DE102021214948A1 - System and method for controlling access to data - Google Patents

Abstract

System for controlling access by a data consumer (500-B) to data from a data provider (500-X) via user accounts of the data consumer (500-B) and the data provider (500-X) in a system for controlling access, the system having a Data access control layer (DAC) that allows or prohibits access to the data depending on access rights, whereby data access control layer (DAC) administrator rights are held exclusively by a data consumer (500-B) and data provider (500-X) neutral third party.

Description

The present invention relates to a system and a computer-implemented method for controlling access to data.

State of the art

Controlling data access depending on a user's usage rights is known from the prior art.

Advantages of the Invention

The system and the method with the features of the independent claims have the advantage that secure data access can be designed to be particularly easy to control.

Developments with further advantages are the subject matter of the dependent claims.

Disclosure of Invention

In a first aspect, the invention relates to a system for controlling access by a data consumer to data from a data provider via user accounts of the data consumer and the data provider in the system, the system comprising a data access control layer which allows or prohibits access to the data depending on access rights, whereby administrator rights of the data access control layer are held exclusively by a data consumer and data provider neutral third party.

The administration of the data access control layer by a neutral third party makes it possible to refrain from further, complex measures to secure any data access, which greatly simplifies the complexity of the system.

In an advantageous development of this aspect, the neutral third party does not have access to a user account of the data consumer. By minimizing access options, the need for complex security mechanisms is further reduced.

Alternatively or additionally, a development of the first aspect can provide that the neutral third party only has read access to a user account of the data provider.

In a further aspect, the invention relates to a system in which the data provider registers the data in the data access control layer before access and for registration the data access control layer requests correct input of a hash value assigned to the data provider.

This enables the data provider to determine in a particularly simple and reliable manner that the request to register the data actually came from the data provider, which increases the security of the system.

In particular, it can be provided here that the data is only registered in the data access control layer if the data access control layer determines that the hash value is correct.

In further aspects it can be provided that the data access control layer maintains a log file in a user account of the data provider at the data access control layer, in which attempted access by the data consumer to the data is recorded.

In still further aspects, the invention relates to a system in which the data consumer is assigned to a selection of groups from a plurality of groups, with groups from the plurality of groups being granted access rights and data access for the data consumer depending on the access rights of the groups to which he is assigned is granted.

This can be done, for example, in such a way that the data consumer is granted data access if at least one of the groups to which it is assigned is granted access.

This makes administration particularly efficient and easy.

Alternatively or additionally, it can also be provided that each of the groups from the plurality of groups is assigned information that characterizes which of the data providers can see that the group exists. This enables a particularly efficient administration of confidential content.

In further aspects, the invention relates to computer-implemented methods.

Further measures improving the invention are presented in more detail below together with the description of the preferred exemplary embodiments of the invention with the aid of figures.

character list

• 1 ein Datenaustauschsystems;
• 2 eine Ausführungsform eines Datenaustauschsystems gemäß Aspekten der Erfindung;
• 3 eine Ausführungsform einer neutralen Datenbank-Architektur;
• 4 eine Ausführungsform von Aspekten der Datenzugangskontrollschicht;
• 5 eine Ausführungsform der Vermittlung des Datenzugriffs durch die Datenzugangskontrollschicht.

Show it:

• 1 a data exchange system;
• 2 an embodiment of a data exchange system according to aspects of the invention;
• 3 an embodiment of a neutral database architecture;
• 4 an embodiment of aspects of the data access control layer;
• 5 an embodiment of mediating data access through the data access control layer.

In order to implement value-added functions, e.g. with the help of digital twins of products, it is important in many cases to have product data available from all phases of the product life cycle. This can affect data on the complete (end) product as well as on its components and subsystems. In a layered value chain, such as is common in the automotive industry, such data is often not in one hand, but to a certain extent in each case with the end customers (to whom manufacturers of the end products can be granted access rights), the manufacturers of the end products, their suppliers and suppliers of suppliers, etc.

A data exchange system would here, as in 1 illustrated, a large number of bilateral technical and contractual precautions between end customers (E1, E2, E3), manufacturers of the end products (01, O2, O3), their suppliers (Z1, Z2, Z3, Z4) and suppliers' suppliers (Z5, Z6 , Z7, Z8, Z9) for the respective data access, which greatly increases the complexity.

It is therefore advantageously provided that the respective data exchange does not take place bilaterally, but via a neutral database infrastructure (200) as in 2 illustrated. This greatly reduces the associated complexity.

3 illustrates what such a neutral database infrastructure can look like. This includes a data access control layer (DAC). This data access control layer (DAC) can be located on a server (CP4) of a cloud-based infrastructure, for example. On the data provider side, it is possible that data is either also stored in this cloud-based infrastructure (with associated user accounts (K1, K2, K3) of the respective data provider), or alternatively that the data is stored on servers (CP1, CP2, CP3) of other infrastructures (e.g. with an alternative cloud-based infrastructure) are stored. In the latter case, access to this data can be mediated via user accounts (K4) of the respective data providers in the cloud-based infrastructure on which the data access control layer (DAC) is located. This means that it can be provided that the data access control layer (DAC), data providers and data consumers are each available via user accounts of a cloud-based infrastructure.

On the data consumer side, service functions (S1, S2, S3) can be provided, which in turn can be located in the cloud-based infrastructure. Access can be via an interface within the same infrastructure as the data access control layer (DAC).

In other words, in the database infrastructure (i.e. the database system), data access control layer (DAC), data consumers and data providers are operated via user accounts by operators of the data access control layer, the data consumers and the data providers. These user accounts are in the same database system. It is important here that the operator and/or the administrator of the data access control layer (DAC) is a neutral third party, i.e. neither a data consumer nor a data provider. In some embodiments it can be provided that the operator and/or the administrator of the data access control layer (DAC) has no access to the computer systems of the data consumer and only has read access to the computer systems of the data provider.

4 illustrates aspects of the operation of the data access control layer (DAC) that are generally known from the prior art. A first user account (X) of a first participant and a second user account (B) of a second participant are shown, each of which is connected to the cloud-based infrastructure of the data access control layer (DAC).

The first user account (X) has data (401) of the first participant which the second participant would like to access using his second user account (B) in order to be able to use the data in a value-added service (AFQM). The second user account (B) has data (402) of the second participant, which the first participant would like to access using his first user account (X) using his own data value-added function (App-X).

The data access control layer (DAC) mediates corresponding access for the second user account (B) to the data (401) of the first user account (X). Likewise, the data access control layer (DAC) mediates corresponding access for the first user account (X) to data (402) from the second user account (B).

5 illustrates further aspects of mediating data access through the data access control layer (DAC). Identifying Information of a user account (500-X) are registered with the provider of the cloud-based infrastructure and with the data access control layer (DAC).

In order to grant access to data (501) of the user account (X), this user account (X) registers a storage area in which the data (501) is stored in the data access control layer (DAC) by transmitting data to the data access control layer (DAC). , which allow registration of the storage area. After registration has taken place, the data access control layer (DAC) can access the memory area and thus the data (501).

In some embodiments, the information registered in the data access control layer (DAC) for identifying the user account (X) comprises a hash that uniquely (preferably one-to-one) identifies the user (500-X) behind the respective user account (X).

In some embodiments it can be provided that the user account (X) requests the input of the correct hash value in a user dialog from a user of the user account (X). This hash value can be displayed to the user of the user account (X) by the data access control layer (DAC), for example.

The hash value entered by the user is transmitted to the data access control layer (DAC).

It can then be checked within the data access control layer (DAC) whether the hash value is correct or not, and depending on this the memory area with the data (501) is registered as belonging to the user account (X). That is, in some embodiments, the memory area with the data (501) is registered precisely when the hash value has been entered correctly. This ensures that this registration was actually initiated by the user account (X).

In some embodiments it is provided that the data access control layer (DAC) groups the user accounts of data consumers into user groups. Each user account can then be assigned to a plurality of user groups.

To release access rights to data (501), it can then be provided that the user account (X) of the provider of the data (501) instructs the data access control layer (DAC) to release the registered data (501) for specifiable user groups.

In some implementations, the data consumer (500-B) can restrict the visibility of its user groups to other participants (500-X).

If a data consumer (500-B) then requests access to the data (501) from the data access control layer (DAC), it is checked for all user groups to which the user account (B) of the data consumer (500-B) is assigned whether access was granted to the data (501) for this user group. If access was granted for at least one of these user groups, access to the data (501) is released and the data (501) is read from the memory area.

In some embodiments, it is provided that the data access control layer (DAC) includes a log file that records incoming access requests from user accounts (B), as well as in some embodiments whether access was granted or not. This makes it possible in a particularly simple manner to understand in detail how the system works.

Claims (18)

System for controlling access of a data consumer (500-B) to data of a data provider (500-X) via user accounts of the data consumer (500-B) and the data provider (500-X) in the system, the system having a data access control layer (DAC) that allows or denies access to the data depending on access rights, where data access control layer (DAC) administrator rights are held exclusively by a data consumer (500-B) and data provider (500-X) neutral third party. system after claim 1 , whereby the neutral third party does not have access to a user account of the data consumer (500-B). system after claim 1 or 2 , whereby the neutral third party only has read access to a user account of the data provider (500-X). System according to one of the preceding claims, wherein the data provider (500-X) registers the data in the data access control layer (DAC) before access and for registration the data access control layer (DAC) requests correct input of a hash value assigned to the data provider (500-X). system after claim 4 , where the data is only registered in the data access control layer (DAC) if the data access control layer (DAC) determines that the hash value is correct. System according to any one of the preceding claims, wherein the data access control layer (DAC) in a user account of the data provider (500-X) at the data access control layer (DAC). Maintains a log file in which attempted access by the data consumer (500-B) to the data is recorded. System according to one of the preceding claims, wherein the data consumer (500-B) is assigned to a selection of groups from a plurality of groups, wherein groups of the plurality of groups are granted access rights and data access for the data consumer (500-B) depends on the access rights of the groups to which it is assigned. system after claim 7 , wherein the data consumer (500-B) is granted data access if at least one of the groups to which it is associated is granted access. system after claim 7 or 8th , wherein each of the groups of the plurality of groups is associated with information characterizing which of the data providers (500-X) can see that the group exists. Computer-implemented method for controlling access by a data consumer (500-B) to data from a data provider (500-X) via user accounts of the data consumer (500-B) and the data provider (500-X) in a system for controlling access, the system a data access control layer (DAC) that allows or prohibits access to the data depending on access rights, with data access control layer (DAC) administrator rights being held exclusively by a data consumer (500-B) and data provider (500-X) neutral third party. procedure after claim 10 , whereby the neutral third party does not have access to a user account of the data consumer (500-B). procedure after claim 11 , whereby the neutral third party only has read access to a user account of the data provider (500-X). Procedure according to one of Claims 10 until 12 , Wherein the data provider (500-X) registers the data in the data access control layer (DAC) before access and for registration the data access control layer (DAC) requests correct input of a hash value assigned to the data provider (500-X). procedure after Claim 13 , where the data is only registered in the data access control layer (DAC) if the data access control layer (DAC) determines that the hash value is correct. Procedure according to one of Claims 10 until 14 , The data access control layer (DAC) in a user account of the data provider (500-X) at the data access control layer (DAC) keeps a log file in which attempted access by the data consumer (500-B) to the data is recorded. Procedure according to one of Claims 10 until 15 , wherein the data consumer (500-B) is assigned to a selection of groups from a plurality of groups, with groups of the plurality of groups being granted access rights and data access for the data consumer (500-B) depending on the access rights of the groups to which it assigned, is granted. procedure after Claim 16 , wherein the data consumer (500-B) is granted data access if at least one of the groups to which it is associated is granted access. procedure after Claim 16 or 17 , wherein each of the groups of the plurality of groups is associated with information characterizing which of the data providers (500-X) can see that the group exists.

Images