# US 11,907,394 B1 · Isolation and authorization for segregated command and query database resource access

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 11,907,394 B1
- Document ID: US11907394B1
- Status: Granted
- Kind: B1
- Application number: 18/080,273
- Filed: 2022-12-13
- Granted: 2024-02-20
- Earliest claimed: 2022-12-13
- Assignees: CyberArk Software Ltd.
- Applicants: CyberArk Software Ltd.
- Inventors: Niv Rabin; Michael Balber; Eli Shemesh
- Web page: https://patentgrep.com/patent/US11907394B1

## CPC

- G06F 21/6227: {where protection concerns the structure of data, e.g. records, types, queries}
- G06F 21/31: User authentication
- G06F 21/604: {Tools and structures for managing or administering access control systems}
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)

## Abstract

Disclosed embodiments relate to systems and methods for securely performing actions on a resource. Techniques include receiving a request by the entity to perform a privileged action on a resource, the request including a token associated with the entity; providing a first indication of the request to a first handler; providing a second indication of the request to a second handler configured to perform the privileged action on the resource, wherein when the privileged action includes a query, the second indication of the request is provided to a query handler, and when the privileged action includes a write command, the second indication of the request is provided to a command handler.

## Claims

### Claim 1

A non-transitory computer readable medium including instructions that, when executed by at least one processor, cause the at least one processor to perform operations for securely performing actions on a resource, the operations comprising:
receiving, from an entity associated with an organization, a request by the entity to perform a privileged action on a resource associated with the organization, the privileged action including either a query or write command, the request including a token associated with the entity;
providing a first indication of the request to a first handler configured to impersonate the entity associated with the organization, wherein the first handler is further configured to interact with a second handler; and
providing a second indication of the request to the second handler, the second handler being configured to perform the privileged action on the resource, the second handler including a query handler and a command handler, wherein:
when the privileged action includes a query, the second indication of the request is provided to the query handler and the query handler is configured to provide an indication of a result of the privileged action; and
when the privileged action includes a write command, the second indication of the request is provided to the command handler.

### Claim 2 (depends on 1)

The non-transitory computer readable medium of claim 1, wherein the operations further comprise validating the token, and wherein the first indication of the request is provided to the first handler based on the validation.

### Claim 3 (depends on 1)

The non-transitory computer readable medium of claim 1, wherein the first indication of the request includes an indication of the privileged action and the token.

### Claim 4 (depends on 2)

The non-transitory computer readable medium of claim 2, wherein the first handler is configured to impersonate the organization using the token.

### Claim 5 (depends on 1)

The non-transitory computer readable medium of claim 1, wherein the second indication of the request includes the token and wherein performing the privileged action by the second handler includes validating the token.

### Claim 6 (depends on 1)

The non-transitory computer readable medium of claim 1, wherein impersonating the organization enables the interaction between the first handler and the second handler.

### Claim 7 (depends on 6)

The non-transitory computer readable medium of claim 6, wherein impersonating the organization includes associating the first handler with a policy enabling the interaction with the second handler.

### Claim 8 (depends on 6)

The non-transitory computer readable medium of claim 6, wherein the second handler is associated with a policy controlling the interaction with the first handler.

### Claim 9 (depends on 1)

The non-transitory computer readable medium of claim 1, wherein providing the second indication of the request to the second handler includes generating a payload.

### Claim 10 (depends on 9)

The non-transitory computer readable medium of claim 9, wherein the payload includes an indication of the privileged action.

### Claim 11 (depends on 1)

The non-transitory computer readable medium of claim 1, wherein the organization is a tenant in a cloud computing platform.

### Claim 12 (depends on 1)

The non-transitory computer readable medium of claim 1, wherein the first query handler and the second query handler are virtual computing services in a cloud computing platform.

### Claim 13 (depends on 1)

The non-transitory computer readable medium of claim 1, wherein the second handler is configured to perform the privileged action on the resource using at least one operations handler.

### Claim 14 (depends on 13)

The non-transitory computer readable medium of claim 13, wherein the at least one operations handler is selected from a plurality of operations handlers based on the privileged action.

### Claim 15 (depends on 13)

The non-transitory computer readable medium of claim 13, wherein providing the second indication of the request to the second handler includes selecting the operations handler from a plurality of operations handlers, each of the operations handlers being associated with a different second handler.

### Claim 16 (depends on 1)

The non-transitory computer readable medium of claim 1, wherein the privileged action includes a write command, and wherein providing the second indication of the request to the second handler includes adding a message to a broker service.

### Claim 17 (depends on 16)

The non-transitory computer readable medium of claim 16, wherein the first handler is authorized to add the message to the broker service based on impersonating the organization.

### Claim 18 (depends on 16)

The non-transitory computer readable medium of claim 16, wherein performing the privileged action by the second handler includes consuming the message from the broker service.

### Claim 19 (depends on 16)

The non-transitory computer readable medium of claim 16, wherein the second handler is authorized to consume messages from the broker service, and wherein an additional second handler not associated with the organization is unauthorized to consume messages from the broker service.

### Claim 20

A computer-implemented method for securely performing actions on a resource, the method comprising:
receiving, from an entity associated with an organization, a request by the entity to perform a privileged action on a resource associated with the organization, the privileged action including either a query or a write command, the request including a token associated with the entity;
providing a first indication of the request to a first handler configured to impersonate the entity associated with the organization, wherein the first handler is further configured to interact with a second handler associated with the resource; and
providing a second indication of the request to the second handler, the second handler being configured to perform the privileged action on the resource, the second handler including a query handler and a command handler, wherein:
when the privileged action includes a query, the second indication of the request is provided to the query handler and the query handler is configured to provide an indication of a result of the privileged action; and
when the privileged action includes a write command, the second indication of the request is provided to the command handler.

### Claim 21 (depends on 20)

The computer-implemented method of claim 20, wherein providing the second indication of the request to the second handler includes generating a payload including an indication of the privileged action operation and encrypting the payload using a public key of the entity associated with the organization.

### Claim 22 (depends on 21)

The computer-implemented method of claim 21, wherein the public key is available to the first handler only after impersonating the organization.

### Claim 23 (depends on 21)

The computer-implemented method of claim 21, wherein the second handler is configured to decrypt the payload using a private key of the entity associated with the organization.

### Claim 24 (depends on 23)

The computer-implemented method of claim 23, wherein the private key is available to the second handler only after validating the token.

### Claim 25 (depends on 21)

The computer-implemented method of claim 21, wherein the second indication of the request includes the token and wherein the second handler is configured to retrieve the private key of the entity associated with the organization using an entity ID associated with the organization, the entity ID being extracted from the token.

### Claim 26 (depends on 20)

The computer-implemented method of claim 20, wherein the request includes an application programming interface (API) request.

### Claim 27 (depends on 20)

The computer-implemented method of claim 20, wherein the resource is a database and wherein the first handler is a domain-specific handler and the second handler is a database-specific handler.

### Claim 28 (depends on 20)

The computer-implemented method of claim 20, wherein when the privileged action includes a query, the indication of the result of the action includes data requested through the query.

### Claim 29 (depends on 20)

The computer-implemented method of claim 20, wherein when the privileged action includes a write command, the command handler is configured to provide a confirmation that information indicated by the write command has been written to the resource.

### Claim 30 (depends on 20)

The computer-implemented method of claim 20, wherein when the privileged action includes a write command, the command handler is configured to provide at least one of an error message, an original form of the resource prior to performing the privileged action, an updated form of the resource after performing the privileged action, or a message including at least a portion of the resource.