a network <NUM> via the network interface device <NUM>.

The machine-readable storage medium <NUM> may also be used to store instructions <NUM> of rules-based dataset cleaning, as described herein. While the machine-readable storage medium <NUM> is shown in an exemplary implementation to be a single medium, the term "machine-readable storage medium" should be taken to include a single medium or multiple media (e.g., a centralized or distributed database, and/or associated caches and servers) that store the one or more sets of instructions. A machine-readable medium includes any mechanism for storing information in a form (e.g., software, processing application) readable by a machine (e.g., a computer). The machine-readable medium may include, but is not limited to, magnetic storage medium (e.g., floppy diskette); optical storage medium (e.g., CD-ROM); magneto-optical storage medium; read-only memory (ROM); random-access memory (RAM); erasable programmable memory (e.g., EPROM and EEPROM); flash memory; or another type of medium suitable for storing electronic instructions.

Although the operations of the methods herein are shown and described in a particular order, the order of the operations of each method may be altered so that certain operations may be performed in an inverse order or so that certain operation may be performed, at least in part, concurrently with other operations. In another implementation, instructions or sub-operations of distinct operations may be in an intermittent and/or alternating manner.

It is to be understood that the above description is intended to be illustrative, and not restrictive. Many other implementations will be apparent to those of skill in the art upon reading and understanding the above description. The scope of the disclosure should, therefore, be determined with reference to the appended claims, along with the full scope of equivalents to which such claims are entitled.

In the above description, numerous details are set forth. It will be apparent, however, to one skilled in the art, that the aspects of the present disclosure may be practiced without these specific details. In some instances, well-known structures and devices are shown in block diagram form, rather than in detail, in order to avoid obscuring the present disclosure.

Some portions of the detailed descriptions above are presented in terms of algorithms and symbolic representations of operations on data bits within a computer memory. An algorithm is here, and generally, conceived to be a self-consistent sequence of steps leading to a desired result. The steps are those requiring physical manipulations of physical quantities. Usually, though not necessarily, these quantities take the form of electrical or magnetic signals capable of being stored, transferred, combined, compared, and otherwise manipulated.

Unless specifically stated otherwise, as apparent from the following discussion, it is appreciated that throughout the description, discussions utilizing terms such as "receiving," "determining," "selecting," "storing," "setting," or the like, refer to the action and processes of a computer system, or similar electronic computing device, that manipulates and transforms data represented as physical (electronic) quantities within the computer system's registers and memories into other data similarly represented as physical quantities within the computer system memories or registers or other such information storage, transmission or display devices.

The present disclosure also relates to an apparatus for performing the operations herein. This apparatus may be specially constructed for the required purposes, or it may comprise a general purpose computer selectively activated or reconfigured by a computer program stored in the computer. Such a computer program may be stored in a computer readable storage medium, such as, but not limited to, any type of disk including floppy disks, optical disks, CD-ROMs, and magnetic-optical disks, read-only memories (ROMs), random access memories (RAMs), EPROMs, EEPROMs, magnetic or optical cards, or any type of media suitable for storing electronic instructions, each coupled to a computer system bus.

Various general purpose systems may be used with programs in accordance with the teachings herein, or it may prove convenient to construct more specialized apparatus to perform the required method steps. The required structure for a variety of these systems will appear as set forth in the description. In addition, aspects of the present disclosure are not described with reference to any particular programming language. It will be appreciated that a variety of programming languages may be used to implement the teachings of the present disclosure as described herein.

Aspects of the present disclosure may be provided as a computer program product, or software, that may include a machine-readable medium having stored thereon instructions, which may be used to program a computer system (or other electronic devices) to perform a process according to the present disclosure. A machine-readable medium includes any procedure for storing or transmitting information in a form readable by a machine (e.g., a computer). For example, a machine-readable (e.g., computer-readable) medium includes a machine (e.g., a computer) readable storage medium (e.g., read only memory ("ROM"), random access memory ("RAM"), magnetic disk storage media, optical storage media, flash memory devices, etc.).

Claim 1:
A method, comprising:
detecting (<NUM>), by a computer system (<NUM>), an association of an embedded artifact (<NUM>, <NUM>) with a resource container (<NUM>);
associating (<NUM>) the embedded artifact (<NUM>, <NUM>) with an access control policy (<NUM>, <NUM>) of the resource container (<NUM>);
creating (<NUM>) a restrictive version (<NUM>) of the access control policy (<NUM>, <NUM>);
associating (<NUM>) the embedded artifact (<NUM>, <NUM>) with the restrictive version (<NUM>) of the access control policy (<NUM>, <NUM>);
redacting (<NUM>) a part of the embedded artifact (<NUM>, <NUM>) based on the restrictive version (<NUM>) of the access control policy (<NUM>, <NUM>); and
sharing (<NUM>) the embedded artifact (<NUM>, <NUM>) with a user that is authorized to access the embedded artifact (<NUM>, <NUM>) based on the restrictive version (<NUM>) of the access control policy (<NUM>, <NUM>).