Systems and methods for producing, displaying, and interacting with collaborative environments using classification-based access control

Patent metadata

Field	Value
Publication number	US-11720713-B2
Application number	US-202117396372-A
Country	US
Kind code	B2
Filing date	Aug 6, 2021
Priority date	May 30, 2017
Publication date	Aug 8, 2023
Grant date	Aug 8, 2023

Abstract

Systems and methods are provided for sharing maps in a collaborative environment using classification-based access control. The generation of and dissemination of maps and/or data within such maps can be governed by classification-based access control, where a user's classification level can determine whether or not maps and/or data within those maps can be seen. In scenarios whether a plurality of users wishes to collaborate on the same map, the systems and methods provided herein generate multiple versions or views of the same map in accordance with different classification levels. In this way, users with different classification levels can nevertheless see the same map and engage in collaborations regarding the same map, while maintaining control of sensitive data.

First claim

The invention claimed is:

1. A system for generating a classification-based dissemination control environment comprising:
one or more processors; and
a non-transitory memory storing instructions that, when executed by the one or more processors, cause the system to:
generate, according to search queries, dissemination views corresponding to a map, wherein each dissemination view includes one or more objects, and wherein each dissemination view is associated with a different classification level compared to other dissemination views, wherein the generation of dissemination views comprises:
obtaining a first classification attribute of a first user submitting a search query;
selecting a first dissemination view to be rendered to the first user based on a first classification level of the first user;
receiving an annotation from the first user;
obtaining a second classification attribute of a second user;
selecting a second dissemination view to be rendered to the second user based on a second classification level of the second user; and
selectively rendering, by the one or more processors, the annotation to the second user, wherein the selectively rendering comprises:
if the second user has a lower or more restrictive classification level compared to the first user, refraining from rendering the annotation; and
if the second user has a higher or equal classification level, or a less restrictive or equally restrictive classification level, compared to the first user, rendering the annotation.

2. The system of claim 1 , wherein the instructions further cause the system to:
declassify terms of the search query such that text of the search query is visible to a particular user if the particular user satisfies a particular classification level defined for the search query, and invisible if the particular user fails to satisfy the particular classification level.

3. The system of claim 2 , wherein the declassifying the terms of the search query comprises declassifying the search query such that, if the search query is visible under the particular classification level, at least a result of the search query is also visible under the particular classification level.

4. The system of claim 1 , wherein the instructions further cause the system to:
define an access control policy that defines a level of access to an object that is redacted under a particular classification level, the level of access determining whether an existence of the redacted object is visible or whether the redacted object is completely hidden.

5. The system of claim 1 , wherein an object represents any: an entity, one or more properties associated with entities, user-generated annotations, and metadata associated with entities.

6. The system of claim 1 , wherein the instructions further cause the system to:
provide a collaborative first dissemination view of the dissemination views for a collaborative presentation that involves the first user and the second user, wherein objects shown in the collaborative dissemination view during the collaborative presentation satisfy (i) one or more classification levels associated with the first user and (ii) one or more classification levels associated with the second user.

7. The system of claim 1 , wherein the instructions further cause the system to:
present one or more permissions under which the search query has been conducted which has been satisfied by results of the search query.

8. A method being implemented by a computing system including one or more physical processors and non-transitory storage media storing machine-readable instructions, the method comprising:
generating, according to search queries, dissemination views corresponding to a map, wherein each dissemination view includes one or more objects, and wherein each dissemination view is associated with a different classification level compared to other dissemination views, wherein the generation of dissemination views comprises:
obtaining a first classification attribute of a first user submitting a search query;
selecting a first dissemination view to be rendered to the first user based on a first classification level of the first user;
receiving an annotation from the first user;
obtaining a second classification attribute of a second user;
selecting a second dissemination view to be rendered to the second user based on a second classification level of the second user; and
selectively rendering, by the one or more processors, the annotation to the second user, wherein the selectively rendering comprises:
if the second user has a lower or more restrictive classification level compared to the first user, refraining from rendering the annotation; and
if the second user has a higher or equal classification level, or a less restrictive or equally restrictive classification level, compared to the first user, rendering the annotation.

9. The method of claim 8 , wherein the declassifying terms of the search query such that text of the search query is visible to a particular user if the particular user satisfies a particular classification level defined for the search query, and invisible if the particular user fails to satisfy the particular classification level.

10. The method of claim 9 wherein the declassifying the terms of the search query comprises declassifying the search query such that, if the search query is visible under the particular classification level, at least a result of the search query is also rendered visible under the particular classification level.

11. The method of claim 8 , further comprising:
defining an access control policy that defines a level of access to an object that is redacted under a particular classification level, the level of access determining whether an existence of the redacted object is visible or whether the redacted object is completely hidden.

12. The method of claim 8 , wherein an object represents any of: an entity, one or more properties associated with entities, user-generated annotations, and metadata associated with entities.

13. The method of claim 8 , further comprising:
providing a collaborative dissemination view of the dissemination views for a collaborative presentation that involves the first user and the second user, wherein objects shown in the collaborative dissemination view during the collaborative presentation satisfy (i) one or more classification levels associated with the first user and (ii) one or more classification levels associated with the second user.

14. The method of claim 8 , further comprising:
presenting one of more permissions under which the search query has been conducted which has been satisfied by results of the search query.

15. A non-transitory computer readable medium comprising instructions that, when executed, cause one or more processors to perform:
generate, according to search queries, dissemination views corresponding to a map, wherein each dissemination view includes one or more objects, and wherein each dissemination view is associated with a different classification level compared to other dissemination views, wherein the generation of dissemination views comprises:
obtaining a first classification attribute of a first user submitting a search query;
selecting a first dissemination view to be rendered to the first user based on a first classification level of the first user;
receiving an annotation from the first user;
obtaining a second classification attribute of a second user;
selecting a second dissemination view to be rendered to the second user based on a second classification level of the second user; and
sele

Assignees

• Palantir Technologies Inc

Inventors

• Wilczynski Peter
• Elder Andrew
• Moreland Andrew
• Carrino John
• Cervelli Daniel
• Garrod John
• Wilson Timothy

Classifications

• G06F21/629 Primary

  to features or functions of an application · CPC title

• G06F16/29

  Geographical information databases · CPC title

• G06F16/9566

  URL specific, e.g. using aliases, detecting broken or misspelled links · CPC title

• G06Q10/10

  Office automation; Time management · CPC title

• G06F2221/2113

  Multi-level security, e.g. mandatory access control · CPC title