Utilizing probabilistic data structures to improve access control of documents across geographic regions

Abstract

The present disclosure relates to systems, methods, and computer-readable media for efficiently and flexibly determining user access control of digital documents stored in different geographic areas using a content access authorization system. For example, a content access authorization system may convert sensitive user information of a digital document stored in a first geographic area to a probabilistic data structure that does not include the user information, and share the probabilistic data structure with a second geographic area. The content access authorization system may then utilize the probabilistic data structure to efficiently pre-filter the user document access control of the digital document requested by the user stored in a second geographic area in the first geographic area, this significantly saves latency and computing resource usage by reducing the number of document control access queries performed on the first geographic region.

Description

Background Art

[0001] In recent years, there have been significant advances in both hardware and software with respect to accessing, managing, and sharing digital content. For example, modern computing systems allow users to identify, access, and utilize digital content as well as share digital content items with other users. As an example, modern computing systems facilitate collaboration among users from different parts of the world on the same digital content item. For example, a team of users (e.g., from the same organization or company) distributed across multiple countries can work together on a shared piece of digital content.

[0002] Previously, to facilitate sharing of digital content across different geographic regions, existing computing systems would store a copy of the shared digital content in a local data center near each user of the user. In this way, existing computing systems can retrieve digital content items from the local data center more quickly than from a remote data center that is farther away. For example, if a first user in Norway shares a digital content item with a second user in India, the existing computing system would store a copy of the digital content item near both users.

[0003] Recent changes in data handling standards (DHS) and privacy regulations now prohibit the sharing of user information across specific countries and regions without user authorization. In many cases, this results in existing computing systems being inflexible and unable to store a copy of the access control block for digital content in each region because the access control block includes sensitive information about the users who have access to the digital content. Therefore, due to these and other changes, existing computing systems are no longer able to store local copies of digital content or associated information (e.g., access control blocks) in data centers across different geographic regions.

[0004] Currently, for users to access digital content stored in different regions, existing computing systems must typically send a request (e.g., call) for each digital content item to the region where the digital content is stored to first determine whether the user has permission to access the file, and if so, retrieve the content of the digital content. These inefficient calls to obtain access control information and verify which users can access the digital content of each digital content item have a significant impact on latency and resource usage. Furthermore, in addition to the latency required to route calls around the world, the call to each digital content item inefficiently uses valuable network and computing resources along the way.

[0005] Additionally, as the number of digital content items shared between users increases with the rise of performing digital content automation (e.g., automation based on analyzing multiple digital content items associated with a user), existing computing systems are further limited in their ability to determine and access a user's digital content items. In particular, many existing computing systems are rigidly prevented from efficiently providing digital content automation to users due to the burden of needing to send a call for each potential digital content item across the world. In fact, for existing computing systems to check a user's digital content access rights against a list of n digital content items stored remotely (e.g., a list of items identified as part of the automation), these existing computing systems must perform n calls to one or more remote geographic regions.

[0006] These and other problems result in significant inflexibility and inefficiency in existing computing systems with respect to managing access to digital content shared across multiple geographic regions. BRIEF DESCRIPTION OF THE DRAWINGS

[0007] The detailed description provides one or more implementations with additional specificity and detail through the use of the accompanying drawings, as briefly described below.

[0008] Figure 1A-1B A diagram is shown of a computing system environment that implements a content access authorization system in accordance with one or more implementations.

[0009] Figure 2 An example workflow for efficiently determining user document access controls for a shared collection of digital documents across different geographic regions using a probabilistic data structure in accordance with one or more implementations is shown.

[0010] Figure 3A-3C A sequence diagram is shown for efficiently managing user access controls for sharing digital content items across different geographic regions in accordance with one or more implementations.

[0011] Figure 4A-4B A flow chart and user interface for utilizing a content access authorization system to efficiently provide automatic insights to users in accordance with one or more implementations are shown.

[0012] Figure 5 An example sequence of actions for determining user access control information for a digital document is shown in accordance with one or more implementations.

[0013] Figure 6 Specific components that may be included within a computer system are shown. DETAILED DESCRIPTION

[0014] Implementations of the present disclosure provide benefits and / or solve one or more of the foregoing or other problems in the art using systems, non-transitory computer-readable media, and methods that provide a content access authorization system to efficiently and flexibly determine user access controls for digital documents stored in different geographic regions. For example, the content access authorization system can convert sensitive user information of digital documents stored in a first geographic region into a probabilistic data structure that does not include user information and shares the probabilistic data structure with a second geographic region. The content access authorization system can then utilize the probabilistic data structure to efficiently pre-filter user document access controls for digital documents stored in a first geographic region that are requested by users in a second geographic region, which significantly saves latency and computing resource usage by reducing the number of document control access queries that need to be performed on the first geographic region.

[0015] To illustrate, in multiple implementations, a content access authorization system receives or identifies a user request from a user in a first geographic region to access a document (i.e., a digital document) stored in a second geographic region. Additionally, the content access authorization system may determine that a full version of the document is stored in the second geographic region based on a shallow version of the document stored in the first geographic region. Additionally, the content access authorization system may determine whether a user has permission (e.g., access rights) to access a full version of a document stored in the second geographic region by utilizing an access control probabilistic data structure that hides the identity of the user (e.g., the probabilistic data structure does not include any information from which the identity of the user may be derived) and is stored in the first geographic region. Additionally, the content access authorization system may grant or deny access to a full version of a document stored in the second geographic region to a user in the first geographic region based on a determination from the access control probabilistic data structure.

[0016] As described herein, the content access authorization system provides several technical benefits in terms of computing flexibility and efficiency compared to existing computing systems.In fact, the content access authorization system provides several practical applications that deliver benefits and / or solve problems associated with document access control.

[0017] To illustrate, in various implementations, the content access authorization system improves flexibility by providing an efficient alternative to sending queries or calls to a large number of documents associated with a user. For example, in various implementations, the content access authorization system utilizes probabilistic data structures (e.g., bloom filters, cuckoo filters, ribbon filters, etc.) to quickly determine when a user in a first geographic region does not have permission to access a document stored in another region. In this way, the content access authorization system prevents a large number of calls from being made to the other region, which reduces both latency and resource usage, particularly if the other region is located on the opposite side of the world, as is common in multinational corporations.

[0018] As additional context, the content access authorization system generates an access control block (e.g., an access control list) for the document, which indicates different permissions and access rights granted to users associated with the document. Additionally, the content access authorization system stores the access control block locally (e.g., in a local data center) in conjunction with storing the document locally. As described above, in many cases, due to data handling standards, the access control block cannot be shared with different geographic regions (because the access control block contains sensitive user information that is not allowed to leave the local geographic region without the user's consent).

[0019] Thus, in some implementations, the content access authorization system generates a probabilistic data structure for an access control block that hides and removes user information, but also prevents discovery of the user information through reverse engineering (e.g., the user information cannot be derived, discovered, or reverse engineered from the probabilistic data structure). For example, in various cases, the content access authorization system generates the probabilistic data structure as a lossy transformation of the access control block in the same geographic region where the document is stored, which reduces the memory footprint required to store the security-protected version of the access control block. The content access authorization system can share the probabilistic data structure with other geographic regions, and when a user requests access to a document in one of the other geographic regions, utilize the probabilistic data structure in the other geographic regions to efficiently pre-filter user access to the document.

[0020] In addition, the content access authorization system provides improved efficiency over existing computing systems. To illustrate, when a user request is made in a second geographic region (e.g., a remote region) to access a document stored in a first geographic region (e.g., a source region), the content access authorization system can utilize the probabilistic data structure to quickly determine at a local level with perfect accuracy when the user does not have permission to access the document. Thus, unlike existing computing systems that require O(n) operations to determine document access permissions, the content access authorization system can utilize fewer operations (e.g., in some cases, O(k) operations, where k corresponds to the number of hash functions used to generate or query the probabilistic data structure) to determine document access permissions.

[0021] In addition, with a high level of accuracy, the content access authorization system can determine when a user should be granted permission to access a document. In many of these cases, to ensure complete data privacy, the content access authorization system can send a query to the first geographic region to verify and / or retrieve the document content of the requested document. In this way, the content access authorization system ensures low latency across geographic regions when providing data access control. In practice, this enables users (e.g., users at a multinational company operating across geographic regions) to have the same user experience as those users operating within a single region.

[0022] As shown in the foregoing discussion, the present disclosure utilizes various terms to describe the features and advantages of one or more implementations described herein. For example, the term "digital document" (or simply "document") refers to a type of digital content item. In various implementations, a document includes a file of stored content. For example, a document may include various types of content, such as text, images, audio, code, metadata, etc. In various implementations, a document is included in a document graph and / or in another type of graph (i.e., a network graph) as a node connected via edges. For example, a document graph may indicate relationships between elements, and may connect document nodes to user nodes and / or other nodes, such as entity nodes (e.g., groups, teams, companies, etc.).

[0023] As a note, although the present disclosure describes various implementations in terms of documents, the content access authorization system can perform similar operations and actions on other types of digital content and / or digital content items. For example, the content access authorization system can be a digital content access control system that efficiently determines access rights and permissions for digital content items.

[0024] Additionally, a document may include various document versions. For example, a document may include a shallow version or a full version. As used herein, a "full version" of a document (or a full version document) refers to a document including its content. Additionally, a full version of a document may also include metadata and other information about the document, such as an access control block of the document. In various implementations, a full version of a document does not hide or remove portions of the document or corresponding document information.

[0025] As used herein, a "shallow version" of a document (or a shallow version of a document) refers to a truncated version of a document. For example, in many implementations, the shallow version of a document does not include the document content. In various cases, the shallow version of a document does not include a user identifier or other user data. In an example case, the shallow version of a document includes a document address (e.g., a URL) and / or activity data of the document, such as by whom, when, where, and / or how the modification occurred. For example, in one or more implementations, the shallow version of a document is a placeholder version of the document that indicates where the full version of the document is located (e.g., the geographic area where the full document version is stored).

[0026] In some implementations, a document is associated with an access control block. As used herein, an "access control block" refers to a set of rules that indicate which users or systems are allowed to access a given document, digital content item, object, and / or resource. In various implementations, a document may be associated with an access control block. Additionally, an access control block may include other control types for compliance, such as user group labels (e.g., colleagues, teams, workgroups, company employees, affiliate members, etc.), defined content sensitivity labels (e.g., confidential, highly confidential, public, etc.), or organizational partitions (e.g., information barriers).

[0027] Additionally, in various implementations, the content access authorization system generates a probabilistic data structure from an access control block (e.g., an access control list). As used herein, the term "access control probabilistic data structure" (or simply "probabilistic data structure") refers to a data structure that provides a level of access control for a document while removing hidden (i.e., removing) user information (which may include a user name, a pseudonymous identifier, or other sensitive user information). In particular, while probabilistic data structures can be shared across geographic regions, probabilistic data structures cannot be used to derive user information. In various implementations, the probabilistic data structure is a lossy transformation of the access control block data that removes user information. Examples of probabilistic data structures include, but are not limited to, a bloom filter, a cuckoo filter, a ribbon filter, a fuse filter, an xor filter, and the like.

[0028] As used herein, the term "geographic region cloud computing system" (or simply "geographic region") refers to one or more computing systems that reside in an area defined by physical or virtual boundaries. For example, a geographic region may be defined by the boundaries of a country or a cluster of countries, such as the Asia and Pacific region, the European region, the African region, the North American region, and the like. As another example, a geographic region may be defined by association with a cluster of cloud computing systems, data centers, and / or co-located data centers. In various implementations, the geographic regions do not overlap. In some implementations, the geographic regions have a certain amount of overlap. In some cases, a geographic region may be located within another geographic region (e.g., a cloud computing system located in an air gap within a larger cloud computing system).

[0029] It is worth noting that geographic regions may be associated with user information restrictions, regulations, rules, and / or requirements. For example, a geographic region may be governed by data processing standards that regulate the sharing of user information outside the region. For example, some data processing standards require that user information may not implicitly or explicitly leave a geographic region unless specifically requested or initiated by an affected user. In some cases, users must provide authorization for their user information (e.g., a user identifier or pseudonymous identifier) ​​or data about their user information to be shared with different geographic regions.

[0030] As used herein, a "cloud computing system" refers to a network of connected computing devices that provides various services to computing devices (e.g., client devices, server devices, provider devices, customer devices, etc.). For example, as described above, a distributed computing system may include a collection of physical server devices (e.g., server nodes) organized in a hierarchical structure, including clusters, computing zones, virtual local area networks (VLANs), racks, fault domains, etc. In various implementations, the network is a virtual network or a network having a combination of virtual components and real components.

[0031] Additional details will now be provided regarding the components and elements of the content access authorization system. For example, Figure 1A-1B 1 is a schematic diagram of an environment 100 (i.e., a digital media system environment) for implementing a content access authorization system 110. In particular, Figure 1A includes environment 100, and Figure 1B Additional details are provided regarding the components and elements of the content access authorization system 110 .

[0032] like Figure 1AAs shown, the environment 100 includes a first geographical area cloud computing system 101a (or simply referred to as "first geographical area 101a") and a second geographical area cloud computing system 101b (or simply referred to as "second geographical area 101b") connected via a network 111. It is worth noting that the first geographical area 101a and the second geographical area 101b are located in different geographical areas. For example, the first geographical area 101a is located in Europe, and the second geographical area 101b is located in North America.

[0033] As shown, the first geographic area 101a is shown to include a client device 102 and a first server device 106a (which is part of a first cloud computing system). Also as shown, the second geographic area 101b includes a second server device 106b (which is part of a second cloud computing system). Figure 6 Additional details about these and other computing devices are provided. Figure 6 Additional details regarding networks, such as network 111 as shown, are also provided.

[0034] Although the first geographic area 101a includes the client device 102 and the first server device 106a, the first geographic area 101a may include any number of client devices or server devices. For example, the first server device 106a may represent a cluster of server devices. Similarly, although the client device is not shown in the second geographic area 101b for simplicity, the second geographic area 101b may include client devices and / or multiple server devices. In various implementations, the first geographic area 101a and the second geographic area 101b may include similar or different network structures and / or system architectures.

[0035] As shown, the first geographic region 101a includes a client device 102 having a client application 104. In various implementations, the client device 102 is associated with a user (e.g., a user client device), such as a user that interacts with both locally and remotely stored documents. In one or more implementations, the client device 102 interacts directly or indirectly with a content access authorization system 110 to obtain access to digital documents stored in different geographic regions, as described below.

[0036] As described above, the first geographic area 101a includes a first server device 106a, which includes a content management system 108a. As shown, the content management system 108a includes a content access authorization system 110. Figure 1B The content management system 108a is further described.

[0037] In various implementations, the content access authorization system 110 efficiently determines user permissions and retrieves document content stored both locally and remotely (e.g., within the first geographic region 101a and the second geographic region 101b). As provided below, in many cases, in response to detecting a user request to access a remotely stored document, the content access authorization system 110 can utilize a locally stored probabilistic data structure associated with the document (i.e., an access control probabilistic data structure) to quickly determine when the user does not have access rights to the document without requiring a call to a remote geographic region where a full version of the document is stored. In some implementations, the content access authorization system 110 utilizes the probabilistic data structure to determine when a user is likely to have access rights and when a call to the geographic region where the document is stored is required to retrieve the document content of the document. See below for details. Figure 1B Additional details are provided regarding the content access authorization system 110 .

[0038] like Figure 1A As shown, the second geographic region 101b includes similar components as the first geographic region 101a. For example, the second geographic region 101b includes a second server device 106b having a content management system 108b, which may be similar to the content management system 108a. The second geographic region 101b may also include another instance of the content access authorization system 110.

[0039] As mentioned above, Figure 1B Additional details are provided regarding the capabilities and components of the content access authorization system 110. For purposes of illustration, Figure 1B A geographic region cloud computing system 101 (or simply referred to as "geographic region 101") is shown with a client device 102 and a server device 106. In various implementations, the geographic region 101 represents the first geographic region 101a or the second geographic region 101b introduced above. Similarly, the server device 106 can represent the first server device 106a or the second server device 106b provided above.

[0040] As shown, the server device 106 can include a content management system 108. In various implementations, the content management system 108 can perform various functions. For example, in one or more implementations, the content management system 108 facilitates the distribution of various digital content (e.g., documents) across the geographic area 101 and / or other computing devices. In some implementations, the content management system 108 facilitates, identifies, receives, accesses, opens, loads, edits, modifies, moves, copies, shares, saves, removes, deletes, stores, downloads, sends, and / or imports digital content.

[0041] As also shown, the content management system 108 includes a content access authorization system 110. In various implementations, the content access authorization system 110 is located separately from the content management system 108. For example, the content access authorization system 110 is located on the same computing device or devices as the content management system 108, but as a separate system. In some cases, the content access authorization system 110 and the content management system 108 may be located on different computing devices. As described above, although documents are described herein, the content access authorization system may additionally or alternatively be a digital content access control system.

[0042] As shown, the content access authorization system 110 includes various components and elements. For example, the content access authorization system 110 includes a document manager 112, a document access request manager 114, an automation manager 116, and a storage manager 118. Also as shown, the storage manager 118 may include a document graph 120 and a document database 126, which includes a shallow version document 128 with a probabilistic data structure 124 and a full version document 130 with a local access control block 122.

[0043] As shown, the content access authorization system 110 includes a document manager 112. In one or more implementations, the document manager 112 receives, accesses, provides, edits, modifies, identifies, creates, or otherwise manages documents, including shallow version documents 128 and full version documents 130 stored within a document database 126. In example implementations, the documents are stored within a document graph 120. In some implementations, the document manager 112 manages the document graph 120 by adding, removing, modifying, searching, traversing, traversing, walking, and / or querying various document versions of the document graph 120 (e.g., depending on whether the full version documents 130 are stored locally or remotely).

[0044] As shown, the content access authorization system 110 includes a document access request manager 114. In various implementations, the document access request manager 114 facilitates identifying, determining, detecting, storing, accessing, or otherwise managing access controls to documents. In one or more implementations, the document access request manager 114 accesses a local access control block 122 to determine user permissions for documents stored within the geographic region 101. In one or more implementations, the document access request manager 114 generates a probabilistic data structure from the access control block and / or shares the probabilistic data structure with another geographic region (in conjunction with sharing a shallow version or corresponding document). As shown, in some cases, the probabilistic data structure 124 is part of a shallow version document 128, while the local access control block 122 is part of a full version document 130. In other cases, the local access control block 122 and / or the probabilistic data structure 124 are located separately.

[0045] In some implementations, the document access request manager 114 utilizes the probabilistic data structure 124 to determine when a query or call to another geographic region can be avoided. For example, the document access request manager 114 utilizes the probabilistic data structure to determine when a user does not have access rights to a document stored in another geographic region. In various implementations, when the user is authorized to access the document, the document access request manager 114 can retrieve digital content from a full version of the document stored in another geographic region because only a shallow version of the document is stored in the user's local geographic region.

[0046] As also shown, the content access authorization system 110 includes an automation manager 116. In various implementations, the automation manager 116 generates, identifies, edits, modifies, receives, curates, analyzes, accesses, provides, or otherwise manages user-specific document insights. For example, the automation manager 116 may detect a user action, such as visiting a website or navigating to a shared folder, and in response, execute one or more automation actions that query the user for permission rights regarding a plurality of documents (including in remotely stored documents). For example, the automation manager 116 traverses the document graph 120 and (e.g., via the document access request manager 114) performs one or more checks of each document node to obtain information between the user and each document. In additional implementations, the automation manager 116 compiles and presents the user-specific document insights to the user.

[0047] Additionally, the content access authorization system 110 includes a storage manager 118. In various implementations, the storage manager 118 may include any data used by any component of the content access authorization system 110 in performing the features and functions described herein.

[0048] As shown, geographic area 101 includes client devices 102 having client applications 104. In some implementations, content access authorization system 110 includes a web hosting application that allows client devices 102 (e.g., via client applications 104) to interact with content and services hosted on server devices 106. To illustrate, in one or more implementations, content access authorization system 110 provides an interface for viewing, editing, or otherwise modifying documents to which a user on client device 102 has access permissions. In various implementations, content access authorization system 110 obtains document access permissions as part of a background service, but is still triggered by user interaction (e.g., a user logging into a target website).

[0049] Combination Figure 2 Additional details are discussed in conjunction with an example implementation of the content access authorization system 110. For example, Figure 2An example workflow for efficiently determining user document access controls for a shared digital document collection across different geographic regions using a probabilistic data structure in accordance with one or more implementations is shown. As shown, Figure 2 A series of actions 200 are shown that may be performed by the content access authorization system 110 and / or the content management system 108. Figure 2 An overview of the content access authorization system 110 is provided, but Figure 3A-3C Additional details regarding the operation and actions of the content access authorization system 110 are provided.

[0050] like Figure 2 As shown, a series of actions 200 includes an action 202 of receiving a user request from a user in a first geographic region to access a document stored in a second geographic region. For example, in various implementations, the content access authorization system 110 detects a request from a user to access a document. In response, the content access authorization system 110 may locate a shallow version of the document stored in the first geographic region (e.g., by searching a document graph), which indicates that a full version of the document is stored in the second geographic region.

[0051] like Figure 2 As shown, a series of actions 200 includes an action 204 of utilizing a probabilistic data structure (i.e., an access control probabilistic data structure) to determine whether to deny a user in a first geographic region access to a document stored in a second geographic region. For example, if the probabilistic data structure is a Bloom filter, the content access authorization system 110 compares the encoded (e.g., hashed) user identifier to the Bloom filter stored within the first geographic region to confirm that the user does not have the privilege to access the content of the requested document. For example, the content access authorization system 110 encodes a user identifier or a pseudonymous identifier of the user as a number or value that falls within a range of entries of the probabilistic data structure, and maps the encoded user identifier to a corresponding entry in the Bloom filter (i.e., the probabilistic data structure).

[0052] like Figure 2 As shown, the series of actions 200 includes an action 206 of denying access to the document based on a negative indication from the probabilistic data structure. For example, the content access authorization system 110 can utilize the probabilistic data structure to confirm with full confidence when user permission for a document is not present. For example, if the encoded user identifier returns a negative result, the content access authorization system 110 can confirm that the user identifier is not listed in the access control block corresponding to the document.

[0053] like Figure 2As shown, a series of actions 200 includes an action 208 of providing a system request to a second geographic region to access a document from the second geographic region based on a positive indication from the probabilistic data structure. For example, if the encoded user identifier returns a negative result, the content access authorization system 110 determines to further verify that the user has the necessary permission to access the document. In some implementations, this can involve sending a request for user permission confirmation and / or a query or call for the second geographic region from the first geographic region to the second geographic region to provide the document content to the first geographic region.

[0054] like Figure 2 As shown, a series of actions 200 includes an action 210 of denying access to a document based on a negative system request response from a geographic region. For example, upon receiving a document query from a first geographic region, a content access authorization system 110 operating in a second geographic region (or simply, the second geographic region) compares a user identifier with one or more access control blocks stored in conjunction with a complete version of the document at the second geographic region. In some cases, the content access authorization system 110 at the second geographic region determines that the user is not included in the access control block and has access permission.

[0055] Also like Figure 2 As shown, a series of actions 200 includes an action 212 of providing document content based on a positive system request response from a second geographic region. For example, in various implementations, the second geographic region identifies a user identifier on an access control block of the document. In response, the second geographic region sends the content of the document back to the first geographic region, so that the first geographic region provides a complete version of the document for the user to access.

[0056] As mentioned above, Figure 3A-3C Provides additional details about the operation and actions of the content access authorization system 110. As shown, FIG. Figure 3C A sequence diagram is shown for efficiently managing user access controls for sharing digital content items across different geographic regions according to one or more implementations. For example, Figure 3A-3C A series of actions 300 are included that are performed by various computing devices.

[0057] In particular, Figure 3A-3C A first geographic area 301a is shown with a client device 102 and a content access authorization system 110 . Figure 3A-3C Also included is a second geographic region 301b having another instance of the content access authorization system 110. In various implementations, the first geographic region 301a and the second geographic region 301b represent the first geographic region 101a and the second geographic region 101b described above.

[0058] To illustrate, Figure 3AThe series of actions 300 in FIG. 3 include an action 302 in which the content access authorization system 110 stores a document in the second geographic region 301b. For example, the content access authorization system 110 operating in the second geographic region 301b stores documents created and / or modified in the second geographic region 301b. For example, a first user in the second geographic region 301b creates a document and shares the document with a team of users (i.e., a group) in which one or more users reside in the first geographic region 301a. Therefore, the content access authorization system 110 operating on the second geographic region 301b can securely store the complete version of the document in the second geographic region 301b.

[0059] As shown, the content access authorization system 110 operating in the second geographic region 301b can provide copies of the document to other geographic regions. For example, the content access authorization system 110 adds the document to a document graph (or another type of network graph that includes documents) or a network storage location. In one or more implementations, updates to the document graph can be pushed to other geographic regions.

[0060] In some cases, only a shallow version of the document is pushed to other geographic regions. For example, the content access authorization system 110 stores the full version of the document in the second geographic region 301b and stores the shallow version of the document in the first geographic region 301a. As described above, although the shallow version of the document may include metadata and other activity data for the document, the shallow version typically does not include document content or other user information.

[0061] Additionally, the series of actions 300 may include an action 304 in which the content access authorization system 110 generates a probabilistic data structure for the document. For example, in conjunction with storing the document, the content access authorization system 110 operating in the second geographic region 301b may generate one or more probabilistic data structures for the document and provide them to other geographic regions. As shown, the content access authorization system 110 on the second geographic region 301b may provide the probabilistic data structure to the first geographic region 301a.

[0062] In various implementations, the content access authorization system 110 generates an access control block that indicates security behaviors and permissions associated with a document. For example, the access control block includes a list of access control entities and corresponding granted access rights or permissions (e.g., for users and systems). In some cases, when a document is shared with users in a team, the access control block includes the user identity of each member of the team with which the document is shared. In some implementations, the access control block may indicate that one user is granted a first set of permissions (e.g., read-only permissions), and a second user is granted a second set of permissions (e.g., read permissions and write permissions).

[0063] In one or more implementations, the content access authorization system 110 generates a probabilistic data structure (i.e., an access control probabilistic data structure) from an access control block for a document. For example, the content access authorization system 110 creates a probabilistic data structure to indicate which users (and systems) have access rights by encoding the user identities of users (and system identities) into the probabilistic data structure, while still protecting the user identities by removing them and other sensitive user information from the probabilistic data structure. In this way, the probabilistic data structure can be used as a lossy transformation of the access control block data, which can be considered system metadata as opposed to user information, and can therefore be shared across geographic regions without violating data handling standards.

[0064] In some cases, the content access authorization system 110 utilizes one or more hash functions to encode the user identity and / or other user information into a bit array or other type of probabilistic data structure. For example, the content access authorization system 110 utilizes a double hash operation with the user identity to generate a Bloom filter for the document. In other cases, the content access authorization system 110 utilizes other types of operations to generate a probabilistic data structure.

[0065] In various implementations, the content access authorization system 110 creates multiple probabilistic data structures from the access control block of the document. For example, the content access authorization system 110 creates a first probabilistic data structure indicating users with read-only permission to the document. Additionally, the content access authorization system 110 creates a second probabilistic data structure indicating users with read privileges and write privileges to the document. Because the probabilistic data structure (i.e., the access control probabilistic data structure) can be saved as a bit array or even converted to an integer, the content access authorization system 110 can create multiple probabilistic data structures for a document using very little memory. In addition, creating separate probabilistic data structures that address a single permission level allows the content access authorization system 110 in other areas to more quickly and efficiently determine user document access permissions.

[0066] As shown, the series of actions 300 may include an action 306 in which the content access authorization system 110 stores a shallow version of the document and a probabilistic data structure. For example, a content access authorization system 110 operating in a first geographic region 301a may receive or otherwise identify both a shallow version of the document and a corresponding probabilistic data structure. In some cases, the content access authorization system 110 updates the local document graph to include these elements.

[0067] Subsequently, the client device 102 within the first geographic area may directly or indirectly request access to the document. Thus, as shown, the series of actions 300 may include an action 308 in which the client device 102 requests access to the document within the first geographic area 301a. As an example, a user may attempt to open the document via the client device 102. As another example, a user may perform a function or operation that triggers the content access authorization system 110 to determine access to one or more files including the document, which will be further described below. In either example, the content access authorization system 110 operating in the first geographic area 301a may detect an action initiated by a user requesting access to the document.

[0068] As shown, a series of actions 300 includes an action 310 in which the content access authorization system 110 determines that a document is stored in a second geographic region 301b. For example, upon receiving a user request to access a document, the content access authorization system 110 operating in the first geographic region 301a locates a shallow version of the document within its version of the document graph. Then, from the shallow version of the document, the content access authorization system 110 can determine that a full version of the document is stored in the second geographic region 301b. In some implementations, only the probabilistic data structure of the document is accessible within the first geographic region 301a. (e.g., only the probabilistic data structure is stored, or the shallow version of the document includes only one or more probabilistic data structures).

[0069] As also shown, the series of actions 300 includes an action 312 in which the data access control system 110 utilizes the probabilistic data structure to determine document access permissions. For example, when a call or query is sent to the second geographic region 301b, the content access authorization system 110 operating in the first geographic region 301a locally processes the probabilistic data structure to quickly and efficiently determine whether the requesting user (i.e., the client device 102) has permission to access the document or whether a call to the second geographic region 301b is necessary. In fact, in many cases, the call to the second geographic region 301b can be avoided, which results in reduced latency, bandwidth usage, and computing resource usage. In fact, based on the results of comparing the user identifier (or pseudonymous identifier) ​​with the probabilistic data structure, the content access authorization system 110 can perform different actions as described below.

[0070] In detail, actions 302-312 in a series of actions 300 belong to Figure 3A3 and 3 as “B2”. Later, the sequence of actions 300 may further branch path B2 into two additional paths (i.e., path C1 and path C2), at Figure 3C For ease of explanation, Figure 3B An overview diagram of various paths described with respect to a series of actions 300 is included.

[0071] Return to Figure 3A As described above, in the following path A, the content access authorization system 110 may compare the user identifier with the probabilistic data structure. In some implementations, based on the result of the comparison, the content access authorization system 110 proceeds to path B1.

[0072] To illustrate, as shown, the series of actions 300 includes an action 314 in which the content access authorization system 110 denies access based on failure to meet an access control threshold at a first geographic area 301a. For example, the content access authorization system 110 may encode a user name (i.e., a user identifier or a pseudonymous identifier) ​​of a requesting user (i.e., a client device 102) and map it to one or more entries in a probabilistic data structure. In particular, the content access authorization system 110 may encode the user identifier of the user as a number or token that falls within a range of entries of the probabilistic data structure, and map the encoded user identifier to a corresponding entry in the probabilistic data structure. Then, based on the results or values ​​within the one or more entries, the content access authorization system 110 may very quickly determine that the access control threshold is not met.

[0073] Because the content access authorization system 110 performs action 314 locally on the first geographic region 301a, the content access authorization system 110 can "fail fast" and reduce the number of required fan-out calls to the second geographic region 301b, which saves latency and computer resource usage. In fact, the content access authorization system 110 can quickly pre-filter out user document access control requests for users who do not have local permissions in the first geographic region 301a, rather than sending these same requests to the second geographic region 301b.

[0074] By way of example, assume that the probabilistic data structure is a Bloom filter with a bit array of entries that have a value of 0 or a value of 1. In this example, the content access authorization system 110 can encode (e.g., hash) the user identifier into a number that falls within the range of entries in the Bloom filter and map it to a corresponding entry in the Bloom filter. If the entry has a value of 0, the user identifier does not have permission to access the document (i.e., the access control threshold is not satisfied). In this case, the value 0 in the entry corresponding to the encoded user identifier indicates that the user identifier is not included in the probabilistic data structure and is therefore not included in the corresponding access control block of the document. However, if the entry has a value of 1, this indicates that the user identifier may have permission to access the document, but more information is needed before a completely accurate determination can be made (i.e., the access control threshold is satisfied). In this example, a value above 0 may satisfy the access control threshold.

[0075] In some cases, in the above example, the content access authorization system 110 encodes the user identifier by performing multiple hashes and mapping each hash to a different entry within the Bloom filter. If all mapped entries map to a value of 0, then the user does not have permission to access the document. Otherwise, if one or more of the encoded values ​​maps to a value of 1, then again more information is needed.

[0076] As shown, the series of acts 300 includes an act 316 in which the content access authorization system 110 operates in the second geographic region 301b to indicate a denial of the document to the client device 102. For example, in some implementations, the content access authorization system 110 indicates to the client device 102 that the requested type of access to the document is denied because the user identifier does not have sufficient access permissions.

[0077] In some implementations, the data access control system 110 indicates document rejection by hiding or removing the document from a list, interface, or insight to be provided to the user. For example, in these implementations, the content access authorization system 110 verifies user access control permissions for a document as part of a background process.

[0078] Now go to Figure 3C, the content access authorization system 110 may determine to take another path (e.g., path B2) based on the results of action 312. For example, in utilizing the probabilistic data structure to determine document access permissions, the content access authorization system 110 may determine that an access control threshold is satisfied and proceed to path B2. Thus, as shown by path B2, the series of actions 300 includes an action 318 in which the content access authorization system 110 determines that the access control threshold is satisfied over the first geographic area 301a. For example, the content access authorization system 110 may determine that the user identifier may be included in the probabilistic data structure. However, because the probabilistic data structure is a lossy transformation of the access control block, satisfying the access control threshold may be a false positive indication that the user should be granted document permissions.

[0079] As shown, a series of actions 300 includes an action 320 in which the content access authorization system 110 operates in a first geographic region 301a to provide a system request with a user ID (i.e., a user identifier) ​​for document access to a second geographic region 301b. For example, for the content access authorization system 110 operating in the first geographic region 301a to make a fully accurate determination of user permissions regarding a document, in various implementations, the content access authorization system 110 must reach the second geographic region 301b (e.g., a home geographic region where a complete version of the document and a corresponding access control block are stored).

[0080] In one or more implementations, a content access authorization system 110 operating in a first geographic region 301a automatically generates and sends a system request (e.g., a fan-out call) to a second geographic region 301b. For example, the system request identifies a document for which access is requested and a user identifier. Because the content access authorization system 110 acts in response to an action initiated by a user, the content access authorization system 110 can send the user identifier without violating data handling standards. In many cases, the content access authorization system 110 uses encryption to send the system request to further protect the user identifier.

[0081] As shown, the series of actions 300 includes an action 322 in which the content access authorization system 110 operates in the second geographic region 301b using the user ID to verify document access rights. In some implementations, the content access authorization system 110 operating in the second geographic region 301b utilizes a probabilistic data structure to verify document access rights. In other implementations, the content access authorization system 110 verifies the user identifier based on an access control block because it does not violate data processing standards to perform this operation within the second geographic region 301b.

[0082] Based on the result of the document access permission verification, the content access authorization system 110 can branch into multiple paths again. As described above, based on whether the content access authorization system 110 operating in the second geographic area 301b determines that the user identifier should be granted permission to the document, the content access authorization system 110 can proceed to path C1 or path C2. In particular, if it is determined that the user identifier does not have permission to access the document, the content access authorization system 110 can proceed to path C1. Otherwise, if it is determined that the user identifier has permission to access the document, the content access authorization system 110 can proceed to path C2.

[0083] As shown in conjunction with path C1, a series of actions 300 includes an action 324 in which the content access authorization system 110 operating in the second geographic region 301b sends the document content (if document access is authorized) to the content access authorization system 110 operating in the first geographic region 301a. For example, when it is found that the user identifier has permissions to access the document, the content access authorization system 110 operating in the second geographic region 301b can indicate to the content access authorization system 110 operating in the first geographic region 301a which permissions the user identifier is granted with respect to the document. In some cases, the content access authorization system 110 operating in the second geographic region 301b responds to the system request with a confirmation or a negative confirmation.

[0084] In one or more implementations, when it is discovered that the user identifier has permission to access the document, the content access authorization system 110 operating in the first geographic region 301a cannot provide the document to the client device 102 because the shallow version of the document stored in the first geographic region 301a does not include the document content. Therefore, in these implementations, the content access authorization system 110 operating in the second geographic region 301b can make the document content available to the first geographic region 301a.

[0085] To illustrate, upon receiving confirmation of a system request for document access and / or document content, the content access authorization system 110 operating in the first geographic region 301a can provide document access to the user. As shown, the series of actions 300 includes an action 326 in which the content access authorization system 110 operates in the first geographic region 301a to provide document access to the client device 102.

[0086] In some implementations, providing document access includes providing the document itself to the client device 102. In various implementations, providing document access includes including the document in a list, interface, or insight to be provided to the user. In one or more implementations, providing document access includes displaying a preview of the document on the client device 102.

[0087] As shown in conjunction with path C2, the series of actions 300 includes an action 328 in which the content access authorization system 110 operating in the second geographic region 301b sends a negative indicator to the content access authorization system 110 operating in the first geographic region 301a if document access is not granted. For example, upon determining that the access control block of the document does not include a user identifier, the content access authorization system 110 operating in the second geographic region 301b may indicate so to the content access authorization system 110 operating in the first geographic region 301a.

[0088] In response, the content access authorization system 110 operating in the first geographic region 301a may receive a negative acknowledgement of the system request for document access and indicate a document denial to the client device 102. Thus, as shown, the series of actions 300 includes an action 330 in which the content access authorization system 110 operating in the first geographic region 301a indicates a document denial to the client device 102. Action 330 may be similar to action 316 described above.

[0089] Now turn to Figure 4A-4B , provides additional details on leveraging probabilistic data structures to perform automation to provide insights to users. In particular, Figure 4A A flow diagram for utilizing a content access authorization system to efficiently provide automated insights to users is shown in accordance with one or more implementations. Figure 4B

[0013] A user interface for providing automated insights to a user is shown in accordance with one or more implementations.

[0090] As shown, Figure 4A An action of detecting a user action 402 is included. In some implementations, the content access authorization system 110 detects a direct or explicit user action. In other implementations, the content access authorization system 110 detects an indirect or implicit user action. In most cases, the content access authorization system 110 responds to some type of user-initiated request to access one or more documents stored in another geographic region.

[0091] As an example, a user accesses a document collection that includes multiple documents shared with other users. For example, the document collection includes documents created, modified, owned, and / or managed by users in different geographic areas. In some cases, the document collection is provided in a local file directory that is synchronized with cloud storage. In other cases, the document collection is provided via a website or web page directory.

[0092] As shown, Figure 4AAn action 404 of performing automation in response to detecting a user action is included. For example, the content access authorization system 110 performs one or more automations including querying a plurality of documents associated with the user. For example, the content access authorization system 110 provides insights to the user, such as recently accessed documents, documents being worked on by team members or peers, new documents added to a particular directory, documents within the organization, or documents of anticipated interest to the user. As another example, the content access authorization system 110 performs other types of automations involving querying a plurality of documents residing in a geographic region different from where the user resides.

[0093] As shown, Figure 4A An action 406 of traversing the graph to identify documents is included. For example, in various implementations, the content access authorization system 110 traverses the document graph to discover candidate documents corresponding to a given automation. For example, if the automation is to display recently accessed documents, the content access authorization system 110 traverses the document graph to find documents that were recently accessed, viewed, modified, opened, etc. Although the content access authorization system 110 can identify candidate documents by analyzing full versions of the documents, the content access authorization system 110 can also identify candidate documents that are saved as shallow versions in the graph. In this way, the content access authorization system 110 can locate both locally stored documents and documents stored remotely in other geographic areas.

[0094] To elaborate, when the full version of a document is stored in another geographic region, the content access authorization system 110 can obtain the necessary information it needs from the shallow version of the document. In particular, when traversing the document graph, the content access authorization system 110 does not search for documents to which the user has access, but rather searches for candidate documents that meet the given automated query criteria. In fact, the document stored as a shallow version does not include user information for the content access authorization system 110 to search.

[0095] As another example, if the automation is to identify documents associated with team members or peers, the content access authorization system 110 can locate the team or group (e.g., a security group) on the graph and traverse (e.g., span or walk) the graph to identify candidate documents corresponding to the target team or group. For example, the content access authorization system 110 traverses the graph using the group's label instead of the user identifier. Again, the content access authorization system 110 can traverse the graph to identify candidate documents without relying on user information.

[0096] Figure 4AAlso included is an action 408 of utilizing the probabilistic data structure to remove unauthorized documents. For example, for each candidate document stored as a shallow version, the content access authorization system 110 can utilize the probabilistic data structure corresponding to the document to quickly and locally filter out documents that the user does not have access rights to. In contrast, existing computer systems will send a document access request to a remote geographic region for each candidate document.

[0097] In many cases, the content access authorization system 110 will identify a large number of documents that satisfy a query corresponding to a given automation but for which the user does not have any permissions. For example, the content access authorization system 110 identifies 95 documents associated with a target team to which the user belongs. However, the content access authorization system 110 utilizes a probabilistic data structure to determine that the user does not have permissions to access 10% of the documents (e.g., the team is working on a large number of documents, but the user only has permissions to access a select few documents).

[0098] Once candidate documents for which the user does not have permissions have been filtered out, the content access authorization system 110 can determine the access permissions for the remaining candidate documents. For illustration, Figure 4A An act of making a call to a remote region to obtain the document content is included 410. For example, using the remaining candidate documents (e.g., documents that the probabilistic data structure indicates are likely to be approved by the user), the content access authorization system 110 can call or query the geographic region where the full version of the document is stored, as described above.

[0099] Additionally, Figure 4A An action 412 of generating and providing insights based on the accessed documents is included. For example, in various implementations, the content access authorization system 110 analyzes documents for which the user has permission and generates user insights to provide to the user. Figure 4B An example of user insights provided to a user is shown.

[0100] To illustrate, Figure 4B A graphical user interface is shown for providing insights to a user based on documents to which the user has access rights. As shown, Figure 4B Included is a computing device 420 having a graphical user interface 422. In various implementations, the computing device 420 represents the client device 102 described above.

[0101] As shown, graphical user interface 422 includes various automated insights for a user referred to as User 1. For example, graphical user interface 422 includes recommended documents 424 and recently accessed documents 426. The documents shown in graphical user interface 422 are documents that User 1 has permission to access.

[0102] For context, the content access authorization system 110 may provide, in response to detecting a request initiated by a user for document access: Figure 4B For example, when user 1 visits the target website (e.g., office.com), the content access authorization system 110 starts running one or more automations in the background to generate user insights, which is described in conjunction with Figure 4A Described.

[0103] As shown, recommended documents 424 include documents that the content access authorization system 110 has determined to be of interest to the user. For example, the content access authorization system 110 traverses the document graph to determine a plurality of candidate documents, utilizes a plurality of probabilistic data structures to quickly and efficiently filter out candidate documents to which the user does not have access permissions, and determines interest scores for the remaining documents to which the user has access permissions. For example, recommended documents 424 are shown as the three highest ranked recommended documents determined for User 1.

[0104] As described above, graphical user interface 422 includes recently accessed documents 426. As shown, recently accessed documents 426 includes a list of documents recently accessed by the user. In the illustrated implementation, recently accessed documents 426 include additional document information, such as the document type, the document name, the time when the document was last accessed, and the user who last interacted with the document. In other implementations, recently accessed documents 426 may include additional or alternative information corresponding to recently accessed documents to which user 1 has access rights.

[0105] Now turn to Figure 5 , which illustrates an example flow diagram of a series of actions 500 including determining user access control information for a digital document, according to one or more implementations. Figure 5 Actions according to one or more implementations are shown, but alternative implementations may omit, add, reorder, and / or modify any of the actions shown. Figure 5 The actions of may be performed as part of a method. Alternatively, a non-transitory computer-readable medium may include instructions that, when executed by one or more processors, cause a computing device to perform Figure 5 In a further implementation, the system may perform Figure 5 action.

[0106] As shown, series of acts 500 includes an act 510 of receiving a user request for accessing a document in a second geographic region. For example, act 510 may include receiving a user request from a user in a first geographic region for accessing a digital document stored in a second geographic region. In one or more implementations, the second geographic region includes data processing standards that prevent a user identifier of the user from being stored outside of the second geographic region.

[0107] In various implementations, action 510 includes an access request query executed as a background process. In various implementations, the background process includes multiple access request queries requesting access to multiple digital documents stored in the second geographic area. In an example implementation, one or more results of the multiple access request queries are used to provide document insights to the user. In one or more implementations, the background process is an automated technique triggered based on a user accessing a web page associated with a digital document. According to some implementations, the multiple access request queries correspond to traversing a graph including multiple digital documents.

[0108] As further shown, series of acts 500 includes an act of determining that a full version of the document is stored in a second geographic region 520. For example, act 520 can involve determining that a full version of the digital document is stored in the second geographic region based on a shallow version of the digital document stored in the first geographic region. In some implementations, the shallow version of the digital document stored in the first geographic region includes metadata of the digital document, the metadata including activity data indicating modifications to the digital document performed in both the first geographic region and the second geographic region.

[0109] As further shown, the series of acts 500 includes an act 530 of determining whether the user has permission to access a full version of a document in a second geographic region by utilizing a probabilistic data structure. For example, act 530 can include determining that a full version of a digital document is stored in a second geographic region based on a shallow version of the digital document stored in a first geographic region. In some implementations, act 530 includes determining whether the user has permission to access a full version of a digital document stored in a second geographic region by utilizing an access control probabilistic data structure stored in the first geographic region, wherein the access control probabilistic data structure removes the identity of the user.

[0110] In some implementations, act 530 includes determining that the user does not have permission to access the full version of the digital document stored in the second geographic region by utilizing an access control probability data structure stored in the first geographic region. In one or more implementations, act 530 includes sending a query from the first geographic region to the second geographic region for the user to access the full version of the digital document stored in the second geographic region based on determining that the user satisfies the access control threshold.

[0111] In one or more implementations, act 530 includes determining, within the first geographic region, using the access control probabilistic data structure, that the user does not have permission to access the full version of the digital document stored in the second geographic region. In various implementations, act 530 includes determining, using the access control probabilistic data structure, that the user does not have permission to access the full version of the digital document stored in the second geographic region by converting a user identifier of the user into a number that falls within a range of numbers in the access control probabilistic data structure, and determining that an entry in the access control probabilistic data structure that corresponds to the number does not satisfy an access control threshold.

[0112] In some implementations, act 530 of determining whether the user has permission to access the full version of the digital document stored in the second geographic region may include utilizing the access control probability data structure within the first geographic region to determine that the user satisfies the access control threshold. In additional implementations, act 530 may include: based on utilizing the access control probability data structure within the first geographic region to determine that the user satisfies the access control threshold, sending a query from the first geographic region to the second geographic region; and receiving an indication from the second geographic region to grant or deny access to the full version of the digital document stored in the second geographic region to the user in the first geographic region.

[0113] Additionally, action 530 may include receiving an access control probability data structure from the second geographic region and at the first geographic region. In an example implementation, the access control probability data structure corresponds to a permission associated with the digital document. In a specific implementation, the access control probability data structure does not include a user identifier of the user. In addition, the second geographic region includes an access control block associated with the digital document, the access control block including the user identifier and a corresponding user permission that permits the user to access a full version of the digital document stored in the second geographic region within the first geographic region.

[0114] Additionally, in various implementations, action 530 may include determining that the user belongs to a group. In various implementations, determining whether the user has permission to access the full version of the digital document stored in the second geographic area includes utilizing the group's label and an access control probability data structure to determine whether the user has permission to access the full version of the digital document stored in the second geographic area. In various implementations, the access control probability data structure includes a bloom filter. In some implementations, the access control probability data structure includes a cuckoo filter, a ribbon filter, or an xor filter.

[0115] As further shown, series of actions 500 includes an action 540 of granting or denying access to a full version of a document to a user in a first geographic region. For example, action 540 can involve granting or denying access to a full version of a digital document stored in a second geographic region to a user in the first geographic region based on a determination from an access control probability data structure. In one or more implementations, action 540 includes denying access to a full version of a digital document stored in a second geographic region to a user in the first geographic region based on a determination from the access control probability data structure.

[0116] In some implementations, the actions include receiving an indication from the second geographic region to deny a user in the first geographic region access to a full version of a digital document stored in the second geographic region and / or denying a user in the first geographic region access to a full version of a digital document stored in the second geographic region based on the indication received from the second geographic region. In an example implementation, action 540 includes denying a user in the first geographic region access to a full version of a digital document stored in the second geographic region based on determining that the user does not have permission to access the full version of the digital document stored in the second geographic region.

[0117] "Network" is defined as one or more data links that enable electronic data to be transmitted between computer systems and / or modules and / or other electronic devices. When information is transmitted or provided to a computer via a network or another communication connection (hardwired, wireless, or a combination of hardwired or wireless), the computer correctly regards the connection as a transmission medium. The transmission medium may include a network and / or a data link, which may be used to carry the required program code units in the form of computer executable instructions or data structures, and may be accessed by general or special computers. The above combination should also be included in the scope of computer-readable media.

[0118] In addition, the network described herein may represent a network or a collection of networks (such as the Internet, an intranet, a virtual private network (VPN), a local area network (LAN), a wireless local area network (WLAN), a cellular network, a wide area network (WAN), a metropolitan area network (MAN), or a combination of two or more such networks) through which one or more computing devices can access the content access authorization system 110. In fact, the network described herein may include one or more networks that use one or more communication platforms or technologies to transmit data. For example, the network may include the Internet or other data links that are capable of transmitting electronic data between corresponding client devices and components of a cloud computing system (e.g., server devices and / or virtual machines thereon).

[0119] In addition, upon reaching various computer system components, program code units in the form of computer executable instructions or data structures can be automatically transferred from the transmission medium to the non-transitory computer readable storage medium (device) (or vice versa). For example, computer executable instructions or data structures received over a network or data link can be buffered in RAM within a network interface module (NIC), and then ultimately transferred to the computer system RAM and / or a less volatile computer storage medium (device) at the computer system. Therefore, it should be understood that non-transitory computer readable storage media (devices) can be included in computer system components that also (or even primarily) utilize transmission media.

[0120] Computer executable instructions include, for example, instructions and data, which, when executed by a processor, cause a general-purpose computer, a special-purpose computer, or a special-purpose processing device to perform a specific function or function group. In some implementations, computer executable instructions are executed by a general-purpose computer to transform a general-purpose computer into a special-purpose computer that implements the elements of the present disclosure. Computer executable instructions can be, for example, binary files, intermediate format instructions (such as assembly language), or even source code. Although the subject matter has been described in a language dedicated to structural features and / or method actions, it should be understood that the subject matter defined in the appended claims is not necessarily limited to the features or actions described above. Instead, the features and actions described are disclosed as example forms for implementing the claims.

[0121] Figure 6 Specific components are shown that may be included within computer system 600. Computer system 600 may be used to implement the various computing devices, components, and systems described herein.

[0122] In various implementations, computer system 600 may represent one or more of a client device, a server device, or the other computing devices described above. For example, computer system 600 may refer to various types of network devices capable of accessing data on a network, a cloud computing system, or another system. For example, a client device may refer to a mobile device, such as a mobile phone, a smart phone, a personal digital assistant (PDA), a tablet computer, a laptop computer, or a wearable computing device (e.g., a headset or a smart watch). A client device may also refer to a non-mobile device, such as a desktop computer, a server node (e.g., from another cloud computing system), or another non-portable device.

[0123] Computer system 600 includes processor 601. Processor 601 may be a general purpose single-chip or multi-chip microprocessor (e.g., Advanced RISC (Reduced Instruction Set Computer) Machine (ARM)), a special purpose microprocessor (e.g., a digital signal processor (DSP)), a microcontroller, a programmable gate array, etc. Processor 601 may be referred to as a central processing unit (CPU). Although processor 601 is shown as only Figure 6 A single processor is depicted in the computer system 600 , but in an alternative configuration, a combination of processors (e.g., an ARM and DSP) could be used.

[0124] The computer system 600 also includes a memory 603 in electronic communication with the processor 601. The memory 603 may be any electronic component capable of storing electronic information. For example, the memory 603 may be embodied as a random access memory (RAM), a read-only memory (ROM), a magnetic disk storage medium, an optical storage medium, a flash memory device in a RAM, on-board memory including a processor, an erasable programmable read-only memory (EPROM), an electrically erasable programmable read-only memory (EEPROM) memory, a register, etc., including combinations thereof.

[0125] Instructions 605 and data 607 may be stored in memory 603. Instructions 605 may be executed by processor 601 to implement some or all of the functionality disclosed herein. Executing instructions 605 may involve using data 607 stored in memory 603. Any of the various examples of modules and components described herein may be implemented in part or in whole as instructions 605 stored in memory 603 and executed by processor 601. Any of the various examples of data described herein may be in data 607 stored in memory 603 and used during execution of instructions 605 by processor 601.

[0126] The computer system 600 may also include one or more communication interfaces 609 for communicating with other electronic devices. The one or more communication interfaces 609 may be based on wired communication technology, wireless communication technology, or both. Some examples of the one or more communication interfaces 609 include a universal serial bus (USB), an Ethernet adapter, a wireless adapter operating according to the Institute of Electrical and Electronics Engineers (IEEE) 602.11 wireless communication protocol, Wireless communication adapter and infrared (IR) communication port.

[0127] The computer system 600 may also include one or more input devices 611 and one or more output devices 613. Some examples of the one or more input devices 611 include a keyboard, a mouse, a microphone, a remote control device, a button, a joystick, a trackball, a touchpad, and a light pen. Some examples of the one or more output devices 613 include speakers and printers. A specific type of output device typically included in the computer system 600 is a display device 615. The display device 615 used with the implementations disclosed herein may utilize any suitable image projection technology, such as a liquid crystal display (LCD), a light emitting diode (LED), a gas plasma, electroluminescence, etc. A display controller 617 may also be provided for converting data 607 stored in the memory 603 into text, graphics, and / or moving images (as appropriate) shown on the display device 615.

[0128] The various components of the computer system 600 may be coupled together via one or more buses, which may include a power bus, a control signal bus, a status signal bus, a data bus, etc. For clarity, Figure 6 Various buses are shown in FIG. 6 as bus system 619 .

[0129] Those skilled in the art will appreciate that the present disclosure can be practiced in a network computing environment with many types of computer system configurations, including personal computers, desktop computers, laptop computers, message processors, handheld devices, multiprocessor systems, microprocessor-based or programmable consumer electronics, network PCs, minicomputers, mainframe computers, mobile phones, PDAs, tablet computers, pagers, routers, switches, etc. The present disclosure can also be practiced in a distributed system environment, where both a local computer system and a remote computer system linked by a network (by a hardwired data link, a wireless data link, or a combination of a hardwired and wireless data link) perform tasks. In a distributed system environment, program modules can be located in both a local memory storage device and a remote memory storage device.

[0130] Unless explicitly described as being implemented in a particular manner, the techniques described herein may be implemented in hardware, software, firmware, or any combination thereof. Any features described as modules, components, and the like may also be implemented together in an integrated logic device, or separately as discrete but interoperable logic devices. If implemented in software, the techniques may be implemented at least in part by a non-transitory processor-readable storage medium comprising instructions that, when executed by at least one processor, perform one or more of the methods described herein. Instructions may be organized into routines, programs, objects, components, data structures, and the like that may perform specific tasks and / or implement specific data types, and may be combined or distributed in various implementations as desired.

[0131] Computer-readable media can be any available media that can be accessed by a general or special purpose computer system. A computer-readable medium that stores computer-executable instructions is a non-transitory computer-readable storage medium (device). A computer-readable medium that carries computer-executable instructions is a transmission medium. Therefore, by way of example and not limitation, implementations of the present disclosure may include at least two distinct types of computer-readable media: a non-transitory computer-readable storage medium (device) and a transmission medium.

[0132] As used herein, non-transitory computer-readable storage media (devices) may include RAM, ROM, EEPROM, CD-ROM, solid-state drives (“SSD”) (e.g., RAM-based), flash memory, phase-change memory (“PCM”), other types of memory, other optical disk storage, magnetic disk storage or other magnetic storage devices, or any other medium that can be used to store desired program code means in the form of computer-executable instructions or data structures and that can be accessed by a general or special purpose computer.

[0133] Without departing from the scope of the claims, the steps and / or actions of the methods described herein may be interchangeable with each other. In other words, unless the correct operation of the described method requires a specific order of steps or actions, the order and / or use of specific steps and / or actions may be modified without departing from the scope of the claims.

[0134] The term "determining" encompasses a wide variety of actions, and thus, "determining" may include calculating, computing, processing, deriving, investigating, looking up (e.g., looking up in a table, a database, or another data structure), ascertaining, etc. Also, "determining" may include receiving (e.g., receiving information), accessing (e.g., accessing data in a memory), etc. Also, "determining" may include resolving, selecting, choosing, establishing, etc.

[0135] The terms "comprising," "including," and "having" are intended to be inclusive, and mean that there may be additional elements in addition to the listed elements. Additionally, it should be understood that reference to "one implementation" or "an implementation" of the present disclosure is not intended to be interpreted to exclude the existence of additional implementations that also incorporate the described features. For example, any element or feature described with respect to an implementation herein may be combined with any element or feature of any other implementation described herein, where compatible.

[0136] The present disclosure may be embodied in other specific forms without departing from its spirit or characteristics. The described implementations are considered to be illustrative rather than restrictive. Therefore, the scope of the present disclosure is indicated by the appended claims rather than by the foregoing description. Changes falling within the equivalent meaning and scope of the claims should be included within the scope of the claims.

Claims

1. A computer-implemented method for determining user access control information for a digital document, comprising: receiving a user request from a user in a first geographic region to access a digital document stored in a second geographic region; determining, based on the shallow version of the digital document stored in the first geographic area, that a full version of the digital document is stored in the second geographic area; determining whether the user has permission to access a full version of the digital document stored in the second geographic region by utilizing an access control probability data structure stored in the first geographic region, wherein the access control probability data structure removes user identity; as well as Based on the determination according to the access control probabilistic data structure, the user in the first geographic region is granted or denied access to a full version of the digital document stored in the second geographic region.

2. The computer-implemented method of claim 1 , wherein: Determining whether the user has permission to access the full version of the digital document stored in the second geographic region includes: utilizing the access control probability data structure within the first geographic region to determine that the user does not have permission to access the full version of the digital document stored in the second geographic region; and Granting or denying the user in the first geographic area access to the full version of the digital document stored in the second geographic area includes: based on determining that the user does not have permission to access the full version of the digital document stored in the second geographic area, denying the user in the first geographic area access to the full version of the digital document stored in the second geographic area.

3. The computer-implemented method of claim 1 , wherein: The second geographic region includes data handling standards that prevent a user identifier of the user from being stored outside of the second geographic region.

4. The computer-implemented method of claim 1 , further comprising: Determining that the user does not have permission to access the full version of the digital document stored in the second geographic area using the access control probabilistic data structure by: encoding a user identifier for the user as a number that falls within a range of numbers in the access control probability data structure; and A determination is made that the entry in the access control probability data structure corresponding to the number does not satisfy an access control threshold.

5. The computer-implemented method of claim 1 , wherein: Determining whether the user has permission to access the full version of the digital document stored in the second geographic area includes utilizing the access control probability data structure within the first geographic area to determine that the user satisfies an access control threshold.

6. The computer-implemented method of claim 5, further comprising: sending a query from the first geographic region to the second geographic region based on determining, in the first geographic region, utilizing the access control probability data structure to determine that the user satisfies an access control threshold; as well as An indication is received from the second geographic region to grant or deny access to the full version of the digital document stored in the second geographic region to the user in the first geographic region.

7. The computer-implemented method of claim 6, further comprising: The access control probability data structure is received from the second geographic region and at the first geographic region, wherein the access control probability data structure corresponds to a license associated with the digital document, and wherein the access control probability data structure does not include a user identifier for the user.

8. The computer-implemented method of claim 7, wherein: The second geographic region includes an access control block associated with the digital document, the access control block including the user identifier and a corresponding user permission that permits the user to access within the first geographic region a full version of the digital document stored in the second geographic region.

9. The computer-implemented method of claim 1 , wherein: The access control probability data structure includes: a Bloom filter; and / or The access control probability data structure includes: a cuckoo filter, a ribbon filter, or a xor filter.

10. The computer-implemented method of claim 1 , further comprising: determining that the user belongs to a group; as well as Wherein, determining whether the user has permission to access the full version of the digital document stored in the second geographic area includes: using the label of the group and the access control probability data structure to determine whether the user has permission to access the full version of the digital document stored in the second geographic area.

11. A computer-implemented method of determining user access control information for a digital document, comprising: receiving a user request from a user in a first geographic region to access a digital document stored in a second geographic region; determining, based on the shallow version of the digital document stored in the first geographic area, that a full version of the digital document is stored in the second geographic area; determining, using an access control probability data structure stored in the first geographic area, that the user satisfies an access control threshold; based on determining that the user satisfies the access control threshold, sending a query from the first geographic region to the second geographic region for the user to access a full version of the digital document stored in the second geographic region; receiving from the second geographic region an indication that access to a full version of the digital document stored in the second geographic region is denied to the user in the first geographic region; as well as Based on the indication received from the second geographic area, the user in the first geographic area is denied access to a full version of the digital document stored in the second geographic area.

12. The computer-implemented method of claim 11, wherein: The user request of the user in the first geographic area to access the full version of the digital document stored in the second geographic area includes an access request query performed as a background process.

13. The computer-implemented method of claim 12, wherein: The background process includes: a plurality of access request queries requesting access to a plurality of digital documents stored in the second geographic area; one or more results of the plurality of access request queries are used to provide document insights to the user; and The background process is an automated technique that is triggered based on a user accessing a web page associated with the digital document.

14. The computer-implemented method of claim 11, wherein: The shallow version of the digital document stored in the first geographic region includes metadata for the digital document, the metadata including activity data indicative of modifications to the digital document performed in both the first geographic region and the second geographic region.

15. A system comprising: At least one processor and a storage medium storing instructions, which, when executed by the at least one processor, cause the system to perform the method according to any one of claims 1-10.

Images