Sharing information between nexuses that use different classification schemes for information access control

Patent metadata

Field	Value
Publication number	US-11847140-B2
Application number	US-202017124093-A
Country	US
Kind code	B2
Filing date	Dec 16, 2020
Priority date	Oct 22, 2012
Publication date	Dec 19, 2023
Grant date	Dec 19, 2023

Abstract

Systems and methods for sharing information between distributed computer systems connected to one or more data networks. In particular, a replication system implements methodologies for sharing database information between computer systems where the databases use different classification schemes for information access control.

First claim

What is claimed is:

1. A method, comprising:
receiving, by a second database system, a first copy of data associated with an access control list and stored by a first database system, the data stored by the first database system subject to a first classification designation for controlling access to information stored by the first database system;
identifying a shortest translation path from a plurality of translation paths specified in the first copy of data, the shortest translation path associated with a peer database system and having a translation rule, in a translation map, for the peer database system and the second database system for updating the access control list;
in response to the identifying the shortest translation path, applying the translation rule to the first classification designation to obtain a second classification designation; and
storing, by the second database system, a second copy of the data subject to the second classification designation for controlling access to information stored by the second database system.

2. The method of claim 1 , further comprising exporting a third copy of the data from the second database system, wherein the third copy of the data includes an updated plurality of translation paths, wherein the updated plurality of translation paths includes a particular translation path reflective of the second classification designation.

3. The method of claim 1 , further comprising:
modifying the second copy of the data in the second database system to produce changed data in the second database system, the changed data subject to the second classification designation in the second database system;
exporting a first copy of the changed data from the second database system, wherein the first copy of the changed data specifies an updated plurality of translation paths, wherein the updated plurality of translation paths includes a particular translation path reflective of the second classification designation.

4. The method of claim 1 , wherein each of the plurality of translation paths specified in the first copy of data is reflective of a specific classification designation and is associated with a rank.

5. The method of claim 4 , wherein the shortest translation path is a translation path that has the lowest rank among the plurality of translation paths.

6. The method of claim 1 , wherein the first copy of the data exported reflects a database information item stored in the first database system.

7. The method of claim 1 , wherein the first classification designation is stored in the access control list associated with the data in the first database system.

8. The method of claim 1 , wherein the translation map includes translation rules between every two classification designations used in a replication group, wherein the replication group includes the first database system, the second database system, and the peer database system.

9. The method of claim 1 , further comprising identifying the shortest translation path in response to determining that pre-import conditions are satisfied, wherein the pre-import conditions include the first copy of data being able to update the second database system and the plurality of translation paths being validated against the translation map.

10. The method of claim 1 , wherein identifying the shortest translation path comprises performing at least one iteration over the plurality of translation paths in a particular order.

11. One or more non-transitory computer-readable media storing one or more programs for execution by one or more processors, the one or more processors comprising instructions configured for:
receiving, by a second database system, a first copy of data associated with an access control list and stored in a first database system, the data stored by the first database system subject to a first classification designation for controlling access to information stored by the first database system;
identifying a shortest translation path from a plurality of translation paths specified in the first copy of data, the shortest translation path associated with a peer database system and having a translation rule, in a translation map, for the peer database system and the second database system for updating the access control list;
in response to the identifying the shortest translation path, applying the translation rule to the first classification designation to obtain a second classification designation; and
storing, by the second database system, a second copy of the data subject to the second classification designation for controlling access to information stored by the second database system.

12. The one or more non-transitory computer-readable media of claim 11 , the instructions further configured for:
exporting a third copy of the data from the second database system, wherein the third copy of the data includes an updated plurality of translation paths, wherein the updated plurality of translation paths includes a particular translation path reflective of the second classification designation.

13. The one or more non-transitory computer-readable media of claim 11 , the instructions further configured for:
modifying the second copy of the data in the second database system to produce changed data in the second database system, the changed data subject to the second classification designation in the second database system;
exporting a first copy of the changed data from the second database system, wherein the first copy of the changed data specifies an updated plurality of translation paths, wherein the updated plurality of translation paths includes a particular translation path reflective of the second classification designation.

14. The one or more non-transitory computer-readable media of claim 11 , wherein each of the plurality of translation paths specified in the first copy of data is reflective of a specific classification designation and is associated with a rank.

15. The one or more non-transitory computer-readable media of claim 14 , wherein the shortest translation path is a translation path that has the lowest rank among the plurality of translation paths.

16. The one or more non-transitory computer-readable media of claim 11 , wherein the first copy of the data exported reflects a database information item stored in the first database system.

17. The one or more non-transitory computer-readable media of claim 11 , wherein the first classification designation is stored in the access control list associated with the data in the first database system.

18. The one or more non-transitory computer-readable media of claim 11 , wherein the translation map includes translation rules between every two classification designations used in a replication group, wherein the replication group includes the first database system, the second database system, and the peer database system.

19. The one or more non-transitory computer-readable media of claim 11 , further comprising identifying the shortest translation path in response to determining that pre-import conditions are satisfied, wherein the pre-import conditions include the first copy of data being able to update the second database system and the plurality of translation paths being validated against the translation map.

20. The one or more non-transitory computer-readable media of claim 11 , wherein identifying the shortest translation path comprises performing at least one iteration over the plurality of translation paths in a particular order.

Assignees

• Palantir Technologies Inc

Inventors

• Ducott Iii Richard Allen
• Garrod John Kenneth
• Tasinga Khan

Classifications

• G06F16/285 Primary

  Clustering or classification · CPC title

• G06F16/1837

  Management specially adapted to peer-to-peer storage networks (topology management mechanisms of peer-to-peer networks H04L67/1042) · CPC title

• G06F16/213

  with details for schema evolution support · CPC title

• G06F16/24578

  using ranking · CPC title

• G06F16/27

  Replication, distribution or synchronisation of data between databases or within a distributed database system; Distributed database system architectures therefor · CPC title