# US 10,311,242 B2 · Distributed system resource liens > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 10,311,242 B2 - Document ID: US10311242B2 - Status: Granted - Kind: B2 - Application number: 15/497,096 - Filed: 2017-04-25 - Published: 2018-10-25 - Granted: 2019-06-04 - Earliest claimed: 2017-04-25 - Assignees: Google Inc. - Applicants: Google Inc. - Inventors: Buckner Clay - Web page: https://patentgrep.com/patent/US10311242B2 ## CPC - G06F 21/62: Protecting access to data via a platform, e.g. using keys or access control rules - G06F 21/12: Protecting executable software - G06F 21/335: {for accessing specific resources, e.g. using Kerberos tickets} - G06F 21/629: {to features or functions of an application} - H04L 47/50: Queue scheduling - G06F 2221/21: Indexing scheme relating to G06F21/00 and subgroups addressing additional information or applications relating to security arrangements for protecting computers, components thereof, programs or data against unauthorised activity - G06F 2221/2141: Access rights, e.g. capability lists, access control lists, access tables, access matrices - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract A method for accessing liens on resources of distributed systems is provided. The method includes receiving an operation control request. The operation control request identifies a lien requestor, a resource of a distributed system, and at least one restricted operation for the resource of the distributed system. The method also includes associating an operation control lien with the resource of the distributed system based on the operation control request. The operation control lien identifies the lien requestor and the at least one restricted operation for the resource of the distributed system. The method further includes: receiving an operation request to execute a corresponding operation on the resource of the distributed system; determining that the corresponding operation of the operation request is a restricted operation identified by the operation control lien associated with the resource of the distributed system; and restricting execution of the corresponding operation of the operation request. ## Claims ### Claim 1 A method comprising: receiving, at data processing hardware, an operation control request, the operation control request identifying a lien requestor, a resource of a distributed system, and at least one restricted operation for the resource of the distributed system; associating, by the data processing hardware, an operation control lien with the resource of the distributed system based on the operation control request, the operation control lien identifying the lien requestor and the at least one restricted operation for the resource of the distributed system; receiving, at the data processing hardware, an operation request to execute a corresponding operation on the resource of the distributed system; determining, by the data processing hardware, that the corresponding operation of the operation request is a restricted operation identified by the operation control lien associated with the resource of the distributed system; and restricting, by the data processing hardware, execution of the corresponding operation of the operation request. ### Claim 2 (depends on 1) The method of claim 1, wherein restricting execution of the corresponding operation comprises denying execution of the corresponding operation. ### Claim 3 (depends on 1) The method of claim 1, further comprising: receiving, at the data processing hardware, a subsequent operation request to execute the corresponding operation on the resource of the distributed system; determining, by the data processing hardware, that the corresponding operation of the subsequent operation request is an unrestricted operation not identified by any operation control lien associated with the resource of the distributed system; and allowing, by the data processing hardware, unrestricted execution of the corresponding operation. ### Claim 4 (depends on 3) The method of claim 3, further comprising: receiving, at the data processing hardware, a lien requestor existence indicator indicating that the lien requestor of the operation control request no longer exists; and disassociating, by the data processing hardware, any operation control liens based on any operation control requests of the lien requestor from any corresponding resources of the distributed system. ### Claim 5 (depends on 3) The method of claim 3, further comprising: receiving, at the data processing hardware, a remove request from the lien requestor, the remove request identifying the resource of the distributed system and the corresponding associated operation control lien previously requested by the lien requestor; and disassociating, by the data processing hardware, the corresponding operation control lien from the resource of the distributed system. ### Claim 6 (depends on 1) The method of claim 1, further comprising returning, from the data processing hardware, a message indicating the corresponding restricted operation for the resource of the distributed system. ### Claim 7 (depends on 6) The method of claim 6, wherein the message indicates the lien requestor. ### Claim 8 (depends on 6) The method of claim 6, wherein the operation control request further identifies an operation control description and the message indicates the operation control description. ### Claim 9 (depends on 1) The method of claim 1, wherein determining that the corresponding operation of the operation request is the restricted operation comprises: determining a parent-child relationship between the resource of the distributed system and other resources of the distributed system; determining that the resource of the distributed system is a parent resource having at least one depending child resource; and determining that the parent resource has at least one associated operation control lien. ### Claim 10 (depends on 1) The method of claim 1, further comprising: receiving, at the data processing hardware, an update request from the lien requestor, the update request identifying the resource of the distributed system, the corresponding associated operation control lien, and at least one updated restricted operation for the control lien; and updating, by the data processing hardware, the corresponding operation control lien associated with the of the resource of the distributed system as identifying the at least one updated restricted operation. ### Claim 11 A system comprising: data processing hardware; and memory hardware in communication with the data processing hardware, the memory hardware storing instructions that when executed on the data processing hardware cause the data processing hardware to perform operations comprising: receiving an operation control request, the operation control request identifying a lien requestor, a resource of a distributed system, and at least one restricted operation for the resource of the distributed system; associating an operation control lien with the resource of the distributed system based on the operation control request, the operation control lien identifying the lien requestor and the at least one restricted operation for the resource of the distributed system; receiving an operation request to execute a corresponding operation on the resource of the distributed system; determining that the corresponding operation of the operation request is a restricted operation identified by the operation control lien associated with the resource of the distributed system; and restricting execution of the corresponding operation of the operation request. ### Claim 12 (depends on 11) The system of claim 11, wherein restricting execution of the corresponding operation comprises denying execution of the corresponding operation. ### Claim 13 (depends on 11) The system of claim 11, wherein the operations further comprise: receiving a subsequent operation request to execute the corresponding operation on the resource of the distributed system; determining that the corresponding operation of the subsequent operation request is an unrestricted operation not identified by any operation control lien associated with the resource of the distributed system; and allowing unrestricted execution of the corresponding operation. ### Claim 14 (depends on 13) The system of claim 13, wherein the operations further comprise: receiving a lien requestor existence indicator indicating that the lien requestor of the operation control request no longer exists; and disassociating any operation control liens based on any operation control requests of the lien requestor from any corresponding resources of the distributed system. ### Claim 15 (depends on 13) The system of claim 13, wherein the operations further comprise: receiving a remove request from the lien requestor, the remove request identifying the resource of the distributed system and the corresponding associated operation control lien previously requested by the lien requestor; and disassociating the corresponding operation control lien from the resource of the distributed system. ### Claim 16 (depends on 11) The system of claim 11, wherein the operations further comprise returning, from the data processing hardware, a message indicating the corresponding restricted operation for the resource of the distributed system. ### Claim 17 (depends on 16) The system of claim 16, wherein the message indicates the lien requestor. ### Claim 18 (depends on 16) The system of claim 16, wherein the operation control request further identifies an operation control description and the message indicates the operation control description. ### Claim 19 (depends on 11) The system of claim 11, wherein determining that the corresponding operation of the operation request is the restricted operation comprises: determining a parent-child relationship between the resource of the distributed system and other resources of the distributed system; determining that the resource of the distributed system is a parent resource having at least one depending child resource; and determining that the parent resource has at least one associated operation control lien. ### Claim 20 (depends on 11) The system of claim 11, wherein the operations further comprise: receiving an update request from the lien requestor, the update request identifying the resource of the distributed system, the corresponding associated operation control lien, and at least one updated restricted operation for the control lien; and updating the corresponding operation control lien associated with the of the resource of the distributed system as identifying the at least one updated restricted operation. ### Claim 21 A method comprising: receiving, at data processing hardware, an operation request to execute a corresponding operation on a resource of a distributed system; determining, by the data processing hardware, that the resource of the distributed system has an associated operation control lien, the operation control lien identifying a lien requestor and at least one restricted operation for the resource of the distributed system; determining, by the data processing hardware, that the corresponding operation of the operation request is a restricted operation identified by the operation control lien associated with the resource of the distributed system; and restricting, by the data processing hardware, execution of the corresponding operation of the operation request on the resource of the distributed system. ### Claim 22 (depends on 21) The method of claim 21, wherein restricting execution of the corresponding operation of the operation request comprises denying execution of the corresponding operation. ### Claim 23 (depends on 21) The method of claim 21, further comprising: receiving, at the data processing hardware, a subsequent operation request to execute the corresponding operation on the resource of the distributed system; determining, by the data processing hardware, that the corresponding operation of the subsequent operation request is an unrestricted operation not identified by any operation control lien associated with the resource of the distributed system; and allowing, by the data processing hardware, unrestricted execution of the corresponding operation. ### Claim 24 (depends on 23) The method of claim 23, further comprising: receiving, at the data processing hardware, a lien requestor existence indicator indicating that the lien requestor no longer exists; and disassociating, by the data processing hardware, any operation control liens identifying the lien requestor from any corresponding resources of the distributed system. ### Claim 25 (depends on 23) The method of claim 23, further comprising: receiving, at the data processing hardware, a remove request from the lien requestor, the remove request identifying the resource of the distributed system and the corresponding associated operation control lien previously requested by the lien requestor; and disassociating, by the data processing hardware, the corresponding operation control lien from the resource of the distributed system. ### Claim 26 (depends on 21) The method of claim 21, further comprising returning, from the data processing hardware, a message indicating the corresponding restricted operation for the resource of the distributed system, the message indicating the lien requestor. ### Claim 27 A system comprising: data processing hardware; and memory hardware in communication with the data processing hardware, the memory hardware storing instructions that when executed on the data processing hardware cause the data processing hardware to perform operations comprising: receiving an operation request to execute a corresponding operation on a resource of a distributed system; determining that the resource of the distributed system has an associated operation control lien, the operation control lien identifying a lien requestor and at least one restricted operation for the resource of the distributed system; determining that the corresponding operation of the operation request is a restricted operation identified by the operation control lien associated with the resource of the distributed system; and restricting execution of the corresponding operation of the operation request on the resource of the distributed system. ### Claim 28 (depends on 27) The system of claim 27, wherein restricting execution of the corresponding operation of the operation request comprises denying execution of the corresponding operation. ### Claim 29 (depends on 27) The system of claim 27, wherein the operations further comprise: receiving a subsequent operation request to execute the corresponding operation on the resource of the distributed system; determining that the corresponding operation of the subsequent operation request is an unrestricted operation not identified by any operation control lien associated with the resource of the distributed system; and allowing unrestricted execution of the corresponding operation. ### Claim 30 (depends on 29) The system of claim 29, wherein the operations further comprise: receiving a lien requestor existence indicator indicating that the lien requestor no longer exists; and disassociating any operation control liens identifying the lien requestor from any corresponding resources of the distributed system. ### Claim 31 (depends on 29) The system of claim 29, wherein the operations further comprise: receiving a remove request from the lien requestor, the remove request identifying the resource of the distributed system and the corresponding associated operation control lien previously requested by the lien requestor; and disassociating the corresponding operation control lien from the resource of the distributed system. ### Claim 32 (depends on 27) The system of claim 27, wherein the operations further comprise returning, from the data processing hardware, a message indicating the corresponding restricted operation for the resource of the distributed system, the message indicating the lien requestor.