Back to results
US 2020/0051127 A1Published application
Enhanced permissions management
AssigneeAmazon Technologies, Inc.
InventorsAlbert Cooper Johnson, Taylor James White
Life of this patent
Estimating the term…
Abstract
Systems and methods are described for authorizing access to resources to entities by representing objects in a graph database. Entities and resources are represented by nodes in the graph, and permissions by edges connecting the nodes. Nodes may be grouped into groupings, the inclusion of a node in a group being represented by an edge. The graph comprises one or more bipartite graphs, such that nodes of one set do not have edges connecting nodes in the set. Navigation of the graph is performed to determine permissions for the entity to access the resources, such as by utilizing edges and inverse edges in the graph to walk a path to the center of the graph, the edges being associated with the permission required to perform the access.
Claims20
A computer-implemented method, comprising:
- associating a first party with a first node stored in a graph database, the graph database comprising a plurality of nodes and a plurality of edges connecting the nodes, wherein the plurality of nodes comprise at least a first node type and a second node type and no edge of the plurality of edges connects nodes of the same type;
- associating a first resource with a second node;
- receiving a request, from the first party, for access to the first resource;
- determining a first permission type, of a plurality of permission types, corresponding to the request;
- determining one or more edges stored in the graph database, each of the one or more edges associated with one of the plurality of permission types;
- determining a path connecting the first node and the second node, the path based at least on one or more edges, and the path including a first segment starting at the first node and a second segment starting at the second node, the first segment moving inward from the first node toward an inner portion of the graph database, and the second segment, substantially in parallel, moving inward from the second node toward the inner portion of the graph database, a path of travel from the first node being substantially opposite a path of travel of the second node;
- determining starting points and end points of the respective segments forming the path, wherein segment access permissions of the respective segments are directional, and one or more of the respective node types restrict a permission direction;
- determining that at least one edge associated with the path is associated with the first permission type;
- determining that the request is allowed;
- and
- providing access to the first resource.
8 more elements
A computing system, comprising:
- at least one processor;
- and
- memory including instructions that, when executed by the at least one processor, cause the computing system to:
- associate a first party with a first node stored in a graph database, the graph database comprising a plurality of nodes and a plurality of edges connecting the nodes, wherein the plurality of nodes comprise at least a first node type and a second node type and no edge of the plurality of edges connects nodes of the same type;
- associate a first resource with a second node;
- receive a request, from the first party, for access to the first resource;
- determine a first permission type, of a plurality of permission types, corresponding to the request;
- determine one or more edges stored in the graph database, each of the one or more edges associated with one of the plurality of permission types;
- determine a path connecting the first node and the second node, the path based at least on one or more edges, and the path including a first segment starting at the first node and a second segment starting at the second node, the first segment moving inward from the first node toward an inner portion of the graph database, and the second segment, substantially in parallel, moving inward from the second node toward the inner portion of the graph database, a path of travel from the first node being substantially opposite a path of travel of the second node;
- determine starting points and end points of the respective segments forming the path, wherein segment access permissions of the respective segments are directional, and one or more of the respective node types restrict a permission direction;
- determine that at least one edge associated with the path is associated with the first permission type;
- determine that the request is allowed;
- and
- provide access to the first resource.
11 more elements
A non-transitory computer-readable storage medium including instructions that, when executed by at least one processor of a computing device, cause the computing device to:
- associate a first party with a first node stored in a graph database, the graph database comprising a plurality of nodes and a plurality of edges connecting the nodes, wherein the plurality of nodes comprise at least a first node type and a second node type and no edge of the plurality of edges connects nodes of the same type;
- associate a first resource with a second node;
- receive a request, from the first party, for access to the first resource;
- determine a first permission type, of a plurality of permission types, corresponding to the request;
- determine one or more edges stored in the graph database, each of the one or more edges associated with one of the plurality of permission types;
- determine a path connecting the first node and the second node, the path based at least on one or more edges, and the path including a first segment starting at the first node and a second segment starting at the second node, the first segment moving inward from the first node toward an inner portion of the graph database, and the second segment, substantially in parallel, moving inward from the second node toward the inner portion of the graph database, a path of travel from the first node being substantially opposite a path of travel of the second node;
- determine starting points and end points of the respective segments forming the path, wherein segment access permissions of the respective segments are directional, and one or more of the respective node types restrict a permission direction;
- determine that at least one edge associated with the path is associated with the first permission type;
- determine that the request is allowed;
- and
- provide access to the first resource.
8 more elements
Dependencies are inferred from the claim text.