Delegated authorization method and system for isolated collections

Abstract

Examples of the present disclosure describe systems and methods for delegating authorization to access isolated data sets. In various aspects, an application may receive a request for accessing an isolated set of resource identifiers and relationships. The resource identifier may correspond to a resource in one or more remote data repositories. Upon receiving the request, the application may query the remote data repository to determine whether the requester is currently authorized to access one or more resources corresponding to the resource identifier in the isolated set. If it is determined that the requester is authorized, the application may provide the requester with access to the isolated set using an authorization indication provided by the remote data repository. If it is determined that the requester is not authorized, the application may prohibit access to the isolated set.

Description

[0001] This application is a divisional application of the invention patent application "Method and system for delegated authorization of isolated collections" with application date of November 2, 2017 and application number 201780067109.9. Background Art

[0002] Authentication of electronic information is the process of evaluating a set of received credentials to determine the authenticity of a user (e.g., that the user is who he claims to be). Authorization, which occurs after successful authentication, is the process of determining access to electronic information for one or more users. Over the years, various authorization methods have evolved. Typically, such methods require implementation and maintenance of complex architectures and services that must comprehensively facilitate processes such as registration, token generation / assignment, and lifecycle maintenance. Because such requirements are often resource intensive, alternative authorization methods are desirable in many cases.

[0003] It is with respect to these and other general considerations that the various aspects disclosed herein have been made.Also, although relatively specific problems may be discussed, it should be understood that the examples should not be limited to solving specific problems identified in the background or elsewhere in this disclosure. Summary of the invention

[0004] This Summary is provided to introduce a selection of concepts in a simplified form that are further described below in the Detailed Description. This Summary is not intended to identify key features or essential features of the claimed subject matter, nor is it intended to be used as an aid in determining the scope of the claimed subject matter.

[0005] The example of the present disclosure describes the system and method of delegating authorization to access the isolated data set. In various aspects, the request for accessing the isolated set of resources, resource identifiers and / or relationships can be received by the application to determine, navigate and / or visualize the relationship between resources (e.g., people, files, tasks, etc.). The resource identifier can correspond to the resources in one or more remote data repositories. Upon receiving the request, the application can query the remote data repository to determine whether the requester is currently authorized to access one or more resources corresponding to the resource identifier in the isolated set. If it is determined that the requester is authorized, the application can use the authorization indication provided by the remote data repository to provide the requester with access to the isolated set. If it is determined that the requester is not authorized, the application can prohibit the requester from accessing the isolated set.

[0006] This summary is provided to introduce a selection of concepts in a simplified form, which concepts will be further described in the detailed description below. This summary is not intended to identify key features or essential features of the claimed subject matter, nor is it intended to be used to limit the scope of the claimed subject matter. Additional aspects, features, and / or advantages of the examples will be set forth in part in the description below, and in part will be apparent from the description, or may be learned by practice of the present disclosure. BRIEF DESCRIPTION OF THE DRAWINGS

[0007] Non-limiting and non-exhaustive examples are described with reference to the following figures.

[0008] Figure 1 An overview of an exemplary system for authorizing access to isolated collections as described herein is shown.

[0009] Figure 2 An overview of an exemplary system for managing isolated sets of resource identifiers and corresponding relationships as described herein is shown.

[0010] Figure 3A -E shows an exemplary isolated collection as described herein.

[0011] Figure 4 An exemplary method of delegating authorization to access a segregated data set as described herein is shown.

[0012] Figure 5 An exemplary method of determining access to underlying resources of an isolated collection of data as described herein is shown.

[0013] Figure 6 An exemplary method of conditionally granting access to a segregated data set as described herein is shown.

[0014] Figure 7 An exemplary method of determining whether conditions for accessing a segregated collection have been met as described herein is shown.

[0015] Figure 8 is a block diagram illustrating exemplary physical components of a computing device with which aspects of the present disclosure may be practiced.

[0016] Fig. 9A and Fig. 9B is a simplified block diagram of a mobile computing device with which aspects of the present disclosure may be practiced.

[0017] Fig.10 is a simplified block diagram of a distributed computing system in which aspects of the present disclosure may be practiced.

[0018] Fig.11A tablet computing device for performing one or more aspects of the present disclosure is shown. DETAILED DESCRIPTION

[0019] Various aspects of the present disclosure are described more fully below with reference to the accompanying drawings, which form a part of this document and illustrate specific exemplary aspects. However, different aspects of the present disclosure can be implemented in many different forms and should not be construed as being limited to the aspects set forth herein; on the contrary, these aspects are provided so that the present disclosure will be thorough and complete, and the scope of each aspect will be fully conveyed to those skilled in the art. Various aspects can be practiced as methods, systems, or devices. Therefore, various aspects can take the form of hardware implementations, complete software implementations, or implementations combining software and hardware aspects. Therefore, the following detailed description should not be considered to be limiting.

[0020] The present disclosure provides a system and method for delegating authorization to access an isolated assertion data set. In various aspects, an application or service for managing an isolated assertion data set may be accessible to a client. As used herein, an isolated assertion data set may refer to one or more asserted resources and the relationships between those resources. In an example, a resource may correspond to a person, an entity, a file, a task, an electronic communication, a document (or a portion thereof), a calendar event, a task, etc. A resource may be associated with a resource identifier (e.g., a uniform resource locator (URL), a uniform resource name (URN), etc.). A resource identifier may identify a resource and enable interaction with a representation of a resource through a network. A relationship may identify an association between one or more resources and / or resource identifiers. Such a relationship may be manually identified and / or determined using one or more rule sets or using semantic network technologies (e.g., a resource description framework (RDF), an RDF schema (RDFS), a SPARQL protocol and an RDF query language (SPARQL), an online ontology language (OWL), etc.). An isolated set may include one or more resources, resource identifiers, and / or relationships. The isolated collection may also include licensing information, one or more rule sets, and / or metadata (e.g., resource / relationship description properties, such as title, creator, subject, description, publisher, contributors, date, type format, identifier, source, language, relationship, coverage, rights, etc.). Resources and / or relationships (and corresponding data) may be referred to as "asserted" when they are not inferred or defined by the isolated collection. For example, a resource / relationship may be asserted if the resource / relationship is manually defined, determined by querying or interacting with a resource provider or data store, etc. In contrast, a resource / relationship (and corresponding data) may be referred to as "inferred" when the isolated collection uses one or more rules of the isolated collection to define the resource / relationship (or its properties). For example, a resource / relationship may be inferred if the isolated collection (or an application or service that manages the isolated collection) executes one or more rules stored by (or specifically associated with) the isolated collection against the assertion data stored by the isolated collection. Inferred resources or relationships may provide additional or enriched information for the assertion data (e.g., resources, resource identifiers, relationships, etc.). Inference data may be stored in or by an isolated set. An isolated set that includes both assertion data and inference data may be referred to as an enriched isolated assertion data set. As used herein, an isolated assertion data set and an enriched isolated assertion data set may be referred to as an "isolated set" or "set."

[0021] In various aspects, the data of the isolated collection (and its metadata) can be stored in one or more data stores accessible to the application / service. Metadata can include resource and / or relationship description attributes, such as title, creator, subject, description, publisher, contributor, date, type format, identifier, source, language, relationship, coverage, authority, etc. The application / service can provide access to interfaces for querying, navigating, visualizing and / or modifying isolated collections, associated metadata or corresponding underlying resources. In an example, the application / service can receive a request from a requester to access or generate an isolated collection and / or data associated with the isolated collection. The application / service can search the data store to determine at least a portion of the resource identifiers included in the requested isolated collection. The application / service can use the determined resource identifier to identify and / or locate one or more corresponding resources. Identifying / locating resources can include, for example: performing an HTTP call to a resource identifier, providing the resource identifier to a search / find utility, querying a resource provider, etc. In some aspects, when the determined resource identifier is located, the resource provider that can be operated to access the resource corresponding to the determined resource identifier can be queried by the application / service. As used herein, an inquiry may refer to a request for determining authorization information for one or more resources and / or resource providers. In an example, an inquiry may include accessing an authorization file on a resource provider, a user access event file, an authorization token repository, and / or a set of resource permissions. An inquiry may additionally or alternatively include a request from an application / service to respond to one or more questions related to, for example, whether the requestor is authorized to access a resource or resource provider, whether a resource provider or authentication provider has authorized the requestor to access a resource, whether an indication of authorization / authentication (e.g., a token, credential, permission set, etc.) is currently accessible by a resource provider, whether a resource provider has access rights to a resource, an expiration date / time for an indication of authorization / authentication, etc.

[0022] In various aspects, the application / service may use the results of the query to determine whether to provide access to the isolated set and / or one or more resources associated with the isolated set. For example, if the application / service determines from the query that the requester possesses a valid authorization indication for accessing the resource, the application / service may provide access to one or more isolated sets including resource identifiers corresponding to the resource. On the other hand, if the application / service determines from the query that the requester does not possess a valid authorization indication for accessing the resource, the application / service may prevent (or at least not provide) access to one or more isolated sets including resource identifiers corresponding to the resource.

[0023] Thus, the present disclosure provides multiple technical benefits, including but not limited to: enabling users to define and identify relationships between resources; inferring rich relationships from small data sets; creating robust query models; enabling powerful queries to be performed on isolated collections; providing a user interface to create, manage, and visualize isolated collections and license data; providing a delegated authorization model for isolated collection access; providing a conditional authorization model for isolated collection access; protecting access to remote resources underlying isolated collections, and other examples.

[0024] Figure 1 An overview of an exemplary system for authorizing access to an isolated collection as described herein is shown. The exemplary system 100 can be a combination of interdependent components that interact to form an integrated whole for performing delegated authorization. In various aspects, the system 100 can include hardware components (e.g., for executing / running an operating system (OS)) and / or software components (e.g., applications, application programming interfaces (APIs), modules, virtual machines, runtime libraries, etc.) running on the hardware. In certain aspects, the system 100 can provide an environment for the software components to execute, evaluate sets of operational constraints, and utilize resources or facilities of the system 100. In such aspects, the environment can include or be installed on one or more processing devices. For example, software (e.g., applications, operating instructions, modules, etc.) can be run on a processing device, such as a computer, a mobile device (e.g., a smartphone / phone, a tablet, a laptop, a personal digital assistant (PDA), etc.), and / or any other electronic device. As an example of a processing device operating environment, refer to Figure 8-11 . In other examples, the components of the systems disclosed herein can be distributed across multiple devices and can be executed by multiple devices. For example, input can be entered on a client device, and information can be processed or accessed from other devices in the network (e.g., a server device, a network appliance, other client devices, etc.).

[0025] As presented, system 100 includes client devices 102A-C, a distributed network 104, and a distributed server environment including one or more servers (e.g., server devices 106A-C). Those skilled in the art will appreciate that systems such as system 100 may vary in size and may include a variety of server environments. Figure 1 In some aspects, the engagement between components of system 100 may occur remotely, such as where the components of system 100 may be distributed across one or more devices of a distributed network.

[0026] In various aspects, the client device 102A-C can be configured to receive input via a user interface component or other input means. Examples of input can include voice, visual, touch and text input. The interface component can implement the creation, modification and navigation of various data sets and graphical representations. In an example, the various data sets can include (or otherwise be associated with) for example: resource identifiers, resource metadata, relationship information, asserted relationships, graphical mapping information, query data, rule sets (e.g., inference rules), authorization information, authentication information, etc., as discussed in more detail below. Typically, the data set is stored on one or more of the server devices 106A-C and can be accessed by the client device 102A-C via a network connection (e.g., distributed network 104). However, in some examples, the data set can be at least partially stored on one or more of the client devices 102A-C. The underlying resources represented in the various data sets can be stored locally or stored in a data storage accessible to the client device 102A-C, such as a cloud storage application. In at least one example, the underlying resources represented in the various data sets (or portions thereof) may be distributed across client devices 102A-C. For example, client device 102A (e.g., a mobile phone) may locally store a first portion of the resources represented in the data set, client device 102B (e.g., a tablet) may locally store a second portion of the resources, and client device 102C (e.g., a laptop) may locally store the remaining portion of the resources represented in the data set. In an example, client devices 102A-C may have access rights to all resources included in the data set, may have access rights to a subset of the resources included in the data set, or alternatively may not have access rights to any of the resources included in the data set.

[0027] The client device 102A-C may also be configured to determine the location of one or more resources. In various aspects, the client device 102A-C may query a resource provider and / or data store including resources corresponding to resource identifiers in various data sets. The query may include identifying a remote device where the resource is located (or from which the resource can be accessed). In some aspects, the query may additionally include determining whether the remote device (or service / separate remote device) has authorized access to the resource. If it is determined that access to the resource has been authorized, the client device 102A-C may retrieve an authentication (or authorization) indication from the remote device or authentication provider. The client device 102A-C may then use the authentication / authorization indication to provide access to one or more of the various data sets including the corresponding resource identifier. As used herein, such authorization techniques may be referred to as delegated authorization. In other aspects, the query may additionally include determining whether a set of conditions associated with the data set has been met. In an example, one or more of the conditions in a set of conditions may be inside the data set, outside the data set, or some combination thereof. If it is determined that a set of conditions has been met, the client device 102A-C may provide access to one or more corresponding data sets. As used herein, such authorization techniques may be referred to as conditional authorization.

[0028] Server device 106A-C can be configured to store one or more resources and / or provide access to one or more resources. For example, server device 106A can be a network server, server device 106B can be a device including a collaborative messaging tool and a calendar application, and server device 106C can be an email server. Each of these devices can include a resource repository accessible via one or more authorization mechanisms. In an example, when a request for a resource is received, server device 106A-C can perform or monitor an authorization process. If authorization is successful, the authorization device can store or maintain authentication / authorization instructions within a specified time period. When the time period expires, server device 106A-C can remove or attempt to update authentication / authorization instructions. In an example, server device 106A-C can provide authentication / authorization instructions to an inquiry client device. In some aspects, server device 106A-C can also be configured to store at least a portion of various data sets and graphical representations, as described above.

[0029] Figure 2 An overview of an exemplary system 200 for managing isolated collections of resource identifiers and corresponding relationships is shown. The isolated collection techniques implemented in system 200 may include Figure 1In an alternative example, a single device (including one or more components such as a processor and / or a memory) may perform the processes described in systems 100 and 200, respectively.

[0030] about Figure 2 , system 200 may include set creation applications 202 and 204, set environment 206, sets 208 and 210, entities 212 and 214, resource identifiers 216, 218, 220, 222, 224 and 226, and resources 228, 230, 232, 234, 236 and 238. In various aspects, set creation applications 202 and 204 may be applications or services configured to create, infer, manipulate, navigate and visualize various resources, relationships and graphical representations. Set creation applications 202 and 204 may define isolated sets of relationships between resources (e.g., people, files, tasks, emails, documents, calendar events, etc.) and perform queries on those isolated sets. Set creation applications 202 and 204 may also provide: defining and storing rule sets for inferring one or more relationships in isolated sets, and displaying graphical representations of isolated set data. The defined rule sets may be stored in the isolated sets themselves, and in some examples, stored as metadata within the isolated sets. In an example, set creation applications 202 and 204 may be installed and executed on a client device or on one or more devices in a distributed environment. For example, set creation application 202 may be installed on client device 102A, set creation application 204 may be installed on client device 102B, and a set creation service associated with server device 106A may be accessible to client device 102C.

[0031] In various aspects, set creation applications 202 and 204 can have access to a file directory or an execution environment (e.g., environment 206). Environment 206 can be co-located with the set creation application, or environment 206 can be located remotely from the set creation application. Environment 206 can provide access to one or more isolated data sets (e.g., sets 208 and 210). In an example, access to the isolated data sets can be determined using one or more permission sets generated and / or maintained by set creation applications 202 and 204. The permission sets can be different across one or more of the isolated data sets. As a result, one or more of the isolated data sets (or functionality associated therewith) may be inaccessible from one or more of set creation applications 202 and 204.

[0032] Sets 208 and 210 may include isolated collections of asserted and / or inferred resource identifiers and relationships, respectively. The relationships in an isolated collection may be manually defined, or may be automatically derived using one or more rule sets. An isolated collection may be represented using a graphical structure, such as a named graph, that directly associates resources in a data collection and provides for retrieval of relationship data with a single operation. Each isolated collection may include a resource identifier that is unique to the isolated collection. Alternatively, an isolated collection may include resource identifiers that are included in one or more alternative isolated collections. For example, Figure 2 As shown, set 208 may include resource identifiers 216, 218, 220, and 222, and set 210 may include resource identifiers 220, 222, 224, and 226. Resource identifiers 216, 218, 220, 222, 224, and 226 may correspond to and / or identify the location of one or more resources. As used herein, a resource identifier refers to an existing resource but is not a resource itself. Exemplary types of resource identifiers include, but are not limited to, uniform resource identifiers (e.g., uniform resource locators (URLs), uniform resource names (URNs), etc.), IP addresses, memory or storage addresses, and the like. Those skilled in the art will appreciate that, without departing from the scope of the present disclosure, the various aspects disclosed herein may employ any type of identifier. Identifying the location of a resource may include: parsing the resource identifier using, for example, a regular expression, providing one or more parts of the resource identifier to a search utility, executing the resource identifier, and the like. In various aspects, having access rights to a data set does not guarantee access rights to the resources identified by the resource identifiers included in each data set. For example, although a user may be able to access and manipulate set 208 , the user may not be authorized to access one or more of the underlying resources corresponding to the resource identifiers in set 208 .

[0033] Resource providers 212 and 214 may be configured to store one or more resources and / or provide access to one or more resources. As such, a resource provider as used herein may be a data store, a cloud service provider, a client computing device, a server computing device, a distributed system of devices (e.g., an enterprise network), an application, a software platform (e.g., an operating system, a database, etc.), and the like. In various aspects, resource providers 212 and 214 may be (or may have access to) a variety of different data sources, such as content providers, data stores, various application data sets, and the like. A data store may include one or more resources corresponding to one or more resource identifiers. For example, Figure 2As shown, resource provider 212 may be a data store including various different types of resources, such as resource 228 (e.g., document 1 (D1)) and resource 230 (e.g., presentation 2 (P1)), and resource provider 214 may be a contact management application including contact resources 232 (e.g., contact 1 (C1)), 234 (e.g., contact 2 (C2)), 236 (e.g., contact 3 (C3)), and 238 (e.g., contact 4 (C4)). In this example, resource identifier 216 may correspond to resource 228; resource identifier 218 may correspond to resource 230; resource identifier 220 may correspond to resource 232; resource identifier 222 may correspond to resource 234; resource identifier 224 may correspond to resource 236; and resource identifier 226 may correspond to resource 238.

[0034] In some aspects, resource providers 212 and 214 (or resources associated therewith) may be accessible to set creation applications 202 and 204. For example, set creation applications 202 and 204 may access resource providers 212 and 214 to determine the existence of resources and / or retrieve information associated with resources (e.g., resource metadata, resource location, resource identifier, permission set, authorization data, etc.). In an alternative example, set creation applications 202 and 204 may not have access to resource providers 212 and 214. Instead, resource providers 212 and 214 may, for example, publish or broadcast resources and / or resource information to one or more devices or storage locations. Set creation applications 202 and 204 may then access the device or storage location that receives the resource / resource information to determine the existence of the resource. In yet another example, set creation applications 202 and 204 may directly receive the resource / resource information. For example, a user may create or upload one or more resources using an interface accessible to set creation applications 202 and 204. In such aspects, the retrieved resources / resource information can be used to determine a set of resource identifiers corresponding to one or more of the available resources. The set of resource identifiers can be used to create one or more isolated collections. As described above, the resource identifier can be or include a persistent URI for its corresponding resource. For example, the resource identifier 216 can include a URI for the actual document (D1) 228. Thus, in such an example, the user is able to determine the location of the document (D1) 228 from the collection and, depending on authorization and access restrictions, retrieve the document (D1) 228. As another example, if Figure 2As shown, resource provider 212 can be accessed by set creation application 202. Set creation application 202 can determine that resource provider 212 includes at least resources 228 and 230, and can determine resource identification information for each of the resources. Based on the determined resource identification information, resource identifiers 216 and 218 can be applied / associated with resources 228 and 230, respectively, and provided to environment 206. Environment 206 can then make resource identifiers 216 and 218 eligible for inclusion analysis into one or more isolated sets.

[0035] Figure 3A An exemplary isolated set 300 of resource identifiers and corresponding relationships is shown. Exemplary isolated set 300 includes resource identifiers 302, 304, 306, 308, 310, 312, and 314, and relationships 316, 318, 320, 322, 324, and 326. In various aspects, isolated set 300 may be generated and / or manipulated using a collection creation utility that may be included as part of a collection creation application as described above. Figure 3A When presented in the form of a graph depicted in , each resource identifier may be referred to as a "node" and each relationship may be referred to as an "edge". The collection creation utility may also use one or more rule sets to identify resources and / or determine the resource type of the collection, and the rule set may include rules defined according to semantic web technologies, such as Resource Description Framework (RDF), RDF Schema (RDFS), SPARQL Protocol and RDF Query Language (SPARQL), Web Ontology Language (QWL), etc. For example, the isolated collection 300 includes a resource identifier 312 representing an underlying resource ("email789" in the depicted example). Similarly, resource identifier 304 represents a resource document "Doc123", and resource identifier 302 represents a resource task "Task123". Each of the resources and relationships included in the isolated collection 300 may have been asserted by a developer through the set creation application. For example, a developer may manually add each of the resource identifiers and the relationships between the resource identifiers. As an example, a developer may manually indicate that "task123" is a task on "Doc123", as represented by "taskOn" relationship 316 in isolated collection 300. Resource identifiers and relationships may also be asserted by external bots or applications created by developers. For example, an add-in may be programmed to monitor activity in a browser or other application to track the use of the application. Based on the use of the application, the add-in may send additional resources and relationships to be included in isolated collection 300.

[0036] In contrast to asserted resource identifiers and relationships, the collection creation utility can execute a rule set to determine attached relationships and resource types, referred to herein as "inferred relationships" and "inferred resource identifiers" or "inferred resource types." For example, when the rule set is executed, the collection creation utility can determine that resource identifier 312 represents an email message and that resource identifier 304 represents a document. The generation of inferred relationships and resources is discussed in more detail below. Based on this determination, the collection creation utility can assign a relationship 324 (e.g., "attachmentOn") to define an association between resource identifier 312 and resource identifier 304. The collection creation utility can utilize a similar approach to assign a relationship 326 (e.g., "attachmentOn") to define an association between resource identifier 314 and resource identifier 306.

[0037] Isolated collection 300 further depicts resource identifier 302 being associated with resource identifiers 304, 306, and 308 and resource identifier 310. The collection creation utility may determine that resource identifier 302 represents a task to be performed on identifiers 304, 306, and 308. Based on this determination, the collection creation utility may assign relationships 316, 318, and 320 (e.g., "taskOn") to define the association between resource identifier 302 and resource identifiers 304, 306, and 308. The collection creation utility may further determine that resource identifier 310 represents an email (without attachments) that includes a discussion of one or more aspects of resource identifier 302. Based on this determination, the collection creation utility may assign relationship 322 (e.g., "hasDiscussion") to define the association between resource identifier 302 and resource identifier 310.

[0038] Figure 3B-3EAn exemplary query model that can be used to traverse an isolated collection 300 is shown. In various aspects, queries can be performed via an interface provided by a collection creation utility. Queries can be performed against one or more files and / or directories that include information such as resource identifiers, resource types, resource metadata, licensing data, and the like. The query results can be visualized in a graphical form as one or more collections, such as the isolated collection 300. For example, the entire isolated collection 300 data set can include only those elements shown in the collection 300 (e.g., resource identifiers 302, 304, 306, 308, 310, 312, and 314 and relationships 316, 318, 320, 322, 324, and 326). In this particular example, resource identifier 312 can represent an email that includes the subject "API Design" and resource identifier 314 can represent an email that includes the subject "Collection". The query "http: / / ... / collection300 / task123" can be performed against the isolated collection 300. The query results can include resource identifier 302 and be visualized as shown. In Figure 3C In , the query has been modified to "http: / / ... / collection300 / task123?$expand=taskOn" and executed against the isolated collection 300. The query results may include resource identifiers 302, 304, 306, and 308 and relationships 316, 318, and 320, and are visualized as shown. Figure 3D In , the query has been modified to "http: / / ..Jcollection300 / task123?$expand=taskOn($expand=attachmentOn)" and executed against the isolated collection 300. The query results may include resource identifiers 302, 304, 306, 308, 312, and 314 and relationships 316, 318, 320, 324, and 326, and are visualized as shown. Figure 3E , the query has been modified to "http: / / ..Jcollection300 / task123?($expand=taskOn($expand=attachmentOn($filter=Subject eq'Sets'))" and executed against the isolated collection 300. Since only the resource identifier includes the subject "Sets", the query results may include resource identifiers 302, 306, and 314 and relationships 318 and 326, and are visualized as shown.

[0039] Figure 4 An exemplary method 400 of delegating authorization to access a segregated collection is shown. In various aspects, the method 400 may be performed by, for example, Figure 1The method 400 may be performed by an exemplary system such as system 100 of . In an example, the method 400 may be performed on a device including at least one processor configured to store and execute operations, programs, or instructions. However, the method 400 is not limited to such examples. In other examples, the method 400 may be performed on an application or service for providing delegated authorization. In at least one example, the method 400 may be performed (e.g., computer-implemented operations) by one or more components of a distributed network (e.g., a network service / distributed network service (e.g., a cloud service)).

[0040] The exemplary method 400 begins at operation 402, where a request for access to one or more isolated collections (e.g., sets 208 and 210) may be received by a collection creation application / service (e.g., set creation applications 202 and 204) for developing and exploring isolated collections. In various aspects, the collection creation application / service may be installed on or accessible by a computing device such as client devices 102A-C. The collection creation application / service may have access to one or more files or directories including information, such as resource identifiers, resource types, resource metadata, relationship information, one or more rule sets, one or more statistical or predictive models, licensing data, authorization information, query data, one or more query models, graphical components, resource mapping data, and the like. The collection creation application / service may be accessible via an interface, such as a graphical user interface, a command line interface, an API, and the like. In an example, the collection creation application / service may be operable to receive a request to generate and / or access one or more isolated collections and / or associated information via an interface. The request may be in the form of a query, such as described above with respect to Figure 3B-E. In another example, the request may take the form of a selection of a menu, menu item, object, property / attribute, graphic or part of a graphic object, etc. The request may include request data, such as client data (e.g., username, password, device name, IP address, authentication and / or authorization indication, etc.), isolated collection data, file system location, etc. The isolated collection may include resource identifiers, relationship information and / or metadata from one or more parts of the above-mentioned files or directories. The isolated collection may be subject to various security permissions or boundaries. In an example, each isolated collection may contain its own set of security permissions. The security permissions may provide different degrees of access to the isolated collection. For example, a first permission category may provide full control over the isolated collection and corresponding metadata, a second permission category may provide read / write access to the content of the isolated collection, but not to the corresponding metadata, and a third permission category may only provide read access to the content of the isolated collection, but not to the corresponding metadata. The security permissions may be checked when accessing the isolated collection and when accessing the files or directories involved in the isolated collection. The security permissions may be stored as part of the metadata for the isolated collection. In various aspects, access to the isolated collection does not necessarily imply access from the isolated collection to the underlying resources represented by the resource identifiers in the isolated collection. That is, a user or group with access rights to the resource identifiers in the isolated collection may not be able to access the underlying resources from the isolated collection. In such aspects, the security permissions for the isolated collection may be separate and distinct from the security permissions for the underlying resources associated with the isolated collection.

[0041] At operation 404, one or more underlying resources may be located. In various aspects, the collection creation application / service may search and / or evaluate the isolated collection (or corresponding files / directories) to identify one or more resource identifiers. The search may include one or more pattern matching techniques, attribute or property analysis, etc. The search may generate a list of resource identifiers. The list of resource identifiers may be used to determine the physical or logical location of the underlying resources corresponding to the resources in the resource list. In an example, the location of the underlying resource may be determined in the following manner: calling the resource identifier using one or more communication protocols (e.g., HTTP, FTP, etc.), providing the resource identifier to a search / find utility, querying a resource provider for a list of stored / accessible resources, querying a network device for a list of sent / stored resources and locations, etc. For example, the collection creation application / service may make an HTTP call to the identified resource identifier to a search engine. The search engine may respond by providing the underlying resource, the location of the underlying resource, access to the resource provider, authorization queries, etc.

[0042] At operation 406, access to the underlying resource may be determined. In various aspects, the collection creation application / service may use one or more portions of the request data to determine whether the requestor is associated with an identified resource provider or data store (e.g., resource providers 212 and 214). For example, the collection creation application / service may use account information (e.g., user name and / or user credentials) provided in the request data to determine whether the resource provider or data store is associated with a user account of the requestor (e.g., a user requesting access to the isolated collection). The determination may include providing the account information to a single sign-on (SSO) access control system / utility, providing the account information to an authorization provider, comparing the account information from the collection creation application / service with the account information from the resource provider, applying the credentials in the request data to the resource provider, and the like. In some aspects, if it is determined that the requestor is associated with the resource provider, the collection creation application / service may generate an authorization and / or authentication indication. In other aspects, if it is determined that the requestor is associated with the resource provider, the collection creation application / service may determine whether the requestor is authorized or has been authenticated to access the underlying resource from / on the resource provider. This determination may include identifying one or more authentication and / or authorization indications (e.g., tokens, credentials, permission sets, etc.), analyzing one or more authorization events / access events, etc. In a particular example, the collection creation application / service may retrieve the identified authentication / authorization indications (or a close copy thereof) from the resource provider.

[0043] At operation 408, access to the isolated collection may be provided. In various aspects, the collection creation application / service may provide access to the isolated collection based at least in part on one or more determinations of operation 406. For example, the determination may include an analysis of several factors, such as whether the requester is determined to be authorized to access a resource provider with access rights to the underlying resource, whether an authentication / authorization indication for accessing the underlying resource has been identified, an expiration date / time of the authentication / authorization indication, a date / time of the requester's most recent access to the resource or resource provider, a date / time of the requester's most recent access to the resource provider, etc. In an example, the collection creation application / service may provide or block access to the isolated collection based on a single determination or based on multiple determinations. Typically, if the collection creation application / service determines to provide access to the isolated collection, only access to the requested isolated collection is provided to the requester. However, in some aspects, if the collection creation application / service determines to provide access to the isolated collection, access to one or more additional isolated collections may also be provided to the requester, the one or more additional isolated collections including resource identifiers of the underlying resources to which access is determined.

[0044] In at least one aspect, a collection creation application / service may perform access conflict resolution. For example, an isolated collection may include at least a first resource identifier and a second resource identifier. The collection creation application / service may determine that a requester is authorized to access an underlying resource corresponding to the first resource identifier, but is not authorized to access an underlying resource corresponding to the second resource identifier. As a result, the collection creation application / service may apply a set of access resolution rules. If it is determined that the requester has access rights to at least one of the underlying resources corresponding to the resource identifiers in the isolated collection, the access resolution rules may provide, for example, a method in which the requester is provided access to the entire isolated collection. As another example, the access resolution rules may provide a method in which, if it is determined that the requester does not have access rights to all underlying resources corresponding to the resource identifiers in the isolated collection, the requester is blocked from accessing the isolated collection. As yet another example, the access resolution rules may provide a hybrid method in which the requester is limited to accessing only those portions of the isolated collection corresponding to the underlying resources to which the requester has access rights.

[0045] Figure 5 An exemplary method 500 for determining access to the underlying resources of an isolated collection is shown. The exemplary method 500 begins at operation 502, where a resource provider can be queried. In various aspects, a collection creation application / service such as set creation applications 202 and 204 can query a resource provider, such as resource providers 212 and 214. The query can be intended to determine access to the resource provider and / or the underlying resources by a requester (e.g., a user requesting access to an isolated collection). The query can include access to authorization data and / or user access event data of the resource provider, an authentication token repository, and / or a set of resource permissions of the resource provider. For example, the collection creation application / service can analyze the permission set of the requester account on the resource provider. The analysis can include determining whether the requester is authorized or has been authenticated to access the resource provider. As another example, the collection creation application / service can request a security token from the resource provider, which authorizes access to the underlying resources. A security token used herein can refer to a digital object used to store cryptographic data and electronically prove the identity of a user. The security token can be stored by a resource provider of a security token issuing agency. As yet another example, the collection creation application / service may search the resource provider's authorization files to determine the location and time the user logged in and / or authenticated, username, access times, device information, authentication provider, and the like.

[0046] At decision operator 504, authorization to the requester may be performed or otherwise determined. In various aspects, the collection creation application / service may use at least the query information of operation 502 to determine whether the requester is authorized to access the resource provider and / or the underlying resources. For example, the collection creation application / service may use a security token identified by querying the resource provider to determine that the requester is authorized to access one or more underlying resources accessible to the resource provider. If the collection creation application / service determines that the access is authorized for the requester, the process may proceed to operation 506. At operation 506, the collection creation application / service may receive or generate an indication of the determined authorization. For example, the collection creation application / service may retrieve the security token (or a copy of the security token) from the resource provider, a security token repository, or a token issuing authority. As another example, the collection creation application / service may copy / store the requester's resource provider permission (or an indication thereof) to the metadata of an isolated collection including data corresponding to the underlying resources. If the collection creation application / service determines that the access is not authorized for the requester, the process may proceed to operation 508.

[0047] At operation 508, the requester's access may be authorized. In various aspects, if the collection creation application / service determines that the requester (or the requester's access) is not currently authorized, the collection creation application / service may attempt to authenticate the requester or the requester's access to the underlying resource. For example, the collection creation application / service may request the resource provider to generate (or update) authorization for the requester. The request may include client data (e.g., user name, password, device name, IP address, authentication / authorization indication, etc.), resource identifier, expiration date / time, expired credentials / authorization, etc. The resource provider receiving the authorization request may cause an authorization event to be initiated. In some examples, the authorization event may include a registration process in which the requester's credentials are provided to the credential service provider. The credential service provider may perform a verification process to verify the identity of the requester. The authorization event may also include the creation / update of a security token (or credential). The security token may include attributes / properties, such as a token identifier, a user ID, a token type, a time to live (TTL) value, a privilege set, etc. The security token may be sent and / or stored by a token generation agency, a resource provider, or an SSO access control system / utility.

[0048] At decision operator 510, the success of the authorization event can be determined. In various aspects, the collection creation application / service can monitor or maintain the authorization event described in operation 508. If the collection creation application / service determines that the authorization event is successful (e.g., a valid authorization has been identified), the process proceeds to operation 506, as described above. If the collection creation application / service determines that the authorization event is unsuccessful, the process proceeds to operation 512. At operation 512, the collection creation application / service can receive or generate an indication that the authorization event is unsuccessful. The collection creation application / service can use the received / generated indication to determine whether to provide access to one or more isolated collections.

[0049] Figure 6 An exemplary method 600 of conditionally granting access to isolated collections is shown. The exemplary method 600 begins at operation 602, where a request for access to one or more isolated collections (e.g., collections 208 and 210) may be received by a collection creation application / service (e.g., collection creation applications 202 and 204) for developing and exploring isolated collections. In various aspects, the collection creation application / service may be installed on or accessible by a computing device such as a client device 102A-C. The collection creation application / service may have explanatory rights to one or more files or directories including information, such as resource identifiers, resource types, resource metadata, relationship information, one or more rule sets, one or more statistical or predictive models, licensing data, authorization information, query data, one or more query models, graphical components, resource mapping data, and the like. The collection creation application / service may be accessible via an interface, such as a graphical user interface, a command line interface, an API, and the like. In an example, the collection creation application / service may receive a request to generate and / or access one or more isolated collections and / or associated information via an interface. The request can be in the form of a query, as described above about Figure 3B-E described. In another example, the request may take the form of a selection of a menu, menu item, object, attribute / property, a portion of a graphic or a graphic object, etc. The request may include request data, such as client data (e.g., user name, password, device name, IP address, authorization indication, etc.), isolated collection data, file system location, etc. The isolated collection may include resource identifiers, relationship information, and / or metadata from one or more portions of the above-mentioned files or directories. The isolated collection may be subject to various security permissions or boundaries. In the example, each isolated collection may contain its own set of security permissions. The security permissions may provide different degrees of access to the isolated collection and / or individual resources associated with the isolated collection. For example, the first permission category may provide full control over the isolated collection and corresponding metadata, the second permission category may provide read / write access to the content of the isolated collection, but not to the corresponding metadata, and the third permission category may only provide read access to the content of the isolated collection, but not to the corresponding metadata. The security permissions may be checked when accessing the isolated collection and when accessing the files or directories involved in the isolated collection. The security permissions may be stored as part of the metadata for the isolated collection. In various aspects, access to the isolated collection does not necessarily imply access from the isolated collection to the underlying resources represented by the resource identifiers in the isolated collection. That is, a user or group with access rights to the resource identifiers in the isolated collection may not be able to access the underlying resources from the isolated collection. In such aspects, the security permissions for the isolated collection may be independent and different from the security permissions for the underlying resources associated with the isolated collection.

[0050] At operation 604, a condition set may be monitored. In various aspects, a condition set may be associated with an isolated set. A condition set may include one or more conditions for, for example, conditionally authorizing access to an isolated set. The condition may be inside an isolated set, outside an isolated set, or some combination thereof. A set creation application / service may have access rights to a condition set. For example, a resource provider may publish a condition set to a location accessible to a set creation application / service. As another example, a resource provider may register a condition set with a set creation application / service. As another example, a resource provider may register a condition set with a service for monitoring conditions. A service may be operable to organize and / or monitor conditions, and may act as a single condition for monitoring access points for a set creation application / service. As another example, a condition set may be manually entered into a set creation application / service. In various aspects, a condition set may be monitored by a set creation application / service, one or more resource providers, or a condition monitoring service. Monitoring a condition set may include registering one or more conditions in a condition set with one or more sensors of a computing device (e.g., client devices 102A-C). For example, a condition for detecting entry into a particular geographic location may be registered with a GPS of a mobile device. A monitoring condition set may also include registering one or more conditions with one or more applications or services. For example, a condition for detecting modification of a file may be registered with a cloud-based word processing application. A monitoring condition set may also include storing criteria for successfully completing a condition set. For example, the completion criteria of a condition set may indicate that three of the four conditions in the condition set must be met to complete the condition set.

[0051] At operation 606, the state of the condition set can be determined. In various aspects, one or more conditions in the condition set can be evaluated by a condition evaluation entity (e.g., a set creation application / service, a condition evaluation service, one or more resource providers, etc.) to determine whether the condition set has been met / completed. Evaluating the condition set can include polling data sources (e.g., resource providers, resources, applications, services, sensors, authentication systems, identity systems based on claims, etc.) to receive sensor data, condition states, data updates, etc. The claim-based identity system used herein can refer to such a system, wherein the claims describing the capabilities associated with the entities in the system are packaged into one or more tokens and are used to access one or more resources. Polling can be performed manually at specified intervals, in response to certain events, or randomly. Alternatively, sensor data, condition states, and / or updates thereto can be pushed to the condition evaluation entity by the data source. Evaluating the condition set can also include determining whether the condition set or one or more conditions have been met. In an example, such determination may include comparing the received polling information to one or more thresholds, performing pattern matching techniques, evaluating permission sets, evaluating group memberships, providing the polling information to a machine learning model, analyzing user signals (e.g., GPS coordinates, IP address, date / time, user input, etc.), and the like.

[0052] At operation 608, access to the isolated collection may be provided. In various aspects, the collection creation application / service may authenticate access to the isolated collection based on one or more conditions or sets of conditions being satisfied. For example, the collection creation application / service may receive an indication that each condition in the condition set has been satisfied. As a result, the collection creation application / service may authenticate access to the requested isolated collection. As another example, the collection creation application / service may receive an indication that less than all of the conditions in the condition set have been satisfied. As a result, the collection creation application / service may not authenticate access to the requested isolated collection and / or provide an indication of the incomplete conditions to the requestor. Typically, if the collection creation application / service determines to provide access to the isolated collection, access to the requested set is only provided to the requestor. However, in some aspects, if the collection creation application / service determines to provide access to the isolated collection, access to one or more additional isolated collections including resource identifiers of underlying resources for which access is determined may also be provided to the requestor. In at least one aspect, the collection creation application / service may perform access conflict resolution, as described above with respect to Figure 4 As described. For example, access to an isolated collection may be governed by a first set of conditions and a second set of conditions. The collection creation application / service may determine that the requestor has successfully completed the first set of conditions but has not yet completed the second set of conditions. As a result, the collection creation application / service may apply a set of access resolution rules that resolves this conflict.

[0053] Figure 7 An exemplary method 700 is shown for determining whether conditions for accessing an isolated collection have been met. The exemplary method 700 begins at operation 702, where a condition set for accessing an isolated collection is identified. In various aspects, the condition set may include one or more conditions and be associated with criteria for satisfying the condition set. For example, company ABC may establish a condition set for accessing an isolated collection. The condition set may include the following conditions: 1) the requester is a member of the "admin" group, and 2) the necessary training courses have been completed; and 3) the requester is a member of the "HR" group. The corresponding condition set satisfaction criteria may indicate that condition 1) must be completed or that conditions 2) and 3) must be completed.

[0054] At operation 704, conditions may be polled. In various aspects, the condition evaluation entity may poll one or more data sources (e.g., resource providers, resources, applications, services, sensors, etc.) to receive polling data (e.g., sensor data, event data, condition status, etc.) for conditions in the condition set. For example, a creation application / service may be registered to poll the company ABC account information database for account and / or license data. Polling the company ABC database may include sending a query statement including the account name of the requester upon receiving a request for accessing an isolated collection. The creation application / service may also be configured to parse data from the company DEF website. Company DEF may publish training course information (e.g., course name, completion status, score, completion date, registrant information, etc.) to the website every Tuesday and Friday morning.

[0055] At decision operation 706, the condition can be evaluated. In various aspects, the condition evaluation entity can determine whether the polling data satisfies one or more conditions. The determination can include comparing the received polling data to one or more thresholds, performing pattern matching techniques, evaluating permission sets, evaluating group participants, providing polling information to a machine learning model, and the like. For example, the creation application / service can use pattern matching techniques to search account information retrieved from the database of company ABC for a username that matches (or approximately matches) the username of the requester (e.g., a user requesting access to an isolated set). In addition, the creation application / service can provide the URL of the website used by company DEF to publish training course information to the machine learning model. The machine learning model can analyze the website to determine whether the requester is in a list of training course graduates and / or participants.

[0056] In various aspects, if the condition evaluation entity determines that one or more conditions in the condition set are not met, the process proceeds to operation 708. At operation 708, an indication that the condition set has not been met may be provided / recorded. In various aspects, the condition evaluation entity may update the condition set to reflect the results of the most recent monitoring / polling cycle. The condition evaluation entity may also provide updates to one or more failed conditions to the requester. For example, if the creation application / service determines that the requester is in the "HR" group, but has not passed the necessary training course, the creation application / service may report the unfinished training course condition to the requester. However, if the condition evaluation entity determines that all conditions in the condition set are met, the process proceeds to 710. At operation 710, an indication that the condition set has been met may be provided / recorded. In various aspects, the condition evaluation entity may update the condition set and provide a success indicator to the requester. For example, if the creation application / service determines that the requester is in the "Administrator" group, but has not passed the necessary training course, the creation application / service may report to the requester that the condition set is complete. In at least an example, the creation application / service may also provide the status of each condition in the condition set to the requester.

[0057] Figure 8-11 The and associated descriptions provide a discussion of various operating environments in which aspects of the present disclosure may be practiced. Figure 8-11 The devices and systems shown and discussed are for purposes of example and explanation, and are not limiting of the wide variety of computing device configurations that may be used to practice aspects of the disclosure described herein.

[0058] Figure 8800 with which aspects of the present disclosure may be practiced. The computing device components described below may be suitable for the computing devices described above, including client devices 102A-C and server devices 106A-C. In a basic configuration, the computing device 800 may include at least one processing unit 802 and a system memory 804. Depending on the configuration and type of the computing device, the system memory 804 may include, but is not limited to, volatile storage (e.g., random access memory), non-volatile storage (e.g., read-only memory), flash memory, or any combination of such memories. The system memory 804 may include an operating system 805 and one or more program modules 806 suitable for running software applications 820, such as one or more components supported by the system described herein. As an example, the system memory 804 may store isolated collection data (e.g., resource identifiers, resource metadata, relationship information, asserted / inferred relationships, graph mapping information, query data, rule sets (e.g., inference rules), authorization information, authentication information, etc.) and instructions for performing delegated authentication for isolated collections. For example, operating system 805 may be suitable for controlling the operation of computing device 800. In addition, embodiments of the present disclosure may be practiced in conjunction with a graphics library, other operating systems, or any other application program, and are not limited to any particular application or system. Figure 8 800 is shown by those components within dashed line 808. Computing device 800 may have additional features or functionality. For example, computing device 800 may also include additional data storage devices (removable and / or non-removable), such as magnetic disks, optical disks, or tapes. Figure 8 Such additional storage is illustrated in FIG. 8 by removable storage device 809 and non-removable storage device 810 .

[0059] As described above, a number of program modules and data files can be stored in system memory 804. When executed on processing unit 802, program modules 806 (e.g., applications 820) can perform processes including, but not limited to, various aspects as described herein. Other program modules that can be used in accordance with various aspects of the present disclosure can include email and contact applications, word processing applications, spreadsheet applications, database applications, slide presentation applications, drawing or computer-assisted applications, and the like.

[0060] In addition, embodiments of the present disclosure may be practiced in circuits including discrete electronic components, packaged or integrated electronic chips containing logic gates, circuits utilizing microprocessors, or on a single chip containing electronic components or microprocessors. For example, embodiments of the present disclosure may be practiced via a system on a chip (SOC), wherein: Figure 8Each or many of the components shown can be integrated on a single integrated circuit. Such a SOC device may include one or more processing units, a graphics unit, a communication unit, a system virtualization unit, and various application functions, all of which are integrated (or "burned") onto a chip substrate as a single integrated circuit. When operated via a SOC, the functions described herein regarding the ability of a client to switch protocols can be operated via dedicated logic integrated with other components of a computing device 800 on a single integrated circuit (chip). Embodiments of the present disclosure may also be practiced using other techniques capable of performing logical operations, such as AND, OR, and NOT, including but not limited to mechanical, optical, fluid, and quantum technologies. In addition, embodiments of the present disclosure may be practiced in a general-purpose computer or in any other circuit or system.

[0061] The computing device 800 may also have one or more input devices 812, such as a keyboard, a mouse, a pen, a sound or voice input device, a touch and / or sliding input device, etc. Output devices 814 such as a display, a speaker, a printer, etc. may also be included. The above devices are examples, and other devices may be used. The computing device 800 may include one or more communication connections 816 that allow communication with other electronic devices 850. Examples of suitable communication connections 816 include, but are not limited to, radio frequency (RF) transmitters, receivers, and / or transceiver circuits; universal serial bus (USB), parallel and / or serial ports.

[0062] The term computer-readable media used herein may include computer storage media. Computer storage media may include volatile and nonvolatile, removable and non-removable media implemented in any method or technology for storing information such as computer-readable instructions, data structures or program modules. System memory 804, removable storage device 809 and non-removable storage device 810 are all examples of computer storage media (e.g., memory storage devices). Computer storage media may include RAM, ROM, electrically erasable read-only memory (EEPROM), flash memory or other memory technology, CD-ROM, digital versatile disk (DVD) or other optical storage device, cassette, magnetic tape, magnetic disk storage device or other magnetic storage device, or any other product that can be used to store information and can be accessed by computing device 800. Any such computer storage media may be part of computing device 800. Computer storage media do not include carrier waves or other propagated or modulated data signals.

[0063] Communication media may be embodied by computer readable instructions, data structures, program modules, or other data in a modulated data signal (e.g., a carrier wave or other transport mechanism), and includes any information delivery media. The term "modulated data signal" may describe a signal that has one or more of its characteristics set or changed in such a manner as to encode information in the signal. By way of example, and not limitation, communication media may include wired media (e.g., a wired network or direct-wired connection) and wireless media (e.g., acoustic, radio frequency (RF), infrared, and other wireless media).

[0064] Fig. 9A and Fig. 9B A mobile computing device 900 is shown, such as a mobile phone, a smart phone, a wearable computer (e.g., a smart watch), a tablet computer, a laptop computer, etc., with which embodiments of the present disclosure may be practiced. In some aspects, the client may be a mobile computing device. Fig. 9A , one aspect of a mobile computing device 900 for implementing these aspects is shown. In a basic configuration, the mobile computing device 900 is a handheld computer having both input elements and output elements. The mobile computing device 900 typically includes a display 905 and one or more input buttons 910 that allow a user to enter information into the mobile computing device 900. The display 905 of the mobile computing device 900 may also act as an input device (e.g., a touch screen display). If included, an optional side input element 915 allows further user input. The side input element 915 may be a rotary switch, a button, or any other type of manual input element. In alternative aspects, the mobile computing device 900 may include more or fewer input elements. For example, in some embodiments, the display 905 may not be a touch screen. In yet another alternative embodiment, the mobile computing device 900 is a portable telephone system, such as a cellular phone. The mobile computing device 900 may also include an optional keypad 935. The optional keypad 935 may be a physical keypad or a "soft" keypad generated on a touch screen display. In various embodiments, output elements include a display 905 for displaying a graphical user interface (GUI), a visual indicator 920 (e.g., a light emitting diode), and / or an audio transducer 925 (e.g., a speaker). In some aspects, the mobile computing device 900 includes a vibration transducer for providing tactile feedback to the user. In yet another aspect, the mobile computing device 900 includes input and / or output ports, such as an audio input (e.g., a microphone jack), an audio output (e.g., a headphone jack), and a video output (e.g., an HDMI port) for sending signals to or receiving signals from an external device.

[0065] Fig. 9B900 is a block diagram illustrating an architecture of one aspect of a mobile computing device. That is, a mobile computing device 900 may include a system (e.g., architecture) 902 to implement some aspects. In one embodiment, the system 902 is implemented as a "smart phone" capable of running one or more applications (e.g., browsers, email, calendars, contact managers, messaging clients, games, and media clients / players). In some aspects, the system 902 is integrated as a computing device, such as an integrated personal digital assistant (PDA) and wireless phone.

[0066] One or more application programs 966 may be loaded into the memory 962 and run on or in association with the operating system 964. Examples of application programs include a phone dialer, an email program, a personal information management (PIM) program, a word processing program, a spreadsheet program, an Internet browser program, a messaging program, and the like. The system 902 also includes a non-volatile storage area 968 within the memory 962. The non-volatile storage area 968 may be used to store persistent information that should not be lost if the system 902 loses power. The application programs 966 may use and store information in the non-volatile storage area 968, such as emails or other messages used by the email application, and the like. A synchronization application (not shown) also resides on the system 902 and is programmed to interact with a corresponding synchronization application residing on the host computer to synchronize the information stored in the non-volatile storage area 968 with the corresponding information stored at the host computer. It should be appreciated that other applications may be loaded into memory 962 and executed on the mobile computing device 900 described herein (eg, search engines, extractor modules, relevance ranking modules, answer scoring modules, etc.).

[0067] System 902 has a power source 970, which can be implemented as one or more batteries. Power source 970 can also include an external power source, such as an AC adapter or a powered docking station to replenish or recharge the batteries.

[0068] The system 902 may also include a wireless interface layer 972 that performs the functions of sending and receiving radio frequency communications. The wireless interface layer 972 facilitates wireless connections between the system 902 and the "outside world" via a communications carrier or service provider. Transmissions to and from the wireless interface layer 972 are performed under the control of the operating system 964. In other words, communications received by the wireless interface layer 972 can be disseminated to the application 966 via the operating system 964, and vice versa.

[0069] The visual indicator 920 can be used to provide visual notifications, and / or the audio interface 974 can be used to generate audible notifications via the audio transducer 925. In the illustrated embodiment, the visual indicator 920 is a light emitting diode (LED), and the audio transducer 925 is a speaker. These devices can be directly coupled to the power supply 970 so that when they are activated, even if the processor (e.g., processor 960 and / or dedicated processor 961) and other components may be turned off to save battery power, they are also kept turned on within the duration specified by the notification mechanism. The LED can be programmed to remain turned on indefinitely until the user takes action to indicate the power-on state of the device. The audio interface 974 is used to provide audible signals to the user and receive audible signals from the user. For example, in addition to being coupled to the audio transducer 925, the audio interface 974 can also be coupled to a microphone to receive audible input, such as to facilitate a telephone conversation. According to an embodiment of the present disclosure, the microphone can also act as an audio sensor to facilitate the control of the notification, as described below. The system 902 may also include a video interface 976 that enables operation of the onboard camera 930 for recording still images, video streams, and the like.

[0070] The mobile computing device 900 implementing the system 902 may have additional features or functionality. For example, the mobile computing device 900 may also include additional data storage devices (removable and / or non-removable), such as magnetic disks, optical disks, or tapes. Such additional storage devices may be used to store data in a manner that is convenient for the user. Fig. 9B , shown by non-volatile storage area 968.

[0071] Data / information generated or captured by the mobile computing device 900 and stored via the system 902 may be stored locally on the mobile computing device 900 (as described above), or the data may be stored on any number of storage media that may be accessed by the device via the wireless interface layer 972 or via a wired connection between the mobile computing device 900 and a separate computing device associated with the mobile computing device 900 (e.g., a server computer in a distributed computing network such as the Internet). As should be appreciated, such data / information may be accessed via the mobile computing device 900 via the wireless interface layer 972 or via a distributed computing network. Similarly, such data / information may be readily transferred between computing devices for storage and use in accordance with well-known data / information transfer and storage means, including email and collaborative data / information sharing systems.

[0072] Fig.10One aspect of the architecture of a system for processing data received at a computing system from a remote source (e.g., a personal computer 1004, a tablet computing device 1006, or a mobile computing device 1008) is shown, as described above. The content displayed at the server device 1002 can be stored in different communication channels or other storage types. For example, a directory service 1022, a portal website 1024, a mailbox service 1026, an instant messaging store 1028, or a social networking site 1030 can be used to store various documents. An isolated collection application 1021 can be employed by a client communicating with the server device 1002, and / or an isolated collection application 1020 can be employed by the server device 1002. The server device 1002 can provide communication to and from client computing devices such as personal computers 1004, tablet computing devices 1006, and / or mobile computing devices 1008 (e.g., smart phones) via a network 1015. By way of example, the computer system described above may be embodied in a personal computer 1004, a tablet computing device 1006, and / or a mobile computing device 1008 (e.g., a smartphone). In addition to receiving graphics data that may be used for pre-processing at a graphics originating system or post-processing at a receiving computing system, any of these embodiments of the computing device may also obtain content from storage 1016.

[0073] Fig.11 An exemplary tablet computing device 1100 is shown that can perform one or more aspects disclosed herein. In addition, the aspects and functions described herein can be operated on a distributed system (e.g., a cloud-based computing system), wherein application functions, memory, data storage and retrieval, and various processing functions can be remotely operated from each other via a distributed computing network (e.g., the Internet or an intranet). Various types of user interfaces and information can be displayed via an onboard computing device display or via a remote display unit associated with one or more computing devices. For example, various types of user interfaces and information can be displayed and interacted on a wall, on which various types of user interfaces and information are projected. Interaction with multiple computing systems with which embodiments of the present invention can be practiced includes keystroke input, touch screen input, voice or other audio input, gesture input, wherein the associated computing device is equipped with a detection (e.g., camera) function for capturing and interpreting user gestures for controlling functions of the computing device, and the like.

[0074] For example, the above reference block diagrams and / or operating instructions of the methods, systems and computer program products of various aspects of the present disclosure have been described in detail. The functions / actions recorded in the frame may not occur in the order shown in any flow chart. For example, two frames shown in succession may actually be performed substantially simultaneously, or these frames may sometimes be performed in reverse order, depending on the functions / actions involved.

[0075] The description and explanation of one or more aspects provided in this application are not intended to limit or restrict the scope of the present disclosure in any way. The aspects, examples and details provided in this application are considered to be sufficient to convey the best mode of having (possession) and enabling others to manufacture and use the claimed disclosure. The claimed disclosure should not be interpreted as being limited to any aspect, example or detail provided in this application. Whether shown and described in combination or individually, various features (structure and method) are intended to be selectively included or omitted to produce an embodiment with a specific feature set. Description and explanation of the application have been provided, and those skilled in the art can envision variations, modifications and alternative aspects that fall within the spirit of the broader aspects of the overall inventive concept embodied in this application, which do not depart from the broader scope of the claimed disclosure.

Claims

1. A system for delegating authorization to access a graph database, comprising: at least one processor; as well as A memory coupled to the at least one processor, the memory comprising computer executable instructions that, when executed by the at least one processor, perform operations comprising: receiving a request from a client device to access the graph database, wherein the graph database includes a resource identifier associated with an underlying resource; registering a condition set with a sensor of the client device for monitoring a state of the condition set by the sensor; receiving a state associated with the set of conditions from the sensor; and Based on the status of the set of conditions satisfying a predetermined threshold, access to the graph database is provided according to the resource identifier without providing access to the underlying resource associated with the resource identifier.

2. The system of claim 1, wherein: The request is received by an application comprising an interface, wherein the interface is operable to enable exploration and navigation of the graphical database.

3. The system of claim 1, wherein: The operations also include: The underlying resource is located by performing at least one of the following: performing a call to the resource identifier using one or more communication protocols; providing the resource identifier to a search utility; querying the resource provider for a list of accessible resources; and Query a network device for a list of resource locations.

4. The system of claim 1, wherein: The operations also include determining whether access to the underlying resource is authorized by comparing account information associated with the requestor with account information associated with a single sign-on (SSO) system.

5. The system of claim 1, wherein: The operations also include determining whether access to the underlying resource is authorized by comparing account information associated with the requester with account information associated with the resource provider.

6. The system of claim 1, wherein: The operations also include determining whether access to the underlying resource is authorized by at least one of identifying an authorization indication, analyzing one or more authorization events, and analyzing a permission set.

7. The system of claim 1, wherein: The graph database includes its own set of security permissions such that providing access to the graph database does not additionally provide access to a separate isolated set of data including the resource identifier.

8. The system of claim 1, further comprising: When it is determined that access to the underlying resource is not authorized, attempting to authenticate the access, wherein attempting to authenticate the access includes requesting a token issuing authority to provide a valid authorization indication and providing the valid authorization indication to one or more resource providers.

9. The system of claim 1, wherein: Providing access to the graph database includes evaluating an access resolution rule, wherein the access resolution rule indicates that access to the graph database is provided if access to at least one underlying resource corresponding to a resource identifier in the graph database is authorized.

10. A method for delegating authorization to access a graph database, the method comprising: receiving a request from a client device to access a graph database, wherein the graph database includes a resource identifier associated with an underlying resource; registering a condition set with a sensor of the client device for monitoring a state of the condition set by the sensor; receiving a state associated with the set of conditions from the sensor; and Based on the status of the set of conditions satisfying a predetermined threshold, access to the graph database is provided according to the resource identifier without providing access to the underlying resource associated with the resource identifier.

11. The method of claim 10, wherein: The request is received by an application comprising an interface, wherein the interface is operable to enable exploration and navigation of the graphical database.

12. The method of claim 10, further comprising: The underlying resource is located by performing at least one of the following: performing a call to the resource identifier using one or more communication protocols; providing the resource identifier to a search utility; Query the resource provider for a list of accessible resources; as well as Query a network device for a list of resource locations.

13. The method of claim 10, further comprising: A determination is made as to whether access to the underlying resource is authorized by comparing account information associated with the requestor with account information associated with a single sign-on (SSO) system.

14. The method of claim 10, further comprising: A determination is made as to whether access to the underlying resource is authorized by comparing account information associated with the requestor with account information associated with a resource provider.

15. The method of claim 10, further comprising: Whether access to the underlying resource is authorized is determined by at least one of: identifying an authorization indication, analyzing one or more authorization event files, and analyzing a permission set.

16. The method of claim 10, wherein: The graph database includes its own set of security permissions such that providing access to the graph database does not additionally provide access to a separate isolated set of data including the resource identifier.

17. The method of claim 10, further comprising: When it is determined that access to the underlying resource is not authorized, attempting to authenticate the access, wherein attempting to authenticate the access includes requesting a token issuing authority to provide a valid authorization indication and providing the valid authorization indication to one or more resource providers.

18. The method of claim 10, wherein: Providing access to the graph database includes evaluating an access resolution rule, wherein the access resolution rule indicates that access to the graph database is provided if access to at least one underlying resource corresponding to a resource identifier in the graph database is authorized.

19. A hardware device storing computer executable instructions that, when executed, cause a computing system to perform operations for delegating authorization to access a graphical database, the operations comprising: receiving a request from a client device to access the graph database, wherein the graph database includes a resource identifier associated with an underlying resource; registering a condition set with a sensor of the client device for monitoring a state of the condition set by the sensor; receiving a state associated with the set of conditions from the sensor; and Based on the status of the set of conditions satisfying a predetermined threshold, access to the graph database is provided according to the resource identifier without providing access to the underlying resource associated with the resource identifier.

20. The hardware device of claim 19, wherein: The computer executable instructions, when executed, further cause the computing system to perform operations including determining whether access to the underlying resource is authorized by comparing account information associated with the requestor with account information associated with at least one of: a single sign-on (SSO) system and a resource provider.

Images