CONDUCTING INVESTIGATIONS UNDER LIMITED CONNECTIVITY

• US 20200137200A1
• Filed: 12/30/2019
• Published: 04/30/2020
• Est. Priority Date: 12/19/2016
• Status: Active Grant

• Current Assignee: Palantir Technologies Incorporated
• Original Assignee: Palantir Technologies Incorporated
• Inventors: Laub, Brian, Scianna, Mark, Kozak, Carter, Zangri, Daniel, Baker, Izaak, Henke, Joseph
• Granted Patent: US 11,316,956 B2
• Time in Patent Office: Days
• CPC Class Codes: H04L 67/01 Protocols
• CPC Class Codes: H04L 67/1095 Replication or mirroring of data, e.g. scheduling or transport for data synchronisation between network nodes
• CPC Class Codes: H04L 67/56 Provisioning of proxy services store-and-forward switching systems in data switching networks H04L12/54
• CPC Class Codes: H04L 67/60 Scheduling or organising the servicing of application requests, e.g. requests for application data transmissions using the analysis and optimisation of the required network resources admission control or resource allocation H04L47/70

Abstract

Systems and methods are provided for obtaining and providing one or more resources for an investigation to be conducted remotely from a server. Resources needed to conduct an investigation may include one or more portions of a database and/or one or more functionalities of a data analysis platform. Based on the investigation to be conducted (e.g., type of investigation, location of investigation, personnel involved, etc.), a computing system may obtain different amounts/types of resources from the server. The investigation may be conducted via a web application that runs on the computing system. The web application may access the resources obtained from the server. The results of the investigation may be sent by the computing system to the server. The computing system may receive updates from the server. The computing system may act as a server for other remote systems that are conducting investigations.

Claims

1. A system comprising:

one or more processors; and

a memory storing instructions that, when executed by the one or more processors, cause the system to perform;

receiving, by a first client device, from a server, one or more resources for an investigation to be performed remotely from the server;

providing, by the first client device, the one or more resources to an investigation application that facilitates the investigation, the one or more resources enabling the investigation application to facilitate the investigation without an active connection to the server; and

in response to detecting, by the first client, an active connection with the server, packaging, by the first client device, results of the investigation for receipt by the server.

2. The system of claim 1, wherein the one or more resources include a subset of a database accessed by the server.

3. The system of claim 2, wherein the packaging, by the first client device, results of the investigation for receipt by the server, comprises hiding one or more of lineage and history information indicating which client devices made each particular change to data or objects stored in the database.

4. The system of claim 3, wherein the hiding one or more of lineage and history information comprises indicating that any changes made by client devices served by the server as being made by the server.

5. The system of claim 1, wherein the instructions further cause the system to perform:

restricting the first client device from providing the one or more resources to at least one other client device.

6. The system of claim 1, wherein the instructions further cause the system to perform:

restricting a second client device from providing permanent copies of the one or more resources to one or more other client devices.

7. The system of claim 5, wherein the investigation is performed at the second client device.

8. The system of claim 7, wherein the instructions further cause the system to perform:

receiving, by the first client device, at least a result of the investigation from the investigation application, the investigation application being executed at a second client device.

9. The system of claim 1, wherein the instructions further cause the system to, during an operation to import one or more objects at the server from the first client device and the second client device:

perform happens-after/concurrency checks with full vector clock information;

apply the one or more objects or place the one or more objects in pending;

for each happens-after object of the one or more objects, create a local data event, remove a client device-part of the full vector clock information, record the client device-part in another location, and store a remainder of the clock information after removing the client device-part.

10. The system of claim 1, wherein the one or more resources include a functionality for the investigation application, wherein the functionality comprises:

a subset of data analysis module;

a patch for the investigation application;

a custom application or functionality built for investigations, and/or permissions for the investigation application.

11. A method implemented by a computing system including one or more processors and storage media storing machine-readable instructions, wherein the method is performed using the one or more processors, the method comprising:

receiving, by a first client device, from a server, one or more resources for an investigation to be performed remotely from the server;

providing, by the first client device, the one or more resources to an investigation application that facilitates the investigation, the one or more resources enabling the investigation application to facilitate the investigation without an active connection to the server; and

in response to detecting, by the first client, an active connection with the server, packaging, by the first client device, results of the investigation for receipt by the server investigation to be performed remotely from the server.

12. The method of claim 11, wherein the one or more resources include a subset of a database accessed by the server.

13. The method of claim 12, wherein the packaging, by the first client device, results of the investigation for receipt by the server, comprises hiding one or more of lineage and history information indicating which client devices made each particular change to data or objects stored in the database.

14. The method of claim 13, wherein the hiding one or more of lineage and history information comprises indicating that any changes made by client devices served by the server as being made by the server.

15. The method of claim 11, further comprising:

restricting the first client device from providing the one or more resources to at least one other client device.

16. The method of claim 11, further comprising:

restricting a second client device from providing permanent copies of the one or more resources to one or more other client devices.

17. The method of claim 16, wherein the investigation is performed at the second client device.

18. The method of claim 17, wherein the instructions further cause the system to perform:

receiving, by the first client device, at least a result of the investigation from the investigation application, the investigation application being executed at a second client device.

19. The method of claim 11, further comprising:

during an operation to import one or more objects at the server from the first client device and the second client device;

performing happens-after/concurrency checks with full vector clock information;

applying the one or more objects or place the one or more objects in pending;

for each happens-after object of the one or more objects, creating a local data event, removing a client device-part of the full vector clock information, recording the client device-part in another location, and storing a remainder of the clock information after removing the client device-part.

20. A non-transitory computer readable medium comprising instructions that, when executed, cause one or more processors to perform:

receiving, by a first client device, from a server, one or more resources for an investigation to be performed remotely from the server;

providing, by the first client device, the one or more resources to an investigation application that facilitates the investigation, the one or more resources enabling the investigation application to facilitate the investigation without an active connection to the server; and

in response to detecting, by the first client, an active connection with the server, packaging, by the first client device, results of the investigation for receipt by the server investigation to be performed remotely from the server.