US 11,734,053 B2
Attribute-based access control using a dynamic expression engine
Nicholas Bailey, Chicago, IL (US); Jon Stahl, Seattle, WA (US); David Manelski, Seattle, WA (US); Michael McCormick, Boulder, CO (US); and Nicholaus Lacock, San Francisco, CA (US)
Assigned to Salesforce, Inc., San Francisco, CA (US)
Filed by Salesforce, Inc., San Francisco, CA (US)
Filed on Jun. 11, 2021, as Appl. No. 17/346,099.
Application 17/346,099 is a continuation of application No. 16/227,587, filed on Dec. 20, 2018, granted, now 11,061,716.
Claims priority of provisional application 62/720,072, filed on Aug. 20, 2018.
Prior Publication US 2021/0303337 A1, Sep. 30, 2021
This patent is subject to a terminal disclaimer.
Int. Cl. G06F 9/46 (2006.01); G06F 21/62 (2013.01); G06F 12/0815 (2016.01); G06F 9/50 (2006.01); G06F 9/54 (2006.01); G06Q 30/0279 (2023.01)
CPC G06F 9/468 (2013.01) [G06F 9/505 (2013.01); G06F 9/5072 (2013.01); G06F 9/541 (2013.01); G06F 12/0815 (2013.01); G06F 21/6218 (2013.01); G06Q 30/0279 (2013.01)] 15 Claims
OG exemplary drawing
 
1. A computer implemented method of managing access to resources of a cloud platform that are made available to a tenant organization of the cloud platform comprising:
retrieving, at a computing device of the cloud platform, context data and policies for a requestor and an identified resource, where the requestor is external to the cloud platform and is associated with an entity that is separate from the tenant organization and provides services to the tenant organization through the cloud platform in connection with a predefined role assigned to the requestor, wherein the requestor's access to resources of the cloud platform is determined based on the context data, policies, role and resource;
combining, by the computing device, the policies with context data into a combined data structure, where the context data includes parameters of the policies to enable evaluation of dynamic expressions in the policies;
generating, by the computing device, in response to receiving a request from the requestor for the identified resource, resource permissions for the requestor using the combined data structure by evaluating the parameters of the policies in the context data that are applicable to the role of the requestor and the identified resource; and
returning, by the computing device, the resource permissions to the requestor.