Systems and methods for producing, displaying, and interacting with collaborative environments using classification-based access control

Patent metadata

Field	Value
Publication number	US-10528764-B2
Application number	US-201816183267-A
Country	US
Kind code	B2
Filing date	Nov 7, 2018
Priority date	May 30, 2017
Publication date	Jan 7, 2020
Grant date	Jan 7, 2020

Abstract

Systems and methods are provided for sharing maps in a collaborative environment using classification-based access control. The generation of and dissemination of maps and/or data within such maps can be governed by classification-based access control, where a user's classification level can determine whether or not maps and/or data within those maps can be seen. In scenarios whether a plurality of users wishes to collaborate on the same map, the systems and methods provided herein generate multiple versions or views of the same map in accordance with different classification levels. In this way, users with different classification levels can nevertheless see the same map and engage in collaborations regarding the same map, while maintaining control of sensitive data.

First claim

The invention claimed is:

1. A system for generating a classification-based dissemination control environment comprising:
one or more processors; and
a non-transitory memory storing instructions that, when executed by the one or more processors, cause the system to:
generate a plurality of dissemination views corresponding to a map, wherein each dissemination view includes one or more objects, and wherein each dissemination view is associated with at least one of one or more classification levels and one or more access control groups;
provide a first dissemination view corresponding to a map for presentation to a first user, and simultaneously provide a second dissemination view for presentation to a second user for a collaborative presentation;
receive one or more search terms from the first user, the first user being associated with the at least one of the one or more classification levels and the one or more access control groups that is higher than the at least one of the one or more classification levels and the one or more access control groups with which the second user is associated; and
conduct a search within the map based on the one or more search terms, the collaborative presentation reflecting search results of the search regarding a subset of objects of the one or more objects common to the first and second users in addition to collaborative operations of the first and second users regarding the subset of objects comprising input from at least one of the first and second users affecting data presented as the subset of objects.

2. A system for generating a classification-based dissemination control environment comprising:
one or more processors; and
a non-transitory memory storing instructions that, when executed by the one or more processors, cause the system to:
generate a plurality of dissemination views corresponding to a map, wherein each dissemination view includes one or more objects, and wherein each dissemination view is associated with at least one of one or more classification levels and one or more access control groups;
provide a first dissemination view corresponding to a map for presentation to a first user, and simultaneously provide a second dissemination view for presentation to a second user for a collaborative presentation;
receive one or more search terms from the first user, the first user being associated with the at least one of the one or more classification levels and the one or more access control groups that is higher than the at least one of the one or more classification levels and the one or more access control groups with which the second user is associated; and
conduct a search within the map based on the one or more search terms, the collaborative presentation reflecting search results of the search regarding a subset of objects of the one or more objects common to the first and second users, wherein the instructions that, when executed by the one or more processors, cause the system to conduct the search, further cause the system to:
classify at least one of the one or more search terms, the search results, and search-related metadata in accordance with the at least one of the one or more classification levels and the one or more access control groups associated with the first user and the at least one of the one or more classification levels and the one or more access control groups associated with the second user.

3. The system of claim 2 , wherein the instructions that, when executed by the one or more processors, cause the system to conduct the search, further cause the system to:
store the search results as part of one or more viewing sets commensurate with the at least one of the one or more classification levels and the one or more access control groups associated with the first user and the at least one of the one or more classification levels and the one or more access control groups associated with the second user.

4. The system of claim 1 , wherein the instructions that, when executed by the one or more processors, cause the system to conduct the search, further cause the system to:
run a first search in accordance with the at least one of the one or more classification levels and the one or more access control groups associated with the first user; and
run a second search in accordance with the at least one of the one or more classification levels and the one or more access control groups associated with the second user.

5. The system of claim 1 , wherein the instructions that, when executed by the one or more processors, cause the system to conduct the search, further cause the system to:
run the search in accordance with the at least one of the one or more classification levels and the one or more access control groups associated with the first user; and
re-run the search in accordance with the at least one of the one or more classification levels and the one or more access control groups associated with the second user.

6. The system of claim 5 , wherein the instructions that, when executed by the one or more processors, cause the system to conduct the search, further cause the system to:
present the search results obtained by re-running the search in accordance with the at least one of the one or more classification levels and the one or more access control groups associated with the second user to the second user.

7. The system of claim 6 , wherein the non-transitory memory stores further instructions that, when executed by the one or more processors, further cause the system to:
adjust, as part of the collaborative presentation, a presentation of one or more aspects of the search results to the second user when the at least one of the one or more classification levels and the one or more access control groups associated with the second user prohibit knowledge of the one or more aspects of the search results, the one or more aspects of the search results being obtained by running the search in accordance with the at least one of the one or more classification levels and the one or more access control groups associated with the first user.

8. The system of claim 7 , wherein the instructions that, when executed by the one or more processors, cause the system to adjust the presentation of the one or more aspects of the search results, further cause the system to:
present the one or more aspects of the search results to the second user as a redacted element in the collaborative presentation or withhold the presentation of the one or more aspects of the search results to the second user in the collaborative presentation.

9. The system of claim 1 , wherein the non-transitory memory stores further instructions that, when executed by the one or more processors, further cause the system to:
preserve provenance of the search results by prohibiting removal of the search results from a search folder created to store the search results.

10. A method being implemented by a computing system including one or more physical processors and non-transitory storage media storing machine-readable instructions, the method comprising:
generating a plurality of dissemination views corresponding to a map, wherein each dissemination view includes one or more objects, and wherein each dissemination view is associated with at least one of one or more classification levels and one or more access control groups;
providing a first dissemination view corresponding to a map for presentation to a first user, and simultaneously provide a second dissemination view for presentation to a second user for a collaborative presentation;
receiving one or more search terms from the first user, the first user being associated with at least one of the one or more classificat

Assignees

• Palantir Technologies Inc

Inventors

• Wilczynski Peter
• Elder Andrew
• Moreland Andrew
• Carrino John
• Cervelli Daniel
• Garrod John
• Wilson Timothy

Classifications

• G06F21/629 Primary

  to features or functions of an application · CPC title

• G06F16/29

  Geographical information databases · CPC title

• G06Q10/10

  Office automation; Time management · CPC title

• G06F2221/2113

  Multi-level security, e.g. mandatory access control · CPC title

• G06F16/9566

  URL specific, e.g. using aliases, detecting broken or misspelled links · CPC title