Granted Patent B2

US 12,483,597 · App. 18/226,887 · Granted Nov 25, 2025

Inventors: Kun Hu (Shanghai, CN); Na Zhang (Shanghai, CN); Yijin Hu (Shanghai, CN); Wenle Zhao (Shanghai, CN); You Li (Shanghai, CN); Fang Huang (Shanghai, CN); Weijun Yu (Shanghai, CN)

Assignee: SAP SE

H04L63/20H04L63/102

Abstract

Claims (61)

1 . A computer-implemented method for authorization, comprising:

parsing, by at least one processor, a policy expression into an abstract syntax tree (AST);

receiving, from a local server, user attribute data of a user;

traversing the AST to evaluate the user attribute data;

determining whether a result of the traversing is indeterminate;

sending, to a remote server, a request for additional user attribute data in response to determining that the result of the traversing is indeterminate;

receiving, from the remote server, the additional user attribute data;

re-traversing the AST to evaluate the user attribute data and the additional user attribute data;

authorizing the user based on at least one of the traversing or re-traversing; and

outputting an authorization result.

2 . The computer-implemented method of claim 1 , wherein the determining comprises:

detecting missing data in the user attribute data for making the result of the traversing definitive.

3 . The computer-implemented method of claim 2 , wherein the additional user attribute data corresponds to the missing data of the user attribute data.

4 . The computer-implemented method of claim 1 , wherein at least one of the traversing or the re-traversing comprises:

determining a value of a tree node having two child nodes based on considering one of the two child nodes;

determining whether the value of the tree node is definitive without considering an other one of the two child nodes; and

finalizing the value of the tree node after determining that the value of the tree node is definitive without considering the other one of the two child nodes.

5 . The computer-implemented method of claim 1 , wherein at least one of the user attribute data or the additional user attribute data comprises country information.

6 . The computer-implemented method of claim 1 , wherein at least one of the user attribute data or the additional user attribute data comprises location information.

7 . The computer-implemented method of claim 1 , wherein at least one of the user attribute data or the additional user attribute data comprises region information.

8 . A system for authorization, comprising:

a memory; and

at least one processor coupled to the memory and configured to:

parse a policy expression into an abstract syntax tree (AST);

receive, from a local server, user attribute data of a user;

traverse the AST to evaluate the user attribute data;

determine whether a result of the traversing is indeterminate;

send, to a remote server, a request for additional user attribute data in response to determining that the result of the traversing is indeterminate;

receive, from the remote server, the additional user attribute data;

re-traverse the AST to evaluate the user attribute data and the additional user attribute data;

authorize the user based on at least one of the traversing or re-traversing; and

output an authorization result.

9 . The system of claim 8 , wherein to determine whether the result of the traversing is indeterminate, the at least one processor is further configured to:

detect missing data in the user attribute data for making the result of the traversing definitive.

10 . The system of claim 9 , wherein the additional user attribute data corresponds to the missing data of the user attribute data.

11 . The system of claim 8 , wherein to at least traverse the AST to evaluate the user attribute data or to re-traverse the AST to evaluate the user attribute data and the additional user attribute data, the at least one processor is further configured to:

determine a value of a tree node having two child nodes based on considering one of the two child nodes;

determine whether the value of the tree node is definitive without considering an other one of the two child nodes; and

finalize the value of the tree node after determining that the value of the tree node is definitive without considering the other one of the two child nodes.

12 . The system of claim 8 , wherein at least one of the user attribute data or the additional user attribute data comprises country information.

13 . The system of claim 8 , wherein at least one of the user attribute data or the additional user attribute data comprises location information.

14 . The system of claim 8 , wherein at least one of the user attribute data or the additional user attribute data comprises region information.

15 . A non-transitory computer-readable medium having instructions stored thereon that, when executed by at least one computing device, cause the at least one computing device to perform operations comprising:

parsing a policy expression into an abstract syntax tree (AST);

receiving, from a local server, user attribute data of a user;

traversing the AST to evaluate the user attribute data;

determining whether a result of the traversing is indeterminate;

sending, to a remote server, a request for additional user attribute data in response to determining that the result of the traversing is indeterminate;

receiving, from the remote server, the additional user attribute data;

re-traversing the AST to evaluate the user attribute data and the additional user attribute data;

authorizing the user based on at least one of the traversing or re-traversing; and

outputting an authorization result.

16 . The non-transitory computer-readable medium of claim 15 , wherein the determining comprises:

detecting missing data in the user attribute data for making the result of the traversing definitive.

17 . The non-transitory computer-readable medium of claim 16 , wherein the additional user attribute data corresponds to the missing data of the user attribute data.

18 . The non-transitory computer-readable medium of claim 15 , wherein at least one of the traversing or the re-traversing comprises:

determining a value of a tree node having two child nodes based on considering one of the two child nodes;

determining whether the value of the tree node is definitive without considering an other one of the two child nodes; and

finalizing the value of the tree node after determining that the value of the tree node is definitive without considering the other one of the two child nodes.

19 . The non-transitory computer-readable medium of claim 15 , wherein at least one of the user attribute data or the additional user attribute data comprises country information.

20 . The non-transitory computer-readable medium of claim 15 , wherein at least one of the user attribute data or the additional user attribute data comprises location information.

Assignments (1)

Continuity (1)

References Cited (11)