# US 11,907,229 B2 · System and method for platform-independent access bindings > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 11,907,229 B2 - Document ID: US11907229B2 - Status: Granted - Kind: B2 - Application number: 17/710,310 - Filed: 2022-03-31 - Published: 2023-10-05 - Granted: 2024-02-20 - Earliest claimed: 2022-03-31 - Assignees: GM Cruise Holdings LLC - Applicants: GM Cruise Holdings LLC - Inventors: Stephen James Day; Seth Alexander Bunce; Matthew John Landis; Jonathan Langefeld; Jason Vrablik; Cheng Pan - Web page: https://patentgrep.com/patent/US11907229B2 ## CPC - G06F 16/2457: with adaptation to user needs - G06F 21/45: Structures or tools for the administration of authentication - G06F 16/2291: {User-Defined Types; Storage management thereof} - G06F 16/24524: {Access plan code generation and invalidation; Reuse of access plans} - G06F 16/24564: {Applying rules; Deductive queries} - G06F 21/604: {Tools and structures for managing or administering access control systems} - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract A system may include one or more tangible, non-transitory computer-readable media having stored thereon instructions, the instructions when executed to instruct one or more processors to: receive a platform-independent access binding data structure (a PIAB data structure), the PIAB data structure comprising a platform-independent representation of a subject class, a verb, an object, and a binding comprising a permission for the subject class to perform the verb on the object; convert the PIAB data structure to a first platform-specific binding for a first target platform; and cause the first platform-specific binding to be implemented on the first target platform. ## Claims ### Claim 1 One or more non-transitory computer-readable media having stored thereon instructions, the instructions when executed to instruct one or more processors to: receive, at a binding arbiter, a platform-independent access binding (PIAB) data structure, the PIAB data structure comprising a first permission for a subject class to perform a first verb on a first object on a first target platform, and a second permission for the subject class to perform a second verb on a second object on a second target platform; map, by the binding arbiter, the first verb to a first platform action permission specific to the first target platform; map, by the binding arbiter, the second verb to a second platform action permission specific to the second target platform; receive, from a user at the binding arbiter, a request to execute a first task of a software build pipeline on the first target platform and to execute a second task of the software build pipeline on the second target platform, the first task comprising setting up a container by downloading an operating system image and a development environment image, the second task comprising deploying a microservice on the container by pulling and compiling source files; authenticate, by the binding arbiter, the user; determine, by the binding arbiter, that the user is associated with the subject class; authenticate, by the binding arbiter, with the first target platform to obtain the first platform action permission; authenticate, by the binding arbiter, with the second target platform to obtain the second platform action permission; execute, by the user, the first task and the second task of the pipeline on the first target platform and the second target platform respectively; after the first task is executed on the first target platform, revoke, by the binding arbiter, authentication with the first target platform; and after the second task is executed on the second target platform, revoke, by the binding arbiter, authentication with the second target platform. ### Claim 2 (depends on 1) The one or more non-transitory computer-readable media of claim 1, wherein the first target platform comprises one or more of: Docker Hub and Artifactory. ### Claim 3 (depends on 1) The one or more non-transitory computer-readable media of claim 1, wherein the first and second target platforms are members of a heterogeneous platform ecosystem comprising a plurality of platforms with a plurality of incompatible access binding models. ### Claim 4 (depends on 1) The one or more non-transitory computer-readable media of claim 1, wherein the second target platform comprises GitHub. ### Claim 5 (depends on 1) The one or more non-transitory computer-readable media of claim 1, wherein the user comprises a software build system. ### Claim 6 (depends on 1) The one or more non-transitory computer-readable media of claim 1, wherein the subject class is a role-based access class or an attribute-based access class. ### Claim 7 (depends on 1) The one or more non-transitory computer-readable media of claim 1, wherein the PIAB data structure comprises structured text. ### Claim 8 (depends on 7) The one or more non-transitory computer-readable media of claim 7, wherein the structured text is one of YAML, JavaScript Object Notation (JSON), or extensible markup language (XML). ### Claim 9 (depends on 1) The one or more non-transitory computer-readable media of claim 1, wherein the subject class comprises a container build role. ### Claim 10 (depends on 1) The one or more non-transitory computer-readable media of claim 1, wherein the subject class comprises a deployer role, the user comprises a software build system, and authenticating with the first target platform comprises obtaining, by the binding arbiter, a token to access the first target platform on behalf of the software build system. ### Claim 11 (depends on 1) The one or more non-transitory computer-readable media of claim 1, wherein the subject class comprises a deployer role, the user comprises a software build system, and authenticating with the second target platform comprises obtaining, by the binding arbiter, a token to access the second target platform on behalf of the software build system. ### Claim 12 (depends on 1) The one or more non-transitory computer-readable media of claim 1, wherein the instructions are further to manage credentials by the binding arbiter for the user by storing the credential in an encrypted memory location of the binding arbiter. ### Claim 13 A binding arbiter, comprising: a processor circuit and a memory; and instructions encoded within the memory to instruct the processor circuit to: receive a platform-independent access binding (PIAB) data structure, the PIAB data structure comprising a first permission for a subject class to perform a first verb on a first object on a first target platform, and a second permission for the subject class to perform a second verb on a second object on a second target platform; receive, from a user a request to execute a first task of a software build pipeline on the first target platform and to execute a second task of the software build pipeline on the second target platform, the first task comprising setting up a container by downloading an operating system image and a development environment image, the second task comprising deploying a microservice on the container by pulling and compiling source files; authenticate the user; determine that the user is associated with the subject class; authenticate with the first target platform to obtain the first permission; authenticate with the second target platform to obtain the second permission; after the first task is executed on the first target platform, revoke authentication with the first target platform; and after the second task is executed on the second target platform, revoke authentication with the second target platform. ### Claim 14 (depends on 13) The binding arbiter of claim 13, wherein the instructions are further to: map, the first verb to a first platform action permission specific to the first target platform; and map, the second verb to a second platform action permission specific to the second target platform. ### Claim 15 (depends on 13) The binding arbiter of claim 13, wherein the first and second target platforms are members of a heterogeneous platform ecosystem comprising a plurality of platforms with a plurality of incompatible access binding models. ### Claim 16 (depends on 13) The binding arbiter of claim 13, wherein the PIAB data structure comprises YAML, JavaScript Object Notation (JSON), or extensible markup language (XML) structured text. ### Claim 17 (depends on 13) The binding arbiter of claim 13, wherein the subject class comprises a deployer role, the user comprises a software build system, authenticating with the first target platform comprises obtaining a first token to access the first target platform on behalf of the software build system, and authenticating with the second target platform comprises obtaining a second token to access the second target platform on behalf of the software build system. ### Claim 18 A computer-implemented method being performed by a binding arbiter, comprising receiving a platform-independent access binding (PIAB) data structure, the PIAB data structure comprising a first permission for a subject class to perform a first verb on a first object on a first target platform, and a second permission for the subject class to perform a second verb on a second object on a second target platform; receiving, from a user, a request to execute a first task of a software build pipeline on the first target platform and to execute a second task of the software build pipeline on the second target platform, the first task comprising setting up a container by downloading an operating system image and a development environment image, the second task comprising deploying a microservice on the container by pulling and compiling source files; authenticating the user; determining that the user is associated with the subject class; transmitting a first directive to the first target platform to cause the first target platform to implement the first permission; obtaining a first token on behalf of the user to access the first target platform; transmitting a second directive to the second target platform to cause the second target platform to implement the second permission; obtaining a second token on behalf of the user to access the second target platform; after the first task is executed on the first target platform using the first token, revoking the first token; and after the second task is executed on the second target platform using the second token, revoking the second token. ### Claim 19 (depends on 18) The computer-implemented method of claim 18, further comprising storing the first token and the second token in an encrypted memory location of the binding arbiter. ### Claim 20 (depends on 18) The computer-implemented method of claim 18, wherein: the subject class comprises a deployer role; and the user comprises a software build system.