# US 12,118,110 B2 · Identity query language systems and methods > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 12,118,110 B2 - Document ID: US12118110B2 - Status: Granted - Kind: B2 - Application number: 17/712,670 - Filed: 2022-04-04 - Published: 2022-10-06 - Granted: 2024-10-15 - Earliest claimed: 2021-04-02 - Assignees: Strata Identity, Inc. - Applicants: Strata Identity, Inc. - Inventors: Eric Michael Olden; Christopher Eugene Marie; Carl Eric Leach; Mike Barinek; Gerry Joseph Gebel; Phillip James Dennis Hunt - Web page: https://patentgrep.com/patent/US12118110B2 ## CPC - G06F 21/6218: {to a system of files or objects, e.g. local or distributed file system or database} - G06F 16/256: {in federated or virtual databases} - G06F 21/604: {Tools and structures for managing or administering access control systems} - G06F 2221/2101: Auditing as a secondary aspect - G06F 2221/2141: Access rights, e.g. capability lists, access control lists, access tables, access matrices - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract A system, apparatus, and method for policy management is provided. The system, apparatus, and method provide a universal policy management solution to unify multiple bespoke systems to enable management of access and other policies in distributed and/or heterogeneous environments. The system, apparatus, and method uses or may be referred to as Identity Query Language or “IDQL.” Policies and user access are defined centrally, and these policies are distributed out to the various bespoke systems. This distribution is aided by a policy gateway, or orchestrator, which acts as a policy mapper and/or API wrapper which accepts IDQL policy configurations, maps them to an imperative identity system, and carries out the IDQL command in the identity systems' native API calls. ## Claims ### Claim 1 A system for policy management, the system comprising: a primary policy management point (“PPMP”) comprising a microprocessor configured to define a universal policy for a plurality of bespoke systems, wherein the universal policy is defined using a declarative syntax in a human-readable data serialization standard; and a policy gateway configured to: receive the universal policy from the PPMP; validate the universal policy received from the PPMP to ensure the universal policy is active and has not been tampered with using a checksum; translate the universal policy into a bespoke policy for each of the plurality of bespoke systems; and implement each of the bespoke policies in each of the plurality of bespoke systems. ### Claim 2 (depends on 1) The system of claim 1, wherein the PPMP is configured to securely distribute the bespoke policy to the policy gateway. ### Claim 3 (depends on 1) The system of claim 1, wherein the policy gateway implements a bespoke policy using an application programming interface (“API”) of a bespoke system. ### Claim 4 (depends on 1) The system of claim 1, wherein the policy gateway monitors each bespoke system for policy changes. ### Claim 5 (depends on 1) The system of claim 1, wherein the universal policy is one or more of an authentication policy, an access control policy, an authorization policy, an attribute policy, and an auditing policy. ### Claim 6 (depends on 1) The system of claim 1, further comprising a plurality of policy gateways, wherein each policy gateway is configured to implement the universal policy in a plurality of bespoke systems. ### Claim 7 (depends on 1) The system of claim 1, wherein said policy gateway is one of a plurality of policy gateways, each of the plurality of policy gateways configured to: receive the universal policy from the PPMP; authenticate the universal policy received from the PPMP; translate the universal policy received from the PPMP into a bespoke policy for at least one of the bespoke systems; authenticate each bespoke policy against an associated bespoke system; and implement each of the bespoke policies in each of the plurality of bespoke systems using an application programming interface (“API”) of each of the bespoke systems. ### Claim 8 A method for policy management comprising: defining a universal policy using a declarative syntax in a human-readable data serialization standard for a plurality of bespoke systems; validating the universal policy to ensure the universal policy is active and has not been tampered with using a checksum; translating the universal policy into a bespoke policy for each of a plurality of bespoke systems; and implementing each of the bespoke policies in each of the plurality of bespoke systems. ### Claim 9 (depends on 8) The method of claim 8, wherein the defining step comprises defining, at a primary policy management point (“PPMP”), a universal policy for a plurality of bespoke systems. ### Claim 10 (depends on 9) The method of claim 9, wherein the translating step comprises translating, at a policy gateway, the universal policy into a bespoke policy for each of a plurality of bespoke systems. ### Claim 11 (depends on 8) The method of claim 8, wherein the implementing step comprises implementing, at a policy gateway, each of the bespoke policies in each of the plurality of bespoke systems. ### Claim 12 (depends on 8) The method of claim 8, further comprising the step of sending the universal policy to a policy gateway. ### Claim 13 (depends on 8) The method of claim 8, wherein a PPMP is configured to securely distribute the bespoke policy to a policy gateway. ### Claim 14 (depends on 8) The method of claim 8, wherein a policy gateway monitors each bespoke system for policy changes. ### Claim 15 A method for policy management comprising: defining, at a primary policy management point (“PPMP”), a universal policy in a declarative syntax using a human-readable data serialization standard for each of a plurality of bespoke systems; receiving the universal policy from the PPMP at a plurality of policy gateways; authenticating the universal policy received from the PPMP at the plurality of policy gateways; validating the universal policy received from the PPMP at the plurality of policy gateways to ensure the universal policy is active and has not been tampered with using a checksum; translating, at each of the policy gateways, the universal policy received from the PPMP into a bespoke policy for at least one of the bespoke systems; implementing, at each of the policy gateways, at least one of said bespoke policies in at least one of the plurality of bespoke systems using an application programming interface (“API”) at least one of the bespoke systems.