Enhanced permissions management

Abstract

Systems and methods are described for authorizing access to resources to entities by representing objects in a graph database. Entities and resources are represented by nodes in the graph, and permissions by edges connecting the nodes. Nodes may be grouped into groupings, the inclusion of a node in a group being represented by an edge. The graph comprises one or more bipartite graphs, such that nodes of one set do not have edges connecting nodes in the set. Navigation of the graph is performed to determine permissions for the entity to access the resources, such as by utilizing edges and inverse edges in the graph to walk a path to the center of the graph, the edges being associated with the permission required to perform the access.

What is claimed is: 
     
         1 . A computer-implemented method, comprising:
 associating a first party with a first node stored in a graph database, the graph database comprising a plurality of nodes and a plurality of edges connecting the nodes, wherein the plurality of nodes comprise at least a first node type and a second node type and no edge of the plurality of edges connects nodes of the same type;   associating a first resource with a second node;   receiving a request, from the first party, for access to the first resource;   determining a first permission type, of a plurality of permission types, corresponding to the request;   determining one or more edges stored in the graph database, each of the one or more edges associated with one of the plurality of permission types;   determining a path connecting the first node and the second node, the path based at least on one or more edges, and the path including a first segment starting at the first node and a second segment starting at the second node, the first segment moving inward from the first node toward an inner portion of the graph database, and the second segment, substantially in parallel, moving inward from the second node toward the inner portion of the graph database, a path of travel from the first node being substantially opposite a path of travel of the second node;   determining starting points and end points of the respective segments forming the path, wherein segment access permissions of the respective segments are directional, and one or more of the respective node types restrict a permission direction;   determining that at least one edge associated with the path is associated with the first permission type;   determining that the request is allowed; and   providing access to the first resource.   
     
     
         2 . The computer-implemented method of  claim 1 , wherein determining a path connecting the first node and the second node further comprises:
 determining that the first node is connected by an edge to a first group node;   determining that the second node is connected by an edge to a second group node; wherein the first node and the second node are of the first node type and the first group node and the second group node are of the second node type; and   determining that an edge connects the first group node and the second group node, wherein the edge is associated with the first permission type.   
     
     
         3 . The computer-implemented method of  claim 2 , wherein the first node and the first group node comprise a first bipartite graph, the second node and the second group node comprise a second bipartite graph, and the first group node and the second group node comprise a third bipartite graph. 
     
     
         4 . The computer-implemented method of  claim 1 , wherein determining that at least one edge associated with the path is associated with the first permission type further comprises:
 determining an identifier associated with the first permission type; and   determining that the identifier matches an identifier associated with one of the at least one edge associated with the path.   
     
     
         5 . The computer-implemented method of  claim 1 , wherein nodes of the first node type are associated with one of an advertiser, a person, an advertising segment, an item identifier, or a browse node. 
     
     
         6 . The computer-implemented method of  claim 1 , wherein each connection between a pair of nodes on the plurality of nodes comprises a directed edge and an inverse directed edge. 
     
     
         7 . The computer-implemented method of  claim 1 , wherein the graph database comprises a directed acyclic graph and each edge of the plurality of edges comprises a directed edge. 
     
     
         8 . The computer-implemented method of  claim 1 , wherein the request for access is an application programming interface (API) request received by a web service from the first party over a network to access the first resource. 
     
     
         9 . A computing system, comprising:
 at least one processor; and   memory including instructions that, when executed by the at least one processor, cause the computing system to:
 associate a first party with a first node stored in a graph database, the graph database comprising a plurality of nodes and a plurality of edges connecting the nodes, wherein the plurality of nodes comprise at least a first node type and a second node type and no edge of the plurality of edges connects nodes of the same type; 
 associate a first resource with a second node; 
 receive a request, from the first party, for access to the first resource; 
 determine a first permission type, of a plurality of permission types, corresponding to the request; 
 determine one or more edges stored in the graph database, each of the one or more edges associated with one of the plurality of permission types; 
 determine a path connecting the first node and the second node, the path based at least on one or more edges, and the path including a first segment starting at the first node and a second segment starting at the second node, the first segment moving inward from the first node toward an inner portion of the graph database, and the second segment, substantially in parallel, moving inward from the second node toward the inner portion of the graph database, a path of travel from the first node being substantially opposite a path of travel of the second node; 
 determine starting points and end points of the respective segments forming the path, wherein segment access permissions of the respective segments are directional, and one or more of the respective node types restrict a permission direction; 
 determine that at least one edge associated with the path is associated with the first permission type; 
 determine that the request is allowed; and 
 provide access to the first resource. 
   
     
     
         10 . The computing system of  claim 9 , wherein the instructions when executed further cause the computing system to:
 determine that the first node is connected by an edge to a first group node;   determine that the second node is connected by an edge to a second group node; wherein the first node and the second node are of the first node type and the first group node and the second group node are of the second node type; and   determine that an edge connects the first group node and the second group node, wherein the edge is associated with the first permission type.   
     
     
         11 . The computing system of  claim 10 , wherein the first node and the first group node comprise a first bipartite graph, the second node and the second group node comprise a second bipartite graph, and the first group node and the second group node comprise a third bipartite graph. 
     
     
         12 . The computing system of  claim 9 , wherein the instructions when executed further cause the computing system to:
 determining an identifier associated with the first permission type; and   determining that the identifier matches an identifier associated with one of the at least one edge associated with the path.   
     
     
         13 . The computing system of  claim 9 , wherein nodes of the first node type are associated with one of an advertiser, a person, an advertising segment, an item identifier, or a browse node. 
     
     
         14 . The computing system of  claim 9 , wherein each connection between a pair of nodes on the plurality of nodes comprises a directed edge and an inverse directed edge. 
     
     
         15 . The computing system of  claim 9 , wherein the graph database comprises a directed acyclic graph and each edge of the plurality of edges comprises a directed edge. 
     
     
         16 . The computing system of  claim 9 , wherein the request for access is an application programming interface (API) request received by a web service from the first party over a network to access the first resource. 
     
     
         17 . A non-transitory computer-readable storage medium including instructions that, when executed by at least one processor of a computing device, cause the computing device to:
 associate a first party with a first node stored in a graph database, the graph database comprising a plurality of nodes and a plurality of edges connecting the nodes, wherein the plurality of nodes comprise at least a first node type and a second node type and no edge of the plurality of edges connects nodes of the same type;   associate a first resource with a second node;   receive a request, from the first party, for access to the first resource;   determine a first permission type, of a plurality of permission types, corresponding to the request;   determine one or more edges stored in the graph database, each of the one or more edges associated with one of the plurality of permission types;   determine a path connecting the first node and the second node, the path based at least on one or more edges, and the path including a first segment starting at the first node and a second segment starting at the second node, the first segment moving inward from the first node toward an inner portion of the graph database, and the second segment, substantially in parallel, moving inward from the second node toward the inner portion of the graph database, a path of travel from the first node being substantially opposite a path of travel of the second node;   determine starting points and end points of the respective segments forming the path, wherein segment access permissions of the respective segments are directional, and one or more of the respective node types restrict a permission direction;   determine that at least one edge associated with the path is associated with the first permission type;   determine that the request is allowed; and   provide access to the first resource.   
     
     
         18 . The non-transitory computer-readable storage medium of  claim 17 , wherein the instructions when executed further cause the computing device to:
 determine that the first node is connected by an edge to a first group node;   determine that the second node is connected by an edge to a second group node; wherein the first node and the second node are of the first node type and the first group node and the second group node are of the second node type; and   determine that an edge connects the first group node and the second group node, wherein the edge is associated with the first permission type.   
     
     
         19 . The non-transitory computer-readable storage medium of  claim 17 , wherein the instructions when executed further cause the computing device to:
 determining an identifier associated with the first permission type; and   determining that the identifier matches an identifier associated with one of the at least one edge associated with the path.   
     
     
         20 . The non-transitory computer-readable storage medium of  claim 17 , wherein nodes of the first node type are associated with one of an advertiser, a person, an advertising segment, an item identifier, or a browse node.