Data access control with flexible data disclosure

• US 10,169,599 B2
• Filed: 08/26/2009
• Issued: 01/01/2019
• Est. Priority Date: 08/26/2009
• Status: Active Grant

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Fox, Joshua, Pelts, Michael
• Primary Examiner(s): Gergiso, Techane
• Application Number:
  US12/548,123
• Publication Number:
  US 20110055932A1
• Time in Patent Office: 3,415 Days
• Field of Search: 726 27
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database

Abstract

A method for presenting data, the method including presenting via a first computer output device an indicator indicating a data item whose value is prevented, in accordance with predefined access control criteria, from being presented via the first computer output device, receiving from a requestor a request to present the data item value, maintaining a record of an identity of the requestor together with a description of the requested data item, and presenting via a second computer output device the data item value.

Claims

1. A computer-implemented method, comprising:

controlling access to a data item value of a data item that is obscured by an indicator providing a description of the obscured data item value, wherein the data item is any one of a structured data and an unstructured data, by;

presenting, with a first computer output device, the indicator; and

in response to receiving a request from a requestor to access the data item value,

receiving a reason for the request, wherein the reason is associated with a level of access control, wherein the level of access control is based on any one of the requestor, a role, and the data item value;

determining that the reason is valid;

providing access to the data item value by presenting the data item value on a second computer output device; and

recording an identity of the requestor, the reason, and the description of the data item value.

2. A method according to claim 1, wherein the providing the access to the data item value is in accordance with a predefined access control criteria.

3. A method according to claim 1, wherein the indicator is provided in place of the data item value indicating that access to the data item value is prevented in accordance with a predefined access control criteria.

4. A system, comprising:

a processor;

storage coupled to the processor, wherein the storage stores computer program instructions, and wherein the processor executes the computer program instructions to perform operations, and wherein the operations comprise;

controlling access to a data item value of a data item that is obscured by an indicator providing a description of the obscured data item value, wherein the data item is any one of a structured data and an unstructured data, by;

presenting, with a first computer output device, the indicator; and

in response to receiving a request from a requestor to access the data item value,

receiving a reason for the request, wherein the reason is associated with a level of access control, wherein the level of access control is based on any one of the requestor, a role, and the data item value;

determining that the reason is valid;

providing access to the data item value by presenting the data item value on a second computer output device; and

recording an identity of the requestor, the reason, and the description of the data item value.

5. A system according to claim 4, wherein the providing the access to the data item value is in accordance with a predefined access control criteria.

6. A system according to claim 4, wherein the indicator is provided in place of the data item value indicating that access to the data item value is prevented in accordance with a predefined access control criteria.

7. A computer program product stored on a computer readable device, the computer program product comprising computer program instructions, when executed by a processor, operative to perform:

controlling access to a data item value of a data item that is obscured by an indicator providing a description of the obscured data item value, wherein the data item is any one of a structured data and an unstructured data, by;

presenting, with a first computer output device, the indicator; and

in response to receiving a request from a requestor to access the data item value,

receiving a reason for the request, wherein the reason is associated with a level of access control, wherein the level of access control is based on any one of the requestor, a role, and the data item value;

determining that the reason is valid;

providing access to the data item value by presenting the data item value on a second computer output device; and

recording an identity of the requestor, the reason, and the description of the data item value.

8. A computer program product according to claim 7, wherein the providing the access to the data item value is in accordance with a predefined access control criteria.

9. A computer program product according to claim 7, wherein the indicator is provided in place of the data item value indicating that access to the data item value is prevented in accordance with a predefined access control criteria.