Row-level and column-level policy service

Patent metadata

Field	Value
Publication number	US-11244063-B2
Application number	US-201816005264-A
Country	US
Kind code	B2
Filing date	Jun 11, 2018
Priority date	Jun 11, 2018
Publication date	Feb 8, 2022
Grant date	Feb 8, 2022

Abstract

Example embodiments relate to a policy service employed to perform operations to: generate and maintain a data-set that comprises at least a column and a row that intersect at a cell; assign an access policy to a row or column of the data-set, wherein the access policy is defined by one or more access credentials required to receive access the cell that intersect with the row or column; receive a request to read the data-set from a user account, wherein the user account has an associated credential; filter the cell that intersects with the row or column of the data-set based on the access policy and the credential of the user account, in response to receiving the request from the user account; and provide the user account with access to the filtered data-set.

First claim

What is claimed is:

1. A method comprising:
causing display of graphical user interface (GUI) to display a data-set that comprises at least a column and a row that intersect at a cell, the cell comprising content;
receiving a selection of the row from a client device;
causing display of a menu element at a position within the GUI in response to the selection of the row, the menu element comprising a display of a set of access policy identifiers that include a first access policy identifier, the first access policy identifier corresponding with an access policy that defines one or more credentials;
receiving an input that selects the first access policy identifier from among the set of access policy identifiers of the menu element, assigning the access policy associated with the first access policy identifier to the row of the data-set based on the input that selects the first access policy identifier from among the set of access policy identifiers, the access policy defining one or more credentials required to receive access to the content of the cell;
receiving a request to read the data-set from a user account, the request including a credential of the user account associated with the client device;
filtering the content of the cell from the data-set based on the access policy of the row and the credential of the user account; and
causing display of a presentation of the filtered data-set to the user account.

2. The method of claim 1 , further comprising:
maintaining the credential of the user account at a memory location;
associating the memory location with an identifier of the user account; and
wherein the filtering the data-set based on the access policy of the row and the credential associated with the user account includes:
retrieving the credential from the memory location associated with the identifier of the user account in response to the receiving the request to read the data-set from the user account; and
filtering the data-set based on the credential of the user account and the access policy assigned to the row.

3. The method of claim 2 , wherein the credential of the user account is a first credential, and the method further comprises:
assigning a second credential to the user account; and
adding the second credential to the memory location associated with the identifier of the user account in response to the assigning the second credential to the user account.

4. The method of claim 1 , wherein the assigning the access policy to the row of the data-set includes assigning an identifier that identifies the access policy to the row of the data-set, and wherein the method further comprises:
retrieving the one or more credentials associated with the access policy from a memory repository based on the identifier assigned to the row of the data-set in response to the receiving the request to read the data-set from the user account.

5. The method of claim 1 , wherein the assigning the access policy to the row of the data-set includes:
receiving a first user input that defines the one or more credentials of the access policy;
receiving a second user input that identifies the row of the data-set; and
assigning the access policy to the cell that intersects with the row of the data-set.

6. The method of claim 5 , wherein the receiving the second user input that identifies the row of the data-set includes:
receiving a selection of the cell that corresponds to the row.

7. The method of claim 1 , wherein the request is a first request, the row is a first row, the access policy is a first access policy, and the method further comprises:
receiving, from the client device associated with the user account, a second request to add a second row to the data-set;
generating a second access policy based on the credential associated with the user account; and
assigning the second access policy to the second row.

8. The method of claim 1 , wherein the request is a first request, the row is a first row, the access policy is a first access policy, and the method further comprises:
receiving, from the client device associated with the user account, a second request to add a second row to the data-set;
requesting a second access policy from an administrator associated with the data-set in response to the receiving the second request to add the second row to the data-set from the user account;
receiving the second access policy from the administrator associated with the data-set, the second access policy defined by a set of credentials assigned to the second access policy; and
assigning the second access policy to the second row in response to the receiving the second access policy from the administrator associated with the data-set.

9. The method of claim 1 , wherein the providing the user account with access to read the filtered data-set includes:
causing display of the presentation of the filtered data-set at the client device associated with the user account.

10. The method of claim 1 , wherein the method further comprises:
assigning the access policy to the column of the data-set.

11. The method of claim 1 , wherein the one or more credentials of the access policy include one or more of a list comprising: user attributes, device attributes, or location criteria, or temporal data.

12. The method of claim 1 , wherein the filtering the data-set includes:
redacting the content from the one or more cells that correspond to the row.

13. A system comprising:
a memory; and
at least one hardware processor coupled to the memory and comprising instructions that causes the system to perform operations comprising:
causing display of graphical user interface (GUI) to display a data-set that comprises at least a column and a row that intersect at a cell, the cell comprising content;
receiving a selection of the row from a client device;
causing display of a menu element at a position within the GUI in response to the selection of the row, the menu element comprising a display of a set of access policy identifiers that include a first access policy identifier, the first access policy identifier corresponding with an access policy that defines one or more credentials;
receiving an input that selects the first access policy identifier from among the set of access policy identifiers of the menu element, assigning the access policy associated with the first access policy identifier to the row of the data-set based on the input that selects the first access policy identifier from among the set of access policy identifiers, the access policy defining one or more credentials required to receive access to the content of the cell;
receiving a request to read the data-set from a user account, the request including a credential of the user account associated with the client device;
filtering the content of the cell from the data-set based on the access policy of the row and the credential of the user account; and
causing display of a presentation of the filtered data-set to the user account.

14. The system of claim 13 , wherein the operations further comprise:
maintaining the credential of the user account at a memory location;
associating the memory location with an identifier of the user account; and
wherein the filtering the data-set based on the access policy of the row and the credential associated with the user account includes:
retrieving the credential from the memory location associated with the identifier of the user account in response to the receiving the request to read the data-set from the user account; and
filtering the data-set based on the credential of the user account and the access polic

Assignees

• Palantir Technologies Inc

Inventors

• Krieger Brandon
• Elliot Mark
• Lynch Matthew

Classifications

• G06F21/31

  User authentication · CPC title

• G06F2221/2137

  Time limited access, e.g. to a computer or data · CPC title

• G06F21/604

  Tools and structures for managing or administering access control systems · CPC title

• G06F2221/2111

  Location-sensitive, e.g. geographical location, GPS · CPC title

• G06F21/6218 Primary

  to a system of files or objects, e.g. local or distributed file system or database · CPC title