# US 2014/0195563 A1 · Object graph partial immutability and isolation enforcement

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 2014/0195563 A1
- Document ID: US20140195563A1
- Status: Published application
- Kind: A1
- Application number: 13/734,758
- Filed: 2013-01-04
- Published: 2014-07-10
- Earliest claimed: 2013-01-04
- Assignees: Microsoft Corporation
- Applicants: Microsoft Corporation
- Inventors: G. Shon Katzenberger; Jared Porter Parsons; Alexander Daniel Bromfield; John J. Duffy; Krzysztof J. Cwalina
- Web page: https://patentgrep.com/patent/US20140195563A1

## CPC

- G06F 16/20: of structured data, e.g. relational data
- G06F 9/52: Program synchronisation; Mutual exclusion, e.g. by means of semaphores
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)

## Abstract

The type definition of particular types such that different portions of the corresponding object graph may have different permissions assigned to those portions during instantiation. This allows structured permissions to be applied to instantiations of the object graphs of those defined types, allowing fine grained control over what access permissions are enforced against which portions of the object graph. In some embodiments, different instantiations of the object graph may apply permissions differently.

## Claims

### Claim 1

A computer program product comprising one or more computer-readable storage media having thereon computer-executable instructions that, when executed by one or more processors of a computing system, cause the computing system to perform a method for declaring a type that may have a structured permission, the method comprising:
an act of defining a first permission partition within the type; and
an act of defining a second permission partition within the type, such that instantiations of the type are permitted to have a different permission for the second permission partition than the first permission partition.

### Claim 2 (depends on 1)

The computer program product in accordance with claim 1, wherein the declaration of the type may also specify a minimum permission restriction associated with at least one of the first permission partition and the second permission partition.

### Claim 3 (depends on 2)

The computer program product in accordance with claim 2, wherein the minimum permission restriction is an immutable permission.

### Claim 4 (depends on 2)

The computer program product in accordance with claim 2, wherein the minimum permission restriction is a readable permission.

### Claim 5 (depends on 2)

The computer program product in accordance with claim 2, wherein the minimum permission restriction is a writable permission.

### Claim 6 (depends on 1)

The computer program product in accordance with claim 1, wherein the first permission partition is a root permission partition, and the second permission partition is an inner permission partition.

### Claim 7 (depends on 1)

The computer program product in accordance with claim 1, wherein the method further comprises:
an act of defining a third permission partition within the type, such that instantiations of the type are permitted to have a different permission for the third permission partition than the first permission partition or the second permission partition.

### Claim 8

A method for instantiating an object graph representing an instance of a particular type that has structured permissions, the method comprising:
an act of assigning a first permission to a first permission partition of the object graph so that the first permission is enforced on access requests for objects within the first permission partition; and
an act of assigning a second permission to a second permission partition of the object graph so that the second permission is enforced on access requests for objects within the second permission partition, wherein the second permission may be different than the first permission.

### Claim 9 (depends on 8)

The method in accordance with claim 8, wherein the first permission is the same as the second permission.

### Claim 10 (depends on 8)

The method in accordance with claim 8, wherein the first permission is different than the second permission.

### Claim 11 (depends on 10)

The method in accordance with claim 10, wherein the first permission partition is a root permission partition, and the second permission partition is an inner permission partition.

### Claim 12 (depends on 11)

The method in accordance with claim 11, wherein the first permission partition is a shallow fresh permission, representing that 1) that there are no external references to the root permission partition referenced by the return reference, and 2) that there are no mutable references within the root permission partition from to any objects outside of the root permission partition.

### Claim 13 (depends on 8)

The method in accordance with claim 8, wherein the first permission is an immutable permission.

### Claim 14 (depends on 8)

The method in accordance with claim 8, further comprising converting the object graph into an object graph in which either or both of the first permission and the second permission are more restrictive.

### Claim 15 (depends on 8)

The method in accordance with claim 8, wherein the first permission is a readable permission.

### Claim 16 (depends on 8)

The method in accordance with claim 8, wherein the first permission is a writable permission.

### Claim 17 (depends on 8)

The method in accordance with claim 8, wherein the object graph is a first object graph of the particular type, the method further comprising:
an act of assigning a third permission to the first permission partition of a second object graph of the particular type so that the third permission is enforced on access requests for objects within the first permission partition of the second object graph; and
an act of assigning a fourth permission to the second permission partition of the second object graph so that the fourth permission is enforced on access requests for objects within the second permission partition, wherein the fourth permission may be different than the first permission.

### Claim 18 (depends on 17)

The method in accordance with claim 17, wherein the third permission is different than the first permission.

### Claim 19 (depends on 18)

The method in accordance with claim 18, wherein the fourth permission is different than the second permission.

### Claim 20

A system for instantiating an object graph representing an instance of a particular type that has structured permissions, the system comprising:
a type definition access component that accesses a type definition of a particular type, the type definition specifying a first permission partition within the type and a second permission partition within the type, such that a permission assigned to the first permission partition may be different than a permission assigned to the second permission partition; and
an instantiation component configured to generate an object graph of the particular type using the type definition, and in the process assign a first permission to the first permission partition of the object graph, and assign a second permission to the second permission partition of the object graph, wherein the second permission is different than the first permission.