Sharing information between nexuses that use different classification schemes for information access control

Patent metadata

Field	Value
Publication number	US-12572566-B2
Application number	US-202318544177-A
Country	US
Kind code	B2
Filing date	Dec 18, 2023
Priority date	Oct 22, 2012
Publication date	Mar 10, 2026
Grant date	Mar 10, 2026

Abstract

A computer-implemented method comprises obtaining export data representing a first classification in a first database that is to be imported into a second database, the first classification including a first set of classification markings that correspond to a first classification scheme identifier of the first database and that determine access to the first database and including a first plurality of origin classifications, each original classification of the first plurality of origin classifications including a classification scheme identifier; determining that a specific original classification of the first plurality of origin classifications has a specific classification scheme identifier matching a second classification scheme identifier of the second database; importing the specific original classification into the second database as an imported classification.

First claim

What is claimed is:

1 . A computer-implemented method, comprising:
obtaining export data representing a first classification in a first database that is to be imported into a second database, the first classification including a first set of classification markings that correspond to a first classification scheme identifier of the first database and that determine access to the first database and including a first set of origin classifications in a set of databases, each origin classification of the first set of origin classifications including a classification scheme identifier and a set of classification markings of a respective database; determining that a specific origin classification of the first set of origin classifications has a specific classification scheme identifier matching a second classification scheme identifier of the second database; importing the specific origin classification into the second database as an imported classification.

2 . The computer-implemented method of claim 1 ,
each of the first set of origin classifications further including a rank, the determining comprising iterating over the first set of origin classifications in an order of increasing ranks until the specific origin classification is found.

3 . The computer-implemented method of claim 1 ,
the imported classification including the set of classification markings included in the specific origin classification.

4 . The computer-implemented method of claim 2 , the imported classification including a subset of the first set of origin classifications having lower ranks than the specific origin classification.

5 . The computer-implemented method of claim 1 , further comprising
verifying that translations reflected by the first set of origin classifications are the same translations that result under a set of translation rules for the first database, the importing being performed in response to a successful result of the verifying.

6 . The computer-implemented method of claim 5 ,
each of the first set of origin classifications including a rank and a specific set of classification markings, the verifying comprising checking the specific set of classification markings in an order of increasing ranks.

7 . The computer-implemented method of claim 1 , the importing being subject to asymmetric translation rules between classification markings corresponding to the first classification scheme identifier and classification markings corresponding to the second classification scheme identifier.

8 . The computer-implemented method of claim 1 , before the obtaining:
exporting a second classification corresponding to the second classification scheme identifier from the second database to the first database, wherein a first translation rule is applied to translate one or more classification markings in the second classification before the second classification is imported into the first database.

9 . The computer-implemented method of claim 1 , further comprising:
obtaining additional export data representing a third classification in a third database that is to be imported into the second database, the third classification including a third set of classification markings that correspond to a third classification scheme identifier and that determine access to the third database and including a third plurality of origin classifications; determining that a particular origin classification of the third plurality of origin classifications has a particular classification scheme identifier matching the second classification scheme identifier of the second database; judging that an update was made to a second classification corresponding to the second classification scheme identifier after the second classification was exported; rejecting the additional export data.

10 . The computer-implemented method of claim 1 , further comprising:
obtaining additional export data representing a third classification in a third database that is to be imported into the second database, the third classification including a third set of classification markings that correspond to a third classification scheme identifier and that determine access to the third database and including a third plurality of origin classifications; determining that a particular origin classification of the third plurality of origin classifications has a particular classification scheme identifier matching the second classification scheme identifier of the second database; judging that a version of a second classification corresponding to the second classification scheme identifier has a conflict with a version of the particular origin classification; resolving the conflict before importing the particular origin classification into the second database.

11 . One or more computer-readable non-transitory storage media storing instructions which, when executed by one or more processors, cause execution of a method, the method comprising:
obtaining export data representing a first classification in a first database that is to be imported into a second database, the first classification including a first set of classification markings that correspond to a first classification scheme identifier of the first database and that determine access to the first database and including a first set of origin classifications in a set of databases, each origin classification of the first set of origin classifications including a classification scheme identifier and a set of classification markings of a respective database; determining that a specific origin classification of the first set of origin classifications has a specific classification scheme identifier matching a second classification scheme identifier of the second database; importing the specific origin classification into the second database as an imported classification.

12 . The one or more computer-readable non-transitory storage media of claim 11 ,
each of the first set of origin classifications further including a rank, the determining comprising iterating over the first set of origin classifications in an order of increasing ranks until the specific origin classification is found.

13 . The one or more computer-readable non-transitory storage media of claim 11 ,
the imported classification including the set of classification markings included in the specific origin classification.

14 . The one or more computer-readable non-transitory storage media of claim 12 , the imported classification including a subset of the first set of origin classifications having lower ranks than the specific origin classification.

15 . The one or more computer-readable non-transitory storage media of claim 11 , the method further comprising
verifying that translations reflected by the first set of origin classifications are the same translations that result under a set of translation rules for the first database, the importing being performed in response to a successful result of the verifying.

16 . The one or more computer-readable non-transitory storage media of claim 15 ,
each of the first set of origin classifications including a rank and a specific set of classification markings, the verifying comprising checking the specific set of classification markings in an order of increasing ranks.

17 . The one or more computer-readable non-transitory storage media of claim 11 , the importing being subject to asymmetric translation rules between classification markings corresponding to the first classification scheme identifier and classification ma

Assignees

• Palantir Technologies Inc

Inventors

• Ducott Iii Richard Allen
• Garrod John Kenneth
• Tasinga Khan

Classifications

• G06F21/604 Primary

  Tools and structures for managing or administering access control systems · CPC title

• G06F16/273

  Asynchronous replication or reconciliation · CPC title

• H04L63/105

  Multiple levels of security · CPC title

• G06F2221/2141

  Access rights, e.g. capability lists, access control lists, access tables, access matrices · CPC title

• G06F21/6236

  between heterogeneous systems · CPC title