Data permissioning through data replication

Patent metadata

Field	Value
Publication number	US-11314773-B2
Application number	US-202016782602-A
Country	US
Kind code	B2
Filing date	Feb 5, 2020
Priority date	Dec 6, 2019
Publication date	Apr 26, 2022
Grant date	Apr 26, 2022

Abstract

A data querying system is disclosed that provides improved computer functionality that enables efficient permissioning and querying of specific portions of a data table, such that users (e.g., based on user roles or user attributes) are only allowed access to specific portions (e.g., particular data items/rows, and particular data items attributes/columns) of the data. The system advantageously provides efficient and improved querying and permissioning of specific portions of a data table through replication of the data table, or portions of the data table, and does not require permissioning of each individual cell of the data table. Further, the data table replication, querying, and permissioning techniques of the present disclosure, according to various implementations, advantageously integrate with a wide variety of data table query or search services to provide improved functionality, efficiency, and data permissioning.

First claim

What is claimed is:

1. A computer-implemented method of data permissioning, the method comprising:
by one or more processors executing program instructions:
receiving an input search query associated with a data table;
determining sensitivity permissions and group access permissions associated with the input search query;
based on the determined sensitivity permissions and the determined group access permissions, generating a replicated-data-table query;
providing the replicated-data-table query to a search service for execution of the replicated-data-table query on a replicated table data layer generated based on the data table, wherein:
the replicated table data layer comprises two or more replicated data tables each associated with different sensitivity levels of a plurality of sensitivity levels associated with the data table,
each of the two or more replicated data tables includes a different subset of data associated with the applicable sensitivity level of the replicated data table, and
each of the two or more replicated data tables includes data associated with each of a plurality of group access permissions;

receiving a response from the search service including results of the replicated-data-table query; and
providing a response to the input search query based on at least the results of the replicated-data-table query.

2. The computer-implemented method of claim 1 further comprising:
by the one or more processors executing program instructions:
generating the replicated table data layer, wherein generating the replicated table data layer comprises:
determining sensitivity levels associated with the data table; and
generating the two or more replicated data tables, wherein:
a first replicated data table of the two or more replicated data tables corresponds to a first sensitivity level of the determined sensitivity levels, and
a second replicated data table of the two or more replicated data tables corresponds to a second sensitivity level of the determined sensitivity levels.

3. The computer-implemented method of claim 2 , wherein generating the replicated table data layer further comprises:
associating first sensitivity level permissions, corresponding to the first sensitivity level, with the first replicated data table; and
associating second sensitivity level permissions, corresponding to the second sensitivity level, with the second replicated data table.

4. The computer-implemented method of claim 3 , wherein each of the two or more replicated data tables comprises a schema that overlaps or extends that of the data table.

5. The computer-implemented method of claim 4 , wherein:
the data table comprises a plurality of columns,
at least a first set of columns of the plurality of columns is associated with the first sensitivity level,
at least a second set of columns of the plurality of columns is associated with the second sensitivity level, and
generating the replicated table data layer further comprises:
in the first replicated data table associated with the first sensitivity level permissions, setting data values of the second set of columns to null values; and
in the second replicated data table associated with the second sensitivity level permissions, setting data values of the second set of columns to match those of the data table.

6. The computer-implemented method of claim 1 , wherein:
a first replicated data table of the two or more replicated data tables corresponds to a first sensitivity level of the plurality of sensitivity levels associated with the data table, and
a second replicated data table of the two or more replicated data tables corresponds to a second sensitivity level of the plurality of sensitivity levels associated with the data table.

7. The computer-implemented method of claim 6 , wherein:
first sensitivity level permissions, corresponding to the first sensitivity level, are associated with the first replicated data table, and
second sensitivity level permissions, corresponding to the second sensitivity level, are associated with the second replicated data table.

8. The computer-implemented method of claim 7 , wherein:
each of the two or more replicated data tables comprises a schema that overlaps or extends that of the data table,
the data table comprises a plurality of columns,
at least a first set of columns of the plurality of columns is associated with the first sensitivity level,
at least a second set of columns of the plurality of columns is associated with the second sensitivity level,
in the first replicated data table associated with the first sensitivity level permissions, data values of the second set of columns are set to null values, and
in the second replicated data table associated with the second sensitivity level permissions, data values of the second set of columns match those of the data table.

9. The computer-implemented method of claim 8 , wherein:
the determined sensitivity permissions include the first sensitivity level permissions, and
generating the replicated-data-table query comprises:
determining to query the first replicated data table; and
including, in the replicated-data-table query, a query of the first replicated data table.

10. The computer-implemented method of claim 8 , wherein:
the determined sensitivity permissions include the first and second sensitivity level permissions, and
generating the replicated-data-table query comprises:
determining to query the first and second replicated data tables; and
including, in the replicated-data-table query, queries of the first and second replicated data tables.

11. The computer-implemented method of claim 8 further comprising:
by the one or more processors executing program instructions:
based on the results of the replicated-data-table query, and further based on the sensitivity permissions, generating a second replicated-data-table query;
providing the second replicated-data-table query to the search service for execution of the second replicated-data-table query on the replicated table data layer;
receiving a second response from the search service including results of the second replicated-data-table query; and
aggregating the results of the replicated-data-table query and the results of the second replicated-data-table query,
wherein the response to the input search query is further based on at least the results of the replicated-data-table query and the results of the second replicated-data-table query.

12. The computer-implemented method of claim 11 , wherein:
the replicated-data-table query includes a query of the first replicated data table associated with the first sensitivity level, and
the second replicated-data-table query includes a query of the second replicated data table associated with the second sensitivity level.

13. The computer-implemented method of claim 12 , wherein the second replicated-data-table query includes primary keys associated with results of the replicated-data-table query.

14. The computer-implemented method of claim 13 , wherein aggregating the results of the replicated-data-table query and the results of the second replicated-data-table query comprises:
joining the results of the replicated-data-table query and the results of the second replicated-data-table query into a single table; and
associating, with corresponding rows of the single table, unique identifiers matching those of the corresponding rows from the data table.

15. The computer-implemented method of claim 1 , wherein the sensitivity permissions comprise a hierarchical set of sensitivity permissions.

Assignees

• Palantir Technologies Inc

Inventors

• Dorne Jeremy
• Bagdis Jeffrey
• Jain Hirsh
• Skiles Mitchell
• Belardo Armando
• Schiavone Joseph
• Zweig Joshua

Classifications

• G06F16/9532

  Query formulation · CPC title

• G06F16/2452 Primary

  Query translation · CPC title

• G06F16/27 Primary

  Replication, distribution or synchronisation of data between databases or within a distributed database system; Distributed database system architectures therefor · CPC title

• G06F16/2455

  Query execution · CPC title