# US 12,118,106 B2 · Methods and systems for extending row-level security policies > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 12,118,106 B2 - Document ID: US12118106B2 - Status: Granted - Kind: B2 - Application number: 16/286,979 - Filed: 2019-02-27 - Published: 2020-08-27 - Granted: 2024-10-15 - Earliest claimed: 2019-02-27 - Assignees: K2 Software, Inc. - Applicants: K2 Software, Inc. - Inventors: Paul Hoeffer; Lewis Garmston; Grant Dickinson - Web page: https://patentgrep.com/patent/US12118106B2 ## CPC - G06F 21/62: Protecting access to data via a platform, e.g. using keys or access control rules - G06F 21/6218: {to a system of files or objects, e.g. local or distributed file system or database} - G06F 21/604: {Tools and structures for managing or administering access control systems} - G06F 2221/2145: Inheriting rights or properties, e.g., propagation of permissions or restrictions within a hierarchy - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract Methods and systems for creating and extending a row-level security (RLS) policy are provided. In one embodiment, a method is provided that includes creating an RLS policy for a primary object and searching a relationship database for one or more child relationships of the primary object. The method may further include filtering the one or more child relationships to identify a valid child relationship of the primary object. A child object of the primary object may then be identified based on the valid child relationship. The method may further include receiving a request to extend the RLS policy to the child object, and extending the RLS policy to the child object. ## Claims ### Claim 1 A method comprising, accessing an object database, wherein objects stored within the object database correspond to separate SQL data tables; creating a row-level security (RLS) policy for a primary object stored within the object database, wherein the RLS policy comprises (i) an access control list specifying row-level access permissions and (ii) a first plurality of SQL statements implementing the access control list; searching a relationship database separate from the object database for a set of child relationships between a set of child objects and the primary object, wherein the set of child objects corresponds to at least one SQL data table that requires access, via the RLS policy, to at least a portion of data stored in an SQL data table corresponding to the primary object, wherein the relationship database stores relationship data for relationships between objects within the object database, and wherein the relationship data is separate from data stored within the object database; filtering, after the searching, the set of child relationships to identify a set of valid child relationships by (i) determining whether each child relationship in the set of child relationships is valid or invalid, and (ii) removing each invalid child relationship, wherein the determining is distinct from the removing, wherein invalid child relationships include child relationships that are forbidden, circular, or duplicative; identifying, within the object database, a set of valid child objects of the primary object based on the set of valid child relationships; receiving a request to extend the RLS policy to the set of valid child objects; and extending the RLS policy to the set of valid child objects. ### Claim 2 (depends on 1) The method of claim 1, wherein identifying the child object of the primary object based on the set of valid child relationships, receiving the request to extend the RLS policy to the child object, and extending the RLS policy to the child object further comprise: identifying a plurality of child objects of the primary object based on the set of valid child relationships; receiving a request to extend the RLS policy to a subset of the plurality of child objects; and extending the RLS policy to the subset of the plurality of child objects. ### Claim 3 (depends on 1) The method of claim 1, wherein the primary object is a SmartBox Object configured to store its data in a related SQL table, and wherein the RLS policy is generated for the related SQL table in response to receiving a request to apply a data access policy to the SmartBox Object, and. ### Claim 4 (depends on 3) The method of claim 3, wherein the data access policy includes a policy selected from the group consisting of: (i) a full access policy, (ii) a limited access policy, and (iii) a combination of a full access policy and a limited access policy for data stored within the related SQL table. ### Claim 5 (depends on 1) The method of claim 1, wherein extending the RLS policy includes generating a second plurality of SQL statements to extend the RLS policy to the child object. ### Claim 6 (depends on 1) The method of claim 1, wherein searching a relationship database for the set of child relationships of the primary object further comprises identifying one or more foreign-key relationships of the primary object within the relationship database. ### Claim 7 (depends on 1) The method of claim 1, further comprising: searching the relationship database for one or more parent relationships of the primary object; filtering the one or more parent relationships to identify one or more valid parent relationships by (i) determining whether each of the one or more parent relationships is valid or invalid, and (ii) removing each invalid parent relationship; and identifying a parent object of the primary object based on the one or more valid parent relationships. ### Claim 8 (depends on 7) The method of claim 7, further comprising; receiving a request to update the RLS policy; updating the RLS policy for the primary object to create an updated RLS policy; and extending the updated RLS policy to the parent object. ### Claim 9 (depends on 1) The method of claim 1, wherein invalid child relationships include multiple child relationships from a single child object to the primary object. ### Claim 10 A system comprising: a processor; and a memory containing instructions which, when executed by the processor, cause the processor to implement: a row-level security (RLS) policy creator configured to: access an object database, wherein objects stored within the object database correspond to separate SQL data tables; create an RLS policy for a primary object stored within the object database, wherein the RLS policy comprises (i) an access control list specifying row-level access permissions and (ii) a first plurality of SQL statements implementing the access control list; a related object identifier configured to: search a relationship database separate from the object database for a set of child relationships between a set of child objects and the primary object, wherein the set of child objects corresponds to at least one SQL data table that requires access, via the RLS policy, to at least a portion of data stored in an SQL data table corresponding to the primary object, wherein the relationship database stores relationship data for relationships between objects within the object database, and wherein the relationship data is separate from data stored within the object database; filter, after the relationship database is searched, the set of child relationships to identify a set of valid child relationships by (i) determining whether each child relationship in the set of child relationships is valid or invalid, and (ii) removing each invalid child relationship, wherein the determining is distinct from the removing, wherein invalid child relationships include child relationships that are forbidden, circular, or duplicative; and identify, within the object database, a set of valid child objects of the primary object based on the set of valid child relationships; and an RLS policy extender configured to: receive a request to extend the RLS policy to the set of valid child objects; and extend the RLS policy to the set of valid child objects. ### Claim 11 (depends on 10) The system of claim 10, wherein the related object identifier is further configured to: identify a plurality of child objects of the primary object based on the set of valid child relationships, and wherein the RLS policy extender is further configured to: receive a request to extend the RLS policy to a subset of the plurality of child objects; and extend the RLS policy to the subset of the plurality of child objects. ### Claim 12 (depends on 10) The system of claim 10, wherein the primary object is a SmartBox Object configured to store its data in a related SQL table, and wherein the RLS policy extender is further configured to generate a second plurality of SQL statements to extend the RLS policy to the child object. ### Claim 13 (depends on 10) The system of claim 10, wherein the related object identifier is further configured to identify one or more foreign-key relationships of the primary object within the relationship database. ### Claim 14 (depends on 10) The system of claim 10, wherein the related object identifier is further configured to: search the relationship database for one or more parent relationships of the primary object; filter the one or more parent relationships to identify one or more valid parent relationships by (i) determining whether each of the one or more parent relationships is valid or invalid, and (ii) removing each invalid parent relationship; and identify a parent object of the primary object based on the one or more parent relationships. ### Claim 15 (depends on 10) The system of claim 10, wherein the RLS policy creator is further configured to: receive a request to update the RLS policy; and update the RLS policy for the primary object to create an updated RLS policy, and wherein the RLS policy extender is further configured to: extend the updated RLS policy to the child object. ### Claim 16 (depends on 14) The system of claim 14, wherein the RLS policy creator is further configured to: receive a request to update the RLS policy; and update the RLS policy for the primary object to create an updated RLS policy, and wherein the RLS policy extender is further configured to: extend the updated RLS policy to the parent object. ### Claim 17 (depends on 10) The system of claim 10, wherein the relationship database stores a relationship order for each child relationship in the set of child relationships with respect to the primary object, and wherein the related object identifier is further configured to: generate a tree structure based on the relationship order for each child relationship in the set of child relationships, wherein child objects with child relationships corresponding to greater relationship order are placed further from the primary object. ### Claim 18 A non-transitory, computer-readable medium storing instructions which, when executed by a processor, cause the processor to: access an object database, wherein objects stored within the object database correspond to separate SQL data tables; create a row-level security (RLS) policy for a primary object stored within the object database, wherein the RLS policy comprises (i) an access control list specifying row-level access permissions and (ii) a first plurality of SQL statements implementing the access control list; search a relationship database separate from the object database for a set of child relationships between a set of child objects and the primary object, wherein the set of child objects corresponds to at least one SQL data table that requires access, via the RLS policy to at least a portion of data stored in an SQL data table corresponding to the primary object, wherein the relationship database stores relationship data for relationships between objects within the object database, and wherein the relationship data is separate from data stored within the object database; filter, after the relationship database is searched, the set of child relationships to identify a set of valid child relationships by (i) determining whether each child relationship in the set of child relationships is valid or invalid, and (ii) removing each invalid child relationship, wherein the determining is distinct from the removing, wherein invalid child relationships include child relationships that are forbidden, circular, or duplicative; identify, within the object database, a set of valid child objects of the primary object based on the set of valid child relationships; receive a request to extend the RLS policy to the set of valid child objects; and extend the RLS policy to the set of valid child objects. ### Claim 19 (depends on 18) The non-transitory, computer-readable medium of claim 18, wherein the instructions which, when executed by a processor, further cause the processor to: access a user interface for creating data policies; display, at the user interface, the identified set of valid child objects; receive, at the user interface, a user selection to extend the RLS policy to a subset of valid child objects from the set of valid child objects; and responsive to the user selection, display, at the user interface, a set of projected effects of extending the RLS policy to the subset of valid child objects.