Attribute-based access control using a dynamic expression engine

Patent metadata

Field	Value
Publication number	US-11061716-B2
Application number	US-201816227587-A
Country	US
Kind code	B2
Filing date	Dec 20, 2018
Priority date	Aug 20, 2018
Publication date	Jul 13, 2021
Grant date	Jul 13, 2021

Abstract

A computer implemented method manages access to resources of a philanthropy cloud platform. The method includes retrieving, at a computing device of the philanthropy cloud platform, context data and load policies for a requestor and an identified resource, combining, by the computing device, loaded policies with context data into a combined data structure, evaluating, by the computing device, a resource request and apply policies for requestor based on role of requestor using the combined data structure, generating, by the computing device, resource permissions for the requestor, and returning, by the computing device, resource permissions to the requestor.

First claim

What is claimed is:

1. A computer implemented method of managing access to resources of a cloud platform comprising:
retrieving, at a computing device of the cloud platform, context data and load policies for a requestor and an identified resource from multiple tenants of the cloud platform;
combining, by the computing device, loaded policies with context data into a combined data structure;
evaluating, by the computing device, a resource request from the requestor and applying policies for the requestor based on a role of the requestor using the combined data structure, where the role is implemented external to the cloud platform, and where the combined data structure is parsed to identify logical expressions and related data for evaluating the logical expressions;
generating, by the computing device, resource permissions for the requestor by evaluating the logical expressions; and
returning, by the computing device, resource permissions to the requestor,
wherein the cloud platform further includes a transaction manager to execute a method of charitable transaction processing, the method including,
receiving a donation transaction request from a user in an organization, where the donation transaction request specifies non-profit recipients,
selecting a transaction processor with a best match for organization preferences from a plurality of available transaction processors, and
sending the donation transaction request to the selected transaction processor to route funds to specified non-profits.

2. The method of claim 1 , further comprising:
receiving the resource request from the requestor, the resource request including the identifier for the resource and requestor information.

3. The method of claim 1 , further comprising:
checking a context cache for the context data for the requestor and the identified resource;
determining that the context data is present in the context cache; and
loading the context data in response to the determining.

4. The method of claim 1 , wherein the cloud platform enables external assignment of supporting roles, the method further comprising:
evaluating the resource request includes determining whether the requestor has access to the requested resource based on the role assigned to the requestor in the cloud platform.

5. The method of claim 4 , wherein the role assigned to the requestor can be specific to any one or more of a tenant organization of the cloud platform, or a workplace of a tenant organization.

6. The method of claim 1 , wherein resource permissions are provided to an application programming interface (API) of the cloud platform to be enforced for functions of the API.

7. A non-transitory machine-readable storage medium that provides instructions that, if executed by a processor, will cause said processor to perform operations manage access to resources of a cloud platform, the operations comprising:
retrieving context data and load policies for a requestor and an identified resource from multiple tenants of the cloud platform;
combining loaded policies with context data into a combined data structure;
evaluating a resource request from the requestor and applying policies for the requestor based on a role of the requestor using the combined data structure, where the role is implemented external to the cloud platform, and where the combined data structure is parsed to identify logical expressions and related data for evaluating the logical expressions;
generating resource permissions for the requestor by evaluating the logical expressions; and
returning resource permissions to the requestor,
wherein the cloud platform further includes a transaction manager to execute a method of charitable transaction processing, the operations further including,
receiving a donation transaction request from a user in an organization, where the donation transaction request specifies non-profit recipients,
selecting a transaction processor with a best match for organization preferences from a plurality of available transaction processors, and
sending the donation transaction request to the selected transaction processor to route funds to specified non-profits.

8. The non-transitory machine-readable medium of claim 7 , the operations further comprising:
receiving the resource request from the requestor, the resource request including the identifier for the resource and requestor information.

9. The non-transitory machine-readable medium of claim 7 , the operations further comprising:
checking a context cache for the context data for the requestor and the identified resource;
determining that the context data is present in the context cache; and
loading the context data in response to the determining.

10. The non-transitory machine-readable medium of claim 7 , wherein the cloud platform enables external assignment of supporting roles, the operations further comprising:
evaluating the resource request includes determining whether the requestor has access to the requested resource based on the role assigned to the requestor in the cloud platform.

11. The non-transitory machine-readable medium of claim 10 , wherein the role assigned to the requestor can be specific to any one or more of a tenant organization of the cloud platform, or a workplace of a tenant organization.

12. The non-transitory machine-readable medium of claim 7 , wherein resource permissions are provided to an application programming interface (API) of the cloud platform to be enforced for functions of the API.

13. A computing device in a cloud platform, the computing device implementing a method of managing access to resources of a cloud platform comprising:
a non-transitory machine-readable medium having stored therein a permissions manager; and
one or more processors coupled to the non-transitory machine-readable medium, the one or more processors to execute the permissions manager, the permissions manager to retrieve context data and load policies for a requestor and an identified resource from multiple tenants of the cloud platform, to combine loaded policies with context data into a combined data structure, to evaluate a resource request and apply policies for the requestor based on a role of the requestor using the combined data structure, where the role is implemented external to the cloud platform, and where the combined data structure is parsed to identify logical expressions and related data for evaluating the logical expressions, to generate resource permissions for the requestor by evaluating the logical expressions, and to return resource permissions to the requestor, wherein the cloud platform further includes a transaction manager to execute a method of charitable transaction processing, the transaction manager to receive a donation transaction request from a user in an organization, where the donation transaction request specifies non-profit recipients, to select a transaction processor with a best match for organization preferences from a plurality of available transaction processors, and to send the donation transaction request to the selected transaction processor to route funds to specified non-profits.

14. The computing device of claim 13 , wherein the permissions manager is further to
receive the resource request from the requestor, the resource request including the identifier for the resource and requestor information.

15. The computing device of claim 13 , wherein the permission manager is further to check a context cache for the context data for the requestor and the identified resource, to determine that the context data is present in the context cache, and to l

Assignees

• Salesforce Com Inc

Inventors

• Bailey Nicholas
• Stahl Jon
• Manelski David
• Mccormick Michael
• Lacock Nicholaus

Classifications

• G06F21/6218

  to a system of files or objects, e.g. local or distributed file system or database · CPC title

• G06F9/541

  via adapters, e.g. between incompatible applications · CPC title

• G06Q30/0279

  Fundraising management · CPC title

• G06F9/5072 Primary

  Grid computing · CPC title

• G06F9/505

  considering the load · CPC title