Data permissioning through data replication

Patent metadata

Field	Value
Publication number	US-11768854-B2
Application number	US-202217656506-A
Country	US
Kind code	B2
Filing date	Mar 25, 2022
Priority date	Dec 6, 2019
Publication date	Sep 26, 2023
Grant date	Sep 26, 2023

Abstract

A data querying system is disclosed that provides improved computer functionality that enables efficient permissioning and querying of specific portions of a data table, such that users (e.g., based on user roles or user attributes) are only allowed access to specific portions (e.g., particular data items/rows, and particular data items attributes/columns) of the data. The system advantageously provides efficient and improved querying and permissioning of specific portions of a data table through replication of the data table, or portions of the data table, and does not require permissioning of each individual cell of the data table. Further, the data table replication, querying, and permissioning techniques of the present disclosure, according to various implementations, advantageously integrate with a wide variety of data table query or search services to provide improved functionality, efficiency, and data permissioning.

First claim

What is claimed is:

1. A computer-implemented method of data permissioning, the method comprising:
by one or more processors executing program instructions:
receiving an input search query associated with a data table;
determining sensitivity permissions and group access permissions associated with the input search query;
based on the determined sensitivity permissions and the determined group access permissions, generating a replicated-data-table query;
providing the replicated-data-table query to a search service for execution of the replicated-data-table query on a replicated table data layer generated based on the data table, wherein:
the replicated data table layer comprises a replicated data table including two or more replicated sets of rows each associated with different sensitivity levels of a plurality of sensitivity levels associated with the data table,
each of the two or more replicated sets of rows includes a different subset of data associated with the applicable sensitivity level of the replicated data table, and
each of the two or more replicated sets of rows includes data associated with each of a plurality of group access permissions;

receiving a response from the search service including results of the replicated-data-table query; and
providing a response to the input search query based on at least the results of the replicated-data-table query.

2. The computer-implemented method of claim 1 further comprising:
by the one or more processors executing program instructions:
generating the replicated table data layer, wherein generating the replicated table data layer comprises:
determining sensitivity levels associated with the data table; and
generating the replicated data table including the two or more replicated sets of rows, wherein:
a first replicated set of rows of the two or more replicated sets of rows corresponds to a first sensitivity level of the determined sensitivity levels, and
a second replicated set of rows of the two or more replicated sets of rows corresponds to a second sensitivity level of the determined sensitivity levels.

3. The computer-implemented method of claim 2 , wherein generating the replicated table data layer further comprises:
associating first sensitivity level permissions, corresponding to the first sensitivity level, with the first replicated set of rows; and
associating second sensitivity level permissions, corresponding to the second sensitivity level, with the second replicated set of rows.

4. The computer-implemented method of claim 3 , wherein each of the two or more replicated sets of rows comprises a schema that overlaps or extends that of the data table.

5. The computer-implemented method of claim 4 , wherein:
the data table comprises a plurality of columns,
at least a first set of columns of the plurality of columns is associated with the first sensitivity level,
at least a second set of columns of the plurality of columns is associated with the second sensitivity level, and
generating the replicated table data layer further comprises:
in the first replicated set of rows associated with the first sensitivity level permissions, setting data values of the second set of columns to null values; and
in the second replicated set of rows associated with the second sensitivity level permissions, setting data values of the second set of columns to match those of the data table.

6. The computer-implemented method of claim 5 , wherein each of the sets of replicated rows comprises all of the rows of the data table, or a same number of rows as the number of rows in the data table.

7. The computer-implemented method of claim 1 , wherein:
a first replicated set of rows of the two or more replicated sets of rows corresponds to a first sensitivity level of the plurality of sensitivity levels associated with the data table, and
a second replicated set of rows of the two or more replicated sets of rows corresponds to a second sensitivity level of the plurality of sensitivity levels associated with the data table.

8. The computer-implemented method of claim 7 , wherein:
first sensitivity level permissions, corresponding to the first sensitivity level, are associated with the first replicated set of rows, and
second sensitivity level permissions, corresponding to the second sensitivity level, are associated with the second replicated set of rows.

9. The computer-implemented method of claim 7 , wherein:
each of the two or more replicated sets of rows comprises a schema that overlaps or extends that of the data table,
the data table comprises a plurality of columns,
at least a first set of columns of the plurality of columns is associated with the first sensitivity level,
at least a second set of columns of the plurality of columns is associated with the second sensitivity level,
in the first replicated set of rows associated with the first sensitivity level permissions, data values of the second set of columns are set to null values,
in the second replicated set of rows associated with the second sensitivity level permissions, data values of the second set of columns match those of the data table, and
each of the sets of replicated rows comprises all of the rows of the data table, or a same number of rows as the number of rows in the data table.

10. The computer-implemented method of claim 9 , wherein:
the determined sensitivity permissions include the first sensitivity level permissions, and
generating the replicated-data-table query comprises:
determining to query the first replicated set of rows; and
including, in the replicated-data-table query, a query of the first replicated set of rows.

11. The computer-implemented method of claim 9 , wherein:
the determined sensitivity permissions include the first and second sensitivity level permissions, and
generating the replicated-data-table query comprises:
determining to query the first and second replicated sets of rows; and
including, in the replicated-data-table query, queries of the first and second replicated sets of rows.

12. The computer-implemented method of claim 11 further comprising:
by the one or more processors executing program instructions:
resolving unique identifiers associated with the results of the replicated-data-table query by querying or causing querying of a unique identifier lookup table.

13. The computer-implemented method of claim 12 , wherein the unique identifier lookup table includes matches between unique identifiers associated with rows of the data table, and corresponding rows of the replicated data table.

14. The computer-implemented method of claim 11 , wherein the replicated data table includes a column storing unique identifiers matching unique identifiers associated with corresponding rows of the data table.

15. The computer-implemented method of claim 14 further comprising:
by the one or more processors executing program instructions:
removing a primary key column from the results of the replicated-data-table query.

16. The computer-implemented method of claim 1 , wherein the sensitivity permissions are defined for each user with respect to all group access permissions.

17. The computer-implemented method of claim 16 , wherein the sensitivity permissions comprise a hierarchical set of sensitivity permissions.

18. The computer-implemented method of claim 16 , wherein the sensitivity permissions are associated with a user providing the input search query.

19. A system comprising:
a computer readable storage medium having pr

Assignees

• Palantir Technologies Inc

Inventors

• Dorne Jeremy
• Bagdis Jeffrey
• Jain Hirsh
• Skiles Mitchell
• Belardo Armando
• Schiavone Joseph
• Zweig Joshua

Classifications

• G06F16/27 Primary

  Replication, distribution or synchronisation of data between databases or within a distributed database system; Distributed database system architectures therefor · CPC title

• G06F16/2455

  Query execution · CPC title

• G06F16/9532

  Query formulation · CPC title

• G06F16/2452 Primary

  Query translation · CPC title