# US 12,001,578 B2 · Systems using secure permissions for secure enterprise-wide fine-grained role-based access control of organizational assets > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 12,001,578 B2 - Document ID: US12001578B2 - Status: Granted - Kind: B2 - Application number: 18/306,933 - Filed: 2023-04-25 - Published: 2023-08-17 - Granted: 2024-06-04 - Earliest claimed: 2019-10-18 - Assignees: ASG Technologies Group, Inc. - Applicants: ASG Technologies Group, Inc. - Inventors: Yan Bregman; Kizito Ofornagoro - Web page: https://patentgrep.com/patent/US12001578B2 ## CPC - G06F 21/6218: {to a system of files or objects, e.g. local or distributed file system or database} - G06F 21/6245: {Protecting personal data, e.g. for financial or medical purposes} - G06F 3/0482: Interaction with lists of selectable items, e.g. menus - G06F 3/0483: Interaction with page-structured environments, e.g. book metaphor - G06F 16/211: {Schema design and management} - G06F 16/256: {in federated or virtual databases} - G06F 21/10: Protecting distributed programs or content, e.g. vending or licensing of copyrighted material (protection in video systems or pay television H04N7/16) {; Digital rights management [DRM]} - G06F 21/31: User authentication - G06F 21/604: {Tools and structures for managing or administering access control systems} - G06F 21/6209: {to a single file or object, e.g. in a secure envelope, encrypted and accessed using a key, or with access control rules appended to the object itself} - G06F 21/6227: {where protection concerns the structure of data, e.g. records, types, queries} - G06F 40/106: Display of layout of documents; Previewing - G06N 5/01: Dynamic search techniques; Heuristics; Dynamic trees; Branch-and-bound - G06N 5/04: Inference or reasoning models - H04L 63/10: {for controlling access to devices or network resources} - H04L 63/101: {Access control lists [ACL]} - H04L 63/102: {Entity profiles} - H04L 63/105: {Multiple levels of security} - H04L 63/205: {involving negotiation or determination of the one or more network security mechanisms to be used, e.g. by negotiation between the client and the server or between peers or by selection according to the capabilities of the entities involved (negotiation of communication capabilities H04L69/24)} - H04W 12/08: Access security - G06F 2221/2141: Access rights, e.g. capability lists, access control lists, access tables, access matrices - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - G06N: COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - H04W: WIRELESS COMMUNICATION NETWORKS (broadcast communication H04H; communication systems using wireless links for non-selective communication, e.g. wireless extensions H04M1/72) ## Abstract The disclosure is directed to systems and methods for enterprise-wide fine-grained role-based access control to a plurality of organizational assets. In various embodiments exemplary methods include receiving, via an authorization service client API, identification of an asset for fine-grained role-based access control; a definition of an asset type of the asset; a definition of an asset value; receiving, a definition of an organizational role with fine-grained role-based access control to at least one of the asset, the asset type, and the asset value. Furthermore, receiving permissions for fine-grained role-based access by the organizational role to at least one of the asset, the asset type, and the asset value. Furthermore, the exemplary method may comprise providing an authorization service user interface (UI) for enabling fine-grained role-based access control to the asset based on the fine-grained role-based access control database schema. ## Claims ### Claim 1 A method for enterprise-wide fine-grained role-based access control to a plurality of organizational assets, the method comprising: receiving, via an authorization service client Application Programming Interface (API), identification of an asset for fine-grained role-based access control from an organization; receiving, via the authorization service client API, a definition of an asset type of the asset using the identification of the asset; receiving, via the authorization service client API, a definition of an asset value of the asset based on the asset type; receiving, via the authorization service client API, a definition of an organizational role with fine-grained role-based access control to at least one of the asset, the asset type, and the asset value; receiving, via the authorization service client API, permissions for fine-grained role-based access by the organizational role to at least one of the asset, the asset type, and the asset value, the permissions comprising at least one access rule having a set of variables based on the asset, the asset type, and the asset value; generating a fine-grained role-based access control database schema using the asset, the definition of an asset type, the definition of an asset value, the definition of an organizational role, and the permissions for fine-grained role-based access by the organizational role to at least one of the asset, the asset type, and the asset value; providing an authorization service user interface (UI) for enabling fine-grained role-based access control to the asset based on the fine-grained role-based access control database schema; receiving, via the authorization service client API, a request for permission to access at least one of the asset, the asset type, and the asset value by an authenticated user; and receiving, via the authorization service UI, a selection input of the organizational role with fine-grained role-based access control to at least one of an asset, an asset type, and an asset value, the selection input of the organizational role comprising multiple organizational roles. ### Claim 2 (depends on 1) The method as recited in claim 1, further comprising: receiving, via the authorization service UI, selection input of an asset for fine-grained role-based access control using the identification of an asset; receiving, via the authorization service UI, selection input of an asset type of the asset using the definition of the asset type of the asset; receiving, via the authorization service UI, selection input of an asset value of the asset using the definition of the asset value of the asset; receiving, via the authorization service UI, selection input of an organizational role with fine-grained role-based access control to at least one of the asset, the asset type, and the asset value; and receiving, via the authorization service UI, selection input of the permissions for fine-grained role-based access by the organizational role to at least one of the asset, the asset type, and the asset value. ### Claim 3 (depends on 1) The method as recited in claim 1, further comprising: fine-grained role-based access evaluating the request for permission to access the asset from the authenticated user using the fine-grained role-based access control database schema; generating a fine-grained role-based access decision regarding the request for permission to access the asset, the asset type, and the asset value by the authenticated user based on the fine-grained role-based access evaluating; and replying to the request for permission to access at least one of the asset, the asset type, and the asset value by the authenticated user, via the authorization service client API, the fine-grained role-based access decision regarding the request for permission to access at least one of the asset, the asset type, and the asset value by the authenticated user. ### Claim 4 (depends on 3) The method as recited in claim 3, wherein the replying to the request for permission to access at least one of the asset, the asset type, and the asset value by the authenticated user comprises granting permission to access at least one of the asset, the asset type, and the asset value by the authenticated user. ### Claim 5 (depends on 3) The method as recited in claim 3, wherein the replying to the request for permission to access at least one of the asset, the asset type, and the asset value by the authenticated user comprises denial of permission to access at least one of the asset, the asset type, and the asset value by the authenticated user. ### Claim 6 (depends on 2) The method as recited in claim 2, wherein the receiving, via the authorization service UI, the selection input of the organizational role is as a root user; and wherein the receiving, via the authorization service UI, selection input of permissions for fine-grained role-based access by the root user includes permissions to access all asset types and asset values. ### Claim 7 A system for enterprise-wide fine-grained role-based access control to a plurality of organizational assets, the system comprising: at least one processor; and a memory storing processor-executable instructions, wherein the at least one processor is configured to implement the following operations upon executing the processor-executable instructions: receiving, via an authorization service client Application Programming Interface (API), identification of an asset for fine-grained role-based access control from an organization; receiving, via the authorization service client API, a definition of an asset type of the asset using the identification of the asset; receiving, via the authorization service client API, a definition of an asset value of the asset based on the asset type; receiving, via the authorization service client API, a definition of an organizational role with fine-grained role-based access control to at least one of the asset, the asset type, and the asset value; receiving, via the authorization service client API, permissions for fine-grained role-based access by the organizational role to at least one of the asset, the asset type, and the asset value, the permissions comprising at least one access rule having a set of variables based on the asset, the asset type, and the asset value; generating a fine-grained role-based access control database schema using the asset, the definition of an asset type, the definition of an asset value, the definition of an organizational role, and the permissions for fine-grained role-based access by the organizational role to at least one of the asset, the asset type, and the asset value; providing an authorization service user interface (UI) for enabling fine-grained role-based access control to the asset based on the fine-grained role-based access control database schema; receiving, via the authorization service client API, a request for permission to access at least one of the asset, the asset type, and the asset value by an authenticated user; and receiving, via the authorization service UI, a selection input of the organizational role with fine-grained role-based access control to at least one of the asset, the asset type, and the asset value, the selection input of the organizational role comprising multiple organizational roles. ### Claim 8 (depends on 7) The system as recited in claim 7, wherein the at least one processor is further configured to implement the following operations upon executing the processor-executable instructions: receiving, via the authorization service UI, selection input of an asset for fine-grained role-based access control using the identification of an asset; receiving, via the authorization service UI, selection input of an asset type of the asset using the definition of the asset type of the asset; receiving, via the authorization service UI, selection input of an asset value of the asset using the definition of the asset value of the asset; receiving, via the authorization service UI, selection input of an organizational role with fine-grained role-based access control to at least one of the asset, the asset type, and the asset value; and receiving, via the authorization service UI, selection input of permissions for fine-grained role-based access by the organizational role to at least one of the asset, the asset type, and the asset value. ### Claim 9 (depends on 7) The system as recited in claim 7, wherein the at least one processor is further configured to implement the following operations upon executing the processor-executable instructions: fine-grained role-based access evaluating the request for permission to access the asset from the authenticated user using the fine-grained role-based access control database schema; generating a fine-grained role-based access decision regarding the request for permission to access the asset, the asset type, and the asset value by the authenticated user based on the fine-grained role-based access evaluating; and replying to the request for permission to access at least one of the asset, the asset type, and the asset value by the authenticated user, via the authorization service client API, the fine-grained role-based access decision regarding the request for permission to access at least one of the asset, the asset type, and the asset value by the authenticated user. ### Claim 10 (depends on 9) The system as recited in claim 9, wherein the replying to the request for permission to access at least one of the asset, the asset type, and the asset value by the authenticated user comprises granting permission to access at least one of the asset, the asset type, and the asset value by the authenticated user. ### Claim 11 (depends on 9) The system as recited in claim 9, wherein the replying to the request for permission to access at least one of the asset, the asset type, and the asset value by the authenticated user comprises denial of permission to access at least one of the asset, the asset type, and the asset value by the authenticated user. ### Claim 12 (depends on 8) The system as recited in claim 8, wherein the receiving, via the authorization service UI, the selection input of the organizational role is as a root user; and wherein the receiving, via the authorization service UI, selection input of permissions for fine-grained role-based access by the root user includes permissions to access all asset types and asset values. ### Claim 13 A non-transitory computer readable medium having embodied thereon instructions being executable by at least one processor to perform operations for enterprise-wide fine-grained role-based access control to a plurality of organizational assets, the operations comprising: receiving, via an authorization service client Application Programming Interface (API), identification of an asset for fine-grained role-based access control from an organization; receiving, via the authorization service client API, a definition of an asset type of the asset using the identification of the asset; receiving, via the authorization service client API, a definition of an asset value of the asset based on the asset type; receiving, via the authorization service client API, a definition of an organizational role with fine-grained role-based access control to at least one of the asset, the asset type, and the asset value; receiving, via the authorization service client API, permissions for fine-grained role-based access by the organizational role to at least one of the asset, the asset type, and the asset value, the permissions comprising at least one access rule having a set of variables based on the asset, the asset type, and the asset value; generating a fine-grained role-based access control database schema using the asset, the definition of an asset type, the definition of an asset value, the definition of an organizational role, and the permissions for fine-grained role-based access by the organizational role to at least one of the asset, the asset type, and the asset value; providing an authorization service user interface (UI) for enabling fine-grained role-based access control to the asset based on the fine-grained role-based access control database schema; receiving, via the authorization service client API, a request for permission to access at least one of the asset, the asset type, and the asset value by an authenticated user; and receiving, via the authorization service UI, a selection input of the organizational role with fine-grained role-based access control to at least one of the asset, the asset type, and the asset value, the selection input of the organizational role comprising multiple organizational roles. ### Claim 14 (depends on 13) The non-transitory computer readable medium of claim 13, wherein the operations further comprise: receiving, via the authorization service UI, selection input of an asset for fine-grained role-based access control using the identification of an asset; receiving, via the authorization service UI, selection input of an asset type of the asset using the definition of the asset type of the asset; receiving, via the authorization service UI, selection input of an asset value of the asset using the definition of the asset value of the asset; receiving, via the authorization service UI, selection input of an organizational role with fine-grained role-based access control to at least one of the asset, the asset type, and the asset value; and receiving, via the authorization service UI, selection input of permissions for fine-grained role-based access by the organizational role to at least one of the asset, the asset type, and the asset value. ### Claim 15 (depends on 13) The non-transitory computer readable medium of claim 13, wherein the operations further comprise: fine-grained role-based access evaluating the request for permission to access the asset from the authenticated user using the fine-grained role-based access control database schema; generating a fine-grained role-based access decision regarding the request for permission to access the asset, the asset type, and the asset value by the authenticated user based on the fine-grained role-based access evaluating; and replying to the request for permission to access at least one of the asset, the asset type, and the asset value by the authenticated user, via the authorization service client API, the fine-grained role-based access decision regarding the request for permission to access at least one of the asset, the asset type, and the asset value by the authenticated user. ### Claim 16 (depends on 15) The non-transitory computer readable medium of claim 15, wherein the replying to the request for permission to access at least one of the asset, the asset type, and the asset value by the authenticated user comprises granting permission to access at least one of the asset, the asset type, and the asset value by the authenticated user. ### Claim 17 (depends on 15) The non-transitory computer readable medium of claim 15, wherein the replying to the request for permission to access at least one of the asset, the asset type, and the asset value by the authenticated user comprises denial of permission to access at least one of the asset, the asset type, and the asset value by the authenticated user. ### Claim 18 (depends on 14) The non-transitory computer readable medium of claim 14, wherein the receiving, via the authorization service UI, the selection input of the organizational role is as a root user; and wherein the receiving, via the authorization service UI, selection input of the permissions for fine-grained role-based access by the root user includes permissions to access all asset types and asset values.