Policy storage using syntax graphs

A system comprising:

• at least one device including a hardware processor;
• the system configured to perform operations comprising:
• traversing a first policy statement, corresponding to a first authorization policy, to determine a first plurality of elements of the first policy statement;
• generating a first syntax graph comprising a first plurality of nodes that are (a) based on the first plurality of elements of the first policy statement and (b) arranged hierarchically based on node type;
• traversing a second policy statement, corresponding to a second authorization policy, to determine a second plurality of elements of the second policy statement;
• generating a second syntax graph comprising a second plurality of nodes that are (a) based on the second plurality of elements of the second policy statement and (b) arranged hierarchically based on node type;
• generating a multi-policy syntax graph at least by combining one or more nodes from the first plurality of nodes and one or more nodes from the second plurality of nodes;
• evaluating a first authorization request at least by traversing the multi-policy syntax graph to determine whether the first authorization request satisfies one or more of the first authorization policy or the second authorization policy,
• wherein generating the multi-policy syntax graph includes optimizing, by the hardware processor, the multi-policy syntax graph at least by eliminating a redundant node.

A method comprising:

• traversing a first policy statement, corresponding to a first authorization policy, to determine a first plurality of elements of the first policy statement;
• generating a first syntax graph comprising a first plurality of nodes that are (a) based on the first plurality of elements of the first policy statement and (b) arranged hierarchically based on node type;
• traversing a second policy statement, corresponding to a second authorization policy, to determine a second plurality of elements of the second policy statement;
• generating a second syntax graph comprising a second plurality of nodes that are (a) based on the second plurality of elements of the second policy statement and (b) arranged hierarchically based on node type;
• generating a multi-policy syntax graph at least by combining one or more nodes from the first plurality of nodes and one or more nodes from the second plurality of nodes;
• evaluating a first authorization request at least by traversing the multi-policy syntax graph to determine whether the first authorization request satisfies one or more of the first authorization policy or the second authorization policy,
• wherein the method is performed by at least one device including a hardware processor, and
• wherein generating the multi-policy syntax graph includes optimizing, by the hardware processor, the multi-policy syntax graph at least by eliminating a redundant node.