Sharing information between nexuses that use different classification schemes for information access control

Patent metadata

Field	Value
Publication number	US-9836523-B2
Application number	US-201514726204-A
Country	US
Kind code	B2
Filing date	May 29, 2015
Priority date	Oct 22, 2012
Publication date	Dec 5, 2017
Grant date	Dec 5, 2017

Abstract

Systems and methods for sharing information between distributed computer systems connected to one or more data networks. In particular, a replication system implements methodologies for sharing database information between computer systems where the databases use different classification schemes for information access control.

First claim

The invention claimed is:

1. A computer-implemented method performed via a plurality of processors, the method comprising:
obtaining, from a source database, via at least one of the plurality of processors, an identifier of an access control list, at least one access control item of the access control list, and one or more classification markings of the access control list;
generating, via at least one of the plurality of processors, an origin classification comprising an identifier of a classification scheme used for classifying information in the source database and comprising the one or more classification markings of the access control list;
wherein the classification scheme used for classifying information in the source database comprises a set of classification markings, each of the one or more classification markings of the access control list belonging to the set of classification markings of the classification scheme;
exporting, via at least one of the plurality of processors, export data to a peer database system;
wherein the export data comprises the identifier of the access control list, the at least one access control item, and the origin classification;
the peer database system receiving the export data via at least one of the plurality of processors; and
the peer database system storing, via at least one of the plurality of processors, in a target database at the peer database system, in association with the identifier of the access control list:
the at least one access control item, and
one or classification markings belonging to a target classification scheme used for classifying information in the target database.

2. The method of claim 1 , wherein the at least one access control item and the origin classification are associated with the identifier of the access control list in the export data.

3. The method of claim 1 , wherein the access control list governs access to associated information in the source database.

4. The method of claim 1 , wherein the origin classification comprises a representation of the one or more classification markings in a form of a classification string.

5. The method of claim 1 , wherein the export data is formatted in an eXtensible Markup Language (XML) format.

6. The method of claim 1 , wherein exporting the export data comprises sending, via at least one of the plurality of processors, one or more network messages comprising the export data to the peer database system via one or more data networks.

7. The method of claim 1 , wherein the at least one access control item comprises a specification of a permission and a user, one or more users, or a group of users that have that permission.

8. The method of claim 1 , further comprising:
obtaining, from the source database, via at least one of the plurality of processors, an origin classification associated with the identifier of the access control list in the source database; and
wherein the export data comprises, in addition to the origin classification, the origin classification associated with the identifier of the access control list in the source database.

9. The method of claim 8 , wherein the origin classification and the origin classification associated with the identifier of the access control list in the source database are ranked in the export data; and wherein the origin classification associated with the identifier of the access control list in the source database has a lower rank in the export data than the origin classification.

10. A computer-implemented method performed via one or more processors, the method comprising:
obtaining, via at least one of the one or more processors, export data from a source database system representing at least creation, or modification, of an access control list in a source database of the source database system;
wherein the export data comprises an identifier of the access control list, at least one access control item of the access control list, and a plurality of ranked origin classifications associated with the identifier of the access control list in the export data;
wherein each ranked origin classification of the plurality of ranked origin classifications comprises one or more classification markings and comprises an identifier of a classification scheme to which the one or more classification markings of the each ranked origin classification belongs;
identifying, via at least one of the one or more processors, a lowest ranked translatable origin classification, of the plurality of ranked origin classifications, where the one or more classification markings represented in the lowest ranked translatable origin classification can be translated, according to a translation rule, to one or more corresponding classification markings belonging to a target classification scheme used for classifying information in a target database;
wherein the target classification scheme used for classifying information in the target database is not the classification scheme identified in the lowest ranked translatable origin classification;
translating, via at least one of the one or more processors, the one or more classification markings in the lowest ranked translatable origin classification, according to the translation rule, to the one or more corresponding classification markings belonging to the classification scheme used for classifying information in the target database; and
storing, via at least one of the one or more processors, in the target database in association with the identifier of the access control list, the at least one access control item and the one or more corresponding classification markings belonging to the target classification scheme used for classifying information in the target database.

11. The method of claim 10 , wherein identifying the lowest ranked translatable origin classification comprises iterating over at least one of the plurality of ranked origin classifications in rank order from lowest rank to highest rank until an origin classification, of the plurality of ranked origin classifications, is identified where the one or more classification markings of the origin classification can be translated, according to a translation rule, to one or more corresponding classification markings belonging to the target classification scheme used for classifying information in the target database.

12. The method of claim 10 , wherein the translation rule maps the identifier of the classification scheme of the lowest ranked translatable origin classification and the one or more classification markings of the lowest ranked translatable origin classification to the one or more corresponding classification markings belonging to the target classification scheme used for classifying information in the target database.

13. The method of claim 10 , wherein the translation rule is one of a plurality of translation rules of a translation map; and wherein the translation map accepts, as input, an identifier of a source classification scheme, a set of one or more classification markings belonging to the source classification scheme, and an identifier of a target classification scheme; and wherein translating the one or more classification markings in the lowest ranked translatable origin classification comprises:
providing, as input to the translation map, the identifier of the classification scheme of the lowest ranked translatable origin classification, the one or more classification markings of the lowest ranked translatable origin classification, and an identifier of the target classification scheme used for classifying information in the target database; and
obtaining, as output from the translation ma

Assignees

• Palantir Technologies Inc
• Palantir Technologies Inc

Inventors

• Ducott Iii Richard Allen
• Garrod John Kenneth
• Tasinga Khan

Classifications

• G06F16/27

  Replication, distribution or synchronisation of data between databases or within a distributed database system; Distributed database system architectures therefor · CPC title

• G06F16/951

  Indexing; Web crawling techniques · CPC title

• G06F16/1837

  Management specially adapted to peer-to-peer storage networks (topology management mechanisms of peer-to-peer networks H04L67/1042) · CPC title

• G06F16/24578

  using ranking · CPC title

• G06F16/285 Primary

  Clustering or classification · CPC title