# US 12,001,580 B1 · Security description framework

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 12,001,580 B1
- Document ID: US12001580B1
- Status: Granted
- Kind: B1
- Application number: 17/459,914
- Filed: 2021-08-27
- Granted: 2024-06-04
- Earliest claimed: 2021-08-27
- Assignees: Workday, Inc.
- Applicants: Workday, Inc.
- Inventors: Vamsi Thummala; Prasanna JayaPrakash; Gary Heck
- Web page: https://patentgrep.com/patent/US12001580B1

## CPC

- G06F 21/6227: {where protection concerns the structure of data, e.g. records, types, queries}
- G06F 16/24: Querying
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)

## Abstract

The present application discloses a method, system, and computer system for enforcing security with respect to a database. The method includes receiving, by one or more processors, a user query from a user, determining one or more user security privileges for the user, configuring a query string, querying a database to return results based at least in part on the query string, obtaining the results, and providing the results to the user. The query string is based at least in part on the user query, and the query string comprises one or more security predicates that are based at least in part on the one or more user security privileges.

## Claims

### Claim 1

A system, comprising:
one or more processors configured to:
receive a user query from a user;
determine one or more user security privileges for the user;
configure a query string, wherein:
the query string is based at least in part on the user query, and
the query string comprises one or more security predicates that are based at least in part on the one or more user security privileges;
query a database to return results based at least in part on the query string;
obtain the results;
provide the results to the user;
in response to obtaining the results pertaining to the query string, configure the results to be presented to the user, wherein configuring the results comprises:
receiving, by a business intelligence layer, the results; and
translating the results to obtain readable results, wherein translating comprises using a business intelligence layer mapping between database fields and readable names; and
formatting the readable results to obtain results to be returned to the user, the formatting the readable results comprising inserting one or more selectable links that respectively point to associated information; and
provide, to a client terminal associated with the user, the readable results to be returned to the user;
receive, from the client terminal, a user input corresponding to selection of a link of the one or more selectable links;
in response to receiving the user input, generate an other query string based at least in part on the link; and
send, to the database layer, the other query string; and
a memory coupled to the one or more processors and configured to provide the one or more processors with instructions.

### Claim 2 (depends on 1)

The system of claim 1, wherein determining the one or more user security privileges is based at least in part on a user profile associated with the user.

### Claim 3 (depends on 2)

The system of claim 2, wherein the user profile comprises one or more security attributes.

### Claim 4 (depends on 3)

The system of claim 3, wherein the one or more security attributes comprise one or more of the following: an attribute pertaining to one or more of a user identifier, a user role, an organization, a department, a cost center, and/or a location.

### Claim 5 (depends on 1)

The system of claim 1, wherein querying the database comprises sending, via a security layer, the query string to a database layer.

### Claim 6 (depends on 1)

The system of claim 1, wherein the one or more security predicates are used by the database to provide query results that are accessible to the user according the one or more security privileges for the user.

### Claim 7 (depends on 1)

The system of claim 1, wherein the results comprise a database entry responsive to the query string, wherein an associated security descriptor of the database entry and the one or more security predicates of the query string are consistent with permitted access to the database entry.

### Claim 8 (depends on 7)

The system of claim 7, wherein the query string is configured based at least in part on a set of security predicates that correspond to security descriptors of database fields that are associated with the user query.

### Claim 9 (depends on 1)

The system of claim 1, wherein generating the other query string comprises:
determine at least one user security privilege for the user; and
configure the other query string, wherein:
the other query string is based at least in part on the user query, and
the query string comprises one or more security predicates that are based at least in part on the at least one user security privilege.

### Claim 10 (depends on 9)

The system of claim 9, wherein the generating the other query string comprises:
determining one or more security fields corresponding to one or more database fields associated with information to which the at least one of the one or more selectable links points; and
determining one or more security predicates to use in connection with determining the other string, wherein the one or more security predicates are based at least in part on (i) that at least one user security privilege, and (ii) the one or more security fields corresponding to the one or more database fields associated with information to which the at least one of the one or more selectable links points.

### Claim 11 (depends on 1)

The system of claim 1, wherein the one or more processors are configured to:
configure the database by associating a security fields associated with an indexed field of the database.

### Claim 12 (depends on 11)

The system of claim 11, wherein the security fields are set to one or more security descriptors by an administrator.

### Claim 13 (depends on 12)

The system of claim 12, wherein the one or more security descriptors indicate at least one security privilege that is required to access information in the indexed field.

### Claim 14

A method, comprising:
receiving, by one or more processors, a user query from a user;
determining one or more user security privileges for the user;
configuring a query string, wherein:
the query string is based at least in part on the user query, and
the query string comprises one or more security predicates that are based at least in part on the one or more user security privileges;
querying a database to return results based at least in part on the query string;
obtaining the results;
providing the results to the user;
in response to obtaining the results pertaining to the query string, configuring the results to be presented to the user, wherein configuring the results comprises:
receiving, by a business intelligence layer, the results; and
translating the results to obtain readable results, wherein translating comprises using a business intelligence layer mapping between database fields and readable names; and
formatting the readable results to obtain results to be returned to the user, the formatting the readable results comprising inserting one or more selectable links that respectively point to associated information; and
providing, to a client terminal associated with the user, the readable results to be returned to the user;
receiving, from the client terminal, a user input corresponding to selection of a link of the one or more selectable links;
in response to receiving the user input, generating an other query string based at least in part on the link; and
sending, to the database layer, the other query string.

### Claim 15

A computer program product, the computer program product being embodied in a non-transitory computer readable medium and comprising computer instructions for:
receiving, by one or more processors, a user query from a user;
determining one or more user security privileges for the user;
configuring a query string, wherein:
the query string is based at least in part on the user query, and
the query string comprises one or more security predicates that are based at least in part on the one or more user security privileges;
querying a database to return results based at least in part on the query string;
obtaining the results;
providing the results to the user;
in response to obtaining the results pertaining to the query string, configuring the results to be presented to the user, wherein configuring the results comprises:
receiving, by a business intelligence layer, the results; and
translating the results to obtain readable results, wherein translating comprises using a business intelligence layer mapping between database fields and readable names; and
formatting the readable results to obtain results to be returned to the user, the formatting the readable results comprising inserting one or more selectable links that respectively point to associated information;
providing, to a client terminal associated with the user, the readable results to be returned to the user;
receiving, from the client terminal, a user input corresponding to selection of a link of the one or more selectable links;
in response to receiving the user input, generating an other query string based at least in part on the link; and
sending, to the database layer, the other query string.