# US 12,225,015 B2 · Generating and implementing organizational security policies > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 12,225,015 B2 - Document ID: US12225015B2 - Status: Granted - Kind: B2 - Application number: 17/328,614 - Filed: 2021-05-24 - Published: 2022-09-08 - Granted: 2025-02-11 - Earliest claimed: 2021-03-03 - Assignees: People Center, Inc. - Applicants: People Center, Inc. - Inventors: James Arthur Donovan; Adam Vy Donovan - Web page: https://patentgrep.com/patent/US12225015B2 ## CPC - H04L 63/102: {Entity profiles} - G06F 21/6218: {to a system of files or objects, e.g. local or distributed file system or database} - H04L 41/22: comprising specially adapted graphical user interfaces [GUI] - H04L 63/083: {using passwords (cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226)} - H04L 63/105: {Multiple levels of security} - H04L 63/20: {for managing network security; network security policies in general (filtering policies H04L63/0227)} - G06F 21/46: by designing passwords or checking the strength of passwords - H04L 63/1466: {Active attacks involving interception, injection, modification, spoofing of data unit addresses, e.g. hijacking, packet injection or TCP sequence number attacks} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract Methods, systems, devices, and tangible non-transitory computer readable media for generating and implementing security policies are provided. The disclosed technology can include accessing a security request associated with generating a security policy based in part on organizational data that includes one or more organizational records. The security request can include one or more rules associated with the security policy. Based at least in part on the security request, the one or more rules that are in compliance with one or more policies associated with the organizational data can be determined. Furthermore, the security policy can be generated based at least in part on the one or more rules that are in compliance with the one or more policies. Furthermore, operations associated with implementing the security policy can be performed. ## Claims ### Claim 1 A computing system for implementing security policies, the computing system comprising: one or more processors; and one or more non-transitory computer-readable media that store instructions that, when executed by the one or more processors, cause the computing system to perform operations, the operations comprising: receiving an access request associated with a particular employee and a particular computing resource; accessing a user-customized security policy associated with the particular employee or the particular computing resource, wherein the user-customized security policy is defined using one or more references to a set of organizational data comprising employee data records for employees of an organization; determining a policy evaluation outcome comprising: comparing the one or more references to the set of organizational data with an employee data record associated with the particular employee; executing one or more query language expressions against the set of organizational data to determine a query result, the set of organizational data comprises an object database represented as a graph with nodes and edges; traversing the graph based on the query language expressions to determine the query result; and determining the policy evaluation outcome based at least in part on the query result; and providing a response to the access request based at least in part on the policy evaluation outcome. ### Claim 2 (depends on 1) The computing system of claim 1, wherein the user-customized security policy comprises one or more query language expressions. ### Claim 3 (depends on 2) The computing system of claim 2, wherein the nodes correspond to objects and the edges correspond to logical associations between objects or object attributes. ### Claim 4 (depends on 3) The computing system of claim 3, wherein: the set of organizational data comprises organizational structure data encoded within the edges of the graph; and traversing the graph based on the query language expressions to determine the query result comprises traversing at least one of the edges of the graph that encodes organizational structure data. ### Claim 5 (depends on 4) The computing system of claim 4, wherein: the user-customized security policy is defined for a group of users included in a set of users; and traversing at least one of the edges of the graph that encodes organizational structure data comprises traversing an edge of the graph that encodes membership of the particular employee within the group of users. ### Claim 6 (depends on 2) The computing system of claim 2, wherein: executing the one or more query language expressions against the set of organizational data to determine the query result comprises executing the one or more query language expressions against the set of organizational data to determine two or more actions performed by the particular employee; and determining the policy evaluation outcome based at least in part on the query result comprises determining the policy evaluation outcome based at least in part on application of the user-customized security policy to the two or more actions. ### Claim 7 (depends on 6) The computing system of claim 6, wherein the user-customized security policy comprises a behavior detection security policy that screens for impossible velocity between two logins or login attempts associated with the particular employee. ### Claim 8 (depends on 2) The computing system of claim 2, wherein the one or more query language expressions are expressed in a declarative query language. ### Claim 9 (depends on 2) The computing system of claim 2, wherein executing the one or more query language expressions against the set of organizational data to determine the query result comprises executing the one or more query language expressions against the set of organizational data to determine a Boolean query result. ### Claim 10 (depends on 1) The computing system of claim 1, wherein providing the response to the access request based at least in part on the policy evaluation outcome comprises specifying one or more additional security requirements. ### Claim 11 (depends on 1) The computing system of claim 1, wherein the user-customized security policy has been defined via a user interface. ### Claim 12 A computer-implemented method, comprising: receiving an access request associated with a particular employee and a particular computing resource; accessing a user-customized security policy associated with the particular employee or the particular computing resource, wherein the user-customized security policy is defined using one or more references to a set of organizational data comprising employee data records for employees of an organization; determining a policy evaluation outcome comprising: comparing the one or more references to the set of organizational data with an employee data record associated with the particular employee; executing one or more query language expressions against the set of organizational data to determine a query result, the set of organizational data comprises an object database represented as a graph with nodes; traversing the graph based on the query language expressions to determine the query result; and determining the policy evaluation outcome based at least in part on the query result; and providing a response to the access request based at least in part on the policy evaluation outcome. ### Claim 13 (depends on 12) The computer-implemented method of claim 12, wherein the user-customized security policy comprises one or more query language expressions. ### Claim 14 (depends on 13) The computer-implemented method of claim 13, wherein the nodes correspond to objects and the edges correspond to logical associations between objects or object attributes. ### Claim 15 (depends on 14) The computer-implemented method of claim 14, wherein: the set of organizational data comprises organizational structure data encoded within the edges of the graph; and traversing the graph based on the query language expressions to determine the query result comprises traversing at least one of the edges of the graph that encodes organizational structure data. ### Claim 16 (depends on 15) The computer-implemented method of claim 15, wherein: the user-customized security policy is defined for a group of users included in a set of users; and traversing at least one of the edges of the graph that encodes organizational structure data comprises traversing an edge of the graph that encodes membership of the particular employee within the group of users. ### Claim 17 (depends on 13) The computer-implemented method of claim 13, wherein: executing the one or more query language expressions against the set of organizational data to determine the query result comprises executing the one or more query language expressions against the set of organizational data to determine two or more actions performed by the particular employee; and determining the policy evaluation outcome based at least in part on the query result comprises determining the policy evaluation outcome based at least in part on application of the user-customized security policy to the two or more actions. ### Claim 18 (depends on 17) The computer-implemented method of claim 17, wherein the user-customized security policy comprises a behavior detection security policy that screens for impossible velocity between two logins or login attempts associated with the particular employee. ### Claim 19 (depends on 13) The computer-implemented method of claim 13, wherein the one or more query language expressions are expressed in a declarative query language. ### Claim 20 (depends on 13) The computer-implemented method of claim 13, wherein executing the one or more query language expressions against the set of organizational data to determine the query result comprises executing the one or more query language expressions against the set of organizational data to determine a Boolean query result.