# US 10,454,938 B2 · Dynamic permission roles for cloud based applications

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 10,454,938 B2
- Document ID: US10454938B2
- Status: Granted
- Kind: B2
- Application number: 14/723,516
- Filed: 2015-05-28
- Published: 2016-12-01
- Granted: 2019-10-22
- Earliest claimed: 2015-05-28
- Assignees: International Business Machines Corporation
- Applicants: International Business Machines Corporation
- Inventors: Sheehan Anderson; Richard L. Kulp; Gili Mendel; Jianjun Zhang
- Web page: https://patentgrep.com/patent/US10454938B2

## CPC

- H04L 63/102: {Entity profiles}
- G06F 8/70: Software maintenance or management
- G06F 21/30: Authentication, i.e. establishing the identity or authorisation of security principals
- G06F 21/6218: {to a system of files or objects, e.g. local or distributed file system or database}
- H04L 63/08: {for authentication of entities (cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32)}
- H04L 63/104: {Grouping of entities}
- G06F 2221/2141: Access rights, e.g. capability lists, access control lists, access tables, access matrices
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)

## Abstract

During development of an application, an association between a view of the application and a data service, and rules applicable to the view, can be received. The rules can include an indication of a security role assigned to users who are allowed to access the view and an indication of whether the view is allowed to access the data service based on the security role assigned to the user. Based on the rules applicable to the view, permissions for accessing the data service by the view can be automatically extrapolated. Based on the permissions extrapolated for accessing the data service by the view, a binding credential, configured to be processed to determine whether the view of the application is granted access to data provided by the data service at runtime, can be automatically created. The at least one binding credential can be assigned to the view of the application.

## Claims

### Claim 1

A method comprising:
receiving, during development of an application, an association between at least one window or pane of the application and at least one data service, wherein the application is provided as a service in a cloud computing environment;
receiving rules applicable to the at least one window or pane of the application, the rules comprising:
information indicating a first security role assigned to at least a first user who is allowed to access the window or pane of the application and at least a second security role assigned to at least a second user who is allowed to access the window or pane; and
information indicating whether the window or pane is allowed to access the data service based on the first security role assigned to at least the first user and indicating whether the window or pane is allowed to access the data service based on the second security role assigned to at least the second user;
based on the rules applicable to the at least one window or pane, automatically extrapolating, by a software development tool executed by a processor, permissions for accessing the data service by the at least one window or pane;
based on the permissions extrapolated for accessing the data service by the at least one window or pane, automatically creating, by the software development tool, a first binding credential configured to be processed to determine whether the window or pane of the application is granted access to data provided by the data service at runtime while the window or pane is being accessed by at least the first user assigned the first security role, and automatically creating, by the software development tool, at least a second binding credential configured to be processed to determine whether the window or pane of the application is granted access to the data provided by the data service at runtime while the window or pane is being accessed by at least the second user assigned the second security role, wherein the first binding credential specifies a mapping of permissions of users who are assigned the first security role to access the window or pane and a mapping of permissions of the window or pane to access the data provided by the data service while the window or pane is being accessed by the users who are assigned the first security role, and the second binding credential specifies a mapping of permissions of users who are assigned the second security role to access the window or pane and a mapping of permissions of the window or pane to access the data provided by the data service while the window or pane is being accessed by the users who are assigned the second security role;
assigning the first binding credential and the second binding credential to the window or pane of the application, wherein the application functions as a proxy for access to the data provided by the data service, the application determines, based on the first binding credential, whether the window or pane is granted access to the data provided by the data service at runtime while the window or pane is being accessed by at least the first user who is assigned the first security role, and the application determines, based on the second binding credential, whether the window or pane is granted access to the data provided by the data service at runtime while the window or pane is being accessed by at least the second user who is assigned the second security role;
responsive to detecting the first user requesting access to the window or pane of the application, accessing the first security role assigned to the first user;
based on the first security role assigned to the first user, determining whether the first user is allowed to access the window or pane of the application;
responsive to determining that the first user is allowed to access the window or pane of the application:
presenting the window or pane of the application to the first user; and
based on the first binding credential, determining whether the window or pane of the application is granted access to the data provided by the data service at runtime; and
responsive to determining that the window or pane of the application is granted access to the data provided by the data service at runtime for the first user, granting, to the window or pane of the application, access to the data provided by the data service as specified by the first binding credential.

### Claim 2 (depends on 1)

The method of claim 1, wherein:
the indication of whether the window or pane is allowed to access the data service indicates whether the window or pane has read-only or read/write access to the data service; and
extrapolating permissions for accessing the data service by the at least one window or pane further is based on the indication of whether the window or pane is granted read-only or read/write access to the data service and the first binding credential indicates whether the window or pane has read-only access or read/write access to the data service.

### Claim 3 (depends on 2)

The method of claim 2, wherein the access to the data provided by the data service is read-only access or read/write access to the data service.

### Claim 4 (depends on 1)

The method of claim 1, wherein:
the application accesses the data service using at least one representational state transfer (REST) call to the data service; and
the application is configured to generate the at least one REST call responsive to the user being successfully validated to access the window or pane.

### Claim 5 (depends on 1)

The method of claim 1, further comprising:
responsive to detecting the second user requesting access to the window or pane of the application, accessing the second security role assigned to the second user;
based on the second security role assigned to the second user, determining whether the second user is allowed to access the window or pane of the application;
responsive to determining that the second user is allowed to access the window or pane of the application:
presenting the window or pane of the application to the second user; and
based on the second binding credential, determining whether the window or pane of the application is granted access to the data provided by the data service at runtime; and
responsive to determining that the window or pane of the application is not granted access to the data provided by the data service at runtime for the second user, denying, to the window or pane of the application, access to the data provided by the data service as specified by the second binding credential.

### Claim 6

A system, comprising:
a processor programmed to initiate executable operations comprising:
receiving, during development of an application, an association between at least one window or pane of the application and at least one data service, wherein the application is provided as a service in a cloud computing environment;
receiving rules applicable to the at least one window or pane of the application, the rules comprising:
information indicating a first security role assigned to at least a first user who is allowed to access the window or pane of the application and at least a second security role assigned to at least a second user who is allowed to access the window or pane; and
information indicating whether the window or pane is allowed to access the data service based on the first security role assigned to at least the first user and indicating whether the window or pane is allowed to access the data service based on the second security role assigned to at least the second user;
based on the rules applicable to the at least one window or pane, automatically extrapolating, by a software development tool executed by a processor, permissions for accessing the data service by the at least one window or pane;
based on the permissions extrapolated for accessing the data service by the at least one window or pane, automatically creating, by the software development tool, a first binding credential configured to be processed to determine whether the window or pane of the application is granted access to data provided by the data service at runtime while the window or pane is being accessed by at least the first user assigned the first security role, and automatically creating, by the software development tool, at least a second binding credential configured to be processed to determine whether the window or pane of the application is granted access to the data provided by the data service at runtime while the window or pane is being accessed by at least the second user assigned the second security role, wherein the first binding credential specifies a mapping of permissions of users who are assigned the first security role to access the window or pane and a mapping of permissions of the window or pane to access the data provided by the data service while the window or pane is being accessed by the users who are assigned the first security role, and the second binding credential specifies a mapping of permissions of users who are assigned the second security role to access the window or pane and a mapping of permissions of the window or pane to access the data provided by the data service while the window or pane is being accessed by the users who are assigned the second security role; and
assigning the first binding credential and the second binding credential to the window or pane of the application, wherein the application functions as a proxy for access to the data provided by the data service, the application determines, based on the first binding credential, whether the window or pane is granted access to the data provided by the data service at runtime while the window or pane is being accessed by at least the first user who is assigned the first security role, and the application determines, based on the second binding credential, whether the window or pane is granted access to the data provided by the data service at runtime while the window or pane is being accessed by at least the second user who is assigned the second security role;
responsive to detecting the first user requesting access to the window or pane of the application, accessing the first security role assigned to the first user;
based on the first security role assigned to the first user, determining whether the first user is allowed to access the window or pane of the application;
responsive to determining that the first user is allowed to access the window or pane of the application:
presenting the window or pane of the application to the first user; and
based on the first binding credential, determining whether the window or pane of the application is granted access to the data provided by the data service at runtime; and
responsive to determining that the window or pane of the application is granted access to the data provided by the data service at runtime for the first user, granting, to the window or pane of the application, access to the data provided by the data service as specified by the first binding credential.

### Claim 7 (depends on 6)

The system of claim 6, wherein:
the indication of whether the window or pane is allowed to access the data service indicates whether the window or pane has read-only or read/write access to the data service; and
extrapolating permissions for accessing the data service by the at least one window or pane further is based on the indication of whether the window or pane is granted read-only or read/write access to the data service and the first binding credential indicates whether the window or pane has read-only access or read/write access to the data service.

### Claim 8 (depends on 7)

The system of claim 7, wherein the access to the data provided by the data service is read-only access or read/write access to the data service.

### Claim 9 (depends on 6)

The system of claim 6, wherein:
the application accesses the data service using at least one representational state transfer (REST) call to the data service; and
the application is configured to generate the at least one REST call responsive to the user being successfully validated to access the window or pane.

### Claim 10 (depends on 6)

The system of claim 6, the executable operations further comprising:
responsive to detecting the second user requesting access to the window or pane of the application, accessing the second security role assigned to the second user;
based on the second security role assigned to the second user, determining whether the second user is allowed to access the window or pane of the application;
responsive to determining that the second user is allowed to access the window or pane of the application:
presenting the window or pane of the application to the second user; and
based on the second binding credential, determining whether the window or pane of the application is granted access to the data provided by the data service at runtime for the second user; and
responsive to determining that the window or pane of the application is not granted access to the data provided by the data service at runtime for the second user, denying, to the window or pane of the application, access to the data provided by the data service as specified by the second binding credential.

### Claim 11

A computer program product comprising a computer readable storage medium having program code stored thereon, wherein the computer readable storage medium is not a transitory, propagating signal per se, the program code executable by a processor to perform a method comprising:
receiving, by the processor, during development of an application, an association between at least one window or pane of the application and at least one data service, wherein the application is provided as a service in a cloud computing environment;
receiving, by the processor, rules applicable to the at least one window or pane of the application, the rules comprising:
information indicating a first security role assigned to at least a first user who is allowed to access the window or pane of the application and at least a second security role assigned to at least a second user who is allowed to access the window or pane; and
information indicating whether the window or pane is allowed to access the data service based on the first security role assigned to at least the first user and indicating whether the window or pane is allowed to access the data service based on the second security role assigned to at least the second user;
based on the rules applicable to the at least one window or pane, automatically extrapolating, by a software development tool executed by a processor, permissions for accessing the data service by the at least one window or pane;
based on the permissions extrapolated for accessing the data service by the at least one window or pane, automatically creating, by the software development tool, a first binding credential configured to be processed to determine whether the window or pane of the application is granted access to data provided by the data service at runtime while the window or pane is being accessed by at least the first user assigned the first security role, and automatically creating, by the software development tool, at least a second binding credential configured to be processed to determine whether the window or pane of the application is granted access to the data provided by the data service at runtime while the window or pane is being accessed by at least the second user assigned the second security role, wherein the first binding credential specifies a mapping of permissions of users who are assigned the first security role to access the window or pane and a mapping of permissions of the window or pane to access the data provided by the data service while the window or pane is being accessed by the users who are assigned the first security role, and the second binding credential specifies a mapping of permissions of users who are assigned the second security role to access the window or pane and a mapping of permissions of the window or pane to access the data provided by the data service while the window or pane is being accessed by the users who are assigned the second security role; and
assigning the first binding credential and the second binding credential to the window or pane of the application, wherein the application functions as a proxy for access to the data provided by the data service, the application determines, based on the first binding credential, whether the window or pane is granted access to the data provided by the data service at runtime while the window or pane is being accessed by at least the first user who is assigned the first security role, and the application determines, based on the second binding credential, whether the window or pane is granted access to the data provided by the data service at runtime while the window or pane is being accessed by at least the second user who is assigned the second security role;
responsive to detecting the first user requesting access to the window or pane of the application, accessing the first security role assigned to the first user;
based on the first security role assigned to the first user, determining whether the first user is allowed to access the window or pane of the application;
responsive to determining that the first user is allowed to access the window or pane of the application:
presenting the window or pane of the application to the first user; and
based on the first binding credential, determining whether the window or pane of the application is granted access to the data provided by the data service at runtime; and
responsive to determining that the window or pane of the application is granted access to the data provided by the data service at runtime for the first user, granting, to the window or pane of the application, access to the data provided by the data service as specified by the first binding credential.

### Claim 12 (depends on 11)

The computer program product of claim 11, wherein:
the indication of whether the window or pane is allowed to access the data service indicates whether the window or pane has read-only or read/write access to the data service; and
extrapolating permissions for accessing the data service by the at least one window or pane further is based on the indication of whether the window or pane is granted read-only or read/write access to the data service and the first binding credential indicates whether the window or pane has read-only access or read/write access to the data service.

### Claim 13 (depends on 12)

The computer program product of claim 12, wherein the access to the data provided by the data service is read-only access or read/write access to the data service.

### Claim 14 (depends on 11)

The computer program product of claim 11, the method further comprising:
responsive to detecting the second user requesting access to the window or pane of the application, accessing the second security role assigned to the second user;
based on the second security role assigned to the second user, determining whether the second user is allowed to access the window or pane of the application;
responsive to determining that the second user is allowed to access the window or pane of the application:
presenting the window or pane of the application to the second user; and
based on the second binding credential, determining whether the window or pane of the application is granted access to the data provided by the data service at runtime for the second user; and
responsive to determining that the window or pane of the application is not granted access to the data provided by the data service at runtime for the second user, denying, to the window or pane of the application, access to the data provided by the data service as specified by the second binding credential.