# US 7,613,794 B2 · Identifying dynamic groups

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 7,613,794 B2
- Document ID: US7613794B2
- Status: Granted
- Kind: B2
- Application number: 11/684,796
- Filed: 2007-03-12
- Published: 2007-07-19
- Granted: 2009-11-03
- Earliest claimed: 2002-07-11
- Assignees: Oracle International Corporation
- Inventors: Shawn P. Delaney; Robert Summers
- Web page: https://patentgrep.com/patent/US7613794B2

## CPC

- G06F 21/31: User authentication
- G06F 21/62: Protecting access to data via a platform, e.g. using keys or access control rules
- Y10S 707/99933: Query processing, i.e. searching
- Y10S 707/99939: Privileged access
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)
- Y10S: TECHNICAL SUBJECTS COVERED BY FORMER USPC CROSS-REFERENCE ART COLLECTIONS [XRACs] AND DIGESTS

## Abstract

Technology is disclosed for identifying dynamic groups that correspond to a user of a system. A system partitions a set of dynamic groups into multiple test sets of dynamic groups. The system selects a test set and determines whether the user corresponds to the test set. In one implementation, the system combines the filters for the dynamic groups in each test set into a single test set filter. The test set filter is satisfied if the filter of any dynamic group in the test set is satisfied. This allows the system to perform a single comparison between the resulting test set filter and the user's profile to determine whether the user is a member of any dynamic group in the test set. If the user is not a member of any dynamic group in the test set, the system eliminates all of the test set's dynamic groups from consideration, based on the single comparison. Otherwise, the dynamic groups in the test set remain in a list of groups that may include the user. This process is repeated for each test set. After each test set has been evaluated, new test sets are repeatedly generated and evaluated in the above-described fashion using the dynamic groups that are still in consideration. In each iteration, each test set contains fewer dynamic groups. This continues until each test set only contains one dynamic group. After performing an iteration with each test set containing one dynamic group, the only remaining dynamic groups are the ones that include the user as a member.

## Claims

### Claim 1

A method of identifying dynamic groups corresponding to a user, the method comprising:
based on a rule that defines dynamic membership, partitioning, by a computer system, a set of dynamic groups including dynamic members, into multiple test sets, wherein each test set in said multiple test sets includes at least one dynamic group from said set of dynamic groups and wherein said set of dynamic groups are configured to have the potential for said user to be a member, wherein said rule is stored in a dynamic rule attribute of an identity profile of said at least one dynamic group, and wherein said at least one dynamic group includes one or more static members and an identification of each of said static members is stored in a static member attribute for said identity profile of said at least one dynamic group;
selecting, by the computer system, a test set from the multiple test sets;
storing an identification of each of said dynamic members of said at least one dynamic group, wherein said identification of each of said dynamic members is stored in said static member attribute for said identity profile of said at least one dynamic group;
determining, by the computer system, whether said identity profile corresponds to the selected test set in said multiple test sets, wherein said test set includes multiple dynamic groups from said set of dynamic groups, wherein the determination of correspondence includes determining if said static member attributes within said identity profile meet the selected test set's filter requirements; and
removing, by the computer system, the selected test set from the multiple test sets in response to the said static member attributes within said identity profile not meeting the selected test set's filter requirements.

### Claim 2 (depends on 1)

A method according to claim 1, wherein determining whether said user corresponds to a test set in said multiple test sets comprises:
setting matching criteria for said test set; and
determining whether said user satisfies said matching criteria.

### Claim 3 (depends on 2)

A method according to claim 2, wherein each dynamic group in said test set corresponds to at least a portion of said matching criteria.

### Claim 4 (depends on 2)

A method according to claim 2, wherein said matching criteria includes a logical OR of at least one filter from each dynamic group in said test set.

### Claim 5 (depends on 2)

A method according to claim 2, wherein said matching criteria is satisfied if a filter for any dynamic group in said test set is satisfied.

### Claim 6 (depends on 2)

A method according to claim 2, wherein:
said matching criteria is a rule including a filter component, and
said filter component is satisfied if any filter from a dynamic group in said test set is satisfied.

### Claim 7 (depends on 6)

A method according to claim 6, wherein said filter component is a logical OR of a filter from each dynamic group in said test set.

### Claim 8 (depends on 6)

A method according to claim 6, wherein:
said filter component is a logical OR of a filter defining each dynamic group in said test set.

### Claim 9 (depends on 6)

A method according to claim 6, wherein:
said rule includes a searchbase component, and
said searchbase component corresponds to a subtree containing said user.

### Claim 10 (depends on 6)

A method according to claim 6, wherein:
said rule includes a searchbase component, and
said searchbase component corresponds to said user.

### Claim 11 (depends on 10)

A method according to claim 10, wherein said user is represented by a user profile in a directory.

### Claim 12 (depends on 11)

A method according to claim 11, wherein said determining whether said user satisfies said matching criteria comprises:
searching said directory using said rule.

### Claim 13 (depends on 12)

A method according to claim 12, wherein said directory is searched using a LDAP search.

### Claim 14 (depends on 11)

A method according to claim 11, wherein said directory employs LDAP.

### Claim 15 (depends on 14)

A method according to claim 14, wherein:
said rule includes a scope component; and
said scope component corresponds to a base object scope.

### Claim 16 (depends on 15)

A method according to claim 15, wherein said determining whether said user satisfies said matching criteria comprises:
searching said directory using said rule.

### Claim 17 (depends on 11)

A method according to claim 11, wherein said directory is in communication with an Identity System.

### Claim 18 (depends on 1)

A method according to claim 1, further comprising:
eliminating all dynamic groups in said test set from said set of dynamic groups, if it is determined that said user does not correspond to said test set.

### Claim 19 (depends on 18)

A method according to claim 18, wherein said determining whether said user corresponds to a test set in said multiple test sets and said eliminating all dynamic groups in said test set from said set of dynamic groups are performed for each test set in said multiple test sets.

### Claim 20 (depends on 1)

A method according to claim 1, further comprising:
removing from said test set all dynamic groups in said test set that do not correspond to said user, if it is determined that said user does correspond to said test set.

### Claim 21 (depends on 20)

A method according to claim 20, wherein said removing from said test set all dynamic groups in said test set that do not correspond to said user comprises:
removing from said set of dynamic groups said all dynamic groups in said test set that do not correspond to said user.

### Claim 22 (depends on 20)

A method according to claim 20, further comprising:
eliminating all dynamic groups in said test set from said set of dynamic groups, if it is determined that said user does not correspond to said test set.

### Claim 23 (depends on 22)

A method according to claim 22, wherein said determining whether said user corresponds to a test set in said multiple test sets, said removing from said set of dynamic groups all dynamic groups in said test set that do not correspond to said user, and said eliminating all dynamic groups in said test set from said set of dynamic groups, are performed for each test set in said multiple test sets.

### Claim 24 (depends on 1)

A method according to claim 1, wherein said determining whether said user corresponds to a test set in said multiple test sets comprises:
determining that all dynamic groups in said test set do not correspond to said user, based on a single directory search.

### Claim 25 (depends on 1)

A method according to claim 1, wherein:
said method is performed as part of an Identity System.

### Claim 26 (depends on 1)

A method according to claim 1, wherein:
said method is performed as part of an Access System.

### Claim 27 (depends on 1)

A method according to claim 1, wherein:
said method is performed as part of an integrated Access System and Identity System.

### Claim 28 (depends on 1)

A method according to claim 1, wherein determining whether said user corresponds to a test set in said multiple test sets is performed without accessing a directory server.

### Claim 29 (depends on 28)

A method according to claim 28, wherein said determining whether said user corresponds to a test set in said multiple test sets is performed using a filter tester.

### Claim 30 (depends on 1)

A method according to claim 1, wherein determining whether said user corresponds to a test set in said multiple test sets is performed using an SQL command.

### Claim 31

One or more processor readable storage devices having processor readable code embodied on said one or more processor readable storage devices, said processor readable code for programming one or more processors and comprising:
code for based on a rule that defines dynamic membership, partitioning, by a computer system, a set of dynamic groups including dynamic members, into multiple test sets, wherein each test set in said multiple test sets includes at least one dynamic group from said set of dynamic groups and wherein said set of dynamic groups are configured to have the potential for said user to be a member, wherein said rule is stored in a dynamic rule attribute of an identity profile of said at least one dynamic group, and wherein said at least one dynamic group includes one or more static members and an identification of each of said static members is stored in a static member attribute for said identity profile of said at least one dynamic group;
code for selecting, by the computer system, a test set from the multiple test sets;
code for storing an identification of each of said dynamic members of said at least one dynamic group, wherein said identification of each of said dynamic members is stored in said static member attribute for said identity profile of said at least one dynamic group;
code for determining, by the computer system, whether said identity profile corresponds to the selected test set in said multiple test sets, wherein said test set includes multiple dynamic groups from said set of dynamic groups, wherein the determination of correspondence includes determining if said static member attributes within said identity profile meet the selected test set's filter requirements; and
code for removing, by the computer system, the selected test set from the multiple test sets in response to the said static member attributes within said identity profile not meeting the selected test set's filter requirements.

### Claim 32 (depends on 31)

One or more processor readable storage devices according to claim 31, wherein said code for determining whether a user corresponds to a test set in said multiple test sets comprises:
code for setting matching criteria for said test set; and
code for determining whether said user satisfies said matching criteria.

### Claim 33 (depends on 32)

One or more processor readable storage devices according to claim 32, wherein:
said matching criteria is a rule including a filter component, and
said filter component is satisfied if a filter for any dynamic group in said test set is satisfied.

### Claim 34 (depends on 33)

One or more processor readable storage devices according to claim 33, wherein:
said rule includes a searchbase component, and
said searchbase component corresponds to said user.

### Claim 35 (depends on 34)

One or more processor readable storage devices according to claim 34, wherein said user is represented by a user profile in a directory.

### Claim 36 (depends on 35)

One or more processor readable storage devices according to claim 35, wherein said code for determining whether said user satisfies said matching criteria comprises:
code for searching said directory using said rule.

### Claim 37 (depends on 36)

One or more processor readable storage devices according to claim 36, wherein said code for searching said directory using said rule comprises code for searching using a LDAP search.

### Claim 38 (depends on 35)

One or more processor readable storage devices according to claim 35, wherein:
said rule includes a scope component, and
said scope component corresponds to a base object scope.

### Claim 39 (depends on 38)

One or more processor readable storage devices according to claim 38, wherein said code for determining whether said user satisfies said matching criteria comprises:
code for searching said directory using said rule.

### Claim 40 (depends on 31)

One or more processor readable storage devices according to claim 31, wherein said processor readable code further comprises:
code for eliminating all dynamic groups in said test set from said set of dynamic groups, if it is determined that said user does not correspond to said test set.

### Claim 41 (depends on 40)

One or more processor readable storage devices according to claim 40, wherein said processor readable code comprises, for each test set in said multiple test sets, code for determining whether said user corresponds to a test set in said multiple test sets and code for eliminating all dynamic groups in said test set from said set of dynamic groups.

### Claim 42 (depends on 31)

One or more processor readable storage devices according to claim 31, wherein said processor readable code further comprises:
code for removing from said test set all dynamic groups in said test set that do not correspond to said user, if it is determined that said user does correspond to said test set.

### Claim 43 (depends on 42)

One or more processor readable storage devices according to claim 42, wherein said code for removing from said test set all dynamic groups in said test set that do not correspond to said user comprises:
code for removing from said set of dynamic groups said all dynamic groups in said test set that do not correspond to said user.

### Claim 44 (depends on 31)

One or more processor readable storage devices according to claim 31, wherein said code for determining whether a user corresponds to a test set in said multiple test sets comprises:
code for determining that all dynamic groups in said test set do not correspond to said user, based on a single directory search.

### Claim 45 (depends on 31)

One or more processor readable storage devices according to claim 31, wherein:
said processor readable code is executable by an Identity System.

### Claim 46 (depends on 31)

One or more processor readable storage devices according to claim 31, wherein:
said processor readable code is executable by an Access System.

### Claim 47 (depends on 31)

One or more processor readable storage devices according to claim 31, wherein:
said processor readable code is executable by an integrated Access System and Identity System.

### Claim 48

An apparatus, comprising:
one or more storage devices; and
one or more processors in communication with said one or more storage devices, said one or more storage devices comprising processor readable code for programming said one or more processors, said processor readable code comprising:
code for based on a rule that defines dynamic membership, partitioning, by a computer system, a set of dynamic groups including dynamic members, into multiple test sets, wherein each test set in said multiple test sets includes at least one dynamic group from said set of dynamic groups and wherein said set of dynamic groups are configured to have the potential for said user to be a member, wherein said rule is stored in a dynamic rule attribute of an identity profile of said at least one dynamic group, and wherein said at least one dynamic group includes one or more static members and an identification of each of said static members is stored in a static member attribute for said identity profile of said at least one dynamic group;
code for selecting, by the computer system, a test set from the multiple test sets;
code for storing an identification of each of said dynamic members of said at least one dynamic group, wherein said identification of each of said dynamic members is stored in said static member attribute for said identity profile of said at least one dynamic group;
code for determining, by the computer system, whether said identity profile corresponds to the selected test set in said multiple test sets, wherein said test set includes multiple dynamic groups from said set of dynamic groups, wherein the determination of correspondence includes determining if said static member attributes within said identity profile meet the selected test set's filter requirements; and
code for removing, by the computer system, the selected test set from the multiple test sets in response to the said static member attributes within said identity profile not meeting the selected test set's filter requirements.

### Claim 49 (depends on 48)

An apparatus according to claim 48, wherein said code for determining whether a user corresponds to a test set in said multiple test sets comprises:
code for setting matching criteria for said test set; and
code for determining whether said user satisfies said matching criteria.

### Claim 50 (depends on 49)

An apparatus according to claim 49, wherein:
said matching criteria is a rule including a filter component, and
said filter component is satisfied if a filter for any dynamic group in said test set is satisfied.

### Claim 51 (depends on 50)

An apparatus according to claim 50, wherein:
said rule includes a searchbase component, and
said searchbase component corresponds to said user.

### Claim 52 (depends on 51)

An apparatus according to claim 51, wherein said user is represented by a user profile in a directory.

### Claim 53 (depends on 52)

An apparatus according to claim 52, wherein said code for determining whether said user satisfies said matching criteria comprises:
code for searching said directory using said rule.

### Claim 54 (depends on 52)

An apparatus according to claim 52, wherein:
said rule includes a scope component; and
said scope component corresponds to a base object scope.

### Claim 55 (depends on 54)

An apparatus according to claim 54, wherein said code for determining whether said user satisfies said matching criteria comprises:
code for searching said directory using said rule.

### Claim 56 (depends on 48)

An apparatus according to claim 48, wherein said processor readable code further comprises:
code for eliminating all dynamic groups in said test set from said set of dynamic groups, if it is determined that said user does not correspond to said test set.

### Claim 57 (depends on 48)

An apparatus according to claim 48, wherein said processor readable code further comprises:
code for removing from said test set all dynamic groups in said test set that do not correspond to said user, if it is determined that said user does correspond to said test set; and
code for eliminating all dynamic groups in said test set from said set of dynamic groups, if it is determined that said user does not correspond to said test set.

### Claim 58 (depends on 48)

An apparatus according to claim 48, wherein said code for determining whether a user corresponds to a test set in said multiple test sets comprises:
code for determining that all dynamic groups in said test set do not correspond to said user, based on a single directory search.

### Claim 59 (depends on 48)

An apparatus according to claim 48, wherein:
said processor readable code is executable by an Identity System.

### Claim 60 (depends on 48)

An apparatus according to claim 48, wherein:
said processor readable code is executable by an Access System.

### Claim 61

A method of identifying dynamic profiles corresponding to an entity, the method comprising:
based on a rule that defines dynamic membership, partitioning, by a computer system, a set of dynamic groups including dynamic members, into multiple test sets, wherein each test set in said multiple test sets includes at least one dynamic group from said set of dynamic groups and wherein said set of dynamic groups are configured to have the potential for said entity to be a member, wherein said rule is stored in a dynamic rule attribute of an identity profile of said at least one dynamic group, and wherein said at least one dynamic group includes one or more static members and an identification of each of said static members is stored in a static member attribute for said identity profile of said at least one dynamic group;
selecting, by the computer system, a test set from the multiple test sets;
storing an identification of each of said dynamic members of said at least one dynamic group, wherein said identification of each of said dynamic members is stored in said static member attribute for said identity profile of said at least one dynamic group;
determining, by the computer system, whether said identity profile corresponds to the selected test set in said multiple test sets, wherein said test set includes multiple dynamic groups from said set of dynamic groups, wherein the determination of correspondence includes determining if said static member attributes within said identity profile meet the selected test set's filter requirements; and
removing, by the computer system, the selected test set from the multiple test sets in response to the said static member attributes within said identity profile not meeting the selected test set's filter requirements.

### Claim 62 (depends on 61)

A method according to claim 61, wherein said determining whether said entity corresponds to a test set in said multiple test sets comprises:
setting matching criteria for said test set; and
determining whether said entity satisfies said matching criteria.

### Claim 63 (depends on 62)

A method according to claim 62, wherein said matching criteria is satisfied if a filter for any dynamic profile in said test set is satisfied.

### Claim 64 (depends on 62)

A method according to claim 62, wherein:
said matching criteria is a rule including a filter component, and
said filter component is satisfied if any filter from a dynamic group in said test set is satisfied.

### Claim 65 (depends on 64)

A method according to claim 64, wherein:
said rule includes a searchbase component;
said searchbase component corresponds to said entity;
said rule includes a scope component; and
said scope component corresponds to a base object scope.

### Claim 66 (depends on 65)

A method according to claim 65, wherein said entity is represented by a profile in a directory, wherein said determining whether said entity satisfies said matching criteria comprises:
code for searching said directory using said rule.

### Claim 67 (depends on 61)

A method according to claim 61, wherein said entity is represented by a user profile and said set of dynamic profiles includes dynamic group profiles.

### Claim 68 (depends on 61)

A method according to claim 61, further comprising:
eliminating all dynamic profiles in said test set from said set of dynamic profiles, if it is determined that said entity does not correspond to said test set.

### Claim 69 (depends on 61)

A method according to claim 61, wherein said determining whether said entity corresponds to a test set in said multiple test sets comprises:
determining that all dynamic profiles in said test set do not correspond to said entity, based on a single directory search.

### Claim 70

One or more processor readable storage devices having processor readable code embodied on said one or more processor readable storage devices, said processor readable code for programming one or more processors and comprising:
code for based on a rule that defines dynamic membership, partitioning, by a computer system, a set of dynamic groups including dynamic members, into multiple test sets, wherein each test set in said multiple test sets includes at least one dynamic group from said set of dynamic groups and wherein said set of dynamic groups are configured to have the potential for said entity to be a member, wherein said rule is stored in a dynamic rule attribute of an identity profile of said at least one dynamic group, and wherein said at least one dynamic group includes one or more static members and an identification of each of said static members is stored in a static member attribute for said identity profile of said at least one dynamic group;
code for selecting, by the computer system, a test set from the multiple test sets;
code for storing an identification of each of said dynamic members of said at least one dynamic group, wherein said identification of each of said dynamic members is stored in said static member attribute for said identity profile of said at least one dynamic group;
code for determining, by the computer system, whether said identity profile corresponds to the selected test set in said multiple test sets, wherein said test set includes multiple dynamic groups from said set of dynamic groups, wherein the determination of correspondence includes determining if said static member attributes within said identity profile meet the selected test set's filter requirements; and
code for removing, by the computer system, the selected test set from the multiple test sets in response to the said static member attributes within said identity profile not meeting the selected test set's filter requirements.

### Claim 71 (depends on 70)

One or more processor readable storage devices according to claim 70, wherein said code for determining whether said entity corresponds to a test set in said multiple test sets comprises:
code for setting matching criteria for said test set; and
code for determining whether said entity satisfies said matching criteria, wherein said matching criteria is satisfied if a filter for any dynamic profile in said test set is satisfied.

### Claim 72 (depends on 71)

One or more processor readable storage devices according to claim 71, wherein:
said matching criteria is a rule;
said rule includes a filter component;
said filter component is satisfied if a filter for any dynamic profile in said test set is satisfied;
said rule includes a searchbase component;
said searchbase component corresponds to said entity;
said rule includes a scope component; and
said scope component corresponds to a base object scope.

### Claim 73 (depends on 72)

One or more processor readable storage devices according to claim 72, wherein said entity is represented by a profile in a directory, wherein said code for determining whether said entity satisfies said matching criteria comprises:
code for searching said directory using said rule.

### Claim 74 (depends on 70)

One or more processor readable storage devices according to claim 70, wherein said processor readable code further comprises:
code for eliminating all dynamic profiles in said test set from said set of dynamic profiles, if it is determined that said entity does not correspond to said test set.

### Claim 75 (depends on 70)

One or more processor readable storage devices according to claim 70, wherein said code for determining whether said entity corresponds to a test set in said multiple test sets comprises:
code for determining that all dynamic profiles in said test set do not correspond to said entity, based on a single directory search.

### Claim 76

An apparatus, comprising:
one or more storage devices; and
one or more processors in communication with said one or more storage devices, said one or more storage devices comprising processor readable code for programming said one or more processors, said processor readable code comprising:
code for based on a rule that defines dynamic membership, partitioning, by a computer system, a set of dynamic groups including dynamic members, into multiple test sets, wherein each test set in said multiple test sets includes at least one dynamic group from said set of dynamic groups and wherein said set of dynamic groups are configured to have the potential for said entity to be a member, wherein said rule is stored in a dynamic rule attribute of an identity profile of said at least one dynamic group, and wherein said at least one dynamic group includes one or more static members and an identification of each of said static members is stored in a static member attribute for said identity profile of said at least one dynamic group;
code for selecting, by the computer system, a test set from the multiple test sets;
code for storing an identification of each of said dynamic members of said at least one dynamic group, wherein said identification of each of said dynamic members is stored in said static member attribute for said identity profile of said at least one dynamic group;
code for determining, by the computer system, whether said identity profile entity corresponds to the selected test set in said multiple test sets, wherein said test set includes multiple dynamic groups from said set of dynamic groups, wherein the determination of correspondence includes determining if said static member attributes within said identity profile meet the selected test set's filter requirements; and
code for removing, by the computer system, the selected test set from the multiple test sets in response to the said static member attributes within said identity profile not meeting the selected test set's filter requirements.