# US 2018/0025173 A1 · Entity security implied by an asset in a repository system

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 2018/0025173 A1
- Document ID: US20180025173A1
- Status: Published application
- Kind: A1
- Application number: 15/715,029
- Filed: 2017-09-25
- Published: 2018-01-25
- Earliest claimed: 2013-09-20
- Assignees: Oracle International Corporation
- Applicants: Oracle International Corporation
- Inventors: David Keyes; Muthukumar Palanisamy; David Edward DiFranco; Dennis M. Chin
- Web page: https://patentgrep.com/patent/US20180025173A1

## CPC

- G06F 21/6218: {to a system of files or objects, e.g. local or distributed file system or database}
- G06F 21/604: {Tools and structures for managing or administering access control systems}
- G06F 2221/2141: Access rights, e.g. capability lists, access control lists, access tables, access matrices
- H04L 63/20: {for managing network security; network security policies in general (filtering policies H04L63/0227)}
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)

## Abstract

Techniques are described for managing access to a repository system storing information (e.g., metadata) about objects (e.g., an application, a process, or a service) in a computing environment. The repository system can store a data structure (an “entity”) that includes information about an object. An entity can have an association with one or more collections of entities (“assets”) that classify a collection of entities. Access to perform actions (e.g., create, read, update, or delete) an entity can be managed based on an entitlement, which grants a right to access information in the entity and/or at least one asset having an association with the entity. The repository system can manage access to one or more entities based on rights implied by an entitlement to access one or more assets associated with those entities.

## Claims

### Claim 1

A method comprising:
determining, by a computer system, one or more first criteria in a query, the one or more first criteria indicating a first entity and a second entity to which to perform an action, wherein the first entity and the second entity are included in a repository system, wherein the first entity is associated with a first asset in the repository system, wherein the second entity is associated with a second asset in the repository system, wherein each of the first entity and the second entity includes information related to at least one of a computing device or an application in a computing environment;
determining, by the computer system, for a user associated with the query, an entitlement to access one or more assets associated with one of the first entity or the second entity;
determining, by the computer system, one or more second criteria indicating one or more entities to which the action is not to be performed; and
based on determining that the action is included in one or more actions that are permitted for the one or more assets accessible to the user based on the determined entitlement, performing, by the computer system, the action on at least one entity that is one of the first entity or the second entity and that is not included in the one or more entities.

### Claim 2 (depends on 1)

The method of claim 1, further comprising:
obtaining, by the computer system, an access policy that defines one or more first actions that are permitted for the second asset, the one or more first actions being part of the one or more actions that are permitted for the one or more assets accessible to the user; and
determining, by the computer system, that the action is not to be performed on the second entity based on the one or more first actions defined in the access policy and based on the second entity being associated with the second asset.

### Claim 3 (depends on 2)

The method of claim 2, wherein the repository system further includes a third entity,
wherein the second asset is also associated with the third entity,
wherein the method further comprises determining, by the computer system, that the action is not to be performed on the third entity based on the access policy and an association between the second asset and the third entity, and
wherein the one or more second criteria indicate that the action is not to be performed on the third entity.

### Claim 4 (depends on 1)

The method of claim 1, wherein the repository system further includes a third entity,
wherein the third entity is not associated with the first asset,
wherein the method further comprises:
obtaining, by the computer system, an access policy that defines one or more second actions that are permitted for the first asset, the one or more second actions being part of the one or more actions that are permitted for the one or more assets accessible to the user;
determining, by the computer system, that the action is to be performed on the first entity based on the one or more second actions defined in the access policy; and
determining, by the computer system, that the action is not to be performed on the third entity based on the one or more second actions defined in the access policy and based on the third entity being not associated with the first asset, and
wherein the one or more second criteria indicate that the action is not to be performed on the third entity.

### Claim 5 (depends on 4)

The method of claim 4, wherein the repository system further includes a fourth entity,
wherein the fourth entity is associated with the first asset,
wherein the method further comprises determining, by the computer system, that the action is to be performed on the fourth entity based on the one or more second actions defined in the access policy and based on the fourth entity being associated with the first asset, and
wherein the one or more second criteria indicate that the action is to be performed on the fourth entity.

### Claim 6 (depends on 1)

The method of claim 1, wherein the repository system further includes a third entity,
wherein the method further comprises:
obtaining, by the computer system, an access policy that defines one or more third actions that are not permitted for the third entity; and
determining, by the computer system, that the action is not to be performed on the third entity based on the one or more third actions defined in the access policy, and
wherein the one or more second criteria indicate that the action is not to be performed on the third entity.

### Claim 7 (depends on 1)

The method of claim 1, wherein the repository system further includes a third entity,
wherein the first asset includes a data structure that stores: attribute information of the first asset, first metadata that identify the first entity, and second metadata that identify the third entity, and
wherein the method further comprises:
determining, by the computer system, that the first entity is associated with the first asset based on the first asset storing the first metadata; and
determining, by the computer system, that the third entity is associated with the first asset based on the first asset storing the second metadata.

### Claim 8 (depends on 1)

The method of claim 1, further comprising:
determining, by the computer system, a type of the action; and
based on the type of the action, determining, by the computer system, to modify the query to include the one or more second criteria.

### Claim 9 (depends on 8)

The method of claim 8, wherein the type of the action is included in a plurality of types of actions comprising: creating an entity, retrieving information associated with an entity, updating information associated with an entity, and deleting an entity.

### Claim 10 (depends on 1)

The method of claim 1, wherein the entitlement is determined based on a role of the user for operating the repository system.

### Claim 11 (depends on 1)

The method of claim 1, wherein the computing environment includes a plurality of objects,
wherein each object of the plurality of objects includes the application in the computing environment, the computing device in the computing environment, a process, a service, a method, or a combination thereof.

### Claim 12 (depends on 11)

The method of claim 11, wherein the first asset includes information related to an object of the plurality of objects, the object including the at least one of the computing device or the application in the computing environment, and
wherein the information related to the object includes: a location of the object, an identifier of the object, a type of the object, a relationship to other types of objects, or a combination thereof.

### Claim 13

A system comprising:
one or more processors; and
a memory accessible to the one or more processors, the memory storing a set of instructions which, when executed by the one or more processors, causes the one or more processors to perform:
determining one or more first criteria in a query, the one or more first criteria indicating a first entity and a second entity to which to perform an action, wherein the first entity and the second entity are included in a repository system, wherein the first entity is associated with a first asset in the repository system, wherein the second entity is associated with a second asset in the repository system, wherein each of the first entity and the second entity includes information related to at least one of a computing device or an application in a computing environment;
determining for a user associated with the query, an entitlement to access one or more assets associated with one of the first entity or the second entity;
determining one or more second criteria indicating one or more entities to which the action is not to be performed; and
based on determining that the action is included in one or more actions that are permitted for the one or more assets accessible to the user based on the determined entitlement, performing the action on at least one entity that is one of the first entity or the second entity and that is not included in the one or more entities.

### Claim 14 (depends on 13)

The system of claim 13, wherein the repository system further includes a third entity, the second asset being associated with the third entity,
wherein the set of instructions which, when executed by the one or more processors, further causes the one or more processors to further perform:
obtaining an access policy that defines one or more first actions that are permitted for the second asset, the one or more first actions being part of the one or more actions that are permitted for the one or more assets accessible to the user;
determining that the action is not to be performed on the second entity based on the one or more first actions defined in the access policy and based on the second entity being associated with the second asset; and
determining that the action is not to be performed on the third entity based on the access policy and an association between the second asset and the third entity, and
wherein the one or more second criteria indicate that the action is not to be performed on the third entity.

### Claim 15 (depends on 13)

The system of claim 13, wherein the repository system further includes a third entity and a fourth entity, the third entity being not associated with the first asset, the fourth entity being associated with the first asset,
wherein the set of instructions which, when executed by the one or more processors, further causes the one or more processors to further perform:
obtaining an access policy that defines one or more second actions that are permitted for the first asset, the one or more second actions being part of the one or more actions that are permitted for the one or more assets accessible to the user;
determining that the action is to be performed on the first entity based on the one or more second actions defined in the access policy;
determining that the action is not to be performed on the third entity based on the one or more second actions defined in the access policy and based on the third entity being not associated with the first asset; and
determining that the action is to be performed on the fourth entity based on the one or more second actions defined in the access policy and based on the fourth entity being associated with the first asset,
and wherein the one or more second criteria indicate that the action is not to be performed on the third entity, and that the action is to be performed on the fourth entity.

### Claim 16

A non-transitory computer-readable medium storing a set of instructions that are executable by one or more processors to cause the one or more processors to:
determine one or more first criteria in a query, the one or more first criteria indicating a first entity and a second entity to which to perform an action, wherein the first entity and the second entity are included in a repository system, wherein the first entity is associated with a first asset in the repository system, wherein the second entity is associated with a second asset in the repository system, wherein each of the first entity and the second entity includes information related to at least one of a computing device or an application in a computing environment;
determine for a user associated with the query, an entitlement to access one or more assets associated with one of the first entity or the second entity;
determine one or more second criteria indicating one or more entities to which the action is not to be performed; and
based on determining that the action is included in one or more actions that are permitted for the one or more assets accessible to the user based on the determined entitlement, perform the action on at least one entity that is one of the first entity or the second entity and that is not included in the one or more entities.

### Claim 17 (depends on 16)

The non-transitory computer-readable medium of claim 16, wherein the repository system further includes a third entity, the second asset being associated with the third entity,
wherein the set of instructions are executable by the one or more processors to further cause the one or more processors to:
obtain an access policy that defines one or more first actions that are permitted for the second asset, the one or more first actions being part of the one or more actions that are permitted for the one or more assets accessible to the user;
determine that the action is not to be performed on the second entity based on the one or more first actions defined in the access policy and based on the second entity being associated with the second asset; and
determine that the action is not to be performed on the third entity based on the access policy and an association between the second asset and the third entity, and
wherein the one or more second criteria indicate that the action is not to be performed on the third entity.

### Claim 18 (depends on 16)

The non-transitory computer-readable medium of claim 16, wherein the repository system further includes a third entity and a fourth entity, the third entity being not associated with the first asset, the fourth entity being associated with the first asset,
wherein the set of instructions are executable by the one or more processors to further cause the one or more processors to:
obtain an access policy that defines one or more second actions that are permitted for the first asset, the one or more second actions being part of the one or more actions that are permitted for the one or more assets accessible to the user;
determine that the action is to be performed on the first entity based on the one or more second actions defined in the access policy;
determine that the action is not to be performed on the third entity based on the one or more second actions defined in the access policy and based on the third entity being not associated with the first asset; and
determine that the action is to be performed on the fourth entity based on the one or more second actions defined in the access policy and based on the fourth entity being associated with the first asset,
and wherein the one or more second criteria indicate that the action is not to be performed on the third entity, and that the action is to be performed on the fourth entity.

### Claim 19 (depends on 16)

The non-transitory computer-readable medium of claim 16, wherein the repository system further includes a third entity,
wherein the set of instructions are executable by the one or more processors to further cause the one or more processors to:
obtain an access policy that defines one or more third actions that are not permitted for the third entity; and
determine that the action is not to be performed on the third entity based on the one or more third actions defined in the access policy, and
wherein the one or more second criteria indicate that the action is not to be performed on the third entity.

### Claim 20 (depends on 16)

The non-transitory computer-readable medium of claim 16, wherein the entitlement is determined based on a role of the user for operating the repository system.